15 comments

  • boomlinde22 minutes ago
    If you have a slight interest in originality of presentation, whatever website copy first comes out of Claude is not there yet. Its preoccupation with &quot;no x, no y&quot; and annoying runs of sentence fragments might have been a punchy rhetoric for a short while before it became a tired cliché, but by now it stylistically makes it look more like you&#x27;re bragging on LinkedIn than presenting something fun and creative.<p>I mention it because it&#x27;s immediately off-putting even though the project itself sounds fun enough. It tarnishes it with the impression that maybe you just don&#x27;t care, but maybe you just aren&#x27;t attuned to the style and its strong slop connotations.<p>I&#x27;m genuinely fascinated by the problem and I&#x27;ve wondered what in the training process causes the model to develop this peculiar style of writing. Is it because it&#x27;s trained on old Medium slop? Someone else replied with a link to their SSH-based VPS, where the copy is absolutely saturated with the same annoying style.
  • 3dedb728-3f773 hours ago
    Hey, is it not just a simple honeypot reverse hack ssh server?<p>People understand that reverse hacking can happen when connecting to random ssh server, right?
    • neuroticnews257 minutes ago
      Prove it, I&#x27;ll connect to any server you point me to, using default openssh client flags.
    • scubbo2 hours ago
      &gt; People understand that reverse hacking can happen when connecting to random ssh server, right?<p>No, actually, I&#x27;ve never heard of such a vector. How would that work?
      • bulder8 minutes ago
        Agent forwarding would be pretty big, if it for example pushed your git credentials to the remote host.
      • jerrythegerbil2 hours ago
        An ssh server would exploit a vulnerability in the ssh client when it connects.<p>For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.<p>To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
        • applfanboysbgon1 hour ago
          There has never been a real-world OpenSSH exploit that allows a server to RCE a client that connected to it without a bunch of dubious qualifiers. Connecting to a random SSH server is much, much less dangerous than running a random binary or executing a random curl install script, both of which people do all the time, and is probably about on par with the likelihood of a random website escaping your browser&#x27;s sandbox and RCEing you.
          • Oxodao25 minutes ago
            If you properly set up your ssh client (No agent forwarding or X11 forwarding)
        • teiferer1 hour ago
          &gt; To sum it up: Connecting to this server is probably fine<p>And what are you basing this statement on?
      • krautsauer2 hours ago
        Vulnerability in your ssh client (unlikely) or terminal emulator (more common but lower reach).
    • bulbar3 hours ago
      Is that more likely than getting hacked when visiting a website?
      • jolmg2 hours ago
        Visiting a random website is the normal use of HTTP. With SSH, there might be assumptions of connecting to a trusted server you have an account with and likely own. It&#x27;s not very normal to ssh to a random server.
        • teiferer1 hour ago
          &gt; likely own<p>I don&#x27;t know how you are using ssh, but most ssh servers that I have connected to in my life, and still do, I don&#x27;t own. Some of them I barely trust.
          • QuantumNomad_45 minutes ago
            The ones I connect to the most often from my personal laptop I don’t physically own but I do pay to rent them and I installed the OS on them myself.
    • applfanboysbgon3 hours ago
      What exactly is the mechanism by which you think that an SSH RCE is &quot;simple&quot;?
      • dlgeek3 hours ago
        Not OP, but agent forwarding is a significant concern.
  • cbarrick4 hours ago
    Are we coordinating factions here, like the original r&#x2F;place? The social aspect was such a big part of the original. I&#x27;ll start:<p># PURPLE FRAME #<p>Our mission is to draw a purple frame around the canvas. 2 rows of blank space between the frame and the top&#x2F;bottom of the canvas. 4 cols of blank space between the frame and the left&#x2F;right of the canvas.
    • jeninh4 hours ago
      I&#x27;m wondering if there is a better way to do this. On one hand, we could just do it here but then I can&#x27;t link people to this page or it&#x27;ll harm the post. I could also just use a subreddit or make a forum on <a href="https:&#x2F;&#x2F;ssh.place" rel="nofollow">https:&#x2F;&#x2F;ssh.place</a>
      • teiferer1 hour ago
        Building in support for that into the site itself kinda goes against the spirit.<p>It&#x27;s understandable that you as the maker want to flame the hype as much as possible, but by making it too obvious you are kinda working against that goal.
      • cbarrick4 hours ago
        The organicness of the original was really fun. Dunno if coordinating here really fits the HN vibe, but also go where the people are.
        • jeninh4 hours ago
          I&#x27;m just wondering what to do when this post dies down. Then I guess I could link to it... It&#x27;s not like it&#x27;s going to go back to the front page anyways
  • cbarrick5 hours ago
    I can&#x27;t see my cursor if it is placed on top of a cell that has already been colored.
    • jeninh5 hours ago
      Oops. I&#x27;ll fix that right now
  • Heliodex2 hours ago
    Nice, I first saw this on Hack Club ;) Check your terminal to see if it supports certain colours, on mine the darker and lighter colours (eg. maroon&#x2F;red, purple&#x2F;magenta) look identical.
  • koolala2 hours ago
    Wish we had a WebSSH like WebSockets &#x2F; IRC v3.
  • Retr0id5 hours ago
    &gt; Your cooldown is tied to your SSH key<p>This sounds like a recipe for bots that bypass the cooldown...
