6 ms·

Remote shell to a Raspberry Pi at 39,000 ft

58 points by ingve 2y ago

rcarmo 2y ago
My alternative: Tailscale + mosh (or RDP set to 16-bit color).
bobim 2y ago
Yes but the Pi is calling home, so isn't that trading privacy for convenience? And I fail to understand how it's more secure than ssh + private key? There is still a connection outside.
- voidUpdate 2y ago
  My best guess is that its made for the lower end of tech user, who knows they want to ssh but doesn't know enough to be able to do it securely on their own? Otherwise I have no idea what the use-case is
  - geerlingguy 2y ago
    That's exactly the use case—I think after they switched to wayland, and RealVNC didn't work (it was included with the default install on every full version of Pi OS), they wanted to make sure there was an easy to use replacement. Most of us on HN use our own VPNs, or have a dozen other ways to get at infrastructure from anywhere (and mosh, as others have suggested, is a better alternative for simple shell access over high-latency flaky connections)... but there are a _lot_ of people who don't want to (or couldn't figure out how to) maintain their own VPN. Or they want to deploy Pis at remote sites and each one has a weird and unique networking config, and they don't want to mess with Tailscale or the like. It's a useful service, but it's not supposed to compete with homelabber setups, or enterprise solutions. At least I don't think so.
    - bobim 2y ago
      Ok, thanks, it makes sense. I can stick with dietpi and ssh.
- deleted 2y ago
  [deleted]
unwind 2y ago
I didn't read the domain, and was first a bit upset that the OP apparently flew to visit a store[1], but then realized that it's Mr Geerling (I don't follow him) so I guess it's more of a work thing, at least. 1: Yes I'm from Europe and yes I know that the US is big and that domestic flights are like taking the (approved) bus for many of y'all, it just doesn't feel like something that "fits" today's climate, so to speak.
- blueflow 2y ago
  Some people grew up in a household too poor for travel-by-plane to become a thing. I only knew about airplanes because i could see them in the sky and in the TV. I thought it was a rich people's thing. I'm telling that to make people aware that travel-by-plane is not only a carbon-intensive way to travel, but also a privilege not everyone has.
  - boffinAudio 2y ago
    When I lived in the USA, I flew almost every month - for work, for interviews, for a few days in some nice place. It really was like catching a bus. But, man was it stressy. Just getting to the airport, going through the security theatre, commuting on soulless American freeways for hours on end. Now that I live in Europe I do the same, but with trains - and it is a far more pleasant experience. I've even just taken the train for a couple of days so that I could get some work done - nothing gets the neurons firing better than an 8 hour train-ride to Prague or an overnighter to Hamburg or Paris. Its a pretty decent office environment too, if you book things right, or take a sleeper car. I know some folks who just take the train to work, not to get to work, on a regular basis. I absolutely love to be able to see the landscape scroll by while I wait for a build.. and have even had a TV set up in my terrestrial offices with such videos on in the background, although I confess that these days I really like those hour-long "walk through <city>" videos as a viable attention-boosting tool. And, this being Europe, Internet access is not so bad - never had issues with my remote shells being terminated due to altitude limits or zoning issues. Beer spills, and the opening of the disco car, on the other hand ..
    - 2y ago
amelius 2y ago
Does anyone know why it takes a few seconds to start a VNC session, even on a fast computer and a fast and low-latency connection? I'm using TigerVNC.
- any1 2y ago
  The initial handshake goes like this: First TCP handshake: - Client SYN - Server SYN ACK - Client ACK Then VNC handshake: - Server sends highest version that it supports - Client sends back the version that it wants to use - Server sends a list of authentication & encryption methods it supports - Client chooses from the list and sends its response If no authentication is used: - Server sends a message to the client saying auth went ok - Client sends init message - Server replies with its own init message - Client sends pixel format and supported codecs and requests the first frame - Server sends frame If the client chose authentication, more steps are added in between. E.g. if the client chose TLS this happens: - Server sends VEnCrypt version - Client sends VEnCrypt version - Server acks client's version and sends list of supported security subtypes - Client chooses a subtype and sends it - Server upgrades the connection to TLS which adds a couple of more round-trips (5 steps total for this item). If, for example, each step takes 100 ms, you should have a total of 1.2 s without auth and 2.1 s with TLS.
