Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New startup sells coffee through SSH

terminal.shop

Post reply on HN
Print view View original

381–390 of 430 posts

Re: New startup sells coffee through SSH

#381

Post by robertlagrant »

philsnow wrote: post #307
Jenda_ wrote: post #251

Earlier quoted context omitted.

For a cool example (deanonymization), see https://words.filippo.io/dispatches/whoami-updated/ (discussed at time: https://news.ycombinator.com/item?id=34301768 ). Someone has crawled public keys from GitHub (tbh I was surprised that GitHub publishes them) and set up a database.

> You can make a search for all users, which will tell you there are 97,616,627 users at the time of this writing, but you can only fetch at most 1000 results from a search, and they don’t come in any clear order, so you can’t just make the next search start where the previous one left off (or I didn’t figure out how). > What you can do though is request accounts created in a certain time range. If you get the time r…

> I tried to add a google drive storage backend to camlistore/perkeep (because I had nearly-unlimited free quota at the time)

This explains the quotas now :)

Re: New startup sells coffee through SSH

#382

Post by lambdaxyzw »

>is ordering via ssh secure?# you bet it is. arguably more secure than your browser. ssh incorporates encryption and authentication via a process called public key cryptography. if that doesn’t sound secure we don’t know what does.

Strong disagree. The encryption is the easy part, the hard part is the symmetric key exchange. And PKI used by browsers is much more robust for this usecase then TOFU model of ssh. Of course the proper way to fix this is checking the ssh key fingerprint, but almost nobody does this.

Re: New startup sells coffee through SSH

#384

Post by lambdaxyzw »

SoftTalker wrote: post #341
robocat wrote: post #238

Earlier quoted context omitted.

Please avoid acronyms on HN or spell them out. We don't all live in your context. duckduckgo just says PSA is Prostate specific antigen. What did you mean?

Sorry to see this downvoted, I think it's a common courtesy to spell out acronyms on first use, no matter how widely understood one believes them to be.

I think that's because most people consider this requires unjustified. Do you think similarly about expanding acronyms like SSH, CLI, HTTP, HN, FYI, USD, US, EU, PKI? Why/why not?

Re: New startup sells coffee through SSH

#386

Post by psd1 »

KomoD wrote: post #236
Scaevolus wrote: post #68

Earlier quoted context omitted.

Yup! Cloudflare naturally advertises HTTP most heavily and it has fancier routing controls, but it supports arbitrary TCP protocols. > Cloudflare Tunnel can connect HTTP web servers, SSH servers, remote desktops, and other protocols safely to Cloudflare. https://developers.cloudflare.com/cloudflare-one/connections... > In addition to HTTP, cloudflared supports protocols like SSH, RDP, arbitrary TCP services, and Unix…

Cloudflare Tunnels only open HTTP/S to the internet, you'll need their client to reach the other protocols. More likely that this is Cloudflare Spectrum.

I don't think that's correct. I serve matrix on 8443 through a tunnel.

Re: New startup sells coffee through SSH

#387

Post by lrvick »

rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

If you want to use SSH forwarding reasonably safely, use a yubikey for ssh so you have to tap once for each hop. Now a MITM can't use your key for more hops without you physically consenting to each one.

Re: New startup sells coffee through SSH

#388

Post by lrvick »

tichiian wrote: post #67
bananskalhalk wrote: post #52

Earlier quoted context omitted.

*disable ssh agent FORWARDING. Which honestly should always be disabled. There are no trusted hosts.

That's baby+bathwater. Just use ssh-add -c to have the ssh-agent confirm every use of a key.

Or use a hardware backed ssh key you have to tap once for every use, like a Yubikey or Nitrokey.

Re: New startup sells coffee through SSH

#389

Post by KomoD »

psd1 wrote: post #386
KomoD wrote: post #236

Earlier quoted context omitted.

Cloudflare Tunnels only open HTTP/S to the internet, you'll need their client to reach the other protocols. More likely that this is Cloudflare Spectrum.

I don't think that's correct. I serve matrix on 8443 through a tunnel.

Matrix is based on HTTP...?

Cloudflare supports 2052, 2053, 2082, 2083, 2086, 2087, 2095, 2096, 443, 80, 8080, 8443, 8880 for HTTP/S https://developers.cloudflare.com/fundamentals/reference/net...

Re: New startup sells coffee through SSH

#390

Post by hultner »

StableAlkyne wrote: post #302
PaulDavisThe1st wrote: post #146

A lot of people don't know that before Amazon started, there was a company out of Portland, OR called Bookstacks selling books via a telnet interface. In the early days, Bezos was quite worried about their potential to get "there" first (wherever "there" was going to be). It was a fairly cool interface, at least for 1994. [ EDIT: worried to the point that we actually implemented a telnet version of the store in paral…

> selling books via a telnet interface. Were people just that trusting back then, or had they figured out some kind of pre-SSL way of securing things?

I can only talk from personal experience I did not trust most online payments around the turn of the millennium, but I did order quite a few things online. I usually payed either by collect on delivery or by invoice like regular good old fashioned mail-order, or by the early 00s VISA had something called e-card or similar, where you could generate a temporary one time use CC via a Java applet, this card was only valid for a day and could only be charged by a pre-determined amount, making the risk very low.
Post reply on HN