Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Late.sh – a command-line Clubhouse for computer people

late.sh

Post reply on HN
Print view View original

131–140 of 141 posts

Re: Late.sh – a command-line Clubhouse for computer people

#131

Post by notpushkin »

DANmode wrote: post #124
notpushkin wrote: post #108

Earlier quoted context omitted.

I don’t really care. I’m just... disappointed a bit? It seems like a cool project, but those “concise sentences” don’t make it easier to learn about it. no passwords. no OAuth. no accounts. your ssh key is your identity. chats, scores, and streaks are tied to your public key fingerprint. same key, same data. No accounts? How is that possible? You literally store my data! Is that not an account? And what the fuck is O…

I like your last improvement, for sure. The goal of the lander is to get you to use the clubhouse. Not get you to become a contributor, or intrigued/turned away by their stack choice. PS You could also be a heathen, and use the same key across devices!

> The goal of the lander is to get you to use the clubhouse. Not get you to become a contributor, or intrigued/turned away by their stack choice.

Yep! That’s the idea. When writing, think about what your users want to know. If there is some technical detail you want to clarify – show how it helps the user.

> use the same key across devices!

That’s easier for sure! But if I lose a device, revoking one key on every server/service is a PITA already, and reissuing and replacing it on every server and client is even more so. (Also, this wouldn’t work with HSM-backed key stores like https://github.com/maxgoedjen/secretive :-)

Re: Late.sh – a command-line Clubhouse for computer people

#132

Post by DANmode »

sevg wrote: post #127
DANmode wrote: post #126

Earlier quoted context omitted.

I wish - I wouldn’t feel so stupid for replying! =] I genuinely found the space cool, and modern in a good way. Stuff like this has often been an “ugly“ aesthetic, with slapped together and or minimal scaffolding. Or started that way. I thought it was more than enough for a social PoC, & hope it develops further.

I also found it cool/fun and seems many others did too! But this thread isn’t about that. LLM-driven PoC is common and normal these days (and I do it too). But praising the copy here is like praising stock photos.

├─ chill radio, classical, and guest stations ├─ the arcade (2048, sudoku, nonograms, solitaire) ├─ collaborative artboard ├─ daily challenges & streaks ├─ live chat ├─ share & discuss news └─ multiplayer games (coming soon)

^This didn’t feel like LLM to me.

& for the category descriptions, I’m used to way more convoluted word-choice places like…here, lol, so that didn’t stand out to me the way it did for everyone else.

Only the conciseness, the need-to-know.

Re: Late.sh – a command-line Clubhouse for computer people

#133

Post by viccis »

tapland wrote: post #22
viccis wrote: post #16

Earlier quoted context omitted.

I'm, by contrast, an able bodied person with functioning eyes and had no issues.

You might not have the average display. But, can you reason more about your intent with the tone of your comment?

Absolutely not.

Re: Late.sh – a command-line Clubhouse for computer people

#134

Post by endofreach »

Izmaki wrote: post #129
nkrisc wrote: post #128

Earlier quoted context omitted.

The link won’t load for me, but I’m having a hard imagining how a remote server could change a file on your hard drive. Is it about deceptive commands that look like they’ll do something different using weird characters to alter what commands run or something?

The remote server is able to determine whether you are fetching the script using curl/browser or piped directly into bash. I don't remember the magic by heart, but the blog post conclusion was essentially that you can't / shouldn't blindly trust which scripts you pipe straight into bash from the internet, because even if it looks correct in a browser, the script you might end up running could be different. It's more…

> The remote server is able to determine whether you are fetching the script using curl/browser or piped directly into bash

I think you must be mixing something up here. At least i would be very surprised to learn how pipes are that leaky over the wire. It would be very interesting. But i can't imagine how a remote would differentiate between curl and curl piped. And the article doesn't load unfortunately.

Re: Late.sh – a command-line Clubhouse for computer people

#135

Post by nkrisc »

Izmaki wrote: post #129
nkrisc wrote: post #128

Earlier quoted context omitted.

The link won’t load for me, but I’m having a hard imagining how a remote server could change a file on your hard drive. Is it about deceptive commands that look like they’ll do something different using weird characters to alter what commands run or something?

The remote server is able to determine whether you are fetching the script using curl/browser or piped directly into bash. I don't remember the magic by heart, but the blog post conclusion was essentially that you can't / shouldn't blindly trust which scripts you pipe straight into bash from the internet, because even if it looks correct in a browser, the script you might end up running could be different. It's more…

> The remote server is able to determine whether you are fetching the script using curl/browser or piped directly into bash.

