title: ssh proxy command with netcat
body: <p>In example like this:</p>
  
  <pre><code>Host destination
    ProxyCommand ssh gateway nc %h %p
  </code></pre>
  
  <p>Is the connection between the gateway and the destination encrypted? I am confused because I have 2 hypotheses and both are not convincing:</p>
  
  <ul>
  <li><p>It's not encrypted. The stdin in source goes through the source-gateway ssh connection encrypted, and get decrypted before being passed to <code>nc</code>, i.e nc's stdin is the same as stdin into ssh client at source. But I think the <code>%p</code> is 22, the ssh port -- which doesn't fit with this hypothesis.</p></li>
  <li><p>It's encrypted, the sshd daemon at gateway pass to nc encrypted data. Then say instead of executing <code>nc</code>, we are executing <code>cat</code>, does sshd daemon pass it the encrypted data too? That doesn't sound right either.</p></li>
  </ul>