4 ms·

A ssh server that knows who you are. $ ssh whoami.filippo.io

• gnabgib 9mo ago
  Popular in 2023 (240 points, 81 comments) https://news.ycombinator.com/item?id=34301768 https://news.ycombinator.com/item?id=34301768
• seg_lol 9mo ago
  It has downloaded every public key from github? I would use this trick to add them to my test clusters.
• pseudohadamard 9mo ago
  It's an artefact of OpenSSH braindamage, like a WiFi device spraying probe requests OpenSSH sprays all of your keys to any server it connects to and then takes whatever the server responds with as the one to auth. There's a CVE for this, CVE-2016-20012, but the OpenSSH maintainers rejected it as by-design, https://github.com/openssh/openssh-portable/pull/270 https://github.com/openssh/openssh-portable/pull/270.
  • FiloSottile 9mo ago
    If that PR were merged, whoami.filippo.io would still work the same. It would just receive signed requests instead of queries.
• fragmede 9mo ago
  Yes, but telling people to run ssh -o IdentityAgent=/dev/null -v -o IdentityFile=/dev/null funky.nondeterministic.computer instead of just ssh funky.nondeterministic.computer is harder to sell.
  • locke3891 9mo ago
    For those that care about privacy, couldn't you just use an alias? alias ssh='ssh -o IdentityAgent=/dev/null -o IdentityFile=/dev/null -v' then you can do ssh funky.nondeterministic.computer and get the same functionality.
    • rurban 9mo ago
      Just add it to your .ssh/config file