Live data from Hacker News

New startup sells coffee through SSH

terminal.shop

81–90 of 430 posts

Re: New startup sells coffee through SSH

#81
post #75

Earlier quoted context omitted.

*disable ssh agent FORWARDING. Which honestly should always be disabled. There are no trusted hosts.

> There are no trusted hosts. ...your own (headless) server that's in the same room as you, when you're using your laptop as a thin-client for it?

With all these recent exploits, I wouldn't even be 100% sure of that.

Re: New startup sells coffee through SSH

#82
post #66
post #58

Ah lame, they won't even let you browse since they're sold out.

I believe it's just a stub for collecting emails. Nothing more. Edit: somebody was able to order coffee through them (see below).

Nope! It is real, I was able to order some coffee a few days ago. Will report back on if it shows up or if it is any good :)

Re: New startup sells coffee through SSH

#83
post #76
post #66

Earlier quoted context omitted.

I believe it's just a stub for collecting emails. Nothing more. Edit: somebody was able to order coffee through them (see below).

Well I hope they enjoy getting a lot of fake emails, because that's what's gonna happen.

Many people forget that their email is included in the public key that is presented to the ssh server by default. So, the email collection form is actually somewhat redundant.

But yes, I added my share of funny email addresses to their list. Tradition is a tradition.

Re: New startup sells coffee through SSH

#84
So unless you mean to exclusively sell coffee to users who don't have a white terminal background, you may want to consider your color scheme. I was missing the white text.

(I know this is considered an atrocity by some, but I happen to not really care enough about my terminal color to change the default)

Re: New startup sells coffee through SSH

#85

Earlier quoted context omitted.

*disable ssh agent FORWARDING. Which honestly should always be disabled. There are no trusted hosts.

That's baby+bathwater. Just use ssh-add -c to have the ssh-agent confirm every use of a key.

TIL. Thanks! Gonna do wonders when working at places where I can't use a hardware key with physical confirmation of use.

My assessment still stands. Use proxyjump (-J) instead of proxy command whenever possible.

Re: New startup sells coffee through SSH

#89
post #21
post #5

Interesting. I like this. No need for a cookie banner.

they get your ssh public key which is a unique identifier so that should be disclosed.

If IIS had won the server wars, your MOTD could give you targeted ads based on exactly this. Oh, the innovation!

Re: New startup sells coffee through SSH

#90
post #19
post #5

Interesting. I like this. No need for a cookie banner.

I mean, if they somehow ported google analytics (or some other brokered PII network) I think they technically would need consent and disclosure.

They'd only need a cookie banner if they somehow could put a cookie on your machine using SSH.

Depending on how they're using any personal data you provide, they likely wouldn't need consent: for instance, if they use the personal data you provide to ship you your order, they don't need to ask (you supplied your information for the express purpose of placing an order, after all). However, if they want to do more with that data, they'd need consent.

Post reply on HN