Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: ssh ssh.place

ssh.place

Post reply on HN
Print view View original

41–50 of 126 posts

Re: Show HN: ssh ssh.place

#41

Post by teiferer »

jerrythegerbil wrote: post #39
scubbo wrote: post #35

Earlier quoted context omitted.

> People understand that reverse hacking can happen when connecting to random ssh server, right? No, actually, I've never heard of such a vector. How would that work?

An ssh server would exploit a vulnerability in the ssh client when it connects. For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh. To sum it up: Connecting to this s…

> To sum it up: Connecting to this server is probably fine

And what are you basing this statement on?

Re: Show HN: ssh ssh.place

#42

Post by teiferer »

jolmg wrote: post #40
bulbar wrote: post #30

Earlier quoted context omitted.

Is that more likely than getting hacked when visiting a website?

Visiting a random website is the normal use of HTTP. With SSH, there might be assumptions of connecting to a trusted server you have an account with and likely own. It's not very normal to ssh to a random server.

> likely own

I don't know how you are using ssh, but most ssh servers that I have connected to in my life, and still do, I don't own. Some of them I barely trust.

Re: Show HN: ssh ssh.place

#43

Post by teiferer »

jeninh wrote: post #17
cbarrick wrote: post #14

Are we coordinating factions here, like the original r/place? The social aspect was such a big part of the original. I'll start: # PURPLE FRAME # Our mission is to draw a purple frame around the canvas. 2 rows of blank space between the frame and the top/bottom of the canvas. 4 cols of blank space between the frame and the left/right of the canvas.

I'm wondering if there is a better way to do this. On one hand, we could just do it here but then I can't link people to this page or it'll harm the post. I could also just use a subreddit or make a forum on https://ssh.place

Building in support for that into the site itself kinda goes against the spirit.

It's understandable that you as the maker want to flame the hype as much as possible, but by making it too obvious you are kinda working against that goal.

Re: Show HN: ssh ssh.place

#44

Post by applfanboysbgon »

jerrythegerbil wrote: post #39
scubbo wrote: post #35

Earlier quoted context omitted.

> People understand that reverse hacking can happen when connecting to random ssh server, right? No, actually, I've never heard of such a vector. How would that work?

An ssh server would exploit a vulnerability in the ssh client when it connects. For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh. To sum it up: Connecting to this s…

There has never been a real-world OpenSSH exploit that allows a server to RCE a client that connected to it without a bunch of dubious qualifiers. Connecting to a random SSH server is much, much less dangerous than running a random binary or executing a random curl install script, both of which people do all the time, and is probably about on par with the likelihood of a random website escaping your browser's sandbox and RCEing you.

Re: Show HN: ssh ssh.place

#45

Post by QuantumNomad_ »

teiferer wrote: post #42
jolmg wrote: post #40

Earlier quoted context omitted.

Visiting a random website is the normal use of HTTP. With SSH, there might be assumptions of connecting to a trusted server you have an account with and likely own. It's not very normal to ssh to a random server.

> likely own I don't know how you are using ssh, but most ssh servers that I have connected to in my life, and still do, I don't own. Some of them I barely trust.

The ones I connect to the most often from my personal laptop I don’t physically own but I do pay to rent them and I installed the OS on them myself.

Re: Show HN: ssh ssh.place

#46

Post by Oxodao »

applfanboysbgon wrote: post #44
jerrythegerbil wrote: post #39

Earlier quoted context omitted.

An ssh server would exploit a vulnerability in the ssh client when it connects. For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh. To sum it up: Connecting to this s…

There has never been a real-world OpenSSH exploit that allows a server to RCE a client that connected to it without a bunch of dubious qualifiers. Connecting to a random SSH server is much, much less dangerous than running a random binary or executing a random curl install script, both of which people do all the time, and is probably about on par with the likelihood of a random website escaping your browser's sandbox…

If you properly set up your ssh client (No agent forwarding or X11 forwarding)

Re: Show HN: ssh ssh.place

#47

Post by boomlinde »

If you have a slight interest in originality of presentation, whatever website copy first comes out of Claude is not there yet. Its preoccupation with "no x, no y" and annoying runs of sentence fragments might have been a punchy rhetoric for a short while before it became a tired cliché, but by now it stylistically makes it look more like you're bragging on LinkedIn than presenting something fun and creative.

I mention it because it's immediately off-putting even though the project itself sounds fun enough. It tarnishes it with the impression that maybe you just don't care, but maybe you just aren't attuned to the style and its strong slop connotations.

I'm genuinely fascinated by the problem and I've wondered what in the training process causes the model to develop this peculiar style of writing. Is it because it's trained on old Medium slop? Someone else replied with a link to their SSH-based VPS, where the copy is absolutely saturated with the same annoying style.

Re: Show HN: ssh ssh.place

#48

Post by raggi »

pzacik wrote: post #33
raggi wrote: post #27

Time for your regular reminder that ssh has no PKI and is trivial to mitm during tofu.

Yes, but what exactly would an attacker achieve by doing mitm here?

here, less than most, but look for ssh agents

on terminal.shop, steal credit cards on jobs endpoints, perform identity theft on exe.dev, whatever you put on there

Re: Show HN: ssh ssh.place

#49

Post by raggi »

kro wrote: post #36
raggi wrote: post #27

Time for your regular reminder that ssh has no PKI and is trivial to mitm during tofu.

I understand that most people don't use it and indeed rely on tofu, but the statement is not absolutely correct. ssh server keys can be authenticated using (the DNSSEC "CA" system and) SSHFP, and it's possible to setup a signing CA for the host key (similar to ssh certificates, however not applicable for foreign servers). And of course, the fingerprint could be advertised out of band e.g. on the homepage with tls

sshfp is not PKI. It's an option and it is off by default in ssh(1). In practice no one actually deploys it, exe.dev, terminal.shop, jobs.{whoever.com}, etc. I've yet to see an in the wild deployment. The aforementioned sites let you perform electronic payment transactions over ssh without it, which is probably a PCI violation tbh, but auditors aren't good enough.

webpki is on by default.

Re: Show HN: ssh ssh.place

#50

Post by bulder »

scubbo wrote: post #35
3dedb728-3f77 wrote: post #23

Hey, is it not just a simple honeypot reverse hack ssh server? People understand that reverse hacking can happen when connecting to random ssh server, right?

> People understand that reverse hacking can happen when connecting to random ssh server, right? No, actually, I've never heard of such a vector. How would that work?

Agent forwarding would be pretty big, if it for example pushed your git credentials to the remote host.
Post reply on HN