11 ms·

How SSH Port Became 22

382 points by kawera 7y ago

dickeytk 7y ago
I’m more surprised that there is an ssh.com. And that it looks like it was put together with a bad corporate WordPress template.
- deleted 7y ago
  [deleted]
- ollifi 7y ago
  SSH is a publicly traded company since the dotcom era[1]. I think corporate wordpress feel is in line. [1]https://en.m.wikipedia.org/wiki/SSH_Communications_Security https://en.m.wikipedia.org/wiki/SSH_Communications_Security
- walty8 7y ago
  I am sure the site admin will find surprisingly high traffic today :)
schoen 7y ago
(2017)
throw0101a 7y ago
Personally I find how/why FTP uses two ports, 20 and 21, to be more interesting: So the first thing to know is the FTP is 'old', in that it predates TCP and originally ran on NCP: > The original specification for the File Transfer Protocol was written by Abhay Bhushan and published as RFC 114 on 16 April 1971. Until 1980, FTP ran on NCP, the predecessor of TCP/IP.[2] The protocol was later replaced by a TCP/IP version, RFC 765 (June 1980) and RFC 959 (October 1985), the current specification. * https://en.wikipedia.org/wiki/File_Transfer_Protocol https://en.wikipedia.org/wiki/File_Transfer_Protocol The second thing to know is that, unlike TCP or UDP, NCP was not duplex: > NCP preceded the Transmission Control Protocol (TCP) as a transport layer protocol used during the early ARPANET. NCP was a simplex protocol that utilized two port addresses, establishing two connections, for two-way communications. An odd and an even port were reserved for each application layer application or protocol. The standardization of TCP and UDP reduced the need for the use of two simplex ports for each application down to one duplex port.[1] * https://en.wikipedia.org/wiki/Network_Control_Program https://en.wikipedia.org/wiki/Network_Control_Program So the original transport layer that FTP relied on necessitated two ports, and when the move to a newer transport layer occurred the use of two ports was carried over for simplicity's sake. And several decades later that design still exists.
- ghelmer 7y ago
  I've written a lot of TCP deep-packet inspection code, including parsing FTP control protocol. So I was surprised by this post by Robert Graham: https://blog.erratasec.com/2019/08/hacker-jeopardy-wrong-answers-only.html https://blog.erratasec.com/2019/08/hacker-jeopardy-wrong-ans... - FTP control protocol follows the specification for Telnet.
  - crooked-v 7y ago
    You might find the MUD community interesting in this regard, as they've built de facto standards for 16-bit color encoding, text compression, hidden sideband metadata communication usable by clients, and even simple embedded HTML and image rendering all on top of telnet. On top of that, because of the wildly varying capabilities of MUD clients, every single feature has to be totally backwards-compatible with a plain text terminal.
    - pmiller2 7y ago
      Some MUDs even have sound!
    - Twisol 7y ago
      I can vouch for this wholeheartedly! However, be aware that these are all ad-hoc in some fascinating yet depressing ways. I can't help but mention a few names and fun facts... > 16-bit color encoding I think the xterm-256 escape codes came from somewhere other than MUDs, but it is forever frustrating to me that whoever designed them used the parameter separator `;` instead of the subparameter separator `:`. For SGR (`\e[m`-type escapes), each parameter is an individual change to the graphic state, so you can combine multiple settings into a single SGR. (For instance, `\e[1;32m` means "bold" followed by "green foreground".) But the 256-color extensions use a pattern "\e[38;5;<n>m", which makes itself into a fresh edge case you have to handle specially instead of treating "38", "5", and the chosen <n> as individual commands. `:` is perfectly well defined as binding more tightly than `;`, so "38:5:<n>" would have worked perfectly well as a definition for the otherwise-undefined "38" code, but no... > text compression The MCCP (Mud Client Compression Protocol) is very cool, but its first version called to signal the start of compression with the byte sequence `IAC SB MCCP SE`. The intent was to send an empty MCCP subnegotiation frame and immediately return to the main Telnet channel, but they left off an `IAC` to preceed the `SE`, meaning that this just starts a subnegotion frame, sends `SE` as the first byte, and then forgets to close the frame. Ever. So if you want to support MCCPv1, you have to add a little hack to detect this situation and pretend the frame was actually closed as intended. (Please don't support MCCPv1.) > hidden sideband metadata communication usable by clients Yes! One of my favorite topics. Iron Realms-published MUDs introduced "ATCP", another