Rendered at 21:01:52 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
greengreengrass 1 days ago [-]
I would prefer the connection instructions made clear that the default SSH username would be used to set up my username on the platform and display that to other users without initially seeking my consent. On $machine[work], I don't get to pick that $USER is my full name.
If this affects you, make sure you connect with `ssh [pseudonymous name]@late.sh`.
soraminazuki 1 days ago [-]
> without initially seeking my consent
That's just how SSH works. If you want to be pseudonymous, you should also generate a new key pair.
greengreengrass 1 days ago [-]
> That's just how SSH works
I know that. Just because SSH automatically sends my local $USER doesn't mean they have to report the value received in the SSH username automatically on the game platform to other users, without first having prompted me "your username has been reported as <greengreengrass>. Is it okay to show this?".
A simple flag in my user profile in the platform to say whether I've said that's okay or not.
Or instructions to advise people to choose their username /before/ first connect. These are reasonable, privacy-preserving things to call out in a good and user-friendly design.
latchkey 1 days ago [-]
They do make it clear...
# privacy
we store your key fingerprint, not the full public key.
no IP logging. no tracking. no analytics.
chat messages and game scores are stored in
postgres, tied only to your fingerprint.
don't trust us? use a throwaway key:
$ ssh-keygen -t ed25519 -f ~/.ssh/late_throwaway && ssh -o IdentitiesOnly=yes -i ~/.ssh/late_throwaway late.sh
generates a disposable key — zero risk, full experience
Wow, this got flagged immediately. Must have triggered some automated thing. Sorry!
12 hours ago [-]
1dom 2 days ago [-]
This is a really cool idea, and very appealing. Also very nice that it looks usable with just an SSH client. It would be useful if it was explained what the companion client is for?
Another small personal gripe: I think you should either remove the 1 line copy/paste sh install on the homepage, or add a link to a git repo on the homepage. I know it's possible to view the sh by visiting it, but a raw text file doesn't give any info about contributors or development process. Current form of no git repo and copy/paste bash pipe on homepage feels like a dark pattern.
Izmaki 2 days ago [-]
Not to mention that a webserver can be configured to show one sh file when a regular browser visits and another when curl etc. gets it. Show one thing, install another.
nkrisc 1 days ago [-]
So download it with curl and read it first before executing it from your local disk.
codegladiator 1 days ago [-]
read it ? we dont do what kind of stuff here, i got my army of reader agents.
The link won’t load for me, but I’m having a hard imagining how a remote server could change a file on your hard drive.
Is it about deceptive commands that look like they’ll do something different using weird characters to alter what commands run or something?
Izmaki 13 hours ago [-]
The remote server is able to determine whether you are fetching the script using curl/browser or piped directly into bash. I don't remember the magic by heart, but the blog post conclusion was essentially that you can't / shouldn't blindly trust which scripts you pipe straight into bash from the internet, because even if it looks correct in a browser, the script you might end up running could be different.
It's more of a "this is possible" than "this is a real concern", of course.
endofreach 45 minutes ago [-]
> The remote server is able to determine whether you are fetching the script using curl/browser or piped directly into bash
I think you must be mixing something up here. At least i would be very surprised to learn how pipes are that leaky over the wire. It would be very interesting. But i can't imagine how a remote would differentiate between curl and curl piped. And the article doesn't load unfortunately.
drabbiticus 1 days ago [-]
This is helpful to know, but also pretty general security practice. If you are auditing an artifact, only use that audited artifact after, don't assume that a network endpoint can never change what it serves. If you must use a newly downloaded artifact, verify it matches whatever you audited by comparing some sort of hash or derived value.
1 days ago [-]
bl4ckbe4r 2 days ago [-]
noted, good feedback :) will change it later, thanks!
rob 1 days ago [-]
You don't have to change it just because one person complained. I personally like the "copy and paste curl command" to install something and I'm sure many others do as well. It's very convenient, and I can inspect the file myself if I'm that paranoid about it.
1dom 24 hours ago [-]
Sorry, it wasn't meant to come across as a complaint with copy and paste curl command, I agree with you it's convenient and I generally like it.
However, the sort of tools that generally provide it also generally have a GitHub link nearby to encourage reading/writing the source. That too is convenient and I generally like it. Seemed like a fair suggestion.
polycancel 1 days ago [-]
Also for all these kind of ssh stuff. Please include server finger print so others verify.
Is this your server fingerprint?
ED25519 key fingerprint is SHA256:Tc7aeaaQulKJeF3C/zd2BKvq/KgaQTHyMPNa3s9K+aE.
For those who don't know just discovered you can change your theme!