  - amelius 2y ago
    Thank you for this reply!
sgt 2y ago
I have a static IP at home so I can connect via my homelab server (let's call it the bastion) to any of my Pis. No need for VPN.
- voidUpdate 2y ago
  I do that too, but I have a domain to make it easier to remember haha. I should probably beef it up some more though, just in case
- op00to 2y ago
  You don’t even need a static IP. I simply update the dns record (A and AAAA) every time it changes.
  - shzhdbi09gv8ioi 2y ago
    You're right and I used to do the same for years (dyndns xD) But my current ISP required me to pay extra for a static IP, where their ordinary "dynamic IP" offering shares IP and don't allow for direct connections from the internet. This never used to be the case.
    - op00to 2y ago
      That stinks! At this point, it's not even internet access anymore!
- theandrewbailey 2y ago
  A static IP and a VPN solve unrelated problems. Even if you have a static IP, a VPN can still be useful.
mypastself 2y ago
> It's similar to SSH works, but with SSH you'd need your Pi exposed to the Internet. How does Pi Connect’s access differ from regular port forwarding? Isn’t the device still exposed to the Internet? The article mentions Cloudflare tunnels near the end. Does this work on a similar principle as Argo? (I haven’t watched the video yet.)
- crote 2y ago
  The trick is that the connection is made using a third-party server: both the laptop and the Pi make an outgoing connection to this server, and the server sets up a connection between the two when there's pre-existing authorization. This means there's no need to poke a hole in your NAT/firewall to allow an incoming connection to the Pi. There's some magic stuff going on in the background to avoid having all data flow via the server by making it peer-to-peer after initialization, but that's the gist of it.
  - curiousdeadcat 2y ago
    Its not black magic. Its yet another one-off nat hole punch implementation. Absolutely no reason to even think of this when tailscale exists.
nelox 2y ago
The author meant to write “Remote shell to a Raspberry Pi from 39,000 ft.”
duiker101 2y ago
For those like me that were wondering what the resource monitor shown in the photo is, it's btop. https://github.com/aristocratos/btop https://github.com/aristocratos/btop
linuxdude314 2y ago
I get that it’s Jeff, but why is this on the homepage? Silly to think this is relevant at all to HN.
- megous 2y ago
  Yeah, about as exciting as "I ssh'd to a server from a toilet".
  - op00to 2y ago
    If the toilet had a screen and he hacked the toilet to get a shell, that would be amazing!
    - mypastself 2y ago
      I hope he flushed the DNS afterwards.
  - uuddlrlrbaba 2y ago
    Now this is a blog post I could get into!
- shzhdbi09gv8ioi 2y ago
  Engagement like your comment is why it is on the frontpage.
cl3misch 2y ago
I generally like Jeff's content but this headline borders on clickbait. The "39000 ft" part is achieved with airplane wifi over satellite. Otherwise it's just remote shell to a Raspberry Pi.
op00to 2y ago
If you’re too scared to run SSH on the internet, but you feel comfortable with a VPN… you probably don’t know how to use SSH keys. I continue to be unimpressed with this guy and have no idea why he is plastered all over the internet.
- BossingAround 2y ago
  You expose VPN to the internet, and expose SSH access just to the private VPN. You can still use SSH keys for your SSH auth, but now with the added layer of listening only on the VPN network. Isn't that strictly better? I.e. even if an attacker exploits a vulnerability to get to your private VPN network, they now have to find another exploit to get SSH access (presumably with the same SSH keys setup). Edit: Aaah, the VPN isn't a private VPN, but Raspberry Pi Foundation's VPN, to use some of their solution to get to your RPI, right? In that case, I agree, the attack vector is just larger. I was confused because the article mentions a private VPN that Jeff has set up himself.
  - marcus0x62 2y ago
    > Isn't that strictly better? I think that greatly depends on the VPN. For something like Wireguard with a tiny attack surface? Sure, you can make that argument. For something big and sprawling like a commercial VPN (or even something open source like OpenVPN) - I think unless you have some other reason to run that VPN system anyway, the VPN probably has more attack surface than OpenSSH (and, in all likelihood, a worse security record to boot.) Also, consider that if you are running the VPN server on the same system as the SSH daemon, an attacker generally wouldn't need to compromise the SSH daemon after compromising the VPN server - they'd probably already have a root shell just from popping the VPN.
