6 ms·

I'm saddened by the recent shift of HN discussions to Reddit-isms. For Reddit, we have Reddit. Please, stop wasting others' time.

by eliben 14y ago

deleted 14y ago
[deleted]
tripzilch 14y ago
And I am saddened by the not-so-recent yet constant Reddit-bashing over aspects of discussion that appear on HN and not necessarily at all on most programming-related subreddits. Those, in my experience, have a level of discussion quite comparable to HN[0]. [0] in a technical sense, the startup focus is quite unique to HN. or maybe I don't subscribe to startup-related subreddits (since startup news is not really the reason I read HN either)
recycleme 14y ago
You will find many sarcastic comments in HN. This has nothing to do with Reddit. However, I do appreciate when HNers add in a "/s" or something alike to make it clear that sarcasm was used. You can find quality conversations in Reddit but, more than likely, not in the default subreddits.
detst 14y ago
I love HN for discussions like this when a security expert familiar with the Chrome architecture will jump in and break things down (good or bad). Increasingly I expect a contrarian at the top stating nothing but the obvious fact that there are security implications. Can we stop this now?
cnlwsu 14y ago
These comments always remind me of this http://xkcd.com/603/ http://xkcd.com/603/ People have been complaining that Reddit was taking over years ago and will continue to. Strangely while people posting cat pictures is downvoted for not being productive conversation comments like this get upvoted when it contributes just as much. Heck its even in the guideline: If your account is less than a year old, please don't submit comments saying that HN is turning into Reddit. (It's a common semi-noob illusion.) Although I know you have been around for more then a year.
hosay123 14y ago
It is unfair to label this poor quality, the author clearly describes a problem with moving a security tool like SSH into the browser. Despite Chrome being speedily updated when known security problems are discovered, the attack surface compared to a dedicated client is huge: the 2-decade-old /usr/bin/ssh + /usr/bin/xterm combo has no concept of a DOM, does not share computing interfaces available to untrusted users (e.g. shared web workers), cannot receive messages from untrusted frames (postMessage()), cannot even be addressed by untrusted content (chrome://path/to/trusted/script), does not almost transparently expose ring0 drivers (OpenGL), does not have thousands of LOC on subsystems with little battle testing (WebRTC) and so on. Of course these features are thought to be secure, until they are discovered in the midst of a Stuxnet type scenario and suddenly everyone is patching like crazy. Wasn't Java considered invulnerable only 2 weeks ago? Look at what changed - somebody noticed it wasn't long after tens of thousands of infections already occurred, and today it is on every browser's plug-in blacklist. I can't recall the last I read about xterm in the Pwn2Own contest, or any 0-day in the past decade, nor can Google accidentally DoS my xterm because their sync service is down (happened last month). Following from the truism that the fastest, most bug-free code is code that doesn't exist, the easiest way to reduce exposure to unknown attacks is to minimize the amount of code running. Security design 101. Using something with the complexity of a web browser to render an 80x25 vector used to administer potentially hundreds of thousands of machines is almost the antithesis of good protocol.
- VikingCoder 14y ago
  Do most people run ssh and xterm on a bare-bones OS, or are they running on a full OS stack? An OS that they may or may not update frequently. An OS that they may or may not be logged into as an admin. An OS that may have a keylogger running on it. I think running SSH (or Chrome Remote Desktop) from a Chromebox is a pretty good way to have that minimal OS that is updated frequently, without admin privileges, with a lower risk of a keylogger. That I have to use two-factor to log into, even if my device is stolen.
  - ramayac 14y ago
    What do you think about using a js-keylogger via a malicious Chrome extension, could that be a plausible scenario?
acchow 14y ago
To be fair, 90% of the Google SWE interns last summer were given chromebooks (instead of MBP) as their laptops (to supplement their workstations). They were extremely disliked.
- Evbn 14y ago
  Come now. The interns weren't given nice computers, but they were still liked. And FWIW, the only real problem with Chromebook as corporate dumb terminal is the tiny screen resolution.
  - acchow 14y ago
    "ctrl+w" is normally used to move between split panes in vim. It closes the SSH tab on a Chromebook. Googlers were not happy.
jwr 14y ago
My answer was sarcastic, but there were real issues behind. Call it "informed sarcasm". Having used ssh since 1995 (on systems like SunOS 4.2 and UNICOS) I felt entitled to a bit of sarcasm. I thought it would be obvious to most readers how a tty environment is easier to control than a browser (really, just consider the number and pace of updates to your kernel/windowing system/terminal and your web browser), so I did not bother with lengthy explanations.

