ref: https://pico.sh/irc
ssh chat.shazow.net
Discussion at the time:
https://news.ycombinator.com/item?id=8743374
Source code in GitHub repo here:
I would love to hear more about this
Any idea what we could do to allow all of the people still in Dubai to join chats over ssh too?
Workaround: Specify another ssh keypair
Additionally you should disable SSH forwarding. Relevant thread from the startup selling coffee over SSH: https://news.ycombinator.com/item?id=40227624
Is there a usable description somewhere on how to do this safely?
It’s amazing how simple some things are. Similarly, an HTTP server can also run any old binary in response to an incoming request. As long as it produces output that looks like an HTTP response, the client will receive that response.
Disclaimer: I build a personal social web server https://seppo.social like that on top of shared (apache) hosting requiring no root privileges to install and run.
Or with a few lines of sh you can turn many cli tools to web services like https://qr.mro.name/
I once wrote a similar chat, but much much worse in many ways, that could easily handle thousands of concurrent users, but hosted it on a 1mbit residential line. When Slashdot hit it I stood no chance.
ssh -o 'ForwardAgent no' $host
You can see what it looks like here: https://www.youtube.com/watch?v=_bAx4Jx39jE&t=384s
(it's the widget in the bottom right of the screen)
I use it for funky.nondeterministic.computer
I created a throwaway ed25519 key, reconfigured ssh config, and tried to connect with ‘ssh chat’
Nothing loads. ‘ssh -v chat’ isn’t helpful either. ping and nc (on both 22 and 443) show the server (or load balancer) is accessible for me.
Maybe a “hnfp DoS” (hacker news front page DoS)?
also noticed that people were able to run commands but permission denied. that kinda freaked me out. eventually somebody is going to figure out how to escape the go binary
But unless I'm missing something, what's the difference between this and IRC?
PORT STATE SERVICE
22/tcp closed ssh
Nmap done: 1 IP address (1 host up) scanned in 1.18 seconds
----
overloaded?
Irc have exange data between server and minimalize data trafic.
still irc is better, but meybe in future
An old, old Internet protocol that was used to get information on a user, and could be used by users to post updates from their .plan files. Essentially plaintext social media for people with Internet connections in the 80s and (early-ish) 90s.
I'm glad your reaction was to assist the young folks. :)
- terminal emulators are not security hardened clients against malicious actors
- ssh lacks PKI and is inconvenient so users never do prekeying in practice, so it's TOFU / zero server assertion in most practical cases (i.e. easy to mitm)
- ssh channel features are a constant concern, for server resources and for client features like agents, agents are easy to disable
- most ssh implementations don't scale that well, it wasn't ever really a goal to do so
- there are few tools for auditing and monitoring, unlike the common protocols/services/clients
ssh-keygen (1):
ssh-keygen supports signing of keys to produce certificates that may be used for user or host authentication.
Certificates consist of a public key, some identity information, zero or more principal (user or host) names and
a set of options that are signed by a Certification Authority (CA) key. Clients or servers may then trust only
the CA key and verify its signature on a certificate rather than trusting many user/host keys. Note that
OpenSSH certificates are a different, and much simpler, format to the X.509 certificates used in ssl(8)https://gitlab.com/secsh/pkixssh
http://tech.ciges.net/blog/openssh-with-x509-certificates-ho...
Right now I'd stick with something like Gravitational Teleport (overkill); Warpgate may become the perfect fit for this niche soon.
https://github.com/warp-tech/warpgate
It's also worth knowing about SSH clients that can use X.509 certificate keys as normal pre-shared keys with any SSH server, like PuttyCAC and built-in for macOS High Sierra and later.
While it supports serial numbers, expiration dates and key revocation lists, it does not allow certificate chaining. That means whoever signs keys for end users has implicit access to the master key.
https://github.com/anacrolix/btlink https://github.com/anacrolix/dht
command="/usr/bin/foo" ssh-ed25519 AAAA....No it wont! The specified command might provide sftp, scp, telnet or stream a film.