  - op00to 2y ago
    Layered security is good, but you're still using a key to access a resource. Looked at individually, using a key to access a VPN is not more secure than using a key to access SSH. The risk isn't a remotely exploitable bug in ssh, but losing your secrets due to some other vulnerability. If someone has access to your SSH key, they almost certainly are able to also access your VPN key - both are saved in your home directory and need to be regularly accessible. If, maybe, your VPN uses two factor authentication, that makes it much harder, but you could also use two factor authentication for SSH, and we're back to where we were before.
master_crab 2y ago
Generally like Jeff’s stuff but maybe rename this to “Remote shell into a Raspberry pi without a VPN”? Otherwise no one on hacker news is going to care. We’ve been doing that for years on planes with traditional home VPNs or things like Tailscale.
alamortsubite 2y ago
ASCII Star Wars is a limitation of the Pi? Bandwidth isn't always all that limited in-flight. I've watched plenty of sports on my phone.
devdiary 2y ago
No thanks The original Raspberry announcement about Raspberry Pi Connect > All devices get remote shell out-of-the-box, and if you use a Wayland compositor, such as Wayfire, you can also share your screen. In practice, this means you can use screen sharing with Raspberry Pi 4 and later models, and remote shell with all models of Raspberry Pi, even the oldest. Now I have another task to purge this out of my pi.
polairscience 2y ago
I agree it's click baity. My personal favorite related moment, where I felt strongly "the future is now" was when I connected to a research station running autonomously on the Greenland ice sheet... while flying over the Greenland ice sheet to the UK last month. I was able to debug a software problem via satellite link while hurtling through the air in a tin can. Blew my mind. The latency was about 8 seconds, which was painful.
cedws 2y ago
You SSH’d to a Raspberry Pi using plane Wi-Fi… OK?
nunez 2y ago
A) this is great for hobbyists who aren't super technical, but B) Tailscale achieves this, with even more security if you want (I.e. only make the box accessible through a subnet router within your tailnet) and C) Most of Southwest's 737s have been updated with satellite internet that offers okay latency and high bandwidth. This will straight up not work on a regional jet with GoGo/intelsat terrestrial internet that relies on cell towers. Latency is way too high. Keystrokes take like two or three seconds to get picked up.
mnw21cam 2y ago
As one of the comments says, mosh is great for this sort of thing. I use mosh from my laptop, and it is simply bullet-proof. I can hibernate my laptop, warm it up a few days later, and it's all still connected absolutely fine. Running processes that produce loads of output don't care either. In fact, it's now my preferred way to run long jobs for work that don't want to be interrupted by a dropped connection - the alternative is running them with nohup or "at now".
- polairscience 2y ago
  I would argue that it's still much better to run "real" jobs in a daemon or in a multiplexer like screen or tmux. But for picking stuff up, agreed, mosh is amazing.
  - mnw21cam 2y ago
    Yes, the difference is that if the computer running mosh client crashes (or runs out of battery without you realising), then you lose the ability to re-connect with the mosh server, which is where screen or tmux win.
johnklos 2y ago
While the title might make one think, "They've caught up to 1999!", the real point of the article and video seems to be "Raspberry Pi Connect", which is neat, but somewhat orthogonal to ssh and to choosing ssh over VNC on an airplane. Since many ISPs haven't deployed IPv6, or have done so half-assed, services like "Raspberry Pi Connect" may become more and more necessary. Some people have no choice but to be behind CG-NAT, like Starlink and T-Mobile Home 5G, so this is good for them. While I don't see much wrong with "Raspberry Pi Connect", I'm not a fan of the intermingling between the for-profit and the not-for-profit parts of the Raspberry Pi Foundation. Let's just hope the for-profit part doesn't decide that all the money isn't enough and they want to monetize "Raspberry Pi Connect" in the future. And remember, kids, "Raspberry Pi Connect" is not as secure as ssh, so don't set up services lazily thinking they're protected! Set up key-based ssh, anyway, and heck, have VNC listen only on localhost and port forward over ssh so that your VNC password can't be brute forced.

