People understand that reverse hacking can happen when connecting to random ssh server, right?
The risk is far, far lower than browsing the internet. Unlike the massive surface of a browser and all the libraries and processes it is comprised of, the OpenSSH client is a tiny, with a singular purpose, contained in a small and very well-vetted codebase.
From the perspective of connecting to a foreign network service, the OpenSSH client is about the safest thing you can possibly use. Note the use of relative words here - not claiming it is 100% bug-free.
(The main caveat is that you can manually configure the client to do unsafe things, like writing a configuration by hand that enables X forwarding or agent forwarding by default for any host - but you can also actively disable sandboxing in your web browser or run everything as root, and we will never be able to stop you from actively making things insecure.)
For comparison, the surface exposed by your browser rendering this text controlled entirely by an adversary (me) is considerably greater as it also interacts with the style system, content reflow, javascript engine (even for non-javascript websites), etc.
No, actually, I've never heard of such a vector. How would that work?
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
Went to Alacritty. No mentions of security.
Went to Ghostty. No mentions of security, except for "secure keyboard entry".
None have a "security policy" on GitHub.
All written in memory unsafe languages (C, Zig).
Of course the other abouts that you whatted (such as random curl install scripts, binaries, etc.) are still more dangerous.
> The integer overflow provides uncontrolled access to the heap, which reliably crashes the client process but is unlikely to achieve remote code execution in practice. Weaponizing the overflow for code execution would require a separate information disclosure vulnerability to defeat ASLR, along with a specific heap layout to place exploitable structures adjacent to the undersized allocation.
---
> abouts that you whatted
"Whataboutism" is perhaps the most infuriating and wildly misused word in the English language. Pointing out that somebody is scaremongering about an action that is significantly less dangerous than other everyday actions people take on their computers is not a fallacy. It is directly relevant to evaluating risk. Yes, technically there could be some critical bug that allows the posited thing to happen, but in reality it just doesn't happen. If it did happen, nobody would blow their once-in-decades exploit on pranking some people on a forum.
has there ever been an example of such a vulnerability in openssh?
And what are you basing this statement on?
https://www.cve.org/CVERecord?id=CVE-2026-60002
As I understood this, a malicious server can change its host key somewhere during key exchange and trigger a use-after-free in the client, which might be exploitable for code execution.
Weird that you can't just say that you are not doing it.
Regarding empirical data, that would certainly be interesting, not sure if RCE is the only category one would look at in that case.
I don't know how you are using ssh, but most ssh servers that I have connected to in my life, and still do, I don't own. Some of them I barely trust.
AFAIK: No
Host *
ForwardAgent yesAlso my terminal (Ubuntu in WSL2) had an ugly colour palette defined by default with several identical colours. I'm glad I found out!
Use this to check yours:
for i in {0..15}; do
printf "\e[48;5;%dm %2d \e[0m " "$i" "$i"; (( (i + 1) % 8 == 0 )) && echo;
done
I mention it because it's immediately off-putting even though the project itself sounds fun enough. It tarnishes it with the impression that maybe you just don't care, but maybe you just aren't attuned to the style and its strong slop connotations.
I'm genuinely fascinated by the problem and I've wondered what in the training process causes the model to develop this peculiar style of writing. Is it because it's trained on old Medium slop? Someone else replied with a link to their SSH-based VPS, where the copy is absolutely saturated with the same annoying style.
I think this might just be inherent to the currently deployed LLM architecture. If the training process works at all, any model will come out of it with some (default) voice that it'll apply everywhere.
Human voices are not like that, both because one copywriter does not write a significant fraction of all texts in the world and because unlike LLMs they remember all of their own prior writing, which gives them an opportunity to get tired of their old tropes.
Why do they specifically push for this voice? Because it is effective. This is "headline voice", the voice that gets people to endlessly click on Youtube clickbait and garbage articles. Most of the population gets a dopamine hit from this style of writing, making it legitimately addicting to them. Those who recognize it for what it is and find it insufferably grating are in a tiny, tiny minority.
The tiny minorities are the people who are too dumb to notice, and on the other end, the people who can still sift through robot-made clickbait the same way they were wading through human-made clickbait before.
The stylistic elements on their own wouldn't raise an eyebrow if they appeared rarely among many other stylistic devices in order to enhance drama, suspense or emphasis, but within a single completion, Claude will sometimes implement just these two several times to express the most banal things. It ends up looking like a caricature of the worst pre-LLM Medium and LinkedIn garbage.
Read some early pre-mass-adoption LLM papers by the key scientists and researchers. The style is very similar...
# PURPLE FRAME #
Our mission is to draw a purple frame around the canvas. 2 rows of blank space between the frame and the top/bottom of the canvas. 4 cols of blank space between the frame and the left/right of the canvas.
It's understandable that you as the maker want to flame the hype as much as possible, but by making it too obvious you are kinda working against that goal.
ssh applicant@register.public.outband.net
The web page https://www.public.outband.net hosted on the same box, if you can see it you have the needed ip6.
No users yet but feel free to try it out.
;; communications error to 2001:470:4b:27e:8::#53: timed out
I was inspired by @zachlatta's SSHtron (https://github.com/zachlatta/sshtron) and wanted to make an SSH game. I loved how easy it was for him to promote it too, he made a HN post with title "ssh sshtron.zachlatta.com" because it gets people to try out the actual game rather than look at a README. If you have a business, find something useful that would help! Or in my case, find something fun you want to make/remake to be used in the terminal over SSH. Hack Club also used to have a hiring page over SSH, if I recall correctly.
My code uses wish, bubbletea and lipgloss from Charm. You can look at the code over at https://github.com/jeninh/ssh.place
Good luck!
This sounds like a recipe for bots that bypass the cooldown...
ssh paint.dn.ht
..and for more fun:
ssh ski.dn.ht
ssh server keys can be authenticated using (the DNSSEC "CA" system and) SSHFP, and it's possible to setup a signing CA for the host key (similar to ssh certificates, however not applicable for foreign servers). And of course, the fingerprint could be advertised out of band e.g. on the homepage with tls
webpki is on by default.
Now we wait for the discovery of an RCE, key leakage vulnerability or a security bypass that leads to a trivial mitm attack to magnify why ssh apps make no sense security wise.
When I last harassed Crawshaw about this and we discussed bits, he submitted https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts....
Unfortunately neither of us has taken time (AFAIK) to go back and implement it anywhere.
Honestly at this point I'd be kind of happy if we could just use an x.509 cert from a webpki acme provider in the sshd and be done with it, for the host identity part.
on terminal.shop, steal credit cards on jobs endpoints, perform identity theft on exe.dev, whatever you put on there
TIL about 4chan clanker clone moltshit.com