Maybe I’m not that clever but I can’t imagine at all how that would even be remotely possible. How would curl even know it’s being piped into something else? And if curl can’t know, how would the remote server know?

Send different response to browser vs curl, sure, that’s easy. But I’m saying download it to your local disk first, read it from there, then run your local copy, that you read. Don’t read it in the browser.

Re: Late.sh – a command-line Clubhouse for computer people

#136

Post by Hugsbox »

dmux wrote: post #104
Hugsbox wrote: post #97

Earlier quoted context omitted.

Could you explain how/why that would be an issue? I still don't understand. Isn't the nature of public keys meant to be that they're public?

I think what the other comment is getting at is that you're essentially leaving footprints behind on various servers and that information could be used to narrow down who you are, where you work, etc. For example, if you used the same key pair for a work machine at the big social media site example.com as you did late.sh, they could probe example.com's machine and see that you'd been there.

That sounds like the kind of edge-case thing that wouldn't be even slightly a problem for like 99.9% of people.

Re: Late.sh – a command-line Clubhouse for computer people

#137

Post by itsbczurstupid »

Hugsbox wrote: post #136
dmux wrote: post #104

Earlier quoted context omitted.

I think what the other comment is getting at is that you're essentially leaving footprints behind on various servers and that information could be used to narrow down who you are, where you work, etc. For example, if you used the same key pair for a work machine at the big social media site example.com as you did late.sh, they could probe example.com's machine and see that you'd been there.

That sounds like the kind of edge-case thing that wouldn't be even slightly a problem for like 99.9% of people.

[flagged]

Re: Late.sh – a command-line Clubhouse for computer people

#138

Post by Izmaki »

nkrisc wrote: post #135
Izmaki wrote: post #129

Earlier quoted context omitted.

The remote server is able to determine whether you are fetching the script using curl/browser or piped directly into bash. I don't remember the magic by heart, but the blog post conclusion was essentially that you can't / shouldn't blindly trust which scripts you pipe straight into bash from the internet, because even if it looks correct in a browser, the script you might end up running could be different. It's more…

> The remote server is able to determine whether you are fetching the script using curl/browser or piped directly into bash. Maybe I’m not that clever but I can’t imagine at all how that would even be remotely possible. How would curl even know it’s being piped into something else? And if curl can’t know, how would the remote server know? Send different response to browser vs curl, sure, that’s easy. But I’m saying d…

The Way Back Machine link works again, go read the blog post. :P

From the blog:

> Execution in bash is performed line by line and so the speed that bash can ingest data is limited by the speed of execution of the script. This means if we return a sleep at the start of our script the TCP send stream will pause while we wait for the sleep to execute. This pause can be detected and used to render different content streams.

> Unfortuneatly its not just a simple case of wrapping a socket.send("sleep 10") in a timer and waiting for a send call to block. The send and receive TCP streams in linux are buffered on a per socket basis, so we have to fill up these buffers before the call to send data will block. We know the buffer is full when the receiving client to replies to a packet with the Window Size flag set to 0 (Win=0 in wireshark).

Re: Late.sh – a command-line Clubhouse for computer people

#139

Post by Izmaki »

endofreach wrote: post #134
Izmaki wrote: post #129

Earlier quoted context omitted.

The remote server is able to determine whether you are fetching the script using curl/browser or piped directly into bash. I don't remember the magic by heart, but the blog post conclusion was essentially that you can't / shouldn't blindly trust which scripts you pipe straight into bash from the internet, because even if it looks correct in a browser, the script you might end up running could be different. It's more…

> The remote server is able to determine whether you are fetching the script using curl/browser or piped directly into bash I think you must be mixing something up here. At least i would be very surprised to learn how pipes are that leaky over the wire. It would be very interesting. But i can't imagine how a remote would differentiate between curl and curl piped. And the article doesn't load unfortunately.

It has to do with how you can abuse how the TCP data is streamed, not that a web server detects a pipe.

Re: Late.sh – a command-line Clubhouse for computer people

#140

Post by bibelo »

TurdF3rguson wrote: post #118
bibelo wrote: post #116

Earlier quoted context omitted.

he's talking about blindy executing a bash script with curl curl install.sh | bash which is indeed a very bad habit does not mean he should talk that way about people who have less knownledge

That's not one of my pronouns you jerk.

sorry i don't identify as a jerk
Post reply on HN