People understand that such "reverse hacking" can happen when their browser connects to any site (including all the indirect connections from dependent resources), right? Or when resolving any domain name? Or when even just pinging an IP?
The risk is far, far lower than browsing the internet. Unlike the massive surface of a browser and all the libraries and processes it is comprised of, the OpenSSH client is a tiny, with a singular purpose, contained in a small and very well-vetted codebase.
From the perspective of connecting to a foreign network service, the OpenSSH client is about the safest thing you can possibly use. Note the use of relative words here - not claiming it is 100% bug-free.
(The main caveat is that you can manually configure the client to do unsafe things, like writing a configuration by hand that enables X forwarding or agent forwarding by default for any host - but you can also actively disable sandboxing in your web browser or run everything as root, and we will never be able to stop you from actively making things insecure.)
Yes, but terminal escape sequences are a very, very small surface. It's just a few opcodes like "wipe screen", "switch to buffer B", "move to X,Y". All process output regardless of whether it is a terminal escape sequence or regular text just navigate and update the screen "cells", and in, say, alacritty this will be in boring, non-unsafe Rust.
For comparison, the surface exposed by your browser rendering this text controlled entirely by an adversary (me) is considerably greater as it also interacts with the style system, content reflow, javascript engine (even for non-javascript websites), etc.
An ssh server would exploit a vulnerability in the ssh client when it connects.
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
There has never been a real-world OpenSSH exploit that allows a server to RCE a client that connected to it without a bunch of dubious qualifiers. Connecting to a random SSH server is much, much less dangerous than running a random binary or executing a random curl install script, both of which people do all the time, and is probably about on par with the likelihood of a random website escaping your browser's sandbox and RCEing you.
Agreed, bugs in the terminal emulator are probably more concerning. The attack surface of those is much larger (there are some pretty wild ANSI escape sequences, and terminal emulators are often granted pretty wide disk access permissions on systems that have them if they're also used for local development).
Web browsers are generally built with security in mind. Terminal emulators surely much less so. The OpenSSH client probably sits somewhat in between, generally developed with security in mind, but not necessarily consistently expecting malicious servers.
At least for the more prominent terminal emulators i expect they probably devote a great deal of attention to security. They are developing the most commonly used interfaces for linking the most numerous, varied, and/or critical systems on the planet.
I believe the recent cve-2026-55200 in libssh2 (client-side library) was allowing exactly this.
https://nvd.nist.gov/vuln/detail/cve-2026-55200
("Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.")
Of course the other abouts that you whatted (such as random curl install scripts, binaries, etc.) are still more dangerous.
> The integer overflow provides uncontrolled access to the heap, which reliably crashes the client process but is unlikely to achieve remote code execution in practice. Weaponizing the overflow for code execution would require a separate information disclosure vulnerability to defeat ASLR, along with a specific heap layout to place exploitable structures adjacent to the undersized allocation.
---
> abouts that you whatted
"Whataboutism" is perhaps the most infuriating and wildly misused word in the English language. Pointing out that somebody is scaremongering about an action that is significantly less dangerous than other everyday actions people take on their computers is not a fallacy. It is directly relevant to evaluating risk. Yes, technically there could be some critical bug that allows the posited thing to happen, but in reality it just doesn't happen. If it did happen, nobody would blow their once-in-decades exploit on pranking some people on a forum.
Isn't this exploit vector identical to the ones we'd expect on browser-based vulnerabilities? I believe that yes, there are possible risks involved, but no significant than our casual web-surfing through the net.
As I understood this, a malicious server can change its host key somewhere during key exchange and trigger a use-after-free in the client, which might be exploitable for code execution.
Terminal emulators have, on occasion, had all kinds of interesting escape codes that I wouldn't want to expose to an attacker. Whether this is even a true "vulnerability" is somewhat a matter of opinion (in the sense that the feature works as designed, but that's maybe a bad thing).
Would like to clarify that all my code is open source at https://github.com/jeninh/ssh.place , even the deployment is triggered through GitHub actions. I'm also a teen and not too familiar with most of these terms, so I might be forgetting something.
Are we all pretending we have no empirical data on this? How many RCEs has there been in popular web browsers over the past two decades (dozens? hundreds?), compared to how many RCEs there has been in the OpenSSH client (perhaps we can make it one if we include xterm in that)?
Visiting a random website is the normal use of HTTP. With SSH, there might be assumptions of connecting to a trusted server you have an account with and likely own. It's not very normal to ssh to a random server.