subnegotiation-based protocol that would provide additional information about your character, which directions you can move, your inventory, etc., so that your client could provide graphical representations of this information in the UI. They replaced it with "GMCP" later on -- the "standardization" process behind that was memorable -- which used JSON as the payload format. Fun fact about ATCP: It was originally designed with a lightweight handshake mechanism so that only Iron Realms clients ("Nexus") could utilize this information. Before my time, someone seems to have reverse engineered this algorithm, so it pretty quickly spread to custom plugins for third-party clients. They never seemed openly upset about this development, and GMCP dropped this mechanism. And none of this is even getting into MXP, which embedded XML-inspired tags directly into the main data channel instead of using a subnegotiation. The presence of tags is controlled by using a non-standard ANSI-style escape sequence. I never ended up implementing MXP, because ATCP and GMCP were so much simpler to work with, but it's still a very cool piece of tech. > every single feature has to be totally backwards-compatible with a plain text terminal. Telnet is actually a shockingly cool little protocol. Sure, there are some anachronisms, like the "Network Virtual Terminal" (NVT) defining a variety of special text editing commands to provide a common representation for the many terminals sold by many vendors and their incompatible command representations. But Telnet at its core is a data multiplexer with 1 primary data channel and 256 negotiable framed channels ("options"). The mechanism for negotiating the use of a channel is symmetric, meaning that the client and server are on equal footing -- both have to agree, and either one can advertise its willingness to use a channel. It's a really cool protocol to study -- and small enough that you really can understand the whole thing! Source for all this: I was a MUD enthusiast for several years as a teenager, and wrote my own Telnet stack, ANSI escape parser (referencing the ECMA spec!), and started on my own web-based MUD client. I did a heck of a lot of digging back then on these topics. It's still one of my favorite esoteric technology stacks to play around with.
grendelt 7y ago
TLDR; "Because I just asked for it."
tyingq 7y ago
Uh, it was the next available near 23/telnet which it aimed to replace?
- egdod 7y ago
  That’s why, not how. The how is interesting.
  - icedchai 7y ago
    Not really. He asked IANA, which was literally 2 guys in a room back in the 90's. Literally anyone could get a port assigned in those days, just like anyone could get a /24 address block.
    - zatkin 7y ago
      Correction: 1 guy + 1 gal, not 2 guys. Joyce K. Reynolds was a woman. :-)
      - kortilla 7y ago
        Was?
        throw0101a 7y ago
        Channelling Mitch Hedberg: She used to be a woman. She still is, but she used to, too. * https://www.youtube.com/watch?v=VqHA5CIL0fg https://www.youtube.com/watch?v=VqHA5CIL0fg More seriously, she passed away in 2015: * https://en.wikipedia.org/wiki/Joyce_K._Reynolds https://en.wikipedia.org/wiki/Joyce_K._Reynolds
        LukeShu 7y ago
        Joyce K. Reynolds died in 2015.
      - egdod 7y ago
        Gender is just a social construct anyway.
im3w1l 7y ago
With the benefit of hindsight, we know that ssh became extremely successful, so allocating it a nice port was a good choice.
hsnewman 7y ago
SSH is a service, the port is a standard, but the service doesn't have to be on port 22, it's just the standards base port. I never run it on port 22 exposed to the internet (because of the flagrant criminals on the internet trying to hack into systems).
egtiller 7y ago
This makes me wonder. What such booming technology is there right now where I can contribute something like this and make a mark for myself? Having born much later in the history of Internet, I think I have missed out on many of the early magical years of the Internet. But if I can get involved in some other technology that is in early stage and booming and where I have a chance to contribute something that may become a de-facto standard 10 years from now, that's something I will be very interested to invest my time on.
- eru 7y ago
  > Having born much later in the history of Internet, I think I have missed out on many of the early magical years of the Internet. The Internet pioneers probably thought the same about the computer pioneers. And so on further back in time.
- Udo 7y ago
