22 ms·
Show HN: Apply for a job through SSH, $ ssh jobs.hackclub.com
- 1cvmask 5y agoSays the subdomain link that lacks SSL. A wildcard certificate would have sufficed.
- gruez 5y agoor a free one from letsencrypt
- chrismorgan 5y agoLet’s Encrypt has provided wildcard certificates via the DNS-01 challenge type since 2018.
- HatchedLake721 5y agoKinda unforgivable to be on front page of HN in 2021 without https
- bellyfullofbac 5y agoWhy exactly? Other than a lot of "potential problems" security theater? People still send postcards, where they don't care if people read what's written on it..
- jimmygrapes 5y agoPractically speaking, it is because some modern browsers (and extensions) will throw up an error (either by-passable or not) if it's HTTP only. Yeah it's not necessary in many cases, but it's growing to be the standard expected behavior.
- benatkin 5y agoWhich ones, pray tell?
- hollerith 5y agoI've seen the warnings in both Chrome and Firefox.
- generalizations 5y agoI'm sure the readers of hacker news can deal with that.
- unnouinceput 5y agoBecause of ISP's between me and the target http awful track record of injecting their code full of crap, that's why.
- deleted 5y ago[deleted]
- alexander-litty 5y agoPeople also expect their postcards to arrive untampered. ISPs, Comcast in particular, inject ad-loading javascript into HTTP pages. https://arstechnica.com/tech-policy/2014/09/why-comcasts-javascript-ad-injections-threaten-security-net-neutrality/ https://arstechnica.com/tech-policy/2014/09/why-comcasts-jav... https://www.reddit.com/r/technology/comments/9b5ikd/ https://www.reddit.com/r/technology/comments/9b5ikd/
- ipaddr 5y agoIn fairness isn't that a result of your relationship with your isp? If you remain because of price or no other services available why wouldn't you use a vpn knowing your isp is a hostile actor and probably trying to deeply inspect packets, etc?
- hutrdvnj 5y agoBecause if you use HTTP over VPN, then you really have to trust your VPN provider. Why should you do that?
- ipaddr 5y agoYou can be your own vpn provider if thats a big concern. Your isp knows you visited a certain domain with https. That's a concern.
- hutrdvnj 5y ago> You can be your own vpn provider if thats a big concern. You just shift the trust around. Now I have to trust the hoster, e.g. OVH instead of my local ISP. Really the best thing you can do is end-to-end encryption, don't send plaintext over the internet. > Your isp knows you visited a certain domain with https. That's a concern. How about DNS over HTTPS?
- deleted 5y ago[deleted]
- 5y ago
- spoonjim 5y agoBecause it’s the expected behavior. If you showed up to an interview for an attorney position and your interviewer was shirtless you’d think they’d lost their mind.
- bellyfullofbac 5y agoWas it normal to go to job interviews shirtless 10-15 years ago? Please come up with a better analogy ;-) Grandparent said "unforgivable".. sheesh, over the top much?
- chrismorgan 5y agoInfo for the curious: There tend to be about 0–2 http: entries on the front page. A fairly large fraction of those are old things. http: submissions on domains that support https: (whether or not they redirect to it by default) are very uncommon.
- tomcooks 5y agoYes beware of the friendly dragon stealing your credit card info
- zachlatta 5y agoJust added SSL. Live at https://jobs.hackclub.com https://jobs.hackclub.com.
- chrismorgan 5y agoYou should use a 301 (permanent) redirect, not a 302 (temporary) redirect as you currently are. Just speaking generally, I found the use of an http: link on this very curious, given that it’s about SSH (and thus encryption in no little part), so I’m guessing you’re not a “Web Developer”. So here’s my advice on the matter: everything on the web should be HTTPS now; nothing should be plain-text HTTP, with zero exceptions.
- sgt 5y agoUnless you want to allow browsers that can't do HTTPS, such as old Amiga browsers.
- chrismorgan 5y agoI’m going to be callous and say that Amiga browsers aren’t on the web. It’s a dead platform, if you’re actually targeting something for it you’re kind of not targeting the web proper, but rather a historical artefact that kinda lives in the same space. :-)
- deleted 5y ago[deleted]
- danappelxx 5y agoPretty sweet job listing :) I indirectly worked with Hack Club in High School - really great experience. They helped organize a bunch of events and foster a community.
- zachlatta 5y agoHey Dan! I'm so happy to see you here! I am touched that Hack Club was a good experience for you. Thank you.
- reasons 5y agoAre there are any security precautions in using ssh (or telnet, netcat or curl for that matter) to connect to an unknown service like this?
- lallysingh 5y agoYour terminal probably has some stack overflows in its terminal emulation code.
- pushcx 5y agoA privacy precaution would be to `ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no jobs.hackclub.com`. By default ssh will send all its public keys to a server unless given an identify file to use as an arg or in ~/.ssh/config.
- thaumasiotes 5y agoIn case you want to apply for a job without admitting who you are?
- parksy 5y agoIn case you want to connect to a random ssh server without giving it your public ssh keys.
