[dead]
New startup sells coffee through SSH
321–330 of 430 posts
Re: New startup sells coffee through SSH
#322Before a bunch of you run off and make more of these “because it’s cool”, they’ll likely lose access to stripe once stripes security team pay attention and realize that this can be trivially man in the middled and doesn’t actually offer the equivalent protection to https. I wrote up a little demo and explainer at https://mitm.terminal.shop.rag.pub ssh mitm.terminal.shop.rag.pub
> I wrote up a little demo and explainer at They give you the ed25519 host key to insert into your known_hosts file on their homepage, which itself is served over TLS with all of the protections you describe in your article. They could go into more detail on being careful with not falling into the tofu trap perhaps, but I don't see that there's an inherent PCI-critical problem here. ssh tells you who, cryptographical…
Except in their marketing materials they just say `ssh terminal.shop`
Users will fall into the TOFU trap, most users who've sent them cash certainly did.
Most users won't put their credit card credentials into a page that they've had to bypass a cert warning on.
Re: New startup sells coffee through SSH
#323A lot of people don't know that before Amazon started, there was a company out of Portland, OR called Bookstacks selling books via a telnet interface. In the early days, Bezos was quite worried about their potential to get "there" first (wherever "there" was going to be). It was a fairly cool interface, at least for 1994. [ EDIT: worried to the point that we actually implemented a telnet version of the store in paral…
A large bookstore was using CLI for their internal inventory management system well into the 2000s.
amzn was likely doing that too. the original tools that we wrote in 94-96 for store ops were all CLI.
Re: New startup sells coffee through SSH
#324A lot of people don't know that before Amazon started, there was a company out of Portland, OR called Bookstacks selling books via a telnet interface. In the early days, Bezos was quite worried about their potential to get "there" first (wherever "there" was going to be). It was a fairly cool interface, at least for 1994. [ EDIT: worried to the point that we actually implemented a telnet version of the store in paral…
Do you have more info? I found this article[0] about "Book Stacks" which became Books.com, but it looks like they were based in Cleveland? [0] https://sbnonline.com/article/visionary-in-obscurity-charles...
More info is: I was wrong, Ohio is right.
Re: New startup sells coffee through SSH
#325FAQ: > is ordering via ssh secure? you bet it is. arguably more secure than your browser. ssh incorporates encryption and authentication via a process called public key cryptography. if that doesn’t sound secure we don’t know what does. Doesn’t TLS use public key cryptography too?
"More secure than your browser," while serving the hostkey over HTTPS.
Re: New startup sells coffee through SSH
#326Is it /usr/locally grown and single .'ed? How quickly can they mv it to my ~?
[deleted]
Re: New startup sells coffee through SSH
#327I might be horribly out of touch, but... is $25 for a 12oz bag of not-totally-horrible coffee beans really a normal price?
~$15-$20 for a 12oz to get it fresh from a local roaster in the SFBA.
Re: New startup sells coffee through SSH
#328Earlier quoted context omitted.
For a cool example (deanonymization), see https://words.filippo.io/dispatches/whoami-updated/ (discussed at time: https://news.ycombinator.com/item?id=34301768 ). Someone has crawled public keys from GitHub (tbh I was surprised that GitHub publishes them) and set up a database.
It's quite useful! I can give someone access to my server by grabbing their public key and creating an account for them, no need figure out how to send them the password to my server.
[deleted]
Re: New startup sells coffee through SSH
#329suuuuper gay
Re: New startup sells coffee through SSH
#330One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)
And for privacy, don’t let it know your identity or username: ssh -o PubkeyAuthentication=no -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -a nobody@terminal.shop Otherwise, the remote server can probably identify who you are on platforms like GitHub.
What I am reading from this there be dragons so don't use SSH to buy coffee!