how is "curl https://www.teleconsole.com/get.sh | sh " Still considered even a remotely acceptable method for installation?
this just scares me: if they think this is acceptable, have they thought about security elsewhere?
Show HN: Invite friends to SSH into your laptop using their GitHub handle
41–50 of 105 posts
Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle
#42Hmm. Seems like all traffic goes through a central proxy server. Shouldn't it be possible to use the central server only for hole-punching and implement a TCP-over-UDP connection so that the clients can directly communicate with each other? (And don't the major browser vendors already have public NAT-hole-punchers for WebRTC?)
"Hmm. Seems like all traffic goes through a central proxy server."
My first thought.
Also, the server and code may be secure, the weakest point is a person. cf: "You can share the Session URL with a colleague in your organization. Assuming that your colleague has access to teleport.example.com proxy, she will be able to join and help you troubleshoot the problem on "db" in her browser." ~ http://gravitational.com/teleport/docs/quickstart/
Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle
#43how is "curl https://www.teleconsole.com/get.sh | sh " Still considered even a remotely acceptable method for installation?
What's wrong with it?
If you're claiming that you don't get the ability to audit the code, I'd like to watch you audit a ./configure shell script generated by GNU autoconf.
If you're claiming that you want to apt-get install so the package maintainer has audited the code, I'd like to watch them audit the ./configure shell script.
Downloading and auditing code from an untrusted source is security theatre. Don't install it at all, if you don't trust it. Or use some platform (the web, iOS, Android, Qubes, etc.) that makes it such that there's no need to audit it because the app is restricted in what it can do.
Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle
#44how is "curl https://www.teleconsole.com/get.sh | sh " Still considered even a remotely acceptable method for installation?
Can you explain to me the fundamental difference between this and sudo apt-get install?
Note that the curl command is on an https resource. Yes if the https server is compromised there's a problem, but that's true with any other delivery method.
I'm being facetious as the answer is there isn't one
Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle
#45You can use SSH keys for VNC, too. Would be neat to see a PoC that allowed you to invite someone to remote control your computer temporarily via their github handle. https://ubuntuforums.org/showthread.php?t=383053
Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle
#46how is "curl https://www.teleconsole.com/get.sh | sh " Still considered even a remotely acceptable method for installation?
this just scares me: if they think this is acceptable, have they thought about security elsewhere?
Unless I misunderstood their description, they can man-in-the-middle for the disposable keys use-case anyway. If you don't trust them, don't use the software. I don't really mind having curl|sh installation instructions as long as they use https and the script is written so that truncated downloads don't cause any harm. If you know that this is a risky way of installing software, nothing prevents you from manually verifying the installation script or following the manual installation instructions. Everyone else probably doesn't have the means to properly evaluate the downloaded software anyways.
Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle
#47> ssh-import-I'd gh:my-gh-name That little command will pull down your GitHub public keys and add them to authorized key file for the user who runs it. Great for setting up new computers. I run it on boot-time for imbedded devices so that I can always access them.
I didn't know about this, looks really useful, thanks. I wonder if there are any plans to add other protocols e.g. Keybase.
Edit. Seems they are way ahead of me: https://github.com/dustinkirkland/ssh-import-id/blob/master/...
Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle
#48how is "curl https://www.teleconsole.com/get.sh | sh " Still considered even a remotely acceptable method for installation?
Can you explain to me the fundamental difference between this and sudo apt-get install? Note that the curl command is on an https resource. Yes if the https server is compromised there's a problem, but that's true with any other delivery method. I'm being facetious as the answer is there isn't one
[deleted]
Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle
#49how is "curl https://www.teleconsole.com/get.sh | sh " Still considered even a remotely acceptable method for installation?
Can you explain to me the fundamental difference between this and sudo apt-get install? Note that the curl command is on an https resource. Yes if the https server is compromised there's a problem, but that's true with any other delivery method. I'm being facetious as the answer is there isn't one
>Yes if the https server is compromised there's a problem, but that's true with any other delivery method.
That's not correct. In most distros, installing packages from your distro's repositories has an additional security guarantee: the packages you download have their PGP signatures verified before installation. If an attacker compromises the web server and alters the package, your package manager will reject it as it's not signed by a trusted key in your keyring.
Re: Show HN: Invite friends to SSH into your laptop using their GitHub handle
#50Hey HN - This is basically a hosted version of Teleport[0], which may scare some people. We don't store the sessions and you can always self-host if you prefer. [0] http://gravitational.com/teleport/
> We don't store the sessions
Interesting - but how can we trust you?