Subject: RE: New draft-draft of sftp...

From: Richard Whalen <[email-masked]>
Date: Tue, 26 Nov 2002 12:25:25 -0500

The SCP that I am familiary (F-Secure code) does client side "globbing", not
server side.
The command line given in the example would cause it to get a directory
listing and apply the matching rules to the list of files received.

-----Original Message-----
From: Simon Tatham [mailto:[email-masked]]
Sent: Tuesday, November 26, 2002 12:07 PM
To: [email-masked]
Cc: Darren J Moffat; [email-masked]
Subject: Re: New draft-draft of sftp...

Jeffrey Altman <[email-masked]> wrote:

> Exactly.  Which goes directly to reason why globbing must be done on
> the system on which the file system is mounted.  It is only on that
> system that the appropriate matches can be done by the file system.
> Trying to guess what the file system is capable or not capable of will
> only produce inaccurate results.

But this is only one side of the story. The other side is the user
expectations, and the security angle.

SCP is a good example of a protocol that does server-side globbing,
and it's one most people on this list will have heard of :-) So
suppose I'm an SCP user and I type a command such as

  scp myserver:[abc]*.* .

to retrieve some files matching a wildcard, and copy them into my
current directory. The server will now send back a list of file
names and file contents, and my client program will create some
files locally.

---

From: Simon Tatham <[email-masked]>
Date: Tue, 26 Nov 2002 19:45:17 +0000

> listing and apply the matching rules to the list of files received.

Sorry, yes, I should have been clearer; there are two entirely
different things that go by the name SCP. One is the original `scp'
program, which is basically the BSD rcp protocol using SSH instead
of RSH as transport; the other is ssh.com's command-line batch-mode
SFTP client with the same command syntax as the original scp
program.

I'm talking about the SCP _protocol_, which is to say the former.

(PSCP supports both modes of operation, and it will give a security
warning when it has to do a server-side glob, but if it's using SFTP
then it will do client-side globbing without needing to warn about
anything.)

Cheers,
Simon
-- 
Simon Tatham         "My heart bleeds.
<[email-masked]>    (That's how it works.)"   -- Gareth Taylor