  The most unsatisfying but realistic answer is probably that you're best off working on whatever sparks your passion, because making dent in the universe seldomly happens intentionally, and if you don't succeed hugely at least you had fun and learned a lot on the way. If we're talking about basic tech such as networking, the time for foundational work has probably passed, or it has at least become exponentially more unlikely that you'll contribute another bedrock protocol or mechanism. It's also worth noting that you never hear from the many thousands of technologies that either failed to reach critical mass or became obsolete a long time ago. Just like founding a startup, this will be the most likely outcome. If you're looking to be the first to do something, my advice is: try to do it in space. Seriously. Finally things are happening again there, and you can probably make your mark inventing basic necessities and/or being one of the first people to colonize a new place. If you're looking for something in software, opinions on what's needed differ a lot. As an old person, my perspective is that we're going to need a way to deal with complexity and brittleness. Our software stacks have become bloated, unreliable, and a nightmare to debug. Things are getting slower and more buggy year by year, because we have not yet hit the right balance between using low-level primitives and high-level abstractions. We're now using huge frameworks regularly for very simple things, both because it's what we're used to and because these frameworks help paper over design defects lower down the stack. This needs to be solved, we can't keep stacking things on top forever. There is a real, concrete danger to our society here.
toyg 7y ago
Funnily enough, changing the ssh port to a random unprivileged one is now possibly the easiest and most effective step to harden a box... I guess it shows how the internet has changed.
- 0x0 7y ago
  In the last two months, I've been getting lots of bruteforce scan attempts on all my boxes that run ssh on high ports, so it seems this is no longer as effective as it was :-/
  - geocrasher 7y ago
    You are not alone in this. This week I actually changed ports for ssh because of the sheer number of brute force attempts. We'll see how long that holds out.
    - ru552 7y ago
      Why not just restrict access to specific IP blocks? Even if you left it open to Verizon's entire IP space so you can hit it with your cell, you would still dramatically lower your incident rate.
      - geocrasher 7y ago
        Yeah I could do that I suppose. I host several people on it however. Right now the unique port is enough.
    - tlavoie 7y ago
      Why not just use fail2ban or similar, to automatically block the ninnies for a while after a few attempts?
      - geocrasher 7y ago
        Yup, using LFD for that purpose. There's still a lot of attempts.
movieswebsite 7y ago
http://festyy.com/w5lzWS http://festyy.com/w5lzWS
airocker 7y ago
I feel so old!
jedberg 7y ago
So the crux of the story is “I had to email an internet icon and she mailed me back right away having done what I asked”. I can sympathize. When I worked at Sendmail I was tasked with running DNS for the company, which included Sendmail.org. The first thing I had to do was find a secondary DNS. Our founder said to “email his friend Paul”. It turned out his friend was Paul Vixie, the inventor of BIND, who responded in just a couple minutes that he had set up a-root to secondary the domains I was running. Here I was, 22 years old at my first job, emailing with the inventor of critical internet infrastructure who was relying on a database I ran as a source of truth.
- mmjaa 7y ago
  I remember Wired publishing an article about PGP waaay back in the day, and they included Phil Zimmermans phone number in the article, for some bizaare reason. On a whim, after reading the article and because I was at the time involved in setting up ISP services all over SoCal, I decided to just call him and say thanks. Imagine my surprise when he answered, confirmed it was really him, and we chatted for 20 minutes or so about the Internet, how it needed to be secured, and so on. I'll never forget his huge "meh." in response to my statement "it must be weird having your personal phone # published in a national publication" .. ;)
- nineteen999 7y ago
  > When I worked at Sendmail > Here I was, 22 years old at my first job, emailing with the inventor of critical internet infrastructure who was relying on a database I ran as a source of truth. But you were working for a company who employed or was started by the creator of Sendmail, Eric Allman? Surely you were already rubbing shoulders with the Internet giants of old? According to Wikipedia, "in 1996, approximately 80% of the publicly reachable mail-servers on the Internet ran Sendmail".
  - jedberg 7y ago