When I said "own", I meant more in the sense of personally administering. It's like how you own a domain, but you're really renting it from a registrar. Rented hardware and VPSs count, as well as other servers/hosts you're responsible for.
If you have a slight interest in originality of presentation, whatever website copy first comes out of Claude is not there yet. Its preoccupation with "no x, no y" and annoying runs of sentence fragments might have been a punchy rhetoric for a short while before it became a tired cliché, but by now it stylistically makes it look more like you're bragging on LinkedIn than presenting something fun and creative.
I mention it because it's immediately off-putting even though the project itself sounds fun enough. It tarnishes it with the impression that maybe you just don't care, but maybe you just aren't attuned to the style and its strong slop connotations.
I'm genuinely fascinated by the problem and I've wondered what in the training process causes the model to develop this peculiar style of writing. Is it because it's trained on old Medium slop? Someone else replied with a link to their SSH-based VPS, where the copy is absolutely saturated with the same annoying style.
> I've wondered what in the training process causes the model to develop this peculiar style of writing
I think this might just be inherent to the currently deployed LLM architecture. If the training process works at all, any model will come out of it with some (default) voice that it'll apply everywhere.
Human voices are not like that, both because one copywriter does not write a significant fraction of all texts in the world and because unlike LLMs they remember all of their own prior writing, which gives them an opportunity to get tired of their old tropes.
I understand where you are getting from, thanks for posting this. I'll keep this in mind for my next project (or if I push changes to this one.) I also wanted this to appeal to non-hackers, and a big part of that was me wanting to show how simple it was to log in.
It's an extremely pervasive misconception, but a model's voice is not really a matter of its training data, not by the time it reaches consumer eyes. The voice these models use are specifically selected for in RLHF, ie, curated by humans by telling it it did a good job when it uses this voice and telling it it did a bad job when it didn't use this voice.
Why do they specifically push for this voice? Because it is effective. This is "headline voice", the voice that gets people to endlessly click on Youtube clickbait and garbage articles. Most of the population gets a dopamine hit from this style of writing, making it legitimately addicting to them. Those who recognize it for what it is and find it insufferably grating are in a tiny, tiny minority.
The tiny minorities are the people who are too dumb to notice, and on the other end, the people who can still sift through robot-made clickbait the same way they were wading through human-made clickbait before.
I think its peculiar in that it's so limited, repetitive and undiscerning in its stylistic expression.
The stylistic elements on their own wouldn't raise an eyebrow if they appeared rarely among many other stylistic devices in order to enhance drama, suspense or emphasis, but within a single completion, Claude will sometimes implement just these two several times to express the most banal things. It ends up looking like a caricature of the worst pre-LLM Medium and LinkedIn garbage.
Why so few colors? Even with palette characters you can have 240 or so options, and with truecolor you can just have anything. Also, you can double your vertical resolution by using half block characters, setting the foreground color as the top half, and setting the background color as the bottom half. Something like this: `\x1b[38;2;{r};{g};{b};48;2;{r};{g};{b}m{half block character}`.
Are we coordinating factions here, like the original r/place? The social aspect was such a big part of the original. I'll start:
# PURPLE FRAME #
Our mission is to draw a purple frame around the canvas. 2 rows of blank space between the frame and the top/bottom of the canvas. 4 cols of blank space between the frame and the left/right of the canvas.
I'm wondering if there is a better way to do this. On one hand, we could just do it here but then I can't link people to this page or it'll harm the post. I could also just use a subreddit or make a forum on https://ssh.place
Building in support for that into the site itself kinda goes against the spirit.
It's understandable that you as the maker want to flame the hype as much as possible, but by making it too obvious you are kinda working against that goal.
Place 2 wasn't too bad, it did get botted to all hell. I handled some the early recordings of the canvas to make live time lapses of it. I've done the same here just to have something to mess about with.
I'm just wondering what to do when this post dies down. Then I guess I could link to it... It's not like it's going to go back to the front page anyways
Salutes, I had just redone the firewall and forgot to check external access, Works for me herp derp. I guess everything is fine. sigh Should be up now.
Shellbox looks really cool! I love the proliferation of ssh apps lately…
Ever since I saw the terminal coffee I’ve been inspired. I’ve been working on https://billard.sh myself for a bit.
