Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

jobs.hackclub.com

Post reply on HN
Print view View original

101–110 of 119 posts

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#101

Post by thrwaeasddsaf »

raggi wrote: post #50
reasons wrote: post #5

Are there are any security precautions in using ssh (or telnet, netcat or curl for that matter) to connect to an unknown service like this?

Yes. Do not connect with agent forwarding, as doing so would allow the server operator to connect to other locations as you. Do not forward environment information, though the typical ssh default is not to. You will likely leak your username. If you connect from an internet reachable host, and you made the mistake of not doing the first item in this list, they could easily connect back to you, not requiring any zero…

> rxvt, etc have had bugs found and most aren't regularly fuzzed.

Recent example: https://www.openwall.com/lists/oss-security/2021/05/17/1

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#102

Post by px43 »

reasons wrote: post #5

Are there are any security precautions in using ssh (or telnet, netcat or curl for that matter) to connect to an unknown service like this?

I remember back where there were some code execution bugs in putty, a friend would pose as a naive Linux noob on IRC, go into hacking channels, and ask if people could help him fix some problem, and he would get shells on anyone who tried to log in to his machine.

https://www.exploit-db.com/exploits/1788

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#103

Post by jcpham2 »

vbsteven wrote: post #92
jesusjosephsson wrote: post #89

Earlier quoted context omitted.

> Do not connect with agent forwarding This requires an explicit argument, right?

It's not enabled by default, but unfortunately I've seen many SSH config related articles that advocate some scary stuff like setting ForwardAgent yes for Host * combined with ssh-add in .zshrc/.bashrc

whoa whao whao wait just a sec

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#104

Post by shoefindortz »

easton wrote: post #25
soheil wrote: post #22

Any reason why this wasn't implemented with telnet since no authentication is required?

telnet is not shipped in the box on Windows and macOS, ssh is.

Windows ships with ssh now? Is that something new in win10+?

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#105

Post by seoaeu »

krageon wrote: post #94
sterlind wrote: post #58

Earlier quoted context omitted.

Prospective employers probably would want to connect your street pharmacy side-gig with your identity, you just wouldn't want them to.

Any good prospective employer would not want to, unless it's directly relevant to their work field.

Employers are greatly interested in how prospective employees feel about following the law. Learning about your "street pharmacy side-gig" gives a clear answer of that.

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#106

Post by airhead969 »

px43 wrote: post #100
airhead969 wrote: post #99

Earlier quoted context omitted.

Docker containers aren't provably secure. If you want isolation, use a VM that doesn't have host file system access. This way, if the VM is compromised, just throw it away and it can't leak out the way containers do.

> Docker containers aren't provably secure. Not only are they not provably secure (very few things are), they are explicitly not intended for use as a security boundary. Their whole gimmick is lightweight containers you can use instead of VMs if you trust everyone who's going to run code under them.

To disambiguate: I don't mean formal verification like seL4, I mean it hasn't been thoroughly audited to show it is reasonably secure. Docker security of images and running containers is pretty shit as I brought up on GH in the beginning. Developers just shrugged it off and focused on whiz-bang features.

The conflation of what amounts to fancy Linux cgroups trickery with hypervisors is a depressing misunderstanding of isolation.

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#107

Post by inetknght »

philshem wrote: post #84
inetknght wrote: post #57

Earlier quoted context omitted.

If you use the same public key across services then there's a good chance that your user can be identified. Github, for example, publishes users' public keys [0]. So if I re-use the same public key then you know it's me. Re-using the same public key is bad for privacy. But if you combine it with other security nightmares. With agent forwarding the remote can enumerate all of your unlocked keys. The solution is 1) do…

I guess [0] is https://github.com/$USERNAME.keys e.g. https://github.com/nat.keys

Whoops yeah pretty much. I forgot to paste the link. I was distracted. Now it's too late to edit

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#108

Post by tmsbrg »

rokusei wrote: post #36
soheil wrote: post #22

Any reason why this wasn't implemented with telnet since no authentication is required?

SSH, once you (verify and) accept the first key exchange cannot be tampered with in transit, nor have the contents viewed by those sitting in-between. However, I believe everyone's stdout/stderr is available to everyone, if everyone is the same user, and if that user has read access to /proc, so that confidentiality is only restricted those who access to the server.

This is actually just a Go app which implements SSH using the Go standard library's SSH module. It's not like you're really SSH-ing into a server. See the source: https://github.com/hackclub/jobs

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#109

Post by easton »

shoefindortz wrote: post #104
easton wrote: post #25

Earlier quoted context omitted.

telnet is not shipped in the box on Windows and macOS, ssh is.

Windows ships with ssh now? Is that something new in win10+?

Yes, as of Windows 10 1809 the OpenSSH client is included. OpenSSH Server is available as a optional feature.

https://docs.microsoft.com/en-us/windows-server/administrati...

Re: Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com

#110

Post by alexander-litty »

ipaddr wrote: post #64
alexander-litty wrote: post #23

Earlier quoted context omitted.

People also expect their postcards to arrive untampered. ISPs, Comcast in particular, inject ad-loading javascript into HTTP pages. https://arstechnica.com/tech-policy/2014/09/why-comcasts-jav... https://www.reddit.com/r/technology/comments/9b5ikd/

In fairness isn't that a result of your relationship with your isp? If you remain because of price or no other services available why wouldn't you use a vpn knowing your isp is a hostile actor and probably trying to deeply inspect packets, etc?

>isn't that a result of your relationship with your isp?

Any ISP is allowed to sniff and manipulate packets, so this isn't just about my ISP -- it's the server's ISP as well as any entities in-between.

Even if I did (assuming that I reasonably could!) change my ISP, that's changing only one of the potentially many hostile actors.

>why wouldn't you use a vpn

That would require me to trust the connection between the VPN and the server.

Plus, then I would need to buy a VPN subscription :) Just serve HTTPS!

Post reply on HN