Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Late.sh – a command-line Clubhouse for computer people

late.sh

Post reply on HN
Print view View original

81–90 of 141 posts

Re: Late.sh – a command-line Clubhouse for computer people

#82

Post by alentred »

h43z wrote: post #61

Reminder to be cautious about leaking public keys. Once you leak your public key it could be used to check if another server recognizes that leaked public key.

Did I miss something? Aren't public key are supposed to be public?

To be clear, that's an honest question, not sarcasm of anything. I only assume I don't know about some corner case with SSH or something? Because we have those on our websites, they are supposed to be used to verify signatures, etc. How is publishing them bad?

Re: Late.sh – a command-line Clubhouse for computer people

#84

Post by rob »

bl4ckbe4r wrote: post #52
1dom wrote: post #49

This is a really cool idea, and very appealing. Also very nice that it looks usable with just an SSH client. It would be useful if it was explained what the companion client is for? Another small personal gripe: I think you should either remove the 1 line copy/paste sh install on the homepage, or add a link to a git repo on the homepage. I know it's possible to view the sh by visiting it, but a raw text file doesn't…

noted, good feedback :) will change it later, thanks!

You don't have to change it just because one person complained. I personally like the "copy and paste curl command" to install something and I'm sure many others do as well. It's very convenient, and I can inspect the file myself if I'm that paranoid about it.

Re: Late.sh – a command-line Clubhouse for computer people

#85

Post by h43z »

alentred wrote: post #82
h43z wrote: post #61

Reminder to be cautious about leaking public keys. Once you leak your public key it could be used to check if another server recognizes that leaked public key.

Did I miss something? Aren't public key are supposed to be public? To be clear, that's an honest question, not sarcasm of anything. I only assume I don't know about some corner case with SSH or something? Because we have those on our websites, they are supposed to be used to verify signatures, etc. How is publishing them bad?

It's just something everyone should be aware of.

It's up to you to decide if it's okay that you send a server provider (in this case late.sh) a bunch of your public keys which he could for example use to probe other servers to see if you have access to them.

Everyone has different opsec.

Re: Late.sh – a command-line Clubhouse for computer people

#86

Post by greengreengrass »

I would prefer the connection instructions made clear that the default SSH username would be used to set up my username on the platform and display that to other users without initially seeking my consent. On $machine[work], I don't get to pick that $USER is my full name.

If this affects you, make sure you connect with `ssh [pseudonymous name]@late.sh`.

Re: Late.sh – a command-line Clubhouse for computer people

#87

Post by plaidwombat »

prodigycorp wrote: post #69
Zambyte wrote: post #66

Earlier quoted context omitted.

Okay, but why is that something to be concerned about? How would one be able to probe to see if a server recognizes a public key? Why does that matter?

so, i used my public key. can someone please tell me what i should be worried about now?

All your base are belong to us. We recommend rotating keys more often than never.
Post reply on HN