So cool! If I wanted to make a similar product, how should I do it? Do you have any advice or research directions? I saw a company using SSH for hiring a couple of days ago, and I thought it was really cool. I also want to build something similar.
I'm going to be so honest, I don't have much advice for you. I'm a teenager who's part of Hack Club (https://hackclub.com) who made this entirely for fun.
I was inspired by @zachlatta's SSHtron (https://github.com/zachlatta/sshtron) and wanted to make an SSH game. I loved how easy it was for him to promote it too, he made a HN post with title "ssh sshtron.zachlatta.com" because it gets people to try out the actual game rather than look at a README. If you have a business, find something useful that would help! Or in my case, find something fun you want to make/remake to be used in the terminal over SSH. Hack Club also used to have a hiring page over SSH, if I recall correctly.
I also have limits for IP and device + some other factors :) The full details are in the README on GitHub. But also I don't expect too many people to find this, it's one of my first public projects. If we do get a surge of people then I'll implement something better.
I love the idea. I couldn't get it to work; I navigated to (0,0) but didn't see a cursor; kept changing colors and trying to place blocks but saw nothing. Eventually my Ghostty crashed.
Nice, I first saw this on Hack Club ;) Check your terminal to see if it supports certain colours, on mine the darker and lighter colours (eg. maroon/red, purple/magenta) look identical.
Such was r/place, and such is life. There is never a world where there will be no bots and it'll also be completely free for anyone to use online. I'll try to nerf it, though.
I understand that most people don't use it and indeed rely on tofu, but the statement is not absolutely correct.
ssh server keys can be authenticated using (the DNSSEC "CA" system and) SSHFP, and it's possible to setup a signing CA for the host key (similar to ssh certificates, however not applicable for foreign servers).
And of course, the fingerprint could be advertised out of band e.g. on the homepage with tls
sshfp is not PKI. It's an option and it is off by default in ssh(1). In practice no one actually deploys it, exe.dev, terminal.shop, jobs.{whoever.com}, etc. I've yet to see an in the wild deployment. The aforementioned sites let you perform electronic payment transactions over ssh without it, which is probably a PCI violation tbh, but auditors aren't good enough.
Agreed. Amid all this hype, once again we continue to see such disregard for basic security implications and using ssh outside it's intended use-case; especially sshing into random servers.
Now we wait for the discovery of an RCE, key leakage vulnerability or a security bypass that leads to a trivial mitm attack to magnify why ssh apps make no sense security wise.
SSH does in fact have a PKI, just not a global one. Large-fleet SSH installs all tend to use certificate authorities, for this reason (and to simplify SSO).
I don't understand the impulse behind these things --- this is a bootstrap mechanism for a global PKI for SSH. But cold introductions to SSH hosts (that is, first connections to hosts you have no business or technical relationship with) virtually never happen. What problem does it solve?
When you see people advertising a coffee shop at a conference and people TOFU'ing on conference wifi then plugging in credit card numbers, the picture gets a little more clear.
So really the trend I'm talking about here is people turning SSH into a browser, hosting apps behind SSH that expect a much higher volume of TOFU happening, which is a departure from the "first time i setup my vps" kind of case.
Honestly at this point I'd be kind of happy if we could just use an x.509 cert from a webpki acme provider in the sshd and be done with it, for the host identity part.
Hey, is it not just a simple honeypot reverse hack ssh server?
People understand that reverse hacking can happen when connecting to random ssh server, right?
People understand that such "reverse hacking" can happen when their browser connects to any site (including all the indirect connections from dependent resources), right? Or when resolving any domain name? Or when even just pinging an IP?
The risk is far, far lower than browsing the internet. Unlike the massive surface of a browser and all the libraries and processes it is comprised of, the OpenSSH client is a tiny, with a singular purpose, contained in a small and very well-vetted codebase.
From the perspective of connecting to a foreign network service, the OpenSSH client is about the safest thing you can possibly use. Note the use of relative words here - not claiming it is 100% bug-free.
(The main caveat is that you can manually configure the client to do unsafe things, like writing a configuration by hand that enables X forwarding or agent forwarding by default for any host - but you can also actively disable sandboxing in your web browser or run everything as root, and we will never be able to stop you from actively making things insecure.)
There's also the terminal to consider, via terminal escape sequences.
Yes, but terminal escape sequences are a very, very small surface. It's just a few opcodes like "wipe screen", "switch to buffer B", "move to X,Y". All process output regardless of whether it is a terminal escape sequence or regular text just navigate and update the screen "cells", and in, say, alacritty this will be in boring, non-unsafe Rust.