58 points by ingve 2y ago

My alternative: Tailscale + mosh (or RDP set to 16-bit color).

Yes but the Pi is calling home, so isn't that trading privacy for convenience? And I fail to understand how it's more secure than ssh + private key? There is still a connection outside.

voidUpdate 2y ago
My best guess is that its made for the lower end of tech user, who knows they want to ssh but doesn't know enough to be able to do it securely on their own? Otherwise I have no idea what the use-case is
- geerlingguy 2y ago
  That's exactly the use case—I think after they switched to wayland, and RealVNC didn't work (it was included with the default install on every full version of Pi OS), they wanted to make sure there was an easy to use replacement. Most of us on HN use our own VPNs, or have a dozen other ways to get at infrastructure from anywhere (and mosh, as others have suggested, is a better alternative for simple shell access over high-latency flaky connections)... but there are a _lot_ of people who don't want to (or couldn't figure out how to) maintain their own VPN. Or they want to deploy Pis at remote sites and each one has a weird and unique networking config, and they don't want to mess with Tailscale or the like. It's a useful service, but it's not supposed to compete with homelabber setups, or enterprise solutions. At least I don't think so.
  - bobim 2y ago
    Ok, thanks, it makes sense. I can stick with dietpi and ssh.
deleted 2y ago
[deleted]

unwind 2y ago

I didn't read the domain, and was first a bit upset that the OP apparently flew to visit a store[1], but then realized that it's Mr Geerling (I don't follow him) so I guess it's more of a work thing, at least. 1: Yes I'm from Europe and yes I know that the US is big and that domestic flights are like taking the (approved) bus for many of y'all, it just doesn't feel like something that "fits" today's climate, so to speak.

blueflow 2y ago
Some people grew up in a household too poor for travel-by-plane to become a thing. I only knew about airplanes because i could see them in the sky and in the TV. I thought it was a rich people's thing. I'm telling that to make people aware that travel-by-plane is not only a carbon-intensive way to travel, but also a privilege not everyone has.
- boffinAudio 2y ago
  When I lived in the USA, I flew almost every month - for work, for interviews, for a few days in some nice place. It really was like catching a bus. But, man was it stressy. Just getting to the airport, going through the security theatre, commuting on soulless American freeways for hours on end. Now that I live in Europe I do the same, but with trains - and it is a far more pleasant experience. I've even just taken the train for a couple of days so that I could get some work done - nothing gets the neurons firing better than an 8 hour train-ride to Prague or an overnighter to Hamburg or Paris. Its a pretty decent office environment too, if you book things right, or take a sleeper car. I know some folks who just take the train to work, not to get to work, on a regular basis. I absolutely love to be able to see the landscape scroll by while I wait for a build.. and have even had a TV set up in my terrestrial offices with such videos on in the background, although I confess that these days I really like those hour-long "walk through <city>" videos as a viable attention-boosting tool. And, this being Europe, Internet access is not so bad - never had issues with my remote shells being terminated due to altitude limits or zoning issues. Beer spills, and the opening of the disco car, on the other hand ..
  - 2y ago

amelius 2y ago

Does anyone know why it takes a few seconds to start a VNC session, even on a fast computer and a fast and low-latency connection? I'm using TigerVNC.

any1 2y ago
The initial handshake goes like this: First TCP handshake: - Client SYN - Server SYN ACK - Client ACK Then VNC handshake: - Server sends highest version that it supports - Client sends back the version that it wants to use - Server sends a list of authentication & encryption methods it supports - Client chooses from the list and sends its response If no authentication is used: - Server sends a message to the client saying auth went ok - Client sends init message - Server replies with its own init message - Client sends pixel format and supported codecs and requests the first frame - Server sends frame If the client chose authentication, more steps are added in between. E.g. if the client chose TLS this happens: - Server sends VEnCrypt version - Client sends VEnCrypt version - Server acks client's version and sends list of supported security subtypes - Client chooses a subtype and sends it - Server upgrades the connection to TLS which adds a couple of more round-trips (5 steps total for this item). If, for example, each step takes 100 ms, you should have a total of 1.2 s without auth and 2.1 s with TLS.
- amelius 2y ago
  Thank you for this reply!

