<story><title>SSH client in Google Chrome</title><url>https://chrome.google.com/webstore/detail/secure-shell/pnhechapfaindjhompbnflcldabbghjo?</url></story><parent_chain><item><author>eliben</author><text>I&apos;m saddened by the recent shift of HN discussions to Reddit-isms. For Reddit, we have Reddit. Please, stop wasting others&apos; time.</text></item><item><author>jwr</author><text>This is exactly what I&apos;ve been waiting for!&lt;p&gt;The ability to take my critical secret information into a huge, buggy, extensible, unaudited, complex and constantly changing browser environment! Who could resist?&lt;p&gt;This will also inspire innovators world-wide. Look at it this way: we can now find novel ways to steal passwords, secret keys, log sessions, access servers, sneak in trojans.&lt;p&gt;Count me in.</text></item></parent_chain><comment><author>hosay123</author><text>It is unfair to label this poor quality, the author clearly describes a problem with moving a security tool like SSH into the browser.&lt;p&gt;Despite Chrome being speedily updated when &lt;i&gt;known&lt;/i&gt; security problems are discovered, the attack surface compared to a dedicated client is huge: the 2-decade-old /usr/bin/ssh + /usr/bin/xterm combo has no concept of a DOM, does not share computing interfaces available to untrusted users (e.g. shared web workers), cannot receive messages from untrusted frames (postMessage()), cannot even be addressed by untrusted content (chrome://path/to/trusted/script), does not almost transparently expose ring0 drivers (OpenGL), does not have thousands of LOC on subsystems with little battle testing (WebRTC) and so on.&lt;p&gt;Of course these features are thought to be secure, until they are discovered in the midst of a Stuxnet type scenario and suddenly everyone is patching like crazy. Wasn&apos;t Java considered invulnerable only 2 weeks ago? Look at what changed - somebody noticed it wasn&apos;t long after tens of thousands of infections already occurred, and today it is on every browser&apos;s plug-in blacklist. I can&apos;t recall the last I read about xterm in the Pwn2Own contest, or any 0-day in the past decade, nor can Google accidentally DoS my xterm because their sync service is down (happened last month).&lt;p&gt;Following from the truism that the fastest, most bug-free code is code that doesn&apos;t exist, the easiest way to reduce exposure to unknown attacks is to &lt;i&gt;minimize the amount of code running&lt;/i&gt;. Security design 101. Using something with the complexity of a web browser to render an 80x25 vector used to administer potentially hundreds of thousands of machines is almost the antithesis of good protocol.</text></comment>
<story><title>SSH client in Google Chrome</title><url>https://chrome.google.com/webstore/detail/secure-shell/pnhechapfaindjhompbnflcldabbghjo?</url></story><parent_chain><item><author>eliben</author><text>I&apos;m saddened by the recent shift of HN discussions to Reddit-isms. For Reddit, we have Reddit. Please, stop wasting others&apos; time.</text></item><item><author>jwr</author><text>This is exactly what I&apos;ve been waiting for!&lt;p&gt;The ability to take my critical secret information into a huge, buggy, extensible, unaudited, complex and constantly changing browser environment! Who could resist?&lt;p&gt;This will also inspire innovators world-wide. Look at it this way: we can now find novel ways to steal passwords, secret keys, log sessions, access servers, sneak in trojans.&lt;p&gt;Count me in.</text></item></parent_chain><comment><author>tripzilch</author><text>And I am saddened by the not-so-recent yet constant Reddit-bashing over aspects of discussion that appear &lt;i&gt;on HN&lt;/i&gt; and not necessarily at all on most programming-related subreddits. Those, in my experience, have a level of discussion quite comparable to HN[0].&lt;p&gt;[0] in a technical sense, the startup focus is quite unique to HN. or maybe I don&apos;t subscribe to startup-related subreddits (since startup news is not really the reason I read HN either)</text></comment>