zero interest rate startups are still in fashion I see.
they're self-funded, there's no interest rates present.
New startup sells coffee through SSH
161–170 of 430 posts
Re: New startup sells coffee through SSH
#162Re: New startup sells coffee through SSH
#163One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)
*disable ssh agent FORWARDING. Which honestly should always be disabled. There are no trusted hosts.
I've found myself to be much more comfortable to just define all my private keys in ~/.ssh/config on a host-by-host basis.
Re: New startup sells coffee through SSH
#164Another service that is completely controlled through a ssh tui : https://nixbuild.net
Re: New startup sells coffee through SSH
#165Earlier quoted context omitted.
The full command you want is: ssh -a -i /dev/null terminal.shop to disable agent forwarding, as well as to not share your ssh public key with them, but that's just a little less slick than saying just: ssh terminal.shop to connect.
I'm curious why you added `-i /dev/null`. IIUC, this doesn't remove ssh-agent keys. If you want to make sure no keys are offered, you'd want: ssh -a -o IdentitiesOnly=yes terminal. Shop I'm not sure if the `-i` actually prevents anything, I believe things other than /dev/null will still be tried in sequence.
instructions not clear, my entire drive is empty now
Re: New startup sells coffee through SSH
#166One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)
*disable ssh agent FORWARDING. Which honestly should always be disabled. There are no trusted hosts.
[deleted]
Re: New startup sells coffee through SSH
#167I would really like to see a decaf option there.
Re: New startup sells coffee through SSH
#168Earlier quoted context omitted.
Is it not standard practice to make different keys for different important services? I have a private key for my prod server, a private key for GitHub, and a private junk key for authenticating to misc stuff. I can discard any without affecting anything else that's important. If I authenticated with my junk key, would my other keys still be at risk?
It’s a practice, but not necessarily a standard one. In any case if even one person sees that, the advice will have served its purpose.
TIL, the good news I guess is I only ssh into my hosting platforms and GitHub who have a reason to protect my data since I pay them.
Still I'll be sure to break up my keys more going forward and disable SSH forwarding.
Re: New startup sells coffee through SSH
#169I can't test this due to the product being out of stock, but I wonder what their approach to PCI compliance is.
Processing credit card data has a high compliance burden if you're unwilling to use a secure widget made by an already-authorized provider like Stripe. That's for a good reason, most web and mobile apps are designed such that their backend servers never see your full credit card number and CVV. You can't do this over SSH.
I also wonder whether you could even do this if you had to handle PSD2 2-factor authentication (AKA 3d Secure), which is a requirement for all EU-based companies. This is usually implemented by displaying an embed from your bank inside an iframe. The embed usually asks you to authenticate in your banking app or enter a code that you get via SMS.
You can take the easy way out of course and make the payment form a web page and direct the user to it with an URL and/or a Unicode-art rendition of a QR code.
Re: New startup sells coffee through SSH
#170Earlier quoted context omitted.
Sorry, English is not my native language. I know I sometimes sound strange because most of my use of the language is around the internet and at work, not that much casual "normal" conversation.
English is my native language and I have no idea what that person was talking about. Your post is fine.
I think that person was talking about having had 4 out of 5 squares in a line on their bingo card already, and stumbling across "baby+bathwater" earned them bingo. The card is metaphorical though... more of a mental buffer that just overflowed.