sgt 2y ago

I have a static IP at home so I can connect via my homelab server (let's call it the bastion) to any of my Pis. No need for VPN.

voidUpdate 2y ago
I do that too, but I have a domain to make it easier to remember haha. I should probably beef it up some more though, just in case
op00to 2y ago
You don’t even need a static IP. I simply update the dns record (A and AAAA) every time it changes.
- shzhdbi09gv8ioi 2y ago
  You're right and I used to do the same for years (dyndns xD) But my current ISP required me to pay extra for a static IP, where their ordinary "dynamic IP" offering shares IP and don't allow for direct connections from the internet. This never used to be the case.
  - op00to 2y ago
    That stinks! At this point, it's not even internet access anymore!
theandrewbailey 2y ago
A static IP and a VPN solve unrelated problems. Even if you have a static IP, a VPN can still be useful.

mypastself 2y ago

> It's similar to SSH works, but with SSH you'd need your Pi exposed to the Internet. How does Pi Connect’s access differ from regular port forwarding? Isn’t the device still exposed to the Internet? The article mentions Cloudflare tunnels near the end. Does this work on a similar principle as Argo? (I haven’t watched the video yet.)

crote 2y ago
The trick is that the connection is made using a third-party server: both the laptop and the Pi make an outgoing connection to this server, and the server sets up a connection between the two when there's pre-existing authorization. This means there's no need to poke a hole in your NAT/firewall to allow an incoming connection to the Pi. There's some magic stuff going on in the background to avoid having all data flow via the server by making it peer-to-peer after initialization, but that's the gist of it.
- curiousdeadcat 2y ago
  Its not black magic. Its yet another one-off nat hole punch implementation. Absolutely no reason to even think of this when tailscale exists.

nelox 2y ago

The author meant to write “Remote shell to a Raspberry Pi from 39,000 ft.”

duiker101 2y ago

For those like me that were wondering what the resource monitor shown in the photo is, it's btop. https://github.com/aristocratos/btop https://github.com/aristocratos/btop

linuxdude314 2y ago

I get that it’s Jeff, but why is this on the homepage? Silly to think this is relevant at all to HN.

megous 2y ago
Yeah, about as exciting as "I ssh'd to a server from a toilet".
- op00to 2y ago
  If the toilet had a screen and he hacked the toilet to get a shell, that would be amazing!
  - mypastself 2y ago
    I hope he flushed the DNS afterwards.
- uuddlrlrbaba 2y ago
  Now this is a blog post I could get into!
shzhdbi09gv8ioi 2y ago
Engagement like your comment is why it is on the frontpage.

cl3misch 2y ago

I generally like Jeff's content but this headline borders on clickbait. The "39000 ft" part is achieved with airplane wifi over satellite. Otherwise it's just remote shell to a Raspberry Pi.

op00to 2y ago

If you’re too scared to run SSH on the internet, but you feel comfortable with a VPN… you probably don’t know how to use SSH keys. I continue to be unimpressed with this guy and have no idea why he is plastered all over the internet.

BossingAround 2y ago
You expose VPN to the internet, and expose SSH access just to the private VPN. You can still use SSH keys for your SSH auth, but now with the added layer of listening only on the VPN network. Isn't that strictly better? I.e. even if an attacker exploits a vulnerability to get to your private VPN network, they now have to find another exploit to get SSH access (presumably with the same SSH keys setup). Edit: Aaah, the VPN isn't a private VPN, but Raspberry Pi Foundation's VPN, to use some of their solution to get to your RPI, right? In that case, I agree, the attack vector is just larger. I was confused because the article mentions a private VPN that Jeff has set up himself.
- marcus0x62 2y ago
  > Isn't that strictly better? I think that greatly depends on the VPN. For something like Wireguard with a tiny attack surface? Sure, you can make that argument. For something big and sprawling like a commercial VPN (or even something open source like OpenVPN) - I think unless you have some other reason to run that VPN system anyway, the VPN probably has more attack surface than OpenSSH (and, in all likelihood, a worse security record to boot.) Also, consider that if you are running the VPN server on the same system as the SSH daemon, an attacker generally wouldn't need to compromise the SSH daemon after compromising the VPN server - they'd probably already have a root shell just from popping the VPN.
- op00to 2y ago
  Layered security is good, but you're still using a key to access a resource. Looked at individually, using a key to access a VPN is not more secure than using a key to access SSH. The risk isn't a remotely exploitable bug in ssh, but losing your secrets due to some other vulnerability. If someone has access to your SSH key, they almost certainly are able to also access your VPN key - both are saved in your home directory and need to be regularly accessible. If, maybe, your VPN uses two factor authentication, that makes it much harder, but you could also use two factor authentication for SSH, and we're back to where we were before.