For comparison, the surface exposed by your browser rendering this text controlled entirely by an adversary (me) is considerably greater as it also interacts with the style system, content reflow, javascript engine (even for non-javascript websites), etc.
> People understand that reverse hacking can happen when connecting to random ssh server, right?
No, actually, I've never heard of such a vector. How would that work?
An ssh server would exploit a vulnerability in the ssh client when it connects.
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
There has never been a real-world OpenSSH exploit that allows a server to RCE a client that connected to it without a bunch of dubious qualifiers. Connecting to a random SSH server is much, much less dangerous than running a random binary or executing a random curl install script, both of which people do all the time, and is probably about on par with the likelihood of a random website escaping your browser's sandbox and RCEing you.
Agreed, bugs in the terminal emulator are probably more concerning. The attack surface of those is much larger (there are some pretty wild ANSI escape sequences, and terminal emulators are often granted pretty wide disk access permissions on systems that have them if they're also used for local development).
Malicious servers can send malicious terminal escape codes. For example https://www.sentinelone.com/vulnerability-database/cve-2026-...
Web browsers are generally built with security in mind. Terminal emulators surely much less so. The OpenSSH client probably sits somewhat in between, generally developed with security in mind, but not necessarily consistently expecting malicious servers.
At least for the more prominent terminal emulators i expect they probably devote a great deal of attention to security. They are developing the most commonly used interfaces for linking the most numerous, varied, and/or critical systems on the planet.
Went to the kitty website. No mentions of security.
Went to Alacritty. No mentions of security.
Went to Ghostty. No mentions of security, except for "secure keyboard entry".
None have a "security policy" on GitHub.
All written in memory unsafe languages (C, Zig).
I believe the recent cve-2026-55200 in libssh2 (client-side library) was allowing exactly this. https://nvd.nist.gov/vuln/detail/cve-2026-55200 ("Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.")
Of course the other abouts that you whatted (such as random curl install scripts, binaries, etc.) are still more dangerous.
Per Red Hat:
> The integer overflow provides uncontrolled access to the heap, which reliably crashes the client process but is unlikely to achieve remote code execution in practice. Weaponizing the overflow for code execution would require a separate information disclosure vulnerability to defeat ASLR, along with a specific heap layout to place exploitable structures adjacent to the undersized allocation.
---
> abouts that you whatted
"Whataboutism" is perhaps the most infuriating and wildly misused word in the English language. Pointing out that somebody is scaremongering about an action that is significantly less dangerous than other everyday actions people take on their computers is not a fallacy. It is directly relevant to evaluating risk. Yes, technically there could be some critical bug that allows the posited thing to happen, but in reality it just doesn't happen. If it did happen, nobody would blow their once-in-decades exploit on pranking some people on a forum.
OpenSSH doesn't use this library.
Good to know, but OpenSSH is not the scope here.
It seems to me you were replying to refute a claim about OpenSSH.
If you properly set up your ssh client (No agent forwarding or X11 forwarding)
Terminal, too; some escape sequences are able to perform attacks in old or buggy terminal emulators.
Even newer ones. Iterm2 had CVE-2026-41253 recently. Or things like Tmux.
Yes, I was thinking of iTerm2. "Older" means not the latest release and "buggy" includes well-intentioned vulnerabilities.
Sure. 3.6.9 (which was affected) was the most recent iTerm2 when that CVE came out.
Hence "or"
Isn't this exploit vector identical to the ones we'd expect on browser-based vulnerabilities? I believe that yes, there are possible risks involved, but no significant than our casual web-surfing through the net.
theoretically a browser could have the same vulnerability and has a vastly higher attack surface.
has there ever been an example of such a vulnerability in openssh?
> To sum it up: Connecting to this server is probably fine
And what are you basing this statement on?
Here is a recent example. Currently unpatched in Debian stable.
https://www.cve.org/CVERecord?id=CVE-2026-60002
As I understood this, a malicious server can change its host key somewhere during key exchange and trigger a use-after-free in the client, which might be exploitable for code execution.
Vulnerability in your ssh client (unlikely) or terminal emulator (more common but lower reach).
Terminal emulators have, on occasion, had all kinds of interesting escape codes that I wouldn't want to expose to an attacker. Whether this is even a true "vulnerability" is somewhat a matter of opinion (in the sense that the feature works as designed, but that's maybe a bad thing).
