disabling local-to-local transfers?
Eloi Benoist-Vanderbeken
eloi.benoist-vanderbeken at synacktiv.com
Tue Jul 28 01:15:24 AEST 2026
>
Theo de Raadt <deraadt at openbsd.org> wrote:
> Eloi Benoist-Vanderbeken <eloi.benoist-vanderbeken at synacktiv.com> wrote:
> > The NEW option (disabling the local copy) should be opt-in. It should be "--refuse-local-copy" and not "--allow-local-copy". To make sure it does not break past scripts.
>
> There is no need for a new option.
>
> The opt-in for to permit local-to-local copy is indicated by
> the absence of : in source or target.
>
> The scripts using scp will already be doing that.
I'm not saying there is a need.
If anyone was asking I would say that I'm actually on your side, that this option is not needed, that there is multiple ways to shoot oneself in the foot with scp (as with any command line utility) and that we should not try to covert all of them.
I'm just saying that new options should not break old scripts. I also gave a reasonable example of such script. Instead of being unnecessarily dogmatic and refusing to discuss arguments that may seem relevant. But feel free to continue your approach.
More information about the openssh-unix-dev
mailing list