Hacker Neue

Preferences
gdevenyi parent
Sadly this project looks dead.
fsiefken
still works great though, there's a lot great software I use that hasn't had an update in years or even decades
voxadam
Is it dead or just mature?
zamadatix
Mature should still be fixing bugs, which something like mosh is bound to always run into. From that perspective, it doesn't seem like it's just mature. There doesn't seem to be a clear all-in-one successor fork taking the reins either. E.g. https://github.com/mobile-shell/mosh/issues/1339, as a random sample.
rurban
There is https://github.com/jdrouhard/mosh/ for the uniwidth problems. (but could be optimized much more)
fsckboy
mosh is still included in the Fedora repository (and probably others, I didn't check)

major distros are maintained, and they wouldn't be shipping it if it had bugs and/or was being used as an exploit

zamadatix
Each distro package maintainer is always welcome to maintain patches in their forks for as long as they like, but the quality and life of each will be per distro as these efforts are coordinated with an upstream.
fsckboy
i was pointing out that saying the package is unmaintained is likely to be false. to add my comment to your comment, i would imagine that distros are not keeping important patches like security to themselves.

i.e. this package being somehow abandoned and therefore should not be trusted is likely to be false

zamadatix
The above has all been in reference to the mosh project, not any individual distro packaging. E.g. if you "brew install mosh" on macOS right now you will indeed get an official-but 3-year-old-release without any patches Fedora (or others) may have applied since https://formulae.brew.sh/api/formula/mosh.json. The same is true if one goes to the project's GitHub to download it manually.

> i would imagine that distros are not keeping important patches like security to themselves.

I'm not 100% sure what "keeping to themselves" means in context of GPL 3 code, but one can verify with the mosh GitHub link to see the upstream project has not had a single commit on any branch for the last 2.5 years.

The project is dead, it's up to your trust+verification of any specific downstream packaging as to how much of a problem that is for the binary you may be using. Some maintainers may not have noticed/cared enough yet, some maintainers may only carry security fixes of known CVEs, some maintainers may be managing a full fork. The average reader probably wants to note that for their specific binary rather than note Fedora still packages a downstream version (which may be completely different).

This item has no comments currently.