Hacker News Reader

Comment by eliben | Hacker News Reader

I'm saddened by the recent shift of HN discussions to Reddit-isms. For Reddit, we have Reddit. Please, stop wasting others' time.

View on HN

It is unfair to label this poor quality, the author clearly describes a problem with moving a security tool like SSH into the browser.

Despite Chrome being speedily updated when known security problems are discovered, the attack surface compared to a dedicated client is huge: the 2-decade-old /usr/bin/ssh + /usr/bin/xterm combo has no concept of a DOM, does not share computing interfaces available to untrusted users (e.g. shared web workers), cannot receive messages from untrusted frames (postMessage()), cannot even be addressed by untrusted content (chrome://path/to/trusted/script), does not almost transparently expose ring0 drivers (OpenGL), does not have thousands of LOC on subsystems with little battle testing (WebRTC) and so on.

Of course these features are thought to be secure, until they are discovered in the midst of a Stuxnet type scenario and suddenly everyone is patching like crazy. Wasn't Java considered invulnerable only 2 weeks ago? Look at what changed - somebody noticed it wasn't long after tens of thousands of infections already occurred, and today it is on every browser's plug-in blacklist. I can't recall the last I read about xterm in the Pwn2Own contest, or any 0-day in the past decade, nor can Google accidentally DoS my xterm because their sync service is down (happened last month).

Following from the truism that the fastest, most bug-free code is code that doesn't exist, the easiest way to reduce exposure to unknown attacks is to minimize the amount of code running. Security design 101. Using something with the complexity of a web browser to render an 80x25 vector used to administer potentially hundreds of thousands of machines is almost the antithesis of good protocol.

Do most people run ssh and xterm on a bare-bones OS, or are they running on a full OS stack?

An OS that they may or may not update frequently.

An OS that they may or may not be logged into as an admin.

An OS that may have a keylogger running on it.

I think running SSH (or Chrome Remote Desktop) from a Chromebox is a pretty good way to have that minimal OS that is updated frequently, without admin privileges, with a lower risk of a keylogger. That I have to use two-factor to log into, even if my device is stolen.

What do you think about using a js-keylogger via a malicious Chrome extension, could that be a plausible scenario?

Sure, absolutely.

If you don't want the risk, don't install extensions you don't fully trust. Just like any applications or services on your desktop.

"It is unfair to label this poor quality, the author clearly describes a problem with moving a security tool like SSH into the browser."

Yes, I agree. The grandparent does point out a valid problem. However I believe the parent was referring to the sarcastic tone and negativity, which I also believe should be out of place here on Hacker News.

Just a quick note, but implicitly asserting that xterm is a very secure program will weaken your argument. From http://st.suckless.org/ :

xterm is bloated and unmaintainable. Here’s an excerpt from the README:

                Abandon All Hope, Ye Who Enter Here


    This is undoubtedly the most ugly program in the distribution.  It was one of
    the first "serious" programs ported, and still has a lot of historical baggage.
    Ideally, there would be a general tty widget and then vt102 and tek4014
    subwidgets so that they could be used in other programs.  We are trying to
    clean things up as we go, but there is still a lot of work to do.

Needless to say things have not changed, it’s still ugly. It has over 65K lines of code and emulates obscure and obsolete terminals you will never need. The popular alternative, rxvt has only 32K lines of code. This is just too much for something as simple as a terminal emulator; it’s yet another example of code complexity.

And I am saddened by the not-so-recent yet constant Reddit-bashing over aspects of discussion that appear on HN and not necessarily at all on most programming-related subreddits. Those, in my experience, have a level of discussion quite comparable to HN[0].

[0] in a technical sense, the startup focus is quite unique to HN. or maybe I don't subscribe to startup-related subreddits (since startup news is not really the reason I read HN either)

I love HN for discussions like this when a security expert familiar with the Chrome architecture will jump in and break things down (good or bad).

Increasingly I expect a contrarian at the top stating nothing but the obvious fact that there are security implications. Can we stop this now?

You will find many sarcastic comments in HN. This has nothing to do with Reddit. However, I do appreciate when HNers add in a "/s" or something alike to make it clear that sarcasm was used.

You can find quality conversations in Reddit but, more than likely, not in the default subreddits.

These comments always remind me of this http://xkcd.com/603/

People have been complaining that Reddit was taking over years ago and will continue to. Strangely while people posting cat pictures is downvoted for not being productive conversation comments like this get upvoted when it contributes just as much. Heck its even in the guideline:

If your account is less than a year old, please don't submit comments saying that HN is turning into Reddit. (It's a common semi-noob illusion.)

Although I know you have been around for more then a year.

To be fair, 90% of the Google SWE interns last summer were given chromebooks (instead of MBP) as their laptops (to supplement their workstations). They were extremely disliked.

Come now. The interns weren't given nice computers, but they were still liked. And FWIW, the only real problem with Chromebook as corporate dumb terminal is the tiny screen resolution.

"ctrl+w" is normally used to move between split panes in vim. It closes the SSH tab on a Chromebook. Googlers were not happy.

My answer was sarcastic, but there were real issues behind. Call it "informed sarcasm". Having used ssh since 1995 (on systems like SunOS 4.2 and UNICOS) I felt entitled to a bit of sarcasm.

I thought it would be obvious to most readers how a tty environment is easier to control than a browser (really, just consider the number and pace of updates to your kernel/windowing system/terminal and your web browser), so I did not bother with lengthy explanations.

Reply on news.ycombinator.com