Agent forwarding would be pretty big, if it for example pushed your git credentials to the remote host.
Would like to clarify that all my code is open source at https://github.com/jeninh/ssh.place , even the deployment is triggered through GitHub actions. I'm also a teen and not too familiar with most of these terms, so I might be forgetting something.
What is public can be changed in private, as for being unfamiliar, well LLM made unfamiliar people able to do plenty of things.
Weird that you can't just say that you are not doing it.
Prove it, I'll connect to any server you point me to, using default openssh client flags.
Is that more likely than getting hacked when visiting a website?
Are we all pretending we have no empirical data on this? How many RCEs has there been in popular web browsers over the past two decades (dozens? hundreds?), compared to how many RCEs there has been in the OpenSSH client (perhaps we can make it one if we include xterm in that)?
It is a real question, because I didn't know about the mentioned ssh attack vector.
Regarding empirical data, that would certainly be interesting, not sure if RCE is the only category one would look at in that case.
Visiting a random website is the normal use of HTTP. With SSH, there might be assumptions of connecting to a trusted server you have an account with and likely own. It's not very normal to ssh to a random server.
> likely own
I don't know how you are using ssh, but most ssh servers that I have connected to in my life, and still do, I don't own. Some of them I barely trust.
The ones I connect to the most often from my personal laptop I don’t physically own but I do pay to rent them and I installed the OS on them myself.
The main ones I don’t own are VPS servers from fairly large providers, or GitHub.
When I said "own", I meant more in the sense of personally administering. It's like how you own a domain, but you're really renting it from a registrar. Rented hardware and VPSs count, as well as other servers/hosts you're responsible for.
I got that, and I'm not saying that it doesn't apply to you, but it surely does not apply to everybody.
This is simply not true
What exactly is the mechanism by which you think that an SSH RCE is "simple"?
Not OP, but agent forwarding is a significant concern.
Is it enabled by default though?
AFAIK: No
It's not, but there is likely a small number people who have something like this configured:
Try me.
Why is there no orange? The entire colour palette is a bit depressing.
Also my terminal (Ubuntu in WSL2) had an ugly colour palette defined by default with several identical colours. I'm glad I found out!
Use this to check yours:
and then press ctrl + , to change it.I'll look into adding orange, thanks :)
If you have a slight interest in originality of presentation, whatever website copy first comes out of Claude is not there yet. Its preoccupation with "no x, no y" and annoying runs of sentence fragments might have been a punchy rhetoric for a short while before it became a tired cliché, but by now it stylistically makes it look more like you're bragging on LinkedIn than presenting something fun and creative.
I mention it because it's immediately off-putting even though the project itself sounds fun enough. It tarnishes it with the impression that maybe you just don't care, but maybe you just aren't attuned to the style and its strong slop connotations.
I'm genuinely fascinated by the problem and I've wondered what in the training process causes the model to develop this peculiar style of writing. Is it because it's trained on old Medium slop? Someone else replied with a link to their SSH-based VPS, where the copy is absolutely saturated with the same annoying style.
> I've wondered what in the training process causes the model to develop this peculiar style of writing
I think this might just be inherent to the currently deployed LLM architecture. If the training process works at all, any model will come out of it with some (default) voice that it'll apply everywhere.
Human voices are not like that, both because one copywriter does not write a significant fraction of all texts in the world and because unlike LLMs they remember all of their own prior writing, which gives them an opportunity to get tired of their old tropes.
I understand where you are getting from, thanks for posting this. I'll keep this in mind for my next project (or if I push changes to this one.) I also wanted this to appeal to non-hackers, and a big part of that was me wanting to show how simple it was to log in.
It's an extremely pervasive misconception, but a model's voice is not really a matter of its training data, not by the time it reaches consumer eyes. The voice these models use are specifically selected for in RLHF, ie, curated by humans by telling it it did a good job when it uses this voice and telling it it did a bad job when it didn't use this voice.
Why do they specifically push for this voice? Because it is effective. This is "headline voice", the voice that gets people to endlessly click on Youtube clickbait and garbage articles. Most of the population gets a dopamine hit from this style of writing, making it legitimately addicting to them. Those who recognize it for what it is and find it insufferably grating are in a tiny, tiny minority.
It seems like the middle of the curve.
The tiny minorities are the people who are too dumb to notice, and on the other end, the people who can still sift through robot-made clickbait the same way they were wading through human-made clickbait before.
