Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New startup sells coffee through SSH

terminal.shop

Post reply on HN
Print view View original

241–250 of 430 posts

Re: New startup sells coffee through SSH

#241

Post by ZiiS »

gowld wrote: post #239
rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

That's terrifying. I don't understand why the design requires Forwarding to work without more explicit consent from the client at use time. (That is, when the middle tier wants to make a connection, it should forward an encrypted challenge from the server that can only be decrypted, answered, and re-encrypted by the original ssh keyholder on the client, similar to how, you know, ssh itself works over untrusted router…

It is not the default, you would have to have a silly config for this to matter.

Re: New startup sells coffee through SSH

#242

Post by snapcaster »

robocat wrote: post #238
Repulsion9513 wrote: post #106

PSA to anyone making a public SSH service: List the fingerprint, not the host key, thanks. (Or better yet list both!)

Please avoid acronyms on HN or spell them out. We don't all live in your context. duckduckgo just says PSA is Prostate specific antigen. What did you mean?

public service announcement, chatgpt would have got it for you

Re: New startup sells coffee through SSH

#243

Post by acchow »

gowld wrote: post #239
rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

That's terrifying. I don't understand why the design requires Forwarding to work without more explicit consent from the client at use time. (That is, when the middle tier wants to make a connection, it should forward an encrypted challenge from the server that can only be decrypted, answered, and re-encrypted by the original ssh keyholder on the client, similar to how, you know, ssh itself works over untrusted router…

AFAIK, that’s exactly how agent forwarding works. The explicit part is that you need to explicitly turn it on

Re: New startup sells coffee through SSH

#244

Post by [deleted] »

robocat wrote: post #238
Repulsion9513 wrote: post #106

PSA to anyone making a public SSH service: List the fingerprint, not the host key, thanks. (Or better yet list both!)

Please avoid acronyms on HN or spell them out. We don't all live in your context. duckduckgo just says PSA is Prostate specific antigen. What did you mean?

[deleted]

Re: New startup sells coffee through SSH

#245

Post by doawoo »

Neat — big fan of TUIs! But I’m an even bigger fan of coffee… so show me where that coffee actually is sourced from…

Did you go and source it from farms? Is this sourced from another company? Whose blend? Do you provide the roast date on the bag?

Re: New startup sells coffee through SSH

#246

Post by eddd-ddde »

robocat wrote: post #238
Repulsion9513 wrote: post #106

PSA to anyone making a public SSH service: List the fingerprint, not the host key, thanks. (Or better yet list both!)

Please avoid acronyms on HN or spell them out. We don't all live in your context. duckduckgo just says PSA is Prostate specific antigen. What did you mean?

IIRC Public service announcement.

Re: New startup sells coffee through SSH

#247

Post by IamDaedalus »

allknowingfrog wrote: post #203
fouc wrote: post #43

Earlier quoted context omitted.

I love TUI (as in text-based user interfaces) so much more than GUI. It always felt like a far more peaceful and productive environment.

I love the idea of TUIs, but I honestly don't have a lot of experience with them. There's a lovely Go library called Wish that I keep looking for reasons to use. https://github.com/charmbracelet/wish

charm bracelet has some really great projects and my obsession for TUI interfaces is why I'm learning Go so that I can use one of their libraries in a peoject

Re: New startup sells coffee through SSH

#248

Post by _lvbh »

robocat wrote: post #238
Repulsion9513 wrote: post #106

PSA to anyone making a public SSH service: List the fingerprint, not the host key, thanks. (Or better yet list both!)

Please avoid acronyms on HN or spell them out. We don't all live in your context. duckduckgo just says PSA is Prostate specific antigen. What did you mean?

Public service announcement. It’s very widely used

Re: New startup sells coffee through SSH

#250

Post by contingencies »

bananskalhalk wrote: post #52
rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

*disable ssh agent FORWARDING. Which honestly should always be disabled. There are no trusted hosts.

Default for the last 24 years according to https://github.com/openssh/openssh-portable/blame/385ecb31e1...
Post reply on HN