inquery: plans for phasing out cpu, rx and import

[cinap_lenrek@felloff.net]

now that we have rcpu taking over for cpu, import and rx...
i want to discuss how to phase out the old protocols.

rationale:

the cpu and import protocols are flawed in several ways:

- initial handshake is not authenticated nor encypted,
  mitm attacker can change the commandline and import
  path without any credentials.

- import and rx default to unencrypted connection.

- when encrypting, defaults to rc4 with sha1... no
  automatic cipher negotiation.

- cpu and import are the only programs still needing
  devssl in the kernel.

- import's authentication negotiation requires some
  ugly code in exportfs snooping the first message
  of the 9p conversation to see if its a import calling.


the following things could be done:

- disable listen scripts for exportfs, cpu and rx services.
  so 9front machines will not serve these anymore by
  default. client would still work as normal, code still
  there and continuing maintaining it.

- rename the old programs, say, move them to /bin/old/^(cpu exportfs import ...)
  scripts will break, but program still there under a different
  name in case one needs it. code still there and will be
  maintained.

- just delete the code. you need to keep old binaries arround
  yourself to use it. and maintain your own kernel config to have
  devssl for it to work. code not maintained anymore.

suggestions?

--
cinap