Rendered at 09:22:00 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
3dedb728-3f77 6 hours ago [-]
Hey, is it not just a simple honeypot reverse hack ssh server?
People understand that reverse hacking can happen when connecting to random ssh server, right?
neuroticnews25 2 hours ago [-]
Prove it, I'll connect to any server you point me to, using default openssh client flags.
scubbo 5 hours ago [-]
> People understand that reverse hacking can happen when connecting to random ssh server, right?
No, actually, I've never heard of such a vector. How would that work?
jerrythegerbil 4 hours ago [-]
An ssh server would exploit a vulnerability in the ssh client when it connects.
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
applfanboysbgon 3 hours ago [-]
There has never been a real-world OpenSSH exploit that allows a server to RCE a client that connected to it without a bunch of dubious qualifiers. Connecting to a random SSH server is much, much less dangerous than running a random binary or executing a random curl install script, both of which people do all the time, and is probably about on par with the likelihood of a random website escaping your browser's sandbox and RCEing you.
lxgr 1 hours ago [-]
Agreed, bugs in the terminal emulator are probably more concerning. The attack surface of those is much larger (there are some pretty wild ANSI escape sequences, and terminal emulators are often granted pretty wide disk access permissions on systems that have them if they're also used for local development).
Oxodao 2 hours ago [-]
If you properly set up your ssh client (No agent forwarding or X11 forwarding)
LoganDark 1 hours ago [-]
Terminal, too; some escape sequences are able to perform attacks in old or buggy terminal emulators.
> To sum it up: Connecting to this server is probably fine
And what are you basing this statement on?
1 hours ago [-]
bulder 2 hours ago [-]
Agent forwarding would be pretty big, if it for example pushed your git credentials to the remote host.
krautsauer 4 hours ago [-]
Vulnerability in your ssh client (unlikely) or terminal emulator (more common but lower reach).
yjftsjthsd-h 2 hours ago [-]
Terminal emulators have, on occasion, had all kinds of interesting escape codes that I wouldn't want to expose to an attacker. Whether this is even a true "vulnerability" is somewhat a matter of opinion (in the sense that the feature works as designed, but that's maybe a bad thing).
UqWBcuFx6NV4r 14 minutes ago [-]
Try me.
bulbar 5 hours ago [-]
Is that more likely than getting hacked when visiting a website?
jolmg 4 hours ago [-]
Visiting a random website is the normal use of HTTP. With SSH, there might be assumptions of connecting to a trusted server you have an account with and likely own. It's not very normal to ssh to a random server.
teiferer 3 hours ago [-]
> likely own
I don't know how you are using ssh, but most ssh servers that I have connected to in my life, and still do, I don't own. Some of them I barely trust.
QuantumNomad_ 3 hours ago [-]
The ones I connect to the most often from my personal laptop I don’t physically own but I do pay to rent them and I installed the OS on them myself.
applfanboysbgon 6 hours ago [-]
What exactly is the mechanism by which you think that an SSH RCE is "simple"?
dlgeek 6 hours ago [-]
Not OP, but agent forwarding is a significant concern.
SXX 1 hours ago [-]
Is it enabled by default though?
AFAIK: No
jamie0 13 minutes ago [-]
It's not, but there is likely a small number people who have something like this configured:
Host *
ForwardAgent yes
boomlinde 2 hours ago [-]
If you have a slight interest in originality of presentation, whatever website copy first comes out of Claude is not there yet. Its preoccupation with "no x, no y" and annoying runs of sentence fragments might have been a punchy rhetoric for a short while before it became a tired cliché, but by now it stylistically makes it look more like you're bragging on LinkedIn than presenting something fun and creative.
I mention it because it's immediately off-putting even though the project itself sounds fun enough. It tarnishes it with the impression that maybe you just don't care, but maybe you just aren't attuned to the style and its strong slop connotations.
I'm genuinely fascinated by the problem and I've wondered what in the training process causes the model to develop this peculiar style of writing. Is it because it's trained on old Medium slop? Someone else replied with a link to their SSH-based VPS, where the copy is absolutely saturated with the same annoying style.
lxgr 1 hours ago [-]
> I've wondered what in the training process causes the model to develop this peculiar style of writing
I think this might just be inherent to the currently deployed LLM architecture. If the training process works at all, any model will come out of it with some (default) voice that it'll apply everywhere.
