David Leadbeater

Probably worth noting that Ghostty was very recently vulnerable to an old/familiar class of terminal vuln that bit a bunch of older terminal applications a while back: https://dgl.cx/2024/12/ghostty-terminal-title So moving to a newer / less "bloated" terminal may also just wind the clock back and cause you to encounter a similar sequence of vulns again, like some kind of unfortunate real-world "New Game Plus".

> While good luck doing that on a laptop that is only ever used to establish an SSH session. [...] > Set that up about ten months ago now (don't remember exactly). It's working flawlessly. Not a single issue. So now your laptop hasn't had security updates for 10 months? Things like this are part of the reason I did the research in https://dgl.cx/2023/09/ansi-terminal-security. It also funny that you've reinvented basically a serial console, but in a modern way, with a second factor. (You could actually just use a physical terminal with S/Key or something.) > P.S: it's just a proof of concept... But I think that requiring to tap a Yubikey every single time you want to do something as root is something that should be envisaged/discussed more and it was great to read TFA doing it too. Agreed, https://neilzone.co.uk/2022/11/using-a-yubikey-or-other-security-key-f… is another potential option for this.

Seems like we live in parallel worlds but I will show you how I am right except you can really proof I am wrong: At Google, they recommend to go to https://www.google.com/advanced_search so you can write all the keywords you want. In this case I searched for: kvt reverse exploit [1] you can quickly see that google search results are inaccurate and it shows first my HN post because it was very recent. Also the recent article where it is also mentioned and added after I post it here in HN [2] and the following results doesn't end in some correct previous post. I then try again [3] with a more precise search adding kconsole and only found three results without all the keywords while the advanced search says explicitly that all these keywords should be there. Am I missing something? [1] https://www.google.com/search?as_q=kvt+reverse+exploit&as_epq=&… [2] https://dgl.cx/2023/09/ansi-terminal-security [3] https://www.google.com/search?as_q=kvt+reverse+exploit+kconsole&as…

These categories of vulnerability are not new: https://dgl.cx/2023/09/ansi-terminal-security -- any time you take any untrusted data and do literally anything with it, you're at risk.

> One day, on a plane with WiFi before paying, I noticed that DNS queries were still allowed and thought it would be nice to chat with an LLM over it. There used to be a service where DNS requests to FOO.that-service.org would return the abstract for the Wikipedia article "FOO". edit: I think it was this one, seems to be defunct now: https://dgl.cx/2008/10/wikipedia-summary-dns

https://dgl.cx/2024/12/ghostty-terminal-title https://github.com/ghostty-org/ghostty/security/advisories/GHSA-5hcq-3…

You'd compress the JSON, and leave the data that you extract from the JSON uncompressed using Generated Columns[1]. That way you can save the original JSON data, but still have fast querying, etc. It would look something like this: CREATE TABLE t1( json TEXT, data INT GENERATED ALWAYS AS (json_extract(body, '$.d')) STORED ); If all you need is fast querying you could make `data` a `VIRTUAL` column and set up an index on it. You can read more about this kind of technique here: https://dgl.cx/2020/06/sqlite-json-support [1]: https://www.sqlite.org/gencol.html

I ended up writing a small wrapper on top of SQLite based on this: https://dgl.cx/2020/06/sqlite-json-support With proper concurrency control, it can work very well even for multi process applications.

You can also do this with haproxy. I ran it for a while (I think it was for git). Here is a page about how to do it: https://dgl.cx/2010/01/haproxy-ssh-and-ssl-on-same-port defaults timeout connect 5s timeout client 50s timeout server 20s listen ssl :443 tcp-request inspect-delay 2s acl is_ssl req_ssl_ver 2:3.1 tcp-request content accept if is_ssl use_backend ssh if !is_ssl server www-ssl :444 timeout client 2h backend ssh mode tcp server ssh :22 timeout server 2h

Or just use both :) https://dgl.cx/2010/01/haproxy-ssh-and-ssl-on-same-port

Didn't know about Wikipedia-over-DNS, that's pretty cool: https://dgl.cx/wikipedia-dns

Real criminals can: - Host such data off of a server bought with a stolen credit card and accessed via anonymous proxies. - Use any of the normal pastebin sides out there with offline encryption methods. (E.g. use PGP + copy/paste encrypted text into browser) - Host such data off of a hacked server. I don't really see how ZeroBin is scary. You could even do something like this: https://dgl.cx/wikipedia-dns with a hacked domain account + a hacked server. I'm sure the amount of traffic could be small enough for the hack to remain hidden for a long time.

> So now your laptop hasn't had security updates for 10 months? Things like this are part of the reason I did the research in https://dgl.cx/2023/09/ansi-terminal-security. That is very interesting: I'll study that. You're correct: it's a Debian 12.2 install (seriously hardened). I take it the surface attack is small. I'm literally using only SSH from that machine: it's got a firewall too. It's only allowing new SSH out session to the desktop. Every other traffic is rejected. So what can realistically affect that machine? SSH exploits for sure... So for example for the recent SSH "terraspin" exploit, I did implement the workaround (by removing broken Ciphers and MACs from the list of authorized ones). I don't know about the rest: I mainly SSH as root into the desktop when I need to install a new package and that's about it. I'm not losing too much sleep over that machine that is on a private LAN and which is not directly connected to the Internet (I'm running both 192.168.x.x and 10.x.x.x at home). I'm not saying it's a panacea: it was mostly a proof of concept and as it's working fine for my usecase, I kept using it.

Interesting project! I have lately been trying out these cool and perhaps in some way similar sqlite libraries: - https://github.com/haxtra/kvstore-sqlite (Basic key-value store for SQLite databases.) - https://github.com/haxtra/super-sqlite3 (Fast SQLite library with optional full db encryption, simple query builder, and a host of utility features, all in one neat package.) - https://github.com/haxtra/live-object (Standard javascript object with built-in JSON serialization to file. Dreams do come true sometimes.) All from github user: https://github.com/haxtra I think the super-sqlite3 source might also be an inspiration for the 'driver' topic: "super-sqlite3 is a thin wrapper around better-sqlite3-multiple-ciphers, which extends better-sqlite3 (the fastest SQLite library for node.js) with full database encryption using SQLite3MultipleCiphers. super-sqlite3 then adds its own query builder and other convenience features." And do check out this user's XRay (JavaScript object browser component) library for your preferred component framework. In my bookmarks I also found these other related and interesting links: - https://dgl.cx/2020/06/sqlite-json-support (An article about SQLite as a document database, using the relatively new 'genrated columns' feature of sqlite 3.31.0, which you seem to be using) - https://www.npmjs.com/package/best.db (easy and quick storage) - https://tinybase.org (This project seems to be an even more similar idea to Doculite)…