Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

jobs.hackclub.com

Post reply on HN
Print view View original

61–70 of 119 posts

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#61

Post by gorgoiler »

sterlind wrote: post #58
gorgoiler wrote: post #51

Earlier quoted context omitted.

The “public” in public key just means it doesn’t need to be secret, for cryptographic purposes. It’s different to your public identity as a person — I don’t think I’ve ever seen an ssh key used for that, in practice. I might have multiple ssh key pairs related to my different roles as: high school teacher, two different GitHub users, peer to peer pharmaceuticals distributor, and upstanding private citizen. I cannot s…

Prospective employers probably would want to connect your street pharmacy side-gig with your identity, you just wouldn't want them to.

Hah, good point. Also, if my upstream dealer knew I was a teacher they’d probably leverage that to blackmail me.

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#62

Post by chrismorgan »

gruez wrote: post #4
1cvmask wrote: post #2

Says the subdomain link that lacks SSL. A wildcard certificate would have sufficed.

or a free one from letsencrypt

Let’s Encrypt has provided wildcard certificates via the DNS-01 challenge type since 2018.

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#63

Post by chrismorgan »

HatchedLake721 wrote: post #7
1cvmask wrote: post #2

Says the subdomain link that lacks SSL. A wildcard certificate would have sufficed.

Kinda unforgivable to be on front page of HN in 2021 without https

Info for the curious:

There tend to be about 0–2 http: entries on the front page. A fairly large fraction of those are old things. http: submissions on domains that support https: (whether or not they redirect to it by default) are very uncommon.

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#64

Post by ipaddr »

alexander-litty wrote: post #23
bellyfullofbac wrote: post #8

Earlier quoted context omitted.

Why exactly? Other than a lot of "potential problems" security theater? People still send postcards, where they don't care if people read what's written on it..

People also expect their postcards to arrive untampered. ISPs, Comcast in particular, inject ad-loading javascript into HTTP pages. https://arstechnica.com/tech-policy/2014/09/why-comcasts-jav... https://www.reddit.com/r/technology/comments/9b5ikd/

In fairness isn't that a result of your relationship with your isp? If you remain because of price or no other services available why wouldn't you use a vpn knowing your isp is a hostile actor and probably trying to deeply inspect packets, etc?

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#65

Post by hollerith »

benatkin wrote: post #17
jimmygrapes wrote: post #11

Earlier quoted context omitted.

Practically speaking, it is because some modern browsers (and extensions) will throw up an error (either by-passable or not) if it's HTTP only. Yeah it's not necessary in many cases, but it's growing to be the standard expected behavior.

Which ones, pray tell?

I've seen the warnings in both Chrome and Firefox.

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#66

Post by soheil »

spijdar wrote: post #47
soheil wrote: post #34

Earlier quoted context omitted.

It doesn't have to be for at least some unsuspecting users to unwittingly share their private key with some random server on the internet. When was the last time you ssh'd to a server you didn't already have some level of trust with? (AWS, GCP, work server farms, etc.)

Not GP, but pretty frequently, although my situation is not normal. I'd still suggest that sharing your keys by default is ... a bad idea. Sure, fingerprints help, but there's the chance of accidentally or maliciously being redirected to a rogue server.

I agree * is unsafe, but then again ssh devs chose to include it so that means they deemed it not completely useless, thus there are probably enough people who use it to make this thread somewhat malicious.

Also if you or another script once added * to your .ssh/config long ago it may still be lurking there among other lines without you realizing.

I agree checking fingerprints helps, but that can turned off pretty easily too.

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#67

Post by chrismorgan »

zachlatta wrote: post #21
1cvmask wrote: post #2

Says the subdomain link that lacks SSL. A wildcard certificate would have sufficed.

Just added SSL. Live at https://jobs.hackclub.com .

You should use a 301 (permanent) redirect, not a 302 (temporary) redirect as you currently are.

Just speaking generally, I found the use of an http: link on this very curious, given that it’s about SSH (and thus encryption in no little part), so I’m guessing you’re not a “Web Developer”. So here’s my advice on the matter: everything on the web should be HTTPS now; nothing should be plain-text HTTP, with zero exceptions.

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#69

Post by justinjlynn »

raggi wrote: post #50
reasons wrote: post #5

Are there are any security precautions in using ssh (or telnet, netcat or curl for that matter) to connect to an unknown service like this?

Yes. Do not connect with agent forwarding, as doing so would allow the server operator to connect to other locations as you. Do not forward environment information, though the typical ssh default is not to. You will likely leak your username. If you connect from an internet reachable host, and you made the mistake of not doing the first item in this list, they could easily connect back to you, not requiring any zero…

Thanks for the excellent summary and explanation. I knew the answer was that it wasn't safe - but the detail here is remarkable. :)

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#70

Post by CuriousCosmic »

raggi wrote: post #50
reasons wrote: post #5

Are there are any security precautions in using ssh (or telnet, netcat or curl for that matter) to connect to an unknown service like this?

Yes. Do not connect with agent forwarding, as doing so would allow the server operator to connect to other locations as you. Do not forward environment information, though the typical ssh default is not to. You will likely leak your username. If you connect from an internet reachable host, and you made the mistake of not doing the first item in this list, they could easily connect back to you, not requiring any zero…

Note that they could only log back into your machine if you use the same credentials to between machines.

This is one of the arguments for generating a unique SSH key on each machine you use. It makes it far harder to break in if you mess up somewhere along the way.

Post reply on HN