Human voices are not like that, both because one copywriter does not write a significant fraction of all texts in the world and because unlike LLMs they remember all of their own prior writing, which gives them an opportunity to get tired of their old tropes.
thinkingemote 50 minutes ago [-]
> what in the training process causes
Read some early pre-mass-adoption LLM papers by the key scientists and researchers. The style is very similar...
lordgrenville 54 minutes ago [-]
I don't think Claude's writing style is peculiar, it is just that we are being flooded with it. Everything becomes stale with overuse.
boomlinde 26 minutes ago [-]
I think its peculiar in that it's so limited, repetitive and undiscerning in its stylistic expression.
The stylistic elements on their own wouldn't raise an eyebrow if they appeared rarely among many other stylistic devices in order to enhance drama, suspense or emphasis, but within a single completion, Claude will sometimes implement just these two several times to express the most banal things. It ends up looking like a caricature of the worst pre-LLM Medium and LinkedIn garbage.
myzek 1 hours ago [-]
Yeah it kinda feels like a great, original meal but served on plasticware
cbarrick 7 hours ago [-]
Are we coordinating factions here, like the original r/place? The social aspect was such a big part of the original. I'll start:
# PURPLE FRAME #
Our mission is to draw a purple frame around the canvas. 2 rows of blank space between the frame and the top/bottom of the canvas. 4 cols of blank space between the frame and the left/right of the canvas.
jeninh 7 hours ago [-]
I'm wondering if there is a better way to do this. On one hand, we could just do it here but then I can't link people to this page or it'll harm the post. I could also just use a subreddit or make a forum on https://ssh.place
teiferer 3 hours ago [-]
Building in support for that into the site itself kinda goes against the spirit.
It's understandable that you as the maker want to flame the hype as much as possible, but by making it too obvious you are kinda working against that goal.
cbarrick 7 hours ago [-]
The organicness of the original was really fun. Dunno if coordinating here really fits the HN vibe, but also go where the people are.
jeninh 6 hours ago [-]
I'm just wondering what to do when this post dies down. Then I guess I could link to it... It's not like it's going to go back to the front page anyways
cbarrick 7 hours ago [-]
I can't see my cursor if it is placed on top of a cell that has already been colored.
jeninh 7 hours ago [-]
Oops. I'll fix that right now
Heliodex 5 hours ago [-]
Nice, I first saw this on Hack Club ;) Check your terminal to see if it supports certain colours, on mine the darker and lighter colours (eg. maroon/red, purple/magenta) look identical.
dhotson 46 minutes ago [-]
Hah nice! I made something a bit like this too:
ssh paint.dn.ht
It's using kitty/iTerm2/Ghostty image placement + pixel mouse reporting support for drawing.
..and for more fun:
ssh ski.dn.ht
:-)
bestony 7 hours ago [-]
So cool! If I wanted to make a similar product, how should I do it? Do you have any advice or research directions? I saw a company using SSH for hiring a couple of days ago, and I thought it was really cool. I also want to build something similar.
jeninh 6 hours ago [-]
I'm going to be so honest, I don't have much advice for you. I'm a teenager who's part of Hack Club (https://hackclub.com) who made this entirely for fun.
I was inspired by @zachlatta's SSHtron (https://github.com/zachlatta/sshtron) and wanted to make an SSH game. I loved how easy it was for him to promote it too, he made a HN post with title "ssh sshtron.zachlatta.com" because it gets people to try out the actual game rather than look at a README. If you have a business, find something useful that would help! Or in my case, find something fun you want to make/remake to be used in the terminal over SSH. Hack Club also used to have a hiring page over SSH, if I recall correctly.
This sounds like a recipe for bots that bypass the cooldown...
jeninh 8 hours ago [-]
I also have limits for IP and device + some other factors :) The full details are in the README on GitHub. But also I don't expect too many people to find this, it's one of my first public projects. If we do get a surge of people then I'll implement something better.
;; communications error to 2001:470:4b:27e:8::#53: timed out
nickzelei 7 hours ago [-]
Shellbox looks really cool! I love the proliferation of ssh apps lately…
Ever since I saw the terminal coffee I’ve been inspired. I’ve been working on https://billard.sh myself for a bit.
jeninh 7 hours ago [-]
Shellbox is so sick!!! I'm going to look into implementing it into a project I'm working on.
BetterThanSober 6 hours ago [-]
Parked means the storage is kept, right?
messh 5 hours ago [-]
Yes, storage and memory/processes. It is basically suspended, not running
I understand that most people don't use it and indeed rely on tofu, but the statement is not absolutely correct.
ssh server keys can be authenticated using (the DNSSEC "CA" system and) SSHFP, and it's possible to setup a signing CA for the host key (similar to ssh certificates, however not applicable for foreign servers).