I'm saddened by the recent shift of HN discussions to Reddit-isms. For Reddit, we have Reddit. Please, stop wasting others' time.

by eliben 14y ago

I'm saddened by the recent shift of HN discussions to Reddit-isms. For Reddit, we have Reddit. Please, stop wasting others' time.

deleted 14y ago

[deleted]

tripzilch 14y ago

And I am saddened by the not-so-recent yet constant Reddit-bashing over aspects of discussion that appear on HN and not necessarily at all on most programming-related subreddits. Those, in my experience, have a level of discussion quite comparable to HN[0]. [0] in a technical sense, the startup focus is quite unique to HN. or maybe I don't subscribe to startup-related subreddits (since startup news is not really the reason I read HN either)

recycleme 14y ago

You will find many sarcastic comments in HN. This has nothing to do with Reddit. However, I do appreciate when HNers add in a "/s" or something alike to make it clear that sarcasm was used. You can find quality conversations in Reddit but, more than likely, not in the default subreddits.

detst 14y ago

I love HN for discussions like this when a security expert familiar with the Chrome architecture will jump in and break things down (good or bad). Increasingly I expect a contrarian at the top stating nothing but the obvious fact that there are security implications. Can we stop this now?

cnlwsu 14y ago

These comments always remind me of this http://xkcd.com/603/ http://xkcd.com/603/ People have been complaining that Reddit was taking over years ago and will continue to. Strangely while people posting cat pictures is downvoted for not being productive conversation comments like this get upvoted when it contributes just as much. Heck its even in the guideline: If your account is less than a year old, please don't submit comments saying that HN is turning into Reddit. (It's a common semi-noob illusion.) Although I know you have been around for more then a year.

hosay123 14y ago

It is unfair to label this poor quality, the author clearly describes a problem with moving a security tool like SSH into the browser. Despite Chrome being speedily updated when known security problems are discovered, the attack surface compared to a dedicated client is huge: the 2-decade-old /usr/bin/ssh + /usr/bin/xterm combo has no concept of a DOM, does not share computing interfaces available to untrusted users (e.g. shared web workers), cannot receive messages from untrusted frames (postMessage()), cannot even be addressed by untrusted content (chrome://path/to/trusted/script), does not almost transparently expose ring0 drivers (OpenGL), does not have thousands of LOC on subsystems with little battle testing (WebRTC) and so on. Of course these features are thought to be secure, until they are discovered in the midst of a Stuxnet type scenario and suddenly everyone is patching like crazy. Wasn't Java considered invulnerable only 2 weeks ago? Look at what changed - somebody noticed it wasn't long after tens of thousands of infections already occurred, and today it is on every browser's plug-in blacklist. I can't recall the last I read about xterm in the Pwn2Own contest, or any 0-day in the past decade, nor can Google accidentally DoS my xterm because their sync service is down (happened last month). Following from the truism that the fastest, most bug-free code is code that doesn't exist, the easiest way to reduce exposure to unknown attacks is to minimize the amount of code running. Security design 101. Using something with the complexity of a web browser to render an 80x25 vector used to administer potentially hundreds of thousands of machines is almost the antithesis of good protocol.

VikingCoder 14y ago
Do most people run ssh and xterm on a bare-bones OS, or are they running on a full OS stack? An OS that they may or may not update frequently. An OS that they may or may not be logged into as an admin. An OS that may have a keylogger running on it. I think running SSH (or Chrome Remote Desktop) from a Chromebox is a pretty good way to have that minimal OS that is updated frequently, without admin privileges, with a lower risk of a keylogger. That I have to use two-factor to log into, even if my device is stolen.
- ramayac 14y ago
  What do you think about using a js-keylogger via a malicious Chrome extension, could that be a plausible scenario?

acchow 14y ago

To be fair, 90% of the Google SWE interns last summer were given chromebooks (instead of MBP) as their laptops (to supplement their workstations). They were extremely disliked.

Evbn 14y ago
Come now. The interns weren't given nice computers, but they were still liked. And FWIW, the only real problem with Chromebook as corporate dumb terminal is the tiny screen resolution.
- acchow 14y ago
  "ctrl+w" is normally used to move between split panes in vim. It closes the SSH tab on a Chromebook. Googlers were not happy.

jwr 14y ago

My answer was sarcastic, but there were real issues behind. Call it "informed sarcasm". Having used ssh since 1995 (on systems like SunOS 4.2 and UNICOS) I felt entitled to a bit of sarcasm. I thought it would be obvious to most readers how a tty environment is easier to control than a browser (really, just consider the number and pace of updates to your kernel/windowing system/terminal and your web browser), so I did not bother with lengthy explanations.