    > Surely you were already rubbing shoulders with the Internet giants of old? I was, but I just didn't see Eric that way, I guess because I saw him all the time? I mean looking back, there were quire a few Internet giants that either worked there or hung out at the office, but that email with Paul was the one that really got me. Maybe because the response was that data I was creating was getting mirrored to a-root.
RcouF1uZ4gsC 7y ago
> Dear Sir, In Finnish culture is this considered a generic term of address? From the write up it seems like the author knew that Joyce K. Reynolds was on the IANA but still addressed the email to “Dear Sir”.
- kilpikaarna 7y ago
  No. "Dear sir" sounds like something he picked up in high school English class, taught for use when addressing an unknown recipient. If writing this in Finnish you'd normally use something very close to "Dear Mr Reynolds".
  - Ndymium 7y ago
    Most of us rarely write such formal letters. I don't remember when is the last time I've written something as formal for a Finnish recipient. At school I was taught to use "Dear Sir or Madam" or "To whom it may concern" but neither of those sound natural, they're just learned. If writing for a Finn, I just start with "Hei" ("Hey") (in fact that has lead me to start emails in English with just "Hey" as well). I may have used some other formality once or twice in my life when it was required for school or such matters but not as an adult. So it may be that they were out of their element when writing that email and just put the first thing that came to their mind.
    - Symbiote 7y ago
      "Hei" means "hi". You can use that in your email. English "hey" is said when someone is annoyed. "Hey you! Stop that!"
      - pbhjpbhj 7y ago
        Hmm, tone is what differentiates the greeting and the admonishment. Your 2nd sentence is correct, but not exclusively. TL;DR I use "hey" as a greeting. [en-gb native]
        7y ago
void-star 7y ago
My memory may be flawed here but I vaguely remember there being a minor controversy over SSH being awarded port 22 instead of a competing protocol/program called “stelnet”. It was a similar solution to SSH but only “replaced” telnet, not FTP. Back then there were “strong feelings about” rsh versus telnet, with SSH actually being modeled more after rsh/rcp/rlogin. Anyway at best this is probably just more internet protocol trivia but I do wonder if anybody can confirm I am remembering this right?
dang 7y ago
A thread from 2018: https://news.ycombinator.com/item?id=17552100 https://news.ycombinator.com/item?id=17552100 and from 2017: https://news.ycombinator.com/item?id=14178091 https://news.ycombinator.com/item?id=14178091
archi42 7y ago
Reminds me of a story about a professor. He has framed an old request for a grant and put it up in his office: > I need 20000US$. That's all it reads (with value converted to today's dollar-value for easier interpretation) - and of course it was granted.
- andruby 7y ago
  I'd love to get a little more context. Who applied for the grant? Where was this?
  - michaelhoffman 7y ago
    https://dirnagl.com/2014/01/14/otto-warburgs-research-grant/ https://dirnagl.com/2014/01/14/otto-warburgs-research-grant/
    - archi42 7y ago
      Aaah, thanks! This is what I had in mind. Though I misjudged the time frame: 10000 Mark in 1921 is in the ball park of 2000 US$ today; that is, if he got lucky, since the German hyperinflation in the 20s quickly made that money essentially worthless.
fretn 7y ago
slightly offtopic: I wish scp also used -p instead of -P for defining a custom port, everytime I want to ssh or scp on a custom port I have to look up which one of the two uses -p or -P :)
- zamadatix 7y ago
  At least it's not like sftp where you have to put `-oPort=` and it doesn't work if it's at the end!
craftoman 7y ago
Look how easy was the whole procedure. You just sent an email and boom next day your application's port was registered by IANA. Nowdays you must have a team of academics backed up by Google to apply for that.
- oblio 7y ago
  The internet was a sort of toy used by 10000 people. Nowadays you should need 2 teams of academics backed up by 4 companies and 2 governments to change anything. I'm not kidding. The internet of today should be like democracy: really hard and slow to change because sudden change is very disruptive.
  - craftoman 7y ago
    Yeah, that's my point. It was like a playground of technologists and hackers. I wish I was born earlier to experience this magic place.
- technothrasher 7y ago
  I remember applying for a Class C block of IP addresses back in 1993 was as simple as sending in a preformatted email template to InterNIC and getting your address space about twenty minutes later in a reply. I've still got that Class C registered, but it hasn't been used in years, and I'm not entirely sure what to do with it.
  - genera1 7y ago
    You could sell, or even better lease it out

