HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
mkj
dropbear
C2018–2025
mkj / dropbear

dropbear

Dropbear SSH

Networking
Explore on GitHubRead Hacker News discussions
4Distinct people
4Mentions
1Explicit recommenders
2.5KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Dropbear SSH

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

I mean, my interests are just really niche in the sense that I like to glue projects and one of my favourite hobbies is to search if there is an open source replacement to…

Imustaskforhelp used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year4 dated mentions

Observed mentions: 2018-08-19 19:36:34 UTC to 2025-08-12 20:18:01 UTC.

0122018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20182019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments20212022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2025

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC101
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC000
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC000
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC000
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC000
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC000
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC110
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC202

What Hacker News says

4 sources
throw0101a·Aug 12, 2025
> The first SSH server that chose it was TinySSH. Yes, I know. I mention this timeline in another one of my comments: * https://news.ycombinator.com/item?id=44866802 > I use this in a variety of ways, thousands of logins per day. I don't see much love for AES. So? Given its focus on low(er)-performance systems, perhaps on chips without AES-NI, it's no surprise that TinySSH does not have AES. Further, Dropbear, another implementation often used on smaller footprints, does have AES and recently added ML-KEM: * https://github.com/mkj/dropbear/commit/1748ccae5090d511753c0... PuTTY added ML-KEM in 0.83 earlier this year. So I'm not sure how talking about a niche SSH implementation supports your claim that "there will be great preference in the community for Bernstein's NTRU Prime." The evidence appears to me that implementation have been addin
Read the rest
g NIST's choice(s) since they have become available.
In OpenSSH Post-Quantum Cryptography
Imustaskforhelp·Aug 2, 2025Recommendation phrase
I mean, my interests are just really niche in the sense that I like to glue projects and one of my favourite hobbies is to search if there is an open source replacement to something or if I can use open source things to do stuff So there is intel tiber cloud and it gave me a free jupyter and I wanted to play minecraft server, so I went to something which is a fork of it and I saw that there was a guy who had created rootless patch of ssh but it wasn't working for me so I kindly asked them and they were really kind enough to help me and then I used something like pinggy or the thousand other cloudflare tunnel-esque solutions which work without any problem whatsoever directly through ssh Earlier I used to use junest to then get something like ssh working. Can I be honest? I am so proud of myself because I guess I did all this stuff an year
Read the rest
ago but I still remember the day I asked my friend to join the mc server and I joined too, the ping sucked but 8 gigs ram or even more and no storage limits and complete freedom... and I thought of such stuff after almost 2 weeks of trying different things and learned a lot about nat punching etc. So such stuff always makes really sense to me, just tinkering with software. But I feel like I need to create some professional software too in order to leave a legacy or just, I feel like, if I am being honest, that the things that I am doing aren't that valuable. Anybody can learn such stuff from me from some blog post I write but there is nothing that I can ever monetize. I don't know why I am seeking monetization that much but its just that, I see all these kids hustling my age too and I feel like everyone's doing everything for the money... so why should I be any different. I get a lot of ideas but I feel like I can never earn a single cent out of it and I find it a little frustating. I feel less confident myself regarding if I will ever earn decent money or will just be a low level cog of this whole system. Found it https://github.com/mkj/dropbear I really love this project so much, it really helped me do something really wonderful.
In At 17, Hannah Cairo solved a major math mystery
1letterunixname·Mar 14, 2024Submission

Tell HN: Ubiquiti APs probably vulnerable to Terrapin due to unpatched Dropbear

{{HOSTNAME}} = U6-Enterprise running firmware v6.6.65 $ Terrapin_Scanner_MacOS_arm64_darwin -connect {{HOSTNAME}} ================================================================================ ==================================== Report ==================================== ================================================================================ Remote Banner: SSH-2.0-dropbear_2020.81 ChaCha20-Poly1305 support: true CBC-EtM support: false Strict key exchange support: false The scanned peer is VULNERABLE to Terrapin. Note: This tool is provided as is, with no warranty whatsoever. It determines the vulnerability of a peer by checking the supported algorithms and support for strict key exchange. It may falsely claim a peer to be vulnerable
Read the rest
if the vendor supports countermeasures other than strict key exchange. For more details visit our website available at https://terrapin-attack.com $ ssh {{HOSTNAME}} {{HOSTNAME}}-BZ.6.6.65# dropbear --help Invalid option -- Dropbear server v2020.81 https://matt.ucc.asn.au/dropbear/dropbear.html Usage: dropbear [options] Dropbear hasn't had a release since 2022 and the Terrapin fix from Dec 31, 2023 is just sitting there. References: https://terrapin-attack.com/patches.html https://github.com/mkj/dropbear/releases https://github.com/mkj/dropbear/issues/270 https://community.ui.com/questions/UbiOS-Dropbear-upgrade/b66ca71f-adef-4a3f-b6c6-…
5 points · Open discussion
mrkoot·Aug 19, 2018
...and apparently the same issue exists in Dropbear up until current version (2018.76 / Feb 2018), which has an entirely different code base. A comment on /r/blackhat [0] led a colleague and me to look at Dropbear's sources, and it happens to have logic that is sufficiently similar [1] for the same PoC to work; tests against v2018.76 and a couple of earlier versions (e.g. v2013.58) are successful. Shodan shows some 66k services identifying as SSH-2.0-dropbear [2], as opposed to some 15k identifying as SSH-2.0-OpenSSH [3]. Issue has been reported to the vendor today. [0] https://www.reddit.com/r/blackhat/comments/97ywnm/openssh_us... [1] https://github.com/mkj/dropbear/blob/master/svr-auth.c#L175-... [2] https://www.shodan.io/search?query=SSH-2.0-dropbear [3] https://www.shodan.io/search?query=SSH-2.0-OpenSSH
In OpenSSH user enumeration

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.