I wrote a bit on the SDF if you are interested: https://rz01.org/sdf/
SDF Public Access Unix System
21–30 of 93 posts
Re: SDF Public Access Unix System
#22I found a way to escape their shell (so you can run whatever you want), if you're not verified, it involves multiple steps to archive this. I mailed them 2x to their membership address, but since today no reaction. I asked also in their IRC. Just a question to HN: should I wait more, try again? Or should I simply publish the vulnerabilities somewhere? If yes, where? It's my first time that I found a vulnerability at…
I think you should create some visible but harmless nuisance using this shell escape, so that it's likely to get noticed, but doesn't damage anyone's valuable data. Perhaps just run "bash -c 'stress --cpu 64 ; echo fix your shell escape'"l " or something like that.
Well, ruining everyone's day on that particular host is not a nice way to "bring this to attention".
If I ever experienced something like that, I'd be banning the person (or limiting their resources drastically) for 60 to 90 days to bring the impact of this matter to their attention.
Anything affecting users on a system is not harmless.
Re: SDF Public Access Unix System
#23I found a way to escape their shell (so you can run whatever you want), if you're not verified, it involves multiple steps to archive this. I mailed them 2x to their membership address, but since today no reaction. I asked also in their IRC. Just a question to HN: should I wait more, try again? Or should I simply publish the vulnerabilities somewhere? If yes, where? It's my first time that I found a vulnerability at…
You shall wait. It's a volunteer powered system and while the ops are silent and terse in their mails, they're nice people. Their plate is already quite full and they operate a whole universe of services, so cut them some slack. It's not an ordinary service which is exposed to internet trying to turn a profit. They run SDF, two Mastodon instances, a mail server, a Git server, trying to salvage/keep alive living compu…
I get that it's a volunteer system, but having donated for 2 years to help support their Lemmy instance, it's frustrating it's been down for 2 weeks without much of an update, just a hint "there's a good chance" it will come back. To me that seems lacking of transparency, not terse. How much disk space is it using? Maybe others in the community could help? How can they if they don't respond to emails? It was a nice thing while it lasted, but for federated social media, that kind of downtime hurts communities the most.
Re: SDF Public Access Unix System
#24SDF is cool, I commend their efforts of keeping a pub unix going! To me it feels like a stronghold of the "old school" web, similar to certain builtin board systems.
I regularly visit and enjoy reading the phlogs of their members as well.
Re: SDF Public Access Unix System
#25Finally got to log into a vms system! I was looking to do that over 20 years ago but never could find one. Somehow I still remembered most of the shell syntax in a book I read about it probably in 2001. Don't ask me ... I don't know how either. Got bored in about 10 minutes but still, another box checked off!
I've only ever read about VMS in an historic context, like Wikipedia articles and blog posts. DEC and VMS are not well known. That's a shame, considering how much influence they had, especially on WinNT.
Re: SDF Public Access Unix System
#26I run a public unix(openbsd) shell for fun, I call it my social network platform it sort of sucks, no users, ip6 only, a bunch of vm's on an old underpowered router running in my closet. But feel free to stop by and set up a .plan if you have nothing better to do.
ssh to applicant@register.public.outband.net
instructions at https://www.public.outband.net note that it's ip6 only.
It is pretty pointless, nobody needs or wants a unix shell account in this day and age. But I had fun setting it up, it started as an exercise to see what a shared multiuser postgres install would look like and got a little out of control. My current project is getting a rack of raspberry pi's(6 of them in a cute little case) hooked in as physical application nodes.
Re: SDF Public Access Unix System
#27Omg, we can access even ancient OSes, this is amazing!
Re: SDF Public Access Unix System
#28I've been fortunate enough to know Stephen Jones of SDF through his running of the local Seattle retro computing event (now rebranded as VCF PNW) He's an absolutely kind soul who is deeply interested in all kinds of retro projects. I wish there were more folks like him in tech generally
Likewise, iirc @ VCF in MV 2005.
Re: SDF Public Access Unix System
#29I run a public unix(openbsd) shell for fun, I call it my social network platform it sort of sucks, no users, ip6 only, a bunch of vm's on an old underpowered router running in my closet. But feel free to stop by and set up a .plan if you have nothing better to do. ssh to applicant@register.public.outband.net instructions at https://www.public.outband.net note that it's ip6 only. It is pretty pointless, nobody needs o…
> nobody needs or wants a unix shell account in this day and age
I do. But I do not need just any Unix shell account, I need old and weird ones! I develop and maintain a portable utility (rlwrap) that is aimed at users of older software, who are often also using older or even obsolete systems.
For years, I used Polarhome (http://www.polarhome.com/) as a "dinosaur zoo" of obsolete systems (thans, Zoltan!) For every new release, building it on a creaky Solaris or HP-UX machine would expose a few bugs.
Because older systems are being replaced by (much more uniform) newer ones, there is a diminishing need for such extreme portability. This is also the reason that Polarhome closed in 2022.
In spite of this, testing on many different systems improves general code quality, even for users of mainstream systems like linux, BSD or OSX.
Of course, I could setup a couple of virtual machines, but that is a lot of hassle, especially for machines with uncommon processor architectures.
Re: SDF Public Access Unix System
#30I found a way to escape their shell (so you can run whatever you want), if you're not verified, it involves multiple steps to archive this. I mailed them 2x to their membership address, but since today no reaction. I asked also in their IRC. Just a question to HN: should I wait more, try again? Or should I simply publish the vulnerabilities somewhere? If yes, where? It's my first time that I found a vulnerability at…
I think you should create some visible but harmless nuisance using this shell escape, so that it's likely to get noticed, but doesn't damage anyone's valuable data. Perhaps just run "bash -c 'stress --cpu 64 ; echo fix your shell escape'"l " or something like that.
Creating a nuisance is not a good way to go about it.
Some security practices sometimes feels like someone stabbing you just to prove you could be stabbed. Then they point at the wound and say: "See? You should be more careful."
Yes, the risk is real, but creating harm to demonstrate it isnt the same as protecting people.