5 ms·

I love Charm; doing `ssh git.charm.sh` is a lot of fun and really sparks the imagination about SSH apps. They also have usable solutions for auth and storage, w

I love Charm; doing `ssh git.charm.sh` is a lot of fun and really sparks the imagination about SSH apps. They also have usable solutions for auth and storage, which like, if you're thinking of writing something like this are the first things you'd start reaching for. They also work hard to enable you to run all your own services, so you don't rely on the Charm cloud for everything. Definitely a good model for future punk projects IMO.

divbzero 5y ago
The dynamic intuitive interface provided by `ssh git.charm.sh` is a wonderful example of how text-based user interfaces do not need to be limited to REPL. I wonder if there is space for a new text-based web browser that adopts some of the design features showcased by Charm.
- capableweb 5y ago
  > I wonder if there is space for a new text-based web browser that adopts some of the design features showcased by Charm Not sure if you're aware, but older protocols are still around to be used for this use case, and Gopher has even had a bit of a resurgence as of late
- digisign 5y ago
  A Gemini client might benefit: https://gemini.circumlunar.space/ https://gemini.circumlunar.space/
  - viraptor 5y ago
    Aren't Gemini pages static-by-design? It would be hard to do something really interactive / state-preserving with them if I'm not mistaken.
  - makeworld 5y ago
    Not using Charm, but I've designed a TUI Gemini client in Go! It's pretty popular, for terminal clients at least. https://github.com/makeworld-the-better-one/amfora https://github.com/makeworld-the-better-one/amfora
    - anthk 5y ago
      I miss a search function, but thanks for your client. I may write one a la av98, but with jimtcl instead of Python3. It makes really easy to write networked stuff, either with TLS or not. I wrote a finger client in minutes.
- suction 5y ago
  It surely is impressively well made. I am wondering though whether Charm actually qualifies as a text-based interface. Isn't it more like a replication of a graphical user interface, with windows and tabs etc.? If one's issues with working on the command line has always been that there are no "drawn" windows GUI elements, then this of course is a revelation, but we already have high-res versions of Charm, i.e. modern windows-based OSs.
  - riquito 5y ago
    There is no doubt, is a text based interface. The common term is text user interface (TUI vs GUI), and every app rendered as characters in a shell have been always considered TUI, whether they had windows, tabs, dropdowns and whatnot
    - suction 5y ago
      OK. Then I probably should have asked whether there is anything gained by "drawing" a GUI with characters. Don't get me wrong, I spend most of my day on the command line. But I never thought "this would be so much better if it was more like windows / mac os".
      - azeirah 5y ago
        I do think so. Terminal applications tend to be really accessible.
        maccard 5y ago
        You said accessible, so would you expect terminal applications to work with screen readers for example? What about localisation?
        krageon 5y ago
        > would you expect terminal applications to work with screen readers for example Can you explain to me any way in which they might not, bearing in mind they're basically text.
hillcrestenigma 5y ago
It really does. I wonder if these SSH applications can be linked and used like web applications where it's delivered to the end-user over the network with terminal + SSH being used as a browser. The only problem for these applications (and Charmbracelet) would be that there isn't much audience that could use these.
- colecut 5y ago
  Good point on the small target audience.. It really is a shame because this is a great looking project. I think I should write a web app that handles the SHH connection on the backend and renders the SHH app into HTML so that they can be enjoyed by the masses. =)
  - Shared404 5y ago
    If you do this, please mention that using a proper terminal + ssh will work better(This is based on my understanding of technologies used, but I could be wrong), and you may be responsible for a lot of people taking their first steps into knowing computers a lot better!
- qbasic_forever 5y ago
  ttyd is a nice little web terminal: https://github.com/tsl0922/ttyd https://github.com/tsl0922/ttyd Just a small, fast, low fuss C-based executable. wetty is another good option if you want to run a nodejs server: https://github.com/butlerx/wetty https://github.com/butlerx/wetty Both use xterm.js for the client terminal, which is these days the only game in town for a web terminal (it's what VS code and many other electron apps use too). It's quite good. Do be aware though that running a web-accessible terminal is a huge security headache. You're opening up a websocket to effectively allow commands and code to run on your server. Pay attention to security and authentication options any web terminal gives you, and use them. Most are not very secure out of the box or just following their readme examples. And watch out as many rootkits use web terminals as payloads so smart organizations and security policies will be looking for them or their traffic and you might get a very concerned IT person asking you questions if you use these on a network or machine you don't control.
cdiamand 5y ago
Looks cool! Are there any security risks posed by ssh'ing into an unknown server?
- matthewaveryusa 5y ago
  You potentially send all your key IDs (ie public keys) your agent has. there are command line options to force your ssh not to use your agent in which case, barred any bugs in the ssh client, it’s like browsing to a domain in your browser.
  - jdavis703 5y ago
    This is the first time I’ve heard someone say sharing public keys is a security risk. Can you explain the threat model here?
    - ragona 5y ago
      If you ever manage to leak a private key it’s easier to track it back to you. There was a recent paper showing the ability to tie rather a lot of keys to the associated developers.
    - wtetzner 5y ago
      I think it’s more of a privacy leak. E.g., the service could potentially figure out who you are if your public keys are tied to some other service, like GitHub.
    - lenkite 5y ago
      Would be easy to contact other web services and determine the identity marching a public key.
- judge2020 5y ago
  Regarding the concept in general, since it's just a screen with i/o you can't inspect its client-side code (the UI) nor what it does with your user input - but that can be more of a benefit for infosec reasons if you were to deploy this as an alternative to something like browser isolation[0] where you simply see what a remote browser sees without being able to inspect the contents of the page nor inject code. 0: https://www.cloudflare.com/teams/browser-isolation/ https://www.cloudflare.com/teams/browser-isolation/

divbzero 5y ago

The dynamic intuitive interface provided by `ssh git.charm.sh` is a wonderful example of how text-based user interfaces do not need to be limited to REPL. I wonder if there is space for a new text-based web browser that adopts some of the design features showcased by Charm.