And of course, the fingerprint could be advertised out of band e.g. on the homepage with tls
raggi 2 hours ago [-]
sshfp is not PKI. It's an option and it is off by default in ssh(1). In practice no one actually deploys it, exe.dev, terminal.shop, jobs.{whoever.com}, etc. I've yet to see an in the wild deployment. The aforementioned sites let you perform electronic payment transactions over ssh without it, which is probably a PCI violation tbh, but auditors aren't good enough.
webpki is on by default.
pzacik 5 hours ago [-]
Yes, but what exactly would an attacker achieve by doing mitm here?
raggi 2 hours ago [-]
here, less than most, but look for ssh agents
on terminal.shop, steal credit cards
on jobs endpoints, perform identity theft
on exe.dev, whatever you put on there
rvz 2 hours ago [-]
Agreed. Amid all this hype, once again we continue to see such disregard for basic security implications and using ssh outside it's intended use-case; especially sshing into random servers.
Now we wait for the discovery of an RCE, key leakage vulnerability or a security bypass that leads to a trivial mitm attack to magnify why ssh apps make no sense security wise.
People understand that reverse hacking can happen when connecting to random ssh server, right?
No, actually, I've never heard of such a vector. How would that work?
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
And what are you basing this statement on?
I don't know how you are using ssh, but most ssh servers that I have connected to in my life, and still do, I don't own. Some of them I barely trust.
AFAIK: No
I mention it because it's immediately off-putting even though the project itself sounds fun enough. It tarnishes it with the impression that maybe you just don't care, but maybe you just aren't attuned to the style and its strong slop connotations.
I'm genuinely fascinated by the problem and I've wondered what in the training process causes the model to develop this peculiar style of writing. Is it because it's trained on old Medium slop? Someone else replied with a link to their SSH-based VPS, where the copy is absolutely saturated with the same annoying style.
I think this might just be inherent to the currently deployed LLM architecture. If the training process works at all, any model will come out of it with some (default) voice that it'll apply everywhere.
Human voices are not like that, both because one copywriter does not write a significant fraction of all texts in the world and because unlike LLMs they remember all of their own prior writing, which gives them an opportunity to get tired of their old tropes.
Read some early pre-mass-adoption LLM papers by the key scientists and researchers. The style is very similar...
The stylistic elements on their own wouldn't raise an eyebrow if they appeared rarely among many other stylistic devices in order to enhance drama, suspense or emphasis, but within a single completion, Claude will sometimes implement just these two several times to express the most banal things. It ends up looking like a caricature of the worst pre-LLM Medium and LinkedIn garbage.
# PURPLE FRAME #
Our mission is to draw a purple frame around the canvas. 2 rows of blank space between the frame and the top/bottom of the canvas. 4 cols of blank space between the frame and the left/right of the canvas.
It's understandable that you as the maker want to flame the hype as much as possible, but by making it too obvious you are kinda working against that goal.
..and for more fun:
:-)I was inspired by @zachlatta's SSHtron (https://github.com/zachlatta/sshtron) and wanted to make an SSH game. I loved how easy it was for him to promote it too, he made a HN post with title "ssh sshtron.zachlatta.com" because it gets people to try out the actual game rather than look at a README. If you have a business, find something useful that would help! Or in my case, find something fun you want to make/remake to be used in the terminal over SSH. Hack Club also used to have a hiring page over SSH, if I recall correctly.
My code uses wish, bubbletea and lipgloss from Charm. You can look at the code over at https://github.com/jeninh/ssh.place
Good luck!
This sounds like a recipe for bots that bypass the cooldown...
ssh applicant@register.public.outband.net
The web page https://www.public.outband.net hosted on the same box, if you can see it you have the needed ip6.
No users yet but feel free to try it out.
;; communications error to 2001:470:4b:27e:8::#53: timed out
https://en.wikipedia.org/wiki/Man-in-the-middle_attack
https://en.wikipedia.org/wiki/Trust_on_first_use
ssh server keys can be authenticated using (the DNSSEC "CA" system and) SSHFP, and it's possible to setup a signing CA for the host key (similar to ssh certificates, however not applicable for foreign servers). And of course, the fingerprint could be advertised out of band e.g. on the homepage with tls
webpki is on by default.
on terminal.shop, steal credit cards on jobs endpoints, perform identity theft on exe.dev, whatever you put on there
Now we wait for the discovery of an RCE, key leakage vulnerability or a security bypass that leads to a trivial mitm attack to magnify why ssh apps make no sense security wise.