Live data from Hacker News

Why does SSH send 100 packets per keystroke?

eieio.games

121–130 of 375 posts

Re: Why does SSH send 100 packets per keystroke?

#121
post #34
post #25

> I am working on a high-performance game that runs over ssh. Found your problem. But it is an interesting world where you can casually burrow into a crypto library and disable important security features more easily than selecting the right network layer solution.

the obtuseness is the point! This is true of a lot of my work[1][2][3]. The problems you run into when doing things you shouldn't do are often really fun. [1] https://news.ycombinator.com/item?id=42342382 [2] https://news.ycombinator.com/item?id=37810144 [3] https://news.ycombinator.com/item?id=42674116

These were great reads, thanks for linking. The writeup around the UUID page was super interesting!

Re: Why does SSH send 100 packets per keystroke?

#122
post #98

Earlier quoted context omitted.

How much are you staking on that bet?

Sigh. I'm still waiting for a systems engineering tool that can log every layer, and handle SSL the whole pipe wide. Im covering everything from strafe and ltrace on the machine, file reads, IO profiling, bandwidth profiling. Like, the whole thing, from beginning to end. Theres no tool that does that. Hell, I can't even see good network traces within a single Linux app. The closest you'll find is https://github.com/m…

Real talk though, how much would such a tool be worth to you? Would you pay, say, $3,000/license/year for it? Or, after someone puts in the work to develop it, would you wait for someone else to duct tape something together approximately similar enough using regexps that open source but 10% as good, and then not pay for the good proprietary tool because we're all a bunch of cheap bastards?

We have only ourselves to blame that there aren't better tools (publicly) available. If I hypothetically (really!) had such a tool, it would be an advantage over every other SRE out there that could use it. Trying to sell it directly comes with more headaches than money, selling it to corporations has different headaches, open-sourcing it don't pay the bills, nevermind the burnout (people don't donate for shit). So the way to do it is make a pitch deck, get VC funding so you're able to pay rent until it gets acquired by Oracle/RedHat/IBM (aka the greatest hits for Linux tool acquisition), or try and charge money for it when you run out of VC funding, leading to accusations of "rug pull" and development of alternatives (see also: docker) just to spite you.

In the base case you sell Hashimoto and your bank account has two (three!) commas, but worst case you don't make rent and go homeless when instead you could've gone to a FAANG and made $250k/yr instead of getting paid $50k/yr as the founder and burning VC cash and eating ramen that you have to make yourself.

I agree, that would be an awesome tool! Best case scenario, a company pays for that tool to be developed internally, the company goes under, it gets sold as an asset and whomever buys it forms a compnay and tries to sell it directly and then that company goes under but that whomever finally open sources it because they don't want it to slip into obscurity but if falls into obscurity anyway because it only works on Linux 5.x kernels and can't be ported to the 6.x series that we're on now easily.

Re: Why does SSH send 100 packets per keystroke?

#123

The reliance on LLMs is unfortunate. I bet this mystery could gave been solved much quicker by simply looking at the packet capture in Wireshark. The Wireshark dissectors are quite mature, SSH is covered fairly well.

obviously OPs empirical and analytical rigor are top notch. He applied LLMs in the best way possible: fill gaps with clumsy command line flags or protocol implementations. Those aren't things one needs to keep in their head all the time.

Re: Why does SSH send 100 packets per keystroke?

#124
> I am working on a high-performance game that runs over ssh.

Step one, run https://www.psc.edu/hpn-ssh-home/introduction/ instead Step two, tune TCP/IP stack Step... much later: write your own "crypto". (I'm using quotes because, before someone points out the obvious, packets-per-keystroke isn't, itself, a cryptographic algorithm, but because it's being done to protect connections from being decrypted/etc, mess with it at your own peril.)

Re: Why does SSH send 100 packets per keystroke?

#125
post #77

Earlier quoted context omitted.

Yes, but I wouldn't be surprised if the change is rejected. The crypto library is very opinionated, you're also not allowed to configure the order of TLS cipher suites, for example.

[flagged]

that's the point of opinionated crypto libraries, yes

Re: Why does SSH send 100 packets per keystroke?

#126
post #118

Earlier quoted context omitted.

In practice I've never felt this was an issue. But I can see how with extremely low bandwidth devices it might be, for instance LoRa over a 40 km link into some embedded device.

Hah no. Nobody is running TCP on that link, let alone SSH.

https://github.com/markqvist/Reticulum

and RNode would be a better match.

Re: Why does SSH send 100 packets per keystroke?

#127

The reliance on LLMs is unfortunate. I bet this mystery could gave been solved much quicker by simply looking at the packet capture in Wireshark. The Wireshark dissectors are quite mature, SSH is covered fairly well.

Asking an LLM about SSH (hint: the two S-es stand for security) would tell you why only having packet capture in Wireshark isn't going to reveal shit.

Re: Why does SSH send 100 packets per keystroke?

#128
post #77

Earlier quoted context omitted.

Yes, but I wouldn't be surprised if the change is rejected. The crypto library is very opinionated, you're also not allowed to configure the order of TLS cipher suites, for example.

[flagged]

Those same security guys also think that "just hope that no bad guy ever gets root access, lol" is a valid threat model analysis, so whatever.

Re: Why does SSH send 100 packets per keystroke?

#129
post #101

The reliance on LLMs is unfortunate. I bet this mystery could gave been solved much quicker by simply looking at the packet capture in Wireshark. The Wireshark dissectors are quite mature, SSH is covered fairly well.

Unfortunately with SSH specifically, the dissectors aren't very mature - you only get valid parsing up to the KeX completion messages (NEWKEYS), and after that, even if the encryption is set to `none` via custom patches, the rest of the message flow is not parsed. Seems because dumping the session keys is not at all a common thing. It's just a matter of effort though - if someone put in the time to improve the SSH st…

Interesting, I thought it was possible to decrypt SSH in Wireshark a la TLS, but it seems I'm mistaken. It still would have been my first goto, likely with encryption patched out as you stated. With well documented protocols, it's generally not too difficult deciphering the raw interior bits as needed with the orientation provided by the dissected pieces. So let me revise my statement: this probably would have been a fairly easy task with protocol analysis guided code review (or simply CR alone).

Re: Why does SSH send 100 packets per keystroke?

#130

I don't see how Claude helped the debugging at all. It seemed like the author knew what to do and it was more telling Claude to think about that. I've used Claude a bit and it never speaks to me like that either, "Holy Cow!" etc. It sounds more annoying than interacting with real people. Perhaps AIs are good at sensing personalities from input text and doesn't act this way with my terse prompts..

Even if the chatbot served only as a Rubber Ducky [1], that's already valuable.

I've used Claude for debugging system behavior, and I kind of agree with the author. While Claude isn't always directly helpful (hallucinations remain, or at least outdated information), it helps me 1) spell out my understanding of the system (see [1]) and 2) help me keep momentum by supplying tasks.

[1] https://en.wikipedia.org/wiki/Rubber_duck_debugging

Post reply on HN