capableweb 5y ago
> I wonder if there is space for a new text-based web browser that adopts some of the design features showcased by Charm Not sure if you're aware, but older protocols are still around to be used for this use case, and Gopher has even had a bit of a resurgence as of late
digisign 5y ago
A Gemini client might benefit: https://gemini.circumlunar.space/ https://gemini.circumlunar.space/
- viraptor 5y ago
  Aren't Gemini pages static-by-design? It would be hard to do something really interactive / state-preserving with them if I'm not mistaken.
- makeworld 5y ago
  Not using Charm, but I've designed a TUI Gemini client in Go! It's pretty popular, for terminal clients at least. https://github.com/makeworld-the-better-one/amfora https://github.com/makeworld-the-better-one/amfora
  - anthk 5y ago
    I miss a search function, but thanks for your client. I may write one a la av98, but with jimtcl instead of Python3. It makes really easy to write networked stuff, either with TLS or not. I wrote a finger client in minutes.
suction 5y ago
It surely is impressively well made. I am wondering though whether Charm actually qualifies as a text-based interface. Isn't it more like a replication of a graphical user interface, with windows and tabs etc.? If one's issues with working on the command line has always been that there are no "drawn" windows GUI elements, then this of course is a revelation, but we already have high-res versions of Charm, i.e. modern windows-based OSs.
- riquito 5y ago
  There is no doubt, is a text based interface. The common term is text user interface (TUI vs GUI), and every app rendered as characters in a shell have been always considered TUI, whether they had windows, tabs, dropdowns and whatnot
  - suction 5y ago
    OK. Then I probably should have asked whether there is anything gained by "drawing" a GUI with characters. Don't get me wrong, I spend most of my day on the command line. But I never thought "this would be so much better if it was more like windows / mac os".
    - azeirah 5y ago
      I do think so. Terminal applications tend to be really accessible.
      - maccard 5y ago
        You said accessible, so would you expect terminal applications to work with screen readers for example? What about localisation?
        krageon 5y ago
        > would you expect terminal applications to work with screen readers for example Can you explain to me any way in which they might not, bearing in mind they're basically text.

hillcrestenigma 5y ago

It really does. I wonder if these SSH applications can be linked and used like web applications where it's delivered to the end-user over the network with terminal + SSH being used as a browser. The only problem for these applications (and Charmbracelet) would be that there isn't much audience that could use these.

colecut 5y ago
Good point on the small target audience.. It really is a shame because this is a great looking project. I think I should write a web app that handles the SHH connection on the backend and renders the SHH app into HTML so that they can be enjoyed by the masses. =)
- Shared404 5y ago
  If you do this, please mention that using a proper terminal + ssh will work better(This is based on my understanding of technologies used, but I could be wrong), and you may be responsible for a lot of people taking their first steps into knowing computers a lot better!
qbasic_forever 5y ago
ttyd is a nice little web terminal: https://github.com/tsl0922/ttyd https://github.com/tsl0922/ttyd Just a small, fast, low fuss C-based executable. wetty is another good option if you want to run a nodejs server: https://github.com/butlerx/wetty https://github.com/butlerx/wetty Both use xterm.js for the client terminal, which is these days the only game in town for a web terminal (it's what VS code and many other electron apps use too). It's quite good. Do be aware though that running a web-accessible terminal is a huge security headache. You're opening up a websocket to effectively allow commands and code to run on your server. Pay attention to security and authentication options any web terminal gives you, and use them. Most are not very secure out of the box or just following their readme examples. And watch out as many rootkits use web terminals as payloads so smart organizations and security policies will be looking for them or their traffic and you might get a very concerned IT person asking you questions if you use these on a network or machine you don't control.

cdiamand 5y ago

Looks cool! Are there any security risks posed by ssh'ing into an unknown server?

matthewaveryusa 5y ago
You potentially send all your key IDs (ie public keys) your agent has. there are command line options to force your ssh not to use your agent in which case, barred any bugs in the ssh client, it’s like browsing to a domain in your browser.
- jdavis703 5y ago
  This is the first time I’ve heard someone say sharing public keys is a security risk. Can you explain the threat model here?
  - ragona 5y ago
    If you ever manage to leak a private key it’s easier to track it back to you. There was a recent paper showing the ability to tie rather a lot of keys to the associated developers.
  - wtetzner 5y ago
    I think it’s more of a privacy leak. E.g., the service could potentially figure out who you are if your public keys are tied to some other service, like GitHub.
  - lenkite 5y ago
    Would be easy to contact other web services and determine the identity marching a public key.
judge2020 5y ago
Regarding the concept in general, since it's just a screen with i/o you can't inspect its client-side code (the UI) nor what it does with your user input - but that can be more of a benefit for infosec reasons if you were to deploy this as an alternative to something like browser isolation[0] where you simply see what a remote browser sees without being able to inspect the contents of the page nor inject code. 0: https://www.cloudflare.com/teams/browser-isolation/ https://www.cloudflare.com/teams/browser-isolation/