Pretty soon you'll see privately-owned firefighting companies, mark my words.

USA is going out of their mind with the "private is the solution to anything" concept. They have private armies, private cops (these armed guys that patrol closed-behind-fences residential areas), private prisons, so private firefighters isn't much of a stretch.

I have no particular problems with the private sector, but I do think that some services should NOT be subject to generating benefits (because nowadays you not only need to make benefits, but also double digit growth and margins). In my mind, nobody should make more money because there are more wars, more crime or more fires.

I, for one, welcome our new American overlords.

That was the point of my OP. The paper doesn't describe what you said. It says the client initiates the Mosh UDP session once it got the destination UDP port (the port the server listens on) from the SSH session. A firewall would never allow that. Also, opening a wide range of ports is a... let's say... challenging idea. This goes against all rules of network security known to network administrators.

Reading the linked research paper a bit, and something strikes me.

We use the existing infrastructure for authenticating hosts and users. To bootstrap an SSP connection, the user ïrst logs in to the remote host using conventional means, such as SSH or Kerberos. From there, the user or her script runs the server: an unprivileged process that chooses a random shared encryption key and begins listening on a UDP port. The server conveys the port number and key over the initial connection back to the client, which uses the information to start talking to the server over UDP.

You open a SSH connection (client->server:22). This port is allowed on the firewall, it lets you through. But then the server decides to listen on UDP:(random port) and tells the client, back through the (encrypted) initial connection, which UDP port to contact. So you initiate a SSP UDP session on that port. How does the firewall knows it should let you through? Since the port number is communicated on an encrypted session, it doesn't have access to that information. So how does this work in a secure environment? The paper doesn't mention any mean for the server to communicate with the network which port its listening on.

So each "illegal" download doesn't equal to a lost sale? Who would have thought? I'm shocked.