Yeah it kinda feels like a great, original meal but served on plasticware
I don't think Claude's writing style is peculiar, it is just that we are being flooded with it. Everything becomes stale with overuse.
I think its peculiar in that it's so limited, repetitive and undiscerning in its stylistic expression.
The stylistic elements on their own wouldn't raise an eyebrow if they appeared rarely among many other stylistic devices in order to enhance drama, suspense or emphasis, but within a single completion, Claude will sometimes implement just these two several times to express the most banal things. It ends up looking like a caricature of the worst pre-LLM Medium and LinkedIn garbage.
> what in the training process causes
Read some early pre-mass-adoption LLM papers by the key scientists and researchers. The style is very similar...
Why so few colors? Even with palette characters you can have 240 or so options, and with truecolor you can just have anything. Also, you can double your vertical resolution by using half block characters, setting the foreground color as the top half, and setting the background color as the bottom half. Something like this: `\x1b[38;2;{r};{g};{b};48;2;{r};{g};{b}m{half block character}`.
Are we coordinating factions here, like the original r/place? The social aspect was such a big part of the original. I'll start:
# PURPLE FRAME #
Our mission is to draw a purple frame around the canvas. 2 rows of blank space between the frame and the top/bottom of the canvas. 4 cols of blank space between the frame and the left/right of the canvas.
I'm wondering if there is a better way to do this. On one hand, we could just do it here but then I can't link people to this page or it'll harm the post. I could also just use a subreddit or make a forum on https://ssh.place
Building in support for that into the site itself kinda goes against the spirit.
It's understandable that you as the maker want to flame the hype as much as possible, but by making it too obvious you are kinda working against that goal.
The organicness of the original was really fun. Dunno if coordinating here really fits the HN vibe, but also go where the people are.
Place 2 wasn't too bad, it did get botted to all hell. I handled some the early recordings of the canvas to make live time lapses of it. I've done the same here just to have something to mess about with.
I'm just wondering what to do when this post dies down. Then I guess I could link to it... It's not like it's going to go back to the front page anyways
I can't see my cursor if it is placed on top of a cell that has already been colored.
Oops. I'll fix that right now
Make sure to not be forwarding ssh agents! :)
Takes all the fun out of it when people are multiboxing for the sake of posting an advertisement. Oh well.
Welp. Same thing happened in r/place
I love ssh apps! See also late.sh, and my own https://shellbox.dev
Mine is hard to get to(ip6 only) but was started around the idea of a shared postgres database.
ssh applicant@register.public.outband.net
The web page https://www.public.outband.net hosted on the same box, if you can see it you have the needed ip6.
No users yet but feel free to try it out.
your dns server is down.
;; communications error to 2001:470:4b:27e:8::#53: timed out
Salutes, I had just redone the firewall and forgot to check external access, Works for me herp derp. I guess everything is fine. sigh Should be up now.
Ayy late.sh called out, my favourite hangout on the internet :) I'm in there every evening antagonizing the bartender
Shellbox looks really cool! I love the proliferation of ssh apps lately… Ever since I saw the terminal coffee I’ve been inspired. I’ve been working on https://billard.sh myself for a bit.
Shellbox is so sick!!! I'm going to look into implementing it into a project I'm working on.
Parked means the storage is kept, right?
Yes, storage and memory/processes. It is basically suspended, not running
another one: https://pico.sh
and funky.nondeterministic.computer
So cool! If I wanted to make a similar product, how should I do it? Do you have any advice or research directions? I saw a company using SSH for hiring a couple of days ago, and I thought it was really cool. I also want to build something similar.
I'm going to be so honest, I don't have much advice for you. I'm a teenager who's part of Hack Club (https://hackclub.com) who made this entirely for fun.
I was inspired by @zachlatta's SSHtron (https://github.com/zachlatta/sshtron) and wanted to make an SSH game. I loved how easy it was for him to promote it too, he made a HN post with title "ssh sshtron.zachlatta.com" because it gets people to try out the actual game rather than look at a README. If you have a business, find something useful that would help! Or in my case, find something fun you want to make/remake to be used in the terminal over SSH. Hack Club also used to have a hiring page over SSH, if I recall correctly.
My code uses wish, bubbletea and lipgloss from Charm. You can look at the code over at https://github.com/jeninh/ssh.place
Good luck!
Keep it up! You’re surely the coolest teenager I’ll come across this month.