382 points by kawera 7y ago

I’m more surprised that there is an ssh.com. And that it looks like it was put together with a bad corporate WordPress template.

deleted 7y ago
[deleted]
ollifi 7y ago
SSH is a publicly traded company since the dotcom era[1]. I think corporate wordpress feel is in line. [1]https://en.m.wikipedia.org/wiki/SSH_Communications_Security https://en.m.wikipedia.org/wiki/SSH_Communications_Security
walty8 7y ago
I am sure the site admin will find surprisingly high traffic today :)

schoen 7y ago

(2017)

throw0101a 7y ago

Personally I find how/why FTP uses two ports, 20 and 21, to be more interesting: So the first thing to know is the FTP is 'old', in that it predates TCP and originally ran on NCP: > The original specification for the File Transfer Protocol was written by Abhay Bhushan and published as RFC 114 on 16 April 1971. Until 1980, FTP ran on NCP, the predecessor of TCP/IP.[2] The protocol was later replaced by a TCP/IP version, RFC 765 (June 1980) and RFC 959 (October 1985), the current specification. * https://en.wikipedia.org/wiki/File_Transfer_Protocol https://en.wikipedia.org/wiki/File_Transfer_Protocol The second thing to know is that, unlike TCP or UDP, NCP was not duplex: > NCP preceded the Transmission Control Protocol (TCP) as a transport layer protocol used during the early ARPANET. NCP was a simplex protocol that utilized two port addresses, establishing two connections, for two-way communications. An odd and an even port were reserved for each application layer application or protocol. The standardization of TCP and UDP reduced the need for the use of two simplex ports for each application down to one duplex port.[1] * https://en.wikipedia.org/wiki/Network_Control_Program https://en.wikipedia.org/wiki/Network_Control_Program So the original transport layer that FTP relied on necessitated two ports, and when the move to a newer transport layer occurred the use of two ports was carried over for simplicity's sake. And several decades later that design still exists.

ghelmer 7y ago
I've written a lot of TCP deep-packet inspection code, including parsing FTP control protocol. So I was surprised by this post by Robert Graham: https://blog.erratasec.com/2019/08/hacker-jeopardy-wrong-answers-only.html https://blog.erratasec.com/2019/08/hacker-jeopardy-wrong-ans... - FTP control protocol follows the specification for Telnet.
- crooked-v 7y ago
  You might find the MUD community interesting in this regard, as they've built de facto standards for 16-bit color encoding, text compression, hidden sideband metadata communication usable by clients, and even simple embedded HTML and image rendering all on top of telnet. On top of that, because of the wildly varying capabilities of MUD clients, every single feature has to be totally backwards-compatible with a plain text terminal.
  - pmiller2 7y ago
    Some MUDs even have sound!
  - Twisol 7y ago
    I can vouch for this wholeheartedly! However, be aware that these are all ad-hoc in some fascinating yet depressing ways. I can't help but mention a few names and fun facts... > 16-bit color encoding I think the xterm-256 escape codes came from somewhere other than MUDs, but it is forever frustrating to me that whoever designed them used the parameter separator `;` instead of the subparameter separator `:`. For SGR (`\e[m`-type escapes), each parameter is an individual change to the graphic state, so you can combine multiple settings into a single SGR. (For instance, `\e[1;32m` means "bold" followed by "green foreground".) But the 256-color extensions use a pattern "\e[38;5;<n>m", which makes itself into a fresh edge case you have to handle specially instead of treating "38", "5", and the chosen <n> as individual commands. `:` is perfectly well defined as binding more tightly than `;`, so "38:5:<n>" would have worked perfectly well as a definition for the otherwise-undefined "38" code, but no... > text compression The MCCP (Mud Client Compression Protocol) is very cool, but its first version called to signal the start of compression with the byte sequence `IAC SB MCCP SE`. The intent was to send an empty MCCP subnegotiation frame and immediately return to the main Telnet channel, but they left off an `IAC` to preceed the `SE`, meaning that this just starts a subnegotion frame, sends `SE` as the first byte, and then forgets to close the frame. Ever. So if you want to support MCCPv1, you have to add a little hack to detect this situation and pretend the frame was actually closed as intended. (Please don't support MCCPv1.) > hidden sideband metadata communication usable by clients Yes! One of my favorite topics. Iron Realms-published MUDs introduced "ATCP", another subnegotiation-based protocol that would provide additional information about your character, which directions you can move, your inventory, etc., so that your client could provide graphical representations of this information in the UI. They replaced it with "GMCP" later on -- the "standardization" process behind that was memorable -- which used JSON as the payload format. Fun fact about ATCP: It was originally designed with a lightweight handshake mechanism so that only Iron Realms clients ("Nexus") could utilize this information. Before my time, someone seems to have reverse engineered this algorithm, so it pretty quickly spread to custom plugins for third-party clients. They never seemed openly upset about this development, and GMCP dropped this mechanism. And none of this is even getting into MXP, which embedded XML-inspired tags directly into the main data channel instead of using a subnegotiation. The presence of tags is controlled by using a non-standard ANSI-style escape sequence. I never ended up implementing MXP, because ATCP and GMCP were so much simpler to work with, but it's still a very cool piece of tech. > every single feature has to be totally backwards-compatible with a plain text terminal. Telnet is actually a shockingly cool little protocol. Sure, there are some anachronisms, like the "Network Virtual Terminal" (NVT) defining a variety of special text editing commands to provide a common representation for the many terminals sold by many vendors and their incompatible command representations. But Telnet at its core is a data multiplexer with 1 primary data channel and 256 negotiable framed channels ("options"). The mechanism for negotiating the use of a channel is symmetric, meaning that the client and server are on equal footing -- both have to agree, and either one can advertise its willingness to use a channel. It's a really cool protocol to study -- and small enough that you really can understand the whole thing! Source for all this: I was a MUD enthusiast for several years as a teenager, and wrote my own Telnet stack, ANSI escape parser (referencing the ECMA spec!), and started on my own web-based MUD client. I did a heck of a lot of digging back then on these topics. It's still one of my favorite esoteric technology stacks to play around with.