- thaumasiotes 5y agoYes, but there's a reason those are called "public" keys. The reason is that you don't suffer any harm by giving them out. Except that they may be publicly identified with you. In that case, and only that case, giving them out would involve purporting to be the person who is publicly associated with the keys. (It wouldn't prove it, because, after all, those keys are public; anyone can know and distribute them.) So this concern appears to be that you want to apply for a job without disclosing your identity. I think that's a strange thing to do.
- throwaway888abc 5y agoeasier to read this file online? https://gist.github.com/zachlatta/3a5d780da6a3c964677a4f1c4c751f5c https://gist.github.com/zachlatta/3a5d780da6a3c964677a4f1c4c...
- aidenyb 5y agoi imagine the point of this isn't focused on ease of reading...
- generalizations 5y agoLooks like sshtron.zachlatta.com hasn't been found yet. Try it: `ssh sshtron.zachlatta.com`
- zachlatta 5y agoHack Club founder here. I'm so glad you know SSHTron too! I built SSHTron a few years ago at a hackathon. It served as the inspiration for jobs.hackclub.com. The code for both is open source, at https://github.com/zachlatta/sshtron https://github.com/zachlatta/sshtron and https://github.com/hackclub/jobs https://github.com/hackclub/jobs respectively.
- soheil 5y agoIf you're doing agent forwarding in your .ssh/config for * this could be a massive security thread. Mods should probably put a disclaimer at the top of this thread.
- EE84M3i 5y agoIs that setup common?
- soheil 5y agoIt doesn't have to be for at least some unsuspecting users to unwittingly share their private key with some random server on the internet. When was the last time you ssh'd to a server you didn't already have some level of trust with? (AWS, GCP, work server farms, etc.)
- spijdar 5y agoNot GP, but pretty frequently, although my situation is not normal. I'd still suggest that sharing your keys by default is ... a bad idea. Sure, fingerprints help, but there's the chance of accidentally or maliciously being redirected to a rogue server.
- soheil 5y agoI agree * is unsafe, but then again ssh devs chose to include it so that means they deemed it not completely useless, thus there are probably enough people who use it to make this thread somewhat malicious. Also if you or another script once added * to your .ssh/config long ago it may still be lurking there among other lines without you realizing. I agree checking fingerprints helps, but that can turned off pretty easily too.
- soheil 5y agoAny reason why this wasn't implemented with telnet since no authentication is required?
- easton 5y agotelnet is not shipped in the box on Windows and macOS, ssh is.
- soheil 5y agonc?
- shoefindortz 5y agoWindows ships with ssh now? Is that something new in win10+?
- easton 5y agoYes, as of Windows 10 1809 the OpenSSH client is included. OpenSSH Server is available as a optional feature. https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_overview https://docs.microsoft.com/en-us/windows-server/administrati...
- djhonovak 5y agoBoth Windows and macOS come with telnet clients as part of their default installations. However, there are many versions of Windows which do not ship with ssh.
- rokusei 5y agoSSH, once you (verify and) accept the first key exchange cannot be tampered with in transit, nor have the contents viewed by those sitting in-between. However, I believe everyone's stdout/stderr is available to everyone, if everyone is the same user, and if that user has read access to /proc, so that confidentiality is only restricted those who access to the server.
- 5y ago
- VWWHFSfQ 5y agoI don't understand what this is. Is this just some dude's little terminal game? I ssh'd to the server. I followed some weird little terminal prompts. I cat'd a .md file. I don't really see what's going on here.
- BelenusMordred 5y ago> I cat'd a .md file Apart from the readme all the files are job listings. Seems pretty clear to me.
- raggi 5y agoDo you get rejected if you connect with agent forwarding enabled?
- uchiga 5y agoNo, I was able to apply.
- johnorourke 5y agoVery droll!
- JarlUlvi 5y agoOnce I read through that politically correct Code of Conduct I realized as a small-l libertarian, I would not be a good fit.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- TeeMassive 5y agoI love the idea because it's like an automatic FizzBuzz filter http://weblog.raganwald.com/2007/01/dont-overthink-fizzbuzz.html http://weblog.raganwald.com/2007/01/dont-overthink-fizzbuzz....
- rubicks 5y agoGot a certificate authority I can trust?
- mikewarot 5y agoI have to admit that was fun, even if I'm not remotely qualified (or willing to move).
- dijit 5y ago> The Hack Club Slack Imagine making a job board work over ssh and then using slack to communicate. Especially when things like this exist and are much more in the spirit: https://github.com/shazow/ssh-chat https://github.com/shazow/ssh-chat
- loxias 5y agoAnd here I thought this was for applying for jobs :( For people like me who live in SSH and C. Sadly, it appears to be some sort of MUD with a slack channel. Oh well.
- manuelmagic 5y agoHi, I'm a not native English speaker. I can't understand what do you mean with the word "MUD". Can you explain it for me? Thank you.
- mrshu 5y agoI believe it stands for "Multi-User Dungeon" [0] [0] https://www.allacronyms.com/MUD https://www.allacronyms.com/MUD