master_crab 2y ago

Generally like Jeff’s stuff but maybe rename this to “Remote shell into a Raspberry pi without a VPN”? Otherwise no one on hacker news is going to care. We’ve been doing that for years on planes with traditional home VPNs or things like Tailscale.

alamortsubite 2y ago

ASCII Star Wars is a limitation of the Pi? Bandwidth isn't always all that limited in-flight. I've watched plenty of sports on my phone.

devdiary 2y ago

No thanks The original Raspberry announcement about Raspberry Pi Connect > All devices get remote shell out-of-the-box, and if you use a Wayland compositor, such as Wayfire, you can also share your screen. In practice, this means you can use screen sharing with Raspberry Pi 4 and later models, and remote shell with all models of Raspberry Pi, even the oldest. Now I have another task to purge this out of my pi.

polairscience 2y ago

I agree it's click baity. My personal favorite related moment, where I felt strongly "the future is now" was when I connected to a research station running autonomously on the Greenland ice sheet... while flying over the Greenland ice sheet to the UK last month. I was able to debug a software problem via satellite link while hurtling through the air in a tin can. Blew my mind. The latency was about 8 seconds, which was painful.

cedws 2y ago

You SSH’d to a Raspberry Pi using plane Wi-Fi… OK?

nunez 2y ago

A) this is great for hobbyists who aren't super technical, but B) Tailscale achieves this, with even more security if you want (I.e. only make the box accessible through a subnet router within your tailnet) and C) Most of Southwest's 737s have been updated with satellite internet that offers okay latency and high bandwidth. This will straight up not work on a regional jet with GoGo/intelsat terrestrial internet that relies on cell towers. Latency is way too high. Keystrokes take like two or three seconds to get picked up.

mnw21cam 2y ago

As one of the comments says, mosh is great for this sort of thing. I use mosh from my laptop, and it is simply bullet-proof. I can hibernate my laptop, warm it up a few days later, and it's all still connected absolutely fine. Running processes that produce loads of output don't care either. In fact, it's now my preferred way to run long jobs for work that don't want to be interrupted by a dropped connection - the alternative is running them with nohup or "at now".

polairscience 2y ago
I would argue that it's still much better to run "real" jobs in a daemon or in a multiplexer like screen or tmux. But for picking stuff up, agreed, mosh is amazing.
- mnw21cam 2y ago
  Yes, the difference is that if the computer running mosh client crashes (or runs out of battery without you realising), then you lose the ability to re-connect with the mosh server, which is where screen or tmux win.

johnklos 2y ago

While the title might make one think, "They've caught up to 1999!", the real point of the article and video seems to be "Raspberry Pi Connect", which is neat, but somewhat orthogonal to ssh and to choosing ssh over VNC on an airplane. Since many ISPs haven't deployed IPv6, or have done so half-assed, services like "Raspberry Pi Connect" may become more and more necessary. Some people have no choice but to be behind CG-NAT, like Starlink and T-Mobile Home 5G, so this is good for them. While I don't see much wrong with "Raspberry Pi Connect", I'm not a fan of the intermingling between the for-profit and the not-for-profit parts of the Raspberry Pi Foundation. Let's just hope the for-profit part doesn't decide that all the money isn't enough and they want to monetize "Raspberry Pi Connect" in the future. And remember, kids, "Raspberry Pi Connect" is not as secure as ssh, so don't set up services lazily thinking they're protected! Set up key-based ssh, anyway, and heck, have VNC listen only on localhost and port forward over ssh so that your VNC password can't be brute forced.