Thanks :) There's tons of us over at https://hackclub.com
ssh superlogical.jobs
> Your cooldown is tied to your SSH key
This sounds like a recipe for bots that bypass the cooldown...
I also have limits for IP and device + some other factors :) The full details are in the README on GitHub. But also I don't expect too many people to find this, it's one of my first public projects. If we do get a surge of people then I'll implement something better.
I love the idea. I couldn't get it to work; I navigated to (0,0) but didn't see a cursor; kept changing colors and trying to place blocks but saw nothing. Eventually my Ghostty crashed.
Nice, I first saw this on Hack Club ;) Check your terminal to see if it supports certain colours, on mine the darker and lighter colours (eg. maroon/red, purple/magenta) look identical.
Wish we had a WebSSH like WebSockets / IRC v3.
Hah nice! I made something a bit like this too:
It's using kitty/iTerm2/Ghostty image placement + pixel mouse reporting support for drawing...and for more fun:
:-)This is fun, I tried to draw a flower but it sucks.
It's a pretty flower :-) I hope it wasn't you who put that red line through it
lol no someone else did that while i was drawing it. thanks :)
Aww...
it's already littered with bots, so it's not fun for a human to go there.
Such was r/place, and such is life. There is never a world where there will be no bots and it'll also be completely free for anyone to use online. I'll try to nerf it, though.
aw it didn't work with kitty. i get logged out.
reminds me of the DOS program TheDraw
Time for your regular reminder that ssh has no PKI and is trivial to mitm during tofu.
Acronyms are supposed to be capitalised. I do not belive you are talking about the soy product.
https://en.wikipedia.org/wiki/Man-in-the-middle_attack
https://en.wikipedia.org/wiki/Trust_on_first_use
I understand that most people don't use it and indeed rely on tofu, but the statement is not absolutely correct.
ssh server keys can be authenticated using (the DNSSEC "CA" system and) SSHFP, and it's possible to setup a signing CA for the host key (similar to ssh certificates, however not applicable for foreign servers). And of course, the fingerprint could be advertised out of band e.g. on the homepage with tls
sshfp is not PKI. It's an option and it is off by default in ssh(1). In practice no one actually deploys it, exe.dev, terminal.shop, jobs.{whoever.com}, etc. I've yet to see an in the wild deployment. The aforementioned sites let you perform electronic payment transactions over ssh without it, which is probably a PCI violation tbh, but auditors aren't good enough.
webpki is on by default.
Agreed. Amid all this hype, once again we continue to see such disregard for basic security implications and using ssh outside it's intended use-case; especially sshing into random servers.
Now we wait for the discovery of an RCE, key leakage vulnerability or a security bypass that leads to a trivial mitm attack to magnify why ssh apps make no sense security wise.
SSH does in fact have a PKI, just not a global one. Large-fleet SSH installs all tend to use certificate authorities, for this reason (and to simplify SSO).
Fair!
When I last harassed Crawshaw about this and we discussed bits, he submitted https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts....
Unfortunately neither of us has taken time (AFAIK) to go back and implement it anywhere.
I don't understand the impulse behind these things --- this is a bootstrap mechanism for a global PKI for SSH. But cold introductions to SSH hosts (that is, first connections to hosts you have no business or technical relationship with) virtually never happen. What problem does it solve?
When you see people advertising a coffee shop at a conference and people TOFU'ing on conference wifi then plugging in credit card numbers, the picture gets a little more clear.
Right, I mean, I see the problem for browsers! Just not for SSH servers. (Capturing sessions like this used to be a contest at Usenix Security).
So really the trend I'm talking about here is people turning SSH into a browser, hosting apps behind SSH that expect a much higher volume of TOFU happening, which is a departure from the "first time i setup my vps" kind of case.
Honestly at this point I'd be kind of happy if we could just use an x.509 cert from a webpki acme provider in the sshd and be done with it, for the host identity part.
Do people at conferences buy coffee by SSH'ing into coffee shop servers?
i've seen it, so the answer is non-zero
Yes, but what exactly would an attacker achieve by doing mitm here?
here, less than most, but look for ssh agents
on terminal.shop, steal credit cards on jobs endpoints, perform identity theft on exe.dev, whatever you put on there
aw someone deleted my weezer =w=
ssh join@bbs.profullstack.com
brilliant :)
What's with Fil-C is unsafe? https://archive.ph/ysqbm
TIL about 4chan clanker clone moltshit.com