grendelt 7y ago

TLDR; "Because I just asked for it."

tyingq 7y ago

Uh, it was the next available near 23/telnet which it aimed to replace?

egdod 7y ago
That’s why, not how. The how is interesting.
- icedchai 7y ago
  Not really. He asked IANA, which was literally 2 guys in a room back in the 90's. Literally anyone could get a port assigned in those days, just like anyone could get a /24 address block.
  - zatkin 7y ago
    Correction: 1 guy + 1 gal, not 2 guys. Joyce K. Reynolds was a woman. :-)
    - kortilla 7y ago
      Was?
      - throw0101a 7y ago
        Channelling Mitch Hedberg: She used to be a woman. She still is, but she used to, too. * https://www.youtube.com/watch?v=VqHA5CIL0fg https://www.youtube.com/watch?v=VqHA5CIL0fg More seriously, she passed away in 2015: * https://en.wikipedia.org/wiki/Joyce_K._Reynolds https://en.wikipedia.org/wiki/Joyce_K._Reynolds
      - LukeShu 7y ago
        Joyce K. Reynolds died in 2015.
    - egdod 7y ago
      Gender is just a social construct anyway.

im3w1l 7y ago

With the benefit of hindsight, we know that ssh became extremely successful, so allocating it a nice port was a good choice.

hsnewman 7y ago

SSH is a service, the port is a standard, but the service doesn't have to be on port 22, it's just the standards base port. I never run it on port 22 exposed to the internet (because of the flagrant criminals on the internet trying to hack into systems).

egtiller 7y ago

This makes me wonder. What such booming technology is there right now where I can contribute something like this and make a mark for myself? Having born much later in the history of Internet, I think I have missed out on many of the early magical years of the Internet. But if I can get involved in some other technology that is in early stage and booming and where I have a chance to contribute something that may become a de-facto standard 10 years from now, that's something I will be very interested to invest my time on.

