New startup sells coffee through SSH • Hacker News Board

Re: New startup sells coffee through SSH

#351

Post by DEADMINCE » Thu, May 02, 2024, 5:55 AM UTC

atq2119 wrote: post #160

lxe wrote: post #5

Interesting. I like this. No need for a cookie banner.

There is never a good reason for cookie banners, by definition. The rule is that if you have a good reason for your cookies (i.e., basically one that isn't user-hostile), you have nothing to worry about and don't need a cookie banner. It's only when you engage in user-hostile practices, such as tracking, that you need to ask for consent. I'm being sightly snarky, but that's really the essence of it.

> It's only when you engage in user-hostile practices, such as tracking, that you need to ask for consent.

Which is what the majority of sites want to do which is why there is a good reason for a cookie banner, by definition.

Re: New startup sells coffee through SSH

#352

Post by bascope24 » Thu, May 02, 2024, 6:05 AM UTC

This is really cool. Which tech does it use for ecommerce functions?

Re: New startup sells coffee through SSH

#353

Post by tazu » Thu, May 02, 2024, 6:14 AM UTC

samwillis wrote: post #185

srinathkrishna wrote: post #171

Earlier quoted context omitted.

They mention in the faq that they use Stripe - https://www.terminal.shop/faq . Stripe does offer integrations that are not natively using their widgets. Ultimately, the PII data is stored at Stripe. PS: I work at Stripe but I don't really work on the PCI compliant part of the company.

Interestingly Stripe started life as /dev/payments and I seem to remember the first iteration was an agent on your server that literally processed card payments when you wrote the details to /dev/payments

I'm guessing they ditched that idea because it wouldn't absolve the "writer" of PCI compliance, since the information has to pass through RAM.

Re: New startup sells coffee through SSH

#354

Post by arcanemachiner » Thu, May 02, 2024, 6:32 AM UTC

rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

Thanks for the PSA. It gave me a good opportunity to double check that I hadn't enabled agent forwarding in any of my SSH scripts that don't need it.

Re: New startup sells coffee through SSH

#355

Post by viraptor » Thu, May 02, 2024, 6:33 AM UTC

quesera wrote: post #256

atq2119 wrote: post #160

Earlier quoted context omitted.

There is never a good reason for cookie banners, by definition. The rule is that if you have a good reason for your cookies (i.e., basically one that isn't user-hostile), you have nothing to worry about and don't need a cookie banner. It's only when you engage in user-hostile practices, such as tracking, that you need to ask for consent. I'm being sightly snarky, but that's really the essence of it.

You are not wrong . But beware the predatory lawyers who will come after you for ostensible violations of California’s Invasion of Privacy Act, California Penal Code section 630, et seq. (“CIPA”). One company I work with received multiple arbitration demands (claimed "privacy" damages in excess of $25000 each, helpfully offered to settle for $5000 each!). And this company didn't even set any cookies or run any 3P tra…

Does the law even matter in this case? If the idea was to make you convinced you'd spend $200k to win a bogus case, you can be sued for literally anything...

Re: New startup sells coffee through SSH

#356

Post by CalRobert » Thu, May 02, 2024, 6:40 AM UTC

Justsignedup wrote: post #91

tonymet wrote: post #25

I long for an alternate dimension where terminal-based internet like Minitel dominated . Something like hypercard implemented with 80x24 ncurses UI

Command line dominates in quick flexibility. But is awful when it comes to discoverability. Most people can't even find the turn off ads button in windows 11. And people hate that. So what hope do they have at a terminal.

"Most people can't even find the turn off ads button in windows 11"

Perhaps the problem there is incentives.

Re: New startup sells coffee through SSH

#357

Post by amelius » Thu, May 02, 2024, 6:46 AM UTC

Does ssh have a good payment system built in?

Re: New startup sells coffee through SSH

#358

Post by fragmede » Thu, May 02, 2024, 6:53 AM UTC

fragmede wrote: post #208

glennpratt wrote: post #145

Earlier quoted context omitted.

I'm curious why you added `-i /dev/null`. IIUC, this doesn't remove ssh-agent keys. If you want to make sure no keys are offered, you'd want: ssh -a -o IdentitiesOnly=yes terminal. Shop I'm not sure if the `-i` actually prevents anything, I believe things other than /dev/null will still be tried in sequence.

Check for yourself with ssh -v -i /dev/null terminal.shop vs ssh -v terminal.shop What you're looking for is that there is no line that says something like debug1: Offering public key: /Users/fragmede/.ssh/id_rsa RSA SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Upon further testing, the full command you want is: ssh -a -i /dev/null -o IdentityAgent=/dev/null terminal.shop to forcibly disable a local identity ag…

Hm I thought I'd edited this. I was mistaken,

    ssh -o IdentitiesOnly=yes terminal.shop

works as expected, however I had an IdentityAgent set, and my key was being submitted via that route.

    ssh -o IdentitiesOnly=yes -o IdentityAgent=/dev/null terminal.shop

behaves as expected; same as

    ssh -a -i /dev/null -o IdentityAgent=/dev/null terminal.shop

Verified via whoami.filippo.io.

Re: New startup sells coffee through SSH

#359

Post by ddalex » Thu, May 02, 2024, 6:57 AM UTC

fragmede wrote: post #262

Jenda_ wrote: post #251

Earlier quoted context omitted.

For a cool example (deanonymization), see https://words.filippo.io/dispatches/whoami-updated/ (discussed at time: https://news.ycombinator.com/item?id=34301768 ). Someone has crawled public keys from GitHub (tbh I was surprised that GitHub publishes them) and set up a database.

It's quite useful! I can give someone access to my server by grabbing their public key and creating an account for them, no need figure out how to send them the password to my server.

That's indeed how public keys are intended to work.

Re: New startup sells coffee through SSH

#360

Post by mynameisnoone » Thu, May 02, 2024, 6:59 AM UTC

While it's cute, it's a small business not a startup and still a gimmick that doesn't solve the problem that coffee is a commodity and so the business is fundamentally not defensible. It's equivalent to being a meal kit business, which is one notch away from being a restaurant.