Says the subdomain link that lacks SSL. A wildcard certificate would have sufficed.
Just added SSL. Live at https://jobs.hackclub.com.
Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com
21–30 of 119 posts
Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com
#22Any reason why this wasn't implemented with telnet since no authentication is required?
Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com
#23Earlier quoted context omitted.
Kinda unforgivable to be on front page of HN in 2021 without https
Why exactly? Other than a lot of "potential problems" security theater? People still send postcards, where they don't care if people read what's written on it..
People also expect their postcards to arrive untampered.
ISPs, Comcast in particular, inject ad-loading javascript into HTTP pages.
https://arstechnica.com/tech-policy/2014/09/why-comcasts-jav...
Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com
#24Says the subdomain link that lacks SSL. A wildcard certificate would have sufficed.
[deleted]
Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com
#25Any reason why this wasn't implemented with telnet since no authentication is required?
telnet is not shipped in the box on Windows and macOS, ssh is.
Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com
#26Looks like sshtron.zachlatta.com hasn't been found yet. Try it: `ssh sshtron.zachlatta.com`
Hack Club founder here. I'm so glad you know SSHTron too!
I built SSHTron a few years ago at a hackathon. It served as the inspiration for jobs.hackclub.com.
The code for both is open source, at https://github.com/zachlatta/sshtron and https://github.com/hackclub/jobs respectively.
Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com
#27Earlier quoted context omitted.
A privacy precaution would be to `ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no jobs.hackclub.com`. By default ssh will send all its public keys to a server unless given an identify file to use as an arg or in ~/.ssh/config.
In case you want to apply for a job without admitting who you are?
In case you want to connect to a random ssh server without giving it your public ssh keys.
Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com
#28Earlier quoted context omitted.
In case you want to apply for a job without admitting who you are?
In case you want to connect to a random ssh server without giving it your public ssh keys.
Yes, but there's a reason those are called "public" keys. The reason is that you don't suffer any harm by giving them out.
Except that they may be publicly identified with you. In that case, and only that case, giving them out would involve purporting to be the person who is publicly associated with the keys. (It wouldn't prove it, because, after all, those keys are public; anyone can know and distribute them.)
So this concern appears to be that you want to apply for a job without disclosing your identity. I think that's a strange thing to do.
Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com
#29I don't understand what this is. Is this just some dude's little terminal game?
I ssh'd to the server. I followed some weird little terminal prompts. I cat'd a .md file. I don't really see what's going on here.
Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com
#30Earlier quoted context omitted.
In case you want to connect to a random ssh server without giving it your public ssh keys.
Yes, but there's a reason those are called "public" keys. The reason is that you don't suffer any harm by giving them out. Except that they may be publicly identified with you. In that case, and only that case, giving them out would involve purporting to be the person who is publicly associated with the keys. (It wouldn't prove it, because, after all, those keys are public; anyone can know and distribute them.) So th…
> (It wouldn't prove it, because, after all, those keys are public; anyone can know and distribute them.)
I don't believe this is true, right? You do a private key operation demonstrating you possess the private key associated with the public key.
Or, by contradiction: Since the key is public, any server can put the fingerprint of the key in an authorized_keys file. It can then challenge you to log in in a way that exactly matches what a real server you'd actually want to log into would do, because a real server doesn't have your private key either. If your client could also authenticate to the server in a way that didn't prove anything beyond possession of the public key, then it could do the same to some actual server, i.e., the SSH protocol would have no meaningful authentication at all. Because we know the SSH protocol is not completely and trivially broken, this cannot be true.
(I think you also overestimate the value of technical deniability - certainly outside a court of law, nobody is obligated to think, "Well, it could be a complete coincidence, so I'm going to disregard this piece of information I just learned." And I wouldn't bet on it inside a court of law either.)