Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: ssh ssh.place

ssh.place

Post reply on HN
Print view View original

61–70 of 126 posts

Re: Show HN: ssh ssh.place

#61

Post by FooBarWidget »

applfanboysbgon wrote: post #44
jerrythegerbil wrote: post #39

Earlier quoted context omitted.

An ssh server would exploit a vulnerability in the ssh client when it connects. For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh. To sum it up: Connecting to this s…

There has never been a real-world OpenSSH exploit that allows a server to RCE a client that connected to it without a bunch of dubious qualifiers. Connecting to a random SSH server is much, much less dangerous than running a random binary or executing a random curl install script, both of which people do all the time, and is probably about on par with the likelihood of a random website escaping your browser's sandbox…

Malicious servers can send malicious terminal escape codes. For example https://www.sentinelone.com/vulnerability-database/cve-2026-...

Re: Show HN: ssh ssh.place

#62

Post by thinkingemote »

boomlinde wrote: post #47

If you have a slight interest in originality of presentation, whatever website copy first comes out of Claude is not there yet. Its preoccupation with "no x, no y" and annoying runs of sentence fragments might have been a punchy rhetoric for a short while before it became a tired cliché, but by now it stylistically makes it look more like you're bragging on LinkedIn than presenting something fun and creative. I menti…

> what in the training process causes

Read some early pre-mass-adoption LLM papers by the key scientists and researchers. The style is very similar...

Re: Show HN: ssh ssh.place

#63

Post by dhotson »

Hah nice! I made something a bit like this too:

    ssh paint.dn.ht
It's using kitty/iTerm2/Ghostty image placement + pixel mouse reporting support for drawing.

..and for more fun:

    ssh ski.dn.ht
:-)

Re: Show HN: ssh ssh.place

#64

Post by sph »

raggi wrote: post #27

Time for your regular reminder that ssh has no PKI and is trivial to mitm during tofu.

Acronyms are supposed to be capitalised. I do not belive you are talking about the soy product.

https://en.wikipedia.org/wiki/Man-in-the-middle_attack

https://en.wikipedia.org/wiki/Trust_on_first_use

Re: Show HN: ssh ssh.place

#65

Post by miyuru »

somat wrote: post #24
messh wrote: post #4

I love ssh apps! See also late.sh, and my own https://shellbox.dev

Mine is hard to get to(ip6 only) but was started around the idea of a shared postgres database. ssh applicant@register.public.outband.net The web page https://www.public.outband.net hosted on the same box, if you can see it you have the needed ip6. No users yet but feel free to try it out.

your dns server is down.

;; communications error to 2001:470:4b:27e:8::#53: timed out

Re: Show HN: ssh ssh.place

#66

Post by boomlinde »

lordgrenville wrote: post #60
boomlinde wrote: post #47

If you have a slight interest in originality of presentation, whatever website copy first comes out of Claude is not there yet. Its preoccupation with "no x, no y" and annoying runs of sentence fragments might have been a punchy rhetoric for a short while before it became a tired cliché, but by now it stylistically makes it look more like you're bragging on LinkedIn than presenting something fun and creative. I menti…

I don't think Claude's writing style is peculiar, it is just that we are being flooded with it. Everything becomes stale with overuse.

I think its peculiar in that it's so limited, repetitive and undiscerning in its stylistic expression.

The stylistic elements on their own wouldn't raise an eyebrow if they appeared rarely among many other stylistic devices in order to enhance drama, suspense or emphasis, but within a single completion, Claude will sometimes implement just these two several times to express the most banal things. It ends up looking like a caricature of the worst pre-LLM Medium and LinkedIn garbage.

Re: Show HN: ssh ssh.place

#68

Post by jamie0 »

SXX wrote: post #55
dlgeek wrote: post #28

Earlier quoted context omitted.

Not OP, but agent forwarding is a significant concern.

Is it enabled by default though? AFAIK: No

It's not, but there is likely a small number people who have something like this configured:

  Host *
  ForwardAgent yes

Re: Show HN: ssh ssh.place

#69

Post by jetbalsa »

cbarrick wrote: post #18
jeninh wrote: post #17

Earlier quoted context omitted.

I'm wondering if there is a better way to do this. On one hand, we could just do it here but then I can't link people to this page or it'll harm the post. I could also just use a subreddit or make a forum on https://ssh.place

The organicness of the original was really fun. Dunno if coordinating here really fits the HN vibe, but also go where the people are.

Place 2 wasn't too bad, it did get botted to all hell. I handled some the early recordings of the canvas to make live time lapses of it. I've done the same here just to have something to mess about with.

Re: Show HN: ssh ssh.place

#70

Post by arghwhat »

3dedb728-3f77 wrote: post #23

Hey, is it not just a simple honeypot reverse hack ssh server? People understand that reverse hacking can happen when connecting to random ssh server, right?

People understand that such "reverse hacking" can happen when their browser connects to any site (including all the indirect connections from dependent resources), right? Or when resolving any domain name? Or when even just pinging an IP?

The risk is far, far lower than browsing the internet. Unlike the massive surface of a browser and all the libraries and processes it is comprised of, the OpenSSH client is a tiny, with a singular purpose, contained in a small and very well-vetted codebase.

From the perspective of connecting to a foreign network service, the OpenSSH client is about the safest thing you can possibly use. Note the use of relative words here - not claiming it is 100% bug-free.

(The main caveat is that you can manually configure the client to do unsafe things, like writing a configuration by hand that enables X forwarding or agent forwarding by default for any host - but you can also actively disable sandboxing in your web browser or run everything as root, and we will never be able to stop you from actively making things insecure.)

Post reply on HN