    • jeninh5 hours ago
      I also have limits for IP and device + some other factors :) The full details are in the README on GitHub. But also I don&#x27;t expect too many people to find this, it&#x27;s one of my first public projects. If we do get a surge of people then I&#x27;ll implement something better.
  • messh5 hours ago
    I love ssh apps! See also late.sh, and my own <a href="https:&#x2F;&#x2F;shellbox.dev" rel="nofollow">https:&#x2F;&#x2F;shellbox.dev</a>
    • somat3 hours ago
      Mine is hard to get to(ip6 only) but was started around the idea of a shared postgres database.<p>ssh applicant@register.public.outband.net<p>The web page <a href="https:&#x2F;&#x2F;www.public.outband.net" rel="nofollow">https:&#x2F;&#x2F;www.public.outband.net</a> hosted on the same box, if you can see it you have the needed ip6.<p>No users yet but feel free to try it out.
    • nickzelei4 hours ago
      Shellbox looks really cool! I love the proliferation of ssh apps lately… Ever since I saw the terminal coffee I’ve been inspired. I’ve been working on <a href="https:&#x2F;&#x2F;billard.sh" rel="nofollow">https:&#x2F;&#x2F;billard.sh</a> myself for a bit.
    • jeninh5 hours ago
      Shellbox is so sick!!! I&#x27;m going to look into implementing it into a project I&#x27;m working on.
    • qudat3 hours ago
      another one: <a href="https:&#x2F;&#x2F;pico.sh" rel="nofollow">https:&#x2F;&#x2F;pico.sh</a>
    • BetterThanSober3 hours ago
      Parked means the storage is kept, right?
      • messh2 hours ago
        Yes, storage and memory&#x2F;processes. It is basically suspended, not running
    • fragmede5 hours ago
      and funky.nondeterministic.computer
  • bestony4 hours ago
    So cool! If I wanted to make a similar product, how should I do it? Do you have any advice or research directions? I saw a company using SSH for hiring a couple of days ago, and I thought it was really cool. I also want to build something similar.
    • jeninh4 hours ago
      I&#x27;m going to be so honest, I don&#x27;t have much advice for you. I&#x27;m a teenager who&#x27;s part of Hack Club (<a href="https:&#x2F;&#x2F;hackclub.com" rel="nofollow">https:&#x2F;&#x2F;hackclub.com</a>) who made this entirely for fun.<p>I was inspired by @zachlatta&#x27;s SSHtron (<a href="https:&#x2F;&#x2F;github.com&#x2F;zachlatta&#x2F;sshtron" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;zachlatta&#x2F;sshtron</a>) and wanted to make an SSH game. I loved how easy it was for him to promote it too, he made a HN post with title &quot;ssh sshtron.zachlatta.com&quot; because it gets people to try out the actual game rather than look at a README. If you have a business, find something useful that would help! Or in my case, find something fun you want to make&#x2F;remake to be used in the terminal over SSH. Hack Club also used to have a hiring page over SSH, if I recall correctly.<p>My code uses wish, bubbletea and lipgloss from Charm. You can look at the code over at <a href="https:&#x2F;&#x2F;github.com&#x2F;jeninh&#x2F;ssh.place" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;jeninh&#x2F;ssh.place</a><p>Good luck!
  • quietsegfault5 hours ago
    Make sure to not be forwarding ssh agents! :)
  • erikschoster5 hours ago
    This is fun, I tried to draw a flower but it sucks.
    • jeninh5 hours ago
      It&#x27;s a pretty flower :-) I hope it wasn&#x27;t you who put that red line through it
      • erikschoster4 hours ago
        lol no someone else did that while i was drawing it. thanks :)
  • mplewis3 hours ago
    Takes all the fun out of it when people are multiboxing for the sake of posting an advertisement. Oh well.
  • buffer_overlord4 hours ago
    ssh join@bbs.profullstack.com
  • raggi3 hours ago
    Time for your regular reminder that ssh has no PKI and is trivial to mitm during tofu.
    • kro2 hours ago
      I understand that most people don&#x27;t use it and indeed rely on tofu, but the statement is not absolutely correct.<p>ssh server keys can be authenticated using (the DNSSEC &quot;CA&quot; system and) SSHFP, and it&#x27;s possible to setup a signing CA for the host key (similar to ssh certificates, however not applicable for foreign servers). And of course, the fingerprint could be advertised out of band e.g. on the homepage with tls
      • raggi14 minutes ago
        sshfp is not PKI. It&#x27;s an option and it is off by default in ssh(1). In practice no one actually deploys it, exe.dev, terminal.shop, jobs.{whoever.com}, etc. I&#x27;ve yet to see an in the wild deployment. The aforementioned sites let you perform electronic payment transactions over ssh without it, which is probably a PCI violation tbh, but auditors aren&#x27;t good enough.<p>webpki is on by default.
    • pzacik2 hours ago
      Yes, but what exactly would an attacker achieve by doing mitm here?
      • raggi20 minutes ago
        here, less than most, but look for ssh agents<p>on terminal.shop, steal credit cards on jobs endpoints, perform identity theft on exe.dev, whatever you put on there
  • cdelsolar3 hours ago
    aw it didn&#x27;t work with kitty. i get logged out.