/ssh endpoint should be disabled by default

[Merith-TK]

also, the changelogs on the release page do not state there is an ssh server, to begin with, and I think it is a decent security issue, because there may be people who don't use ssh for reasons or people who hold a STRICT ssh policy and this is just an ssh server without any user configurability by the looks of it, and it is enabled by default.

[kylecarbs]

We might remove the SSH endpoint. Initially, it was added to do port-forwarding and a buncha other things, but isn't really needed anymore.

[Merith-TK]

a better idea, dont remove it, leave it there, but make it so it is disabled by default.

because i can see a use. Like you have a server in which a few people need to access and you dont trust them with the user password (in fear they may attempt to sudo or su), you can provide the code-server password to them.

and add documentation on the things existence.

[jrebey]

@Merith-TK There are plenty of ways to accomplish this without building in an SSH server. For example, you can load up a docker container and mount the workspace volume in it and give SSH access to that container. Maintaining an SSH server inside another application is a security nightmare especially given better alternatives exist.

[Merith-TK]

@jrebey that is not related to this issue. nor did you ping the correct person to talk about this. I am merely the user who pointed out the issue. please do not talk to me about a project i do not maintain, as if i am the one who had the idea to have it there in the first place

[nhooyr]

@jrebey We're going to just remove it. A docker container dependency isn't something we want users to think about.