eru 7y ago
> Having born much later in the history of Internet, I think I have missed out on many of the early magical years of the Internet. The Internet pioneers probably thought the same about the computer pioneers. And so on further back in time.
Udo 7y ago
The most unsatisfying but realistic answer is probably that you're best off working on whatever sparks your passion, because making dent in the universe seldomly happens intentionally, and if you don't succeed hugely at least you had fun and learned a lot on the way. If we're talking about basic tech such as networking, the time for foundational work has probably passed, or it has at least become exponentially more unlikely that you'll contribute another bedrock protocol or mechanism. It's also worth noting that you never hear from the many thousands of technologies that either failed to reach critical mass or became obsolete a long time ago. Just like founding a startup, this will be the most likely outcome. If you're looking to be the first to do something, my advice is: try to do it in space. Seriously. Finally things are happening again there, and you can probably make your mark inventing basic necessities and/or being one of the first people to colonize a new place. If you're looking for something in software, opinions on what's needed differ a lot. As an old person, my perspective is that we're going to need a way to deal with complexity and brittleness. Our software stacks have become bloated, unreliable, and a nightmare to debug. Things are getting slower and more buggy year by year, because we have not yet hit the right balance between using low-level primitives and high-level abstractions. We're now using huge frameworks regularly for very simple things, both because it's what we're used to and because these frameworks help paper over design defects lower down the stack. This needs to be solved, we can't keep stacking things on top forever. There is a real, concrete danger to our society here.

toyg 7y ago

Funnily enough, changing the ssh port to a random unprivileged one is now possibly the easiest and most effective step to harden a box... I guess it shows how the internet has changed.

0x0 7y ago
In the last two months, I've been getting lots of bruteforce scan attempts on all my boxes that run ssh on high ports, so it seems this is no longer as effective as it was :-/
- geocrasher 7y ago
  You are not alone in this. This week I actually changed ports for ssh because of the sheer number of brute force attempts. We'll see how long that holds out.
  - ru552 7y ago
    Why not just restrict access to specific IP blocks? Even if you left it open to Verizon's entire IP space so you can hit it with your cell, you would still dramatically lower your incident rate.
    - geocrasher 7y ago
      Yeah I could do that I suppose. I host several people on it however. Right now the unique port is enough.
  - tlavoie 7y ago
    Why not just use fail2ban or similar, to automatically block the ninnies for a while after a few attempts?
    - geocrasher 7y ago
      Yup, using LFD for that purpose. There's still a lot of attempts.

movieswebsite 7y ago

http://festyy.com/w5lzWS http://festyy.com/w5lzWS

airocker 7y ago

I feel so old!

jedberg 7y ago

So the crux of the story is “I had to email an internet icon and she mailed me back right away having done what I asked”. I can sympathize. When I worked at Sendmail I was tasked with running DNS for the company, which included Sendmail.org. The first thing I had to do was find a secondary DNS. Our founder said to “email his friend Paul”. It turned out his friend was Paul Vixie, the inventor of BIND, who responded in just a couple minutes that he had set up a-root to secondary the domains I was running. Here I was, 22 years old at my first job, emailing with the inventor of critical internet infrastructure who was relying on a database I ran as a source of truth.

mmjaa 7y ago
I remember Wired publishing an article about PGP waaay back in the day, and they included Phil Zimmermans phone number in the article, for some bizaare reason. On a whim, after reading the article and because I was at the time involved in setting up ISP services all over SoCal, I decided to just call him and say thanks. Imagine my surprise when he answered, confirmed it was really him, and we chatted for 20 minutes or so about the Internet, how it needed to be secured, and so on. I'll never forget his huge "meh." in response to my statement "it must be weird having your personal phone # published in a national publication" .. ;)
nineteen999 7y ago
> When I worked at Sendmail > Here I was, 22 years old at my first job, emailing with the inventor of critical internet infrastructure who was relying on a database I ran as a source of truth. But you were working for a company who employed or was started by the creator of Sendmail, Eric Allman? Surely you were already rubbing shoulders with the Internet giants of old? According to Wikipedia, "in 1996, approximately 80% of the publicly reachable mail-servers on the Internet ran Sendmail".
- jedberg 7y ago
  > Surely you were already rubbing shoulders with the Internet giants of old? I was, but I just didn't see Eric that way, I guess because I saw him all the time? I mean looking back, there were quire a few Internet giants that either worked there or hung out at the office, but that email with Paul was the one that really got me. Maybe because the response was that data I was creating was getting mirrored to a-root.

