101–110 of 178 posts
To all those who question the value of this, it's that we now have a new ssh client that runs everywhere Chrome runs. Additionally and non-trivially, the innards of the terminal UI is now exquisitely accessible to the legions of developers who know HTML and CSS. Presumably it's a small step to embedding cross-domain SSH into a webapp. That said, there are minuses. The big minus is that Chrome, like literally every pi…
Does it run on ARM?
I opened chrome to check this out, but it wants me to "sign in" to install the extension. For me this is a bridge too far: I don't care to tell google about every single extension/application (extensplication?) I'm using. Like many people, I'm trying to step back from google/facebook snooping, and this would be a solid step toward such big brothering. I suppose next they'll see what email providers I use and whom I c…
If your bank account recovery link gets emailed to your Gmail account, you have more to worry about if Google decides to abuse your information.
Trust me when I tell you this:
Google will never steal money from your bank account, by using a password recovery link that you had emailed to your GMail account.
Does that really need to be said? Do you really need CONVINCING of this?
- It's sandboxed - big deal, if sandboxing SSH were a real concern then it's a call to sandbox-exec(1) away.
- It could theoretically be extended to support HTML-based console interfaces - but sticking a web view in a regular terminal would solve this just as well with less overhead.
(Note the lack of benefits that usually apply to webapps: multiple browser implementations; written in a high-level language, which increases hackability [you might be able to get some of that]; don't need to trust the app; page-based paradigm allows deep linking.)
Drawbacks:
- Slow. The FAQ says it's intended to compete performance-wise, and it's reasonably fast, but comparing the behavior of 'ls' or, more dramatically, 'cat /usr/share/dict/words' or 'yes' (try interrupting it) demonstrates that it doesn't quite hold up. *
- You have to trust a silently updating, non-downgradeable app with your data. I guess people already do this with Chrome, but terminal emulators don't exactly benefit from constant updates in the way browsers do.
- Non-native - if you're on Chrome OS, this is a benefit, because Web is native, but on other operating systems, you lose the look and feel of the OS (from Terminal.app: useful cmd-tab, transparent window backgrounds, Lion fullscreen mode, Lion auto reopen, other applications can launch the terminal, native keyboard shortcuts, ctrl-w...) for no reason.
- The current version requires an account(!!)
- The current version is buggy - when I try it, just typing "ls" messes up the terminal so that it's not fully scrolled down. I guess this will be ironed out soon, but existing terminal emulators are highly stable.
*edit: or 'bb', heh - Terminal doesn't exactly handle it well (it's a good demonstration of the superior performance of xterm), but at least it doesn't hang like this terminal
this is insanely awesome. as it stands right now, yes its "just ssh". But open up the developer toolbar and you'll notice this thing is rendering HTML inside of webkit. It doesn't take a genius to see this is a few baby steps from making it possible to render arbitrary graphics in the shell. edit: I might go out on a limb here and say this project is something that is going to be looked at as a real inflection point…
as the day SSH became vulnerable to CSS cross-domain exploits :)
Unless, of course, the developer integrating the existing OpenSSH code did so in a way that's not the formal OpenSSH interface. Like if he had to do some kind of dirty hack. But he shouldn't have to for this project.
To all those who question the value of this, it's that we now have a new ssh client that runs everywhere Chrome runs. Additionally and non-trivially, the innards of the terminal UI is now exquisitely accessible to the legions of developers who know HTML and CSS. Presumably it's a small step to embedding cross-domain SSH into a webapp. That said, there are minuses. The big minus is that Chrome, like literally every pi…
runs everywhere Chrome runs. Does it run on ARM?
This is cool hack but a terrible idea. Why do I want some bloated web browser wrapping a lightweight terminal?
I mean sure, opening up an ssh client is 4 keystrokes for me (on windows) but we need to have it integrated into the browser so firefox (or chrome in this case) can find a way to be even more of a bloated memory pig.
Earlier quoted context omitted.
the complete list of software i use day-to-day consists of a web browser and a terminal emulator. if i switched over to this, that list goes down to just a browser. maybe some people don't care, but i think it's pretty cool.
I don't like the idea of using a single app for everything. I have tons and tons of (personal) reasons, but the most obvious and un-solvable reason is: I can switch between terminal emulator and web browser with Command+Tab. If they were both the same thing, I couldn't do it and I would be very disturbed and confused. The same reason I don't use GMail web app and use Mail.app instead, or Reeder.app or iCal.app or iTu…
Earlier quoted context omitted.
as the day SSH became vulnerable to CSS cross-domain exploits :)
Any input receivable by OpenSSH, regardless of whether it is valid user input or malicious input being delivered by a cross-domain attacker, mustn't result in exploit. If so, it's a bug in OpenSSH, not the fault of the developer who integrating the existing OpenSSH code into a new environment. Unless, of course, the developer integrating the existing OpenSSH code did so in a way that's not the formal OpenSSH interfac…
Any XSS type vulnerabilities in this are likely the result of issues with the extension itself rather than OpenSSH, IMO.
I'm not very impressed... although it's partly implemented in HTML (only partly - even though modern JavaScript engines should be more than capable of handling SSH, the implementation is just OpenSSH in Native Client), this is no citizen of the web, and never can be, as trusting an app to connect directly to arbitrary ports and handle all your SSH connections fundamentally subverts the web's security model. Benefits…
this is insanely awesome. as it stands right now, yes its "just ssh". But open up the developer toolbar and you'll notice this thing is rendering HTML inside of webkit. It doesn't take a genius to see this is a few baby steps from making it possible to render arbitrary graphics in the shell. edit: I might go out on a limb here and say this project is something that is going to be looked at as a real inflection point…
as the day SSH became vulnerable to CSS cross-domain exploits :)
There may be undiscovered exploits, of course, but CSP severely reduces the chances.