Rendered at 05:28:48 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
cbarrick 3 hours ago [-]
Are we coordinating factions here, like the original r/place? The social aspect was such a big part of the original. I'll start:
# PURPLE FRAME #
Our mission is to draw a purple frame around the canvas. 2 rows of blank space between the frame and the top/bottom of the canvas. 4 cols of blank space between the frame and the left/right of the canvas.
jeninh 3 hours ago [-]
I'm wondering if there is a better way to do this. On one hand, we could just do it here but then I can't link people to this page or it'll harm the post. I could also just use a subreddit or make a forum on https://ssh.place
cbarrick 3 hours ago [-]
The organicness of the original was really fun. Dunno if coordinating here really fits the HN vibe, but also go where the people are.
jeninh 2 hours ago [-]
I'm just wondering what to do when this post dies down. Then I guess I could link to it... It's not like it's going to go back to the front page anyways
3dedb728-3f77 2 hours ago [-]
Hey, is it not just a simple honeypot reverse hack ssh server?
People understand that reverse hacking can happen when connecting to random ssh server, right?
scubbo 47 minutes ago [-]
> People understand that reverse hacking can happen when connecting to random ssh server, right?
No, actually, I've never heard of such a vector. How would that work?
jerrythegerbil 17 minutes ago [-]
An ssh server would exploit a vulnerability in the ssh client when it connects.
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
krautsauer 24 minutes ago [-]
Vulnerability in your ssh client (unlikely) or terminal emulator (more common but lower reach).
bulbar 1 hours ago [-]
Is that more likely than getting hacked when visiting a website?
jolmg 15 minutes ago [-]
Visiting a random website is the normal use of HTTP. With SSH, there might be assumptions of connecting to a trusted server you have an account with and likely own. It's not very normal to ssh to a random server.
applfanboysbgon 2 hours ago [-]
What exactly is the mechanism by which you think that an SSH RCE is "simple"?
dlgeek 2 hours ago [-]
Not OP, but agent forwarding is a significant concern.
Heliodex 50 minutes ago [-]
Nice, I first saw this on Hack Club ;) Check your terminal to see if it supports certain colours, on mine the darker and lighter colours (eg. maroon/red, purple/magenta) look identical.
koolala 40 minutes ago [-]
Wish we had a WebSSH like WebSockets / IRC v3.
cbarrick 3 hours ago [-]
I can't see my cursor if it is placed on top of a cell that has already been colored.
jeninh 3 hours ago [-]
Oops. I'll fix that right now
bestony 3 hours ago [-]
So cool! If I wanted to make a similar product, how should I do it? Do you have any advice or research directions? I saw a company using SSH for hiring a couple of days ago, and I thought it was really cool. I also want to build something similar.
jeninh 3 hours ago [-]
I'm going to be so honest, I don't have much advice for you. I'm a teenager who's part of Hack Club (https://hackclub.com) who made this entirely for fun.
I was inspired by @zachlatta's SSHtron (https://github.com/zachlatta/sshtron) and wanted to make an SSH game. I loved how easy it was for him to promote it too, he made a HN post with title "ssh sshtron.zachlatta.com" because it gets people to try out the actual game rather than look at a README. If you have a business, find something useful that would help! Or in my case, find something fun you want to make/remake to be used in the terminal over SSH. Hack Club also used to have a hiring page over SSH, if I recall correctly.
This sounds like a recipe for bots that bypass the cooldown...
jeninh 4 hours ago [-]
I also have limits for IP and device + some other factors :) The full details are in the README on GitHub. But also I don't expect too many people to find this, it's one of my first public projects. If we do get a surge of people then I'll implement something better.
Shellbox looks really cool! I love the proliferation of ssh apps lately…
Ever since I saw the terminal coffee I’ve been inspired. I’ve been working on https://billard.sh myself for a bit.
jeninh 3 hours ago [-]
Shellbox is so sick!!! I'm going to look into implementing it into a project I'm working on.
Yes, storage and memory/processes. It is basically suspended, not running
fragmede 3 hours ago [-]
and funky.nondeterministic.computer
quietsegfault 4 hours ago [-]
Make sure to not be forwarding ssh agents! :)
erikschoster 3 hours ago [-]
This is fun, I tried to draw a flower but it sucks.
jeninh 3 hours ago [-]
It's a pretty flower :-) I hope it wasn't you who put that red line through it
erikschoster 3 hours ago [-]
lol no someone else did that while i was drawing it. thanks :)
jeninh 2 hours ago [-]
Aww...
mplewis 2 hours ago [-]
Takes all the fun out of it when people are multiboxing for the sake of posting an advertisement. Oh well.
raggi 2 hours ago [-]
Time for your regular reminder that ssh has no PKI and is trivial to mitm during tofu.
kro 45 minutes ago [-]
I understand that most people don't use it and indeed rely on tofu, but the statement is not absolutely correct.
ssh server keys can be authenticated using (the DNSSEC "CA" system and) SSHFP, and it's possible to setup a signing CA for the host key (similar to ssh certificates, however not applicable for foreign servers).
And of course, the fingerprint could be advertised out of band e.g. on the homepage with tls
pzacik 54 minutes ago [-]
Yes, but what exactly would an attacker achieve by doing mitm here?
# PURPLE FRAME #
Our mission is to draw a purple frame around the canvas. 2 rows of blank space between the frame and the top/bottom of the canvas. 4 cols of blank space between the frame and the left/right of the canvas.
People understand that reverse hacking can happen when connecting to random ssh server, right?
No, actually, I've never heard of such a vector. How would that work?
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
I was inspired by @zachlatta's SSHtron (https://github.com/zachlatta/sshtron) and wanted to make an SSH game. I loved how easy it was for him to promote it too, he made a HN post with title "ssh sshtron.zachlatta.com" because it gets people to try out the actual game rather than look at a README. If you have a business, find something useful that would help! Or in my case, find something fun you want to make/remake to be used in the terminal over SSH. Hack Club also used to have a hiring page over SSH, if I recall correctly.
My code uses wish, bubbletea and lipgloss from Charm. You can look at the code over at https://github.com/jeninh/ssh.place
Good luck!
This sounds like a recipe for bots that bypass the cooldown...
ssh applicant@register.public.outband.net
The web page https://www.public.outband.net hosted on the same box, if you can see it you have the needed ip6.
No users yet but feel free to try it out.
ssh server keys can be authenticated using (the DNSSEC "CA" system and) SSHFP, and it's possible to setup a signing CA for the host key (similar to ssh certificates, however not applicable for foreign servers). And of course, the fingerprint could be advertised out of band e.g. on the homepage with tls