RcouF1uZ4gsC 7y ago

> Dear Sir, In Finnish culture is this considered a generic term of address? From the write up it seems like the author knew that Joyce K. Reynolds was on the IANA but still addressed the email to “Dear Sir”.

kilpikaarna 7y ago
No. "Dear sir" sounds like something he picked up in high school English class, taught for use when addressing an unknown recipient. If writing this in Finnish you'd normally use something very close to "Dear Mr Reynolds".
- Ndymium 7y ago
  Most of us rarely write such formal letters. I don't remember when is the last time I've written something as formal for a Finnish recipient. At school I was taught to use "Dear Sir or Madam" or "To whom it may concern" but neither of those sound natural, they're just learned. If writing for a Finn, I just start with "Hei" ("Hey") (in fact that has lead me to start emails in English with just "Hey" as well). I may have used some other formality once or twice in my life when it was required for school or such matters but not as an adult. So it may be that they were out of their element when writing that email and just put the first thing that came to their mind.
  - Symbiote 7y ago
    "Hei" means "hi". You can use that in your email. English "hey" is said when someone is annoyed. "Hey you! Stop that!"
    - pbhjpbhj 7y ago
      Hmm, tone is what differentiates the greeting and the admonishment. Your 2nd sentence is correct, but not exclusively. TL;DR I use "hey" as a greeting. [en-gb native]
      - 7y ago

void-star 7y ago

My memory may be flawed here but I vaguely remember there being a minor controversy over SSH being awarded port 22 instead of a competing protocol/program called “stelnet”. It was a similar solution to SSH but only “replaced” telnet, not FTP. Back then there were “strong feelings about” rsh versus telnet, with SSH actually being modeled more after rsh/rcp/rlogin. Anyway at best this is probably just more internet protocol trivia but I do wonder if anybody can confirm I am remembering this right?

dang 7y ago

A thread from 2018: https://news.ycombinator.com/item?id=17552100 https://news.ycombinator.com/item?id=17552100 and from 2017: https://news.ycombinator.com/item?id=14178091 https://news.ycombinator.com/item?id=14178091

archi42 7y ago

Reminds me of a story about a professor. He has framed an old request for a grant and put it up in his office: > I need 20000US$. That's all it reads (with value converted to today's dollar-value for easier interpretation) - and of course it was granted.

andruby 7y ago
I'd love to get a little more context. Who applied for the grant? Where was this?
- michaelhoffman 7y ago
  https://dirnagl.com/2014/01/14/otto-warburgs-research-grant/ https://dirnagl.com/2014/01/14/otto-warburgs-research-grant/
  - archi42 7y ago
    Aaah, thanks! This is what I had in mind. Though I misjudged the time frame: 10000 Mark in 1921 is in the ball park of 2000 US$ today; that is, if he got lucky, since the German hyperinflation in the 20s quickly made that money essentially worthless.

fretn 7y ago

slightly offtopic: I wish scp also used -p instead of -P for defining a custom port, everytime I want to ssh or scp on a custom port I have to look up which one of the two uses -p or -P :)

zamadatix 7y ago
At least it's not like sftp where you have to put `-oPort=` and it doesn't work if it's at the end!

craftoman 7y ago

Look how easy was the whole procedure. You just sent an email and boom next day your application's port was registered by IANA. Nowdays you must have a team of academics backed up by Google to apply for that.

oblio 7y ago
The internet was a sort of toy used by 10000 people. Nowadays you should need 2 teams of academics backed up by 4 companies and 2 governments to change anything. I'm not kidding. The internet of today should be like democracy: really hard and slow to change because sudden change is very disruptive.
- craftoman 7y ago
  Yeah, that's my point. It was like a playground of technologists and hackers. I wish I was born earlier to experience this magic place.
technothrasher 7y ago
I remember applying for a Class C block of IP addresses back in 1993 was as simple as sending in a preformatted email template to InterNIC and getting your address space about twenty minutes later in a reply. I've still got that Class C registered, but it hasn't been used in years, and I'm not entirely sure what to do with it.
- genera1 7y ago
  You could sell, or even better lease it out