Making an SSH client the hard way
tailscale.com
Making an SSH client the hard way
1–10 of 108 posts
Re: Making an SSH client the hard way
#2Most of the products from tailscale just seem to be "look at the inner platforms we can build that replace the outer platforms".
Having an SSH client in your browser join your VPN violates all the principles of modern computing.
Re: Making an SSH client the hard way
#3Most of the products from tailscale just seem to be "look at the inner platforms we can build that replace the outer platforms". Having an SSH client in your browser join your VPN violates all the principles of modern computing.
[deleted]
Re: Making an SSH client the hard way
#4Most of the products from tailscale just seem to be "look at the inner platforms we can build that replace the outer platforms". Having an SSH client in your browser join your VPN violates all the principles of modern computing.
> Having an SSH client in your browser join your VPN violates all the principles of modern computing.
I think that's a compliment? You're welcome? :)
Re: Making an SSH client the hard way
#5Most of the products from tailscale just seem to be "look at the inner platforms we can build that replace the outer platforms". Having an SSH client in your browser join your VPN violates all the principles of modern computing.
> Having an SSH client in your browser join your VPN violates all the principles of modern computing. I think that's a compliment? You're welcome? :)
absolutely. the lines weren't bad, but they were off in places and now they are set in stone for no good reason.
edit: _especially_ when it comes to security
Re: Making an SSH client the hard way
#6Most of the products from tailscale just seem to be "look at the inner platforms we can build that replace the outer platforms". Having an SSH client in your browser join your VPN violates all the principles of modern computing.
From the article
> Web-based SSH clients aren’t new. Nearly every VPS and cloud provider already lets you connect to your VMs from the web — so how is this different?
This is clearly isn't for everyone, but if you need or already use something like that, then I think this has a chance to be more secure than some other options.
Re: Making an SSH client the hard way
#7Most of the products from tailscale just seem to be "look at the inner platforms we can build that replace the outer platforms". Having an SSH client in your browser join your VPN violates all the principles of modern computing.
> Having an SSH client in your browser join your VPN violates all the principles of modern computing. I think that's a compliment? You're welcome? :)
It's not a compliment. Or rather, within my understanding of how things should be architected, it's not. I certainly wouldn't claim that my own beliefs about network architecture should trump others, and I work in a different domain from most of the people with your use case. Whether the disruptive work you're doing is good for the world in the long run is still a very open question in my mind.
I used to think that everything in the world should move to the browser (in my case, that would be high performance molecular graphics and microscope control) and ChromeOS was the logical extension. Web Assembly to handle the existing C++ codebases, a collection of standard web tech to handle the user interface. Big fan of SSH extension because it meant that machines that only ran a browser could be useful command line programming terminals. But didn't like that SSH extension was written in a dead-end container technology (NaCl) and the CHrome folks sort of messed up multiple ways for the extension to integrate better.
But after working with web tech for enough time I came to conclude that putting things in the browser like this is an antipattern, in particular increasing the surface complexity of the software space while not actually replacing existing systems (openssh continues to exist, OS-level VPNs continue to exist, even after you port the VPN and client to web assembly and run it in a browser).
In my mental model, it makes more sense to put the browser in a VM and then wire the VM's networking to a VPN handled by the OS, rather than putting what is more or less a significant fraction of a virtual machine manager's capabilities into the browser. If you're going to do that, why not go whole-hog and add a VM to chrome so that it can run linux with a full networking stack and then host an SSH client inside that? So you can run linux in your chrome in your linux.
My compliment is: I am impressed at how well you parlayed several technical projects into a thought leadership position, but we have fundamentally different architectural principles and work in different domains. Your work disrupts mine, but mine doesn't disrupt yours. My enterprise actually disallows me from visiting your company's website on my work computer because users installing their own VPNs is considered a security risk (fwiw, I bought into BeyondCorp, which eschews VPNs, a long time ago, and would prefer my enterprise eliminate VPNs, as they don't really protect our users).
Re: Making an SSH client the hard way
#8Most of the products from tailscale just seem to be "look at the inner platforms we can build that replace the outer platforms". Having an SSH client in your browser join your VPN violates all the principles of modern computing.
From the article > Web-based SSH clients aren’t new. Nearly every VPS and cloud provider already lets you connect to your VMs from the web — so how is this different? This is clearly isn't for everyone, but if you need or already use something like that, then I think this has a chance to be more secure than some other options.
I really liked Chrome SSH extension but now I've returned to using the ssh command line client on all three platforms.
The issue is wiring up the browser-hosted application with a custom network inside the browser. It's a truly interesting but highly disruptive concept and I'm curious how it will play out. Perhaps in the future every program will statically compile its own TCP stack and talk over RAW sockets, but... that's sort of throwing away everything BSD and Linux and Windows achieved over the last few decades in terms of OS abstractions.
Re: Making an SSH client the hard way
#9Earlier quoted context omitted.
> Having an SSH client in your browser join your VPN violates all the principles of modern computing. I think that's a compliment? You're welcome? :)
It's not a compliment. Or rather, within my understanding of how things should be architected, it's not. I certainly wouldn't claim that my own beliefs about network architecture should trump others, and I work in a different domain from most of the people with your use case. Whether the disruptive work you're doing is good for the world in the long run is still a very open question in my mind. I used to think that e…
SSH in the web browser is actually the best practice today. Here are some examples of why SSH in your browser actually compliments modern computing:
- An SSO-authenticated web interface, integrated with a host agent on your instances, means you don't have to manage SSH keys.
- If you just need a disposable CLI that inherits permissions from your SSO-authenticated user role, you can do that from a disposable box in a web interface after authenticating via the web interface. Google Cloud Shell is a good example.
- Cloud-native development is easier if developers can just start working on a unified environment, without having to set up & maintain a local environment. Utilizing the web browser avoids the need to consider separate tools and separate methods of network connection.
- SSH'ing to "private" instances is impossible without going through a bastion or VPN. The bastion then becomes a single point of attack, and is hard to maintain and secure. Similarly the VPN is an additional attack vector, maintenance headache, and requires client-side software, configuration, troubleshooting. Instead of deploying a bunch of bastions or setting up a VPN, if you can use the backend control plane through an SSO-authenticated API gateway, along with a backend proxy to internal networks, you can avoid bastions altogether. This is the best practice for Zero-Trust. Google Cloud IAP Proxy is a good example.
The implementation of it, with WebAssembly/WebSockets/WireGuard/DERP, may be lamentable for several reasons. But it probably (I assume?) solves problems that other SSH Web Interfaces didn't. I hate that the web browser has monopolized computing interfaces :) But in this case it seems to solve many problems.
Re: Making an SSH client the hard way
#10This is really cool and fun, but is this a safe way to run SSH clients?
If, say, the adblock Chrome extension you're using gets bought by a malware operator and backdoored[0], now it also has SSH and VPN access.
[0]: https://www.wired.co.uk/article/fake-chrome-extensions-malwa...