Ctrl + O -> Move down to your theme. Helps with the default one being a bit chaotic
Thanks for whoever made this. This is rad and gives me hope for the old internet vibes.
modinfo 2 days ago [-]
This is amazing! Even real icecast with irc <3
Even my fav game 2048, even with real LLM :D
Fantastic job mati!
bl4ckbe4r 2 days ago [-]
Thank you :)
kksweet 2 days ago [-]
This is like habbo hotel but for terminal nerds, amazing.
tristanMatthias 2 days ago [-]
Totally! Or Club Penguin
pishpash 1 days ago [-]
Reading this is like reading "this is like WiFi but for RJ11 nerds" while holding a dialup modem.
amanverasia 2 days ago [-]
Pay no need to other comments over here, this is awesome. I showed this to my co-workers, they all love it.
Izmaki 2 days ago [-]
OK, which one of yous tried to `sudo apt install bobs and vageen`?? xD
maxgashkov 1 days ago [-]
I'm wondering how many ssh'd into this with the agent forwarding on?
docheinestages 2 days ago [-]
I loved the text contrast on the landing page. Grey text on a dark background.
asdf88990 2 days ago [-]
Yeah, it is a very nice way of saying “f off” if you’re poor, whatever with your display (low res mobile) or eyesight.
nativeit 1 days ago [-]
Is this really not a mostly “solved” problem using assistive browser (or OS-level) settings/extensions that apply high-contrast/large type consistently across all sites/apps? Is it necessary to performatively sacrifice aesthetics to signal to everyone else you’re especially sensitive to these needs?
At what point is it enough? If they use high contrast, large fonts, and translations for every language—including Swahili’s default Kiunjuga dialect, but fail to include the Kimvita, Kiamu, Kingwana, Chimiini, Bajuni, AND Comorian dialects, will they be accosted for saying “f off” to everyone speaking Swahili outside of Zanzibar?
docheinestages 1 days ago [-]
> Is this really not a mostly “solved” problem using assistive browser (or OS-level) ...
> ... performatively sacrifice aesthetics ...
One doesn't need to sacrifice aesthetics to make the design legible to an average user.
> At what point is it enough?
It depends on who your audience is. The more people you want to reach, the more you need to cater to everyone's needs. There are fundamental anti-patterns to avoid like writing with a dark font on a dark background.
nativeit 1 days ago [-]
I generally agree with the first point. As to the second, this is clearly designed for people who will have the technical know-how to facilitate custom CSS, browser extensions, reader modes, and other assistive technology.
Considering its branding is entirely centered on late night socialization, I feel low-contrast dark mode is precisely the aesthetic that fits its identity.
docheinestages 1 days ago [-]
> people who will have the technical know-how to facilitate custom CSS
I think anyone with access to an LLM doesn't necessarily need the technical know-how. They can just ask as an extra step for a design check including text contrast.
> I feel low-contrast dark mode is precisely the aesthetic
Agreed, and I like it too, if legible.
jwr 1 days ago [-]
That is a modern BBS! I love the idea. Though I guess most people these days don't know what a BBS is, if you don't, look it up.
Schlagbohrer 2 days ago [-]
Is this just IRC
T3OU-736 1 days ago [-]
More of a BBS, I'd argue. Replace dialing with a modem with SSH, and otherwise the analogy holds decentky well.
Dangeranger 1 days ago [-]
For anyone looking for a safer way to evaluate this (like myself), feel free to use my safer ssh connection script[0].
Reminder to be cautious about leaking public keys.
Once you leak your public key it could be used to check if another server recognizes that leaked public key.
alentred 1 days ago [-]
Did I miss something? Aren't public key are supposed to be public?
To be clear, that's an honest question, not sarcasm of anything. I only assume I don't know about some corner case with SSH or something? Because we have those on our websites, they are supposed to be used to verify signatures, etc. How is publishing them bad?
h43z 1 days ago [-]
It's just something everyone should be aware of.
It's up to you to decide if it's okay that you send a server provider (in this case late.sh) a bunch of your public keys which he could for example use to probe other servers to see if you have access to them.
Everyone has different opsec.
drabbiticus 1 days ago [-]
The site does include a way to use a throwaway key and IIRC it was there last night too.
Based on what another user said, you might want to modify the above command to use throwawayUsername@late.sh instead if you are going the throwaway route to be more certain you aren't leaking your OS username.
benj111 1 days ago [-]
Surely you shouldn't be leaking your username. I could use it to see if another server recognised 'h43z'....
h43z 1 days ago [-]
OpenSSH server is designed not to reveal whether a username exists.
Zambyte 1 days ago [-]
What?
h43z 1 days ago [-]
By default SSH leaks all of the below public keys (if they exist) + all public keys in your ssh-agent to a server you connect to.
this would only send the late_throwaway public key
Zambyte 1 days ago [-]
Okay, but why is that something to be concerned about? How would one be able to probe to see if a server recognizes a public key? Why does that matter?
prodigycorp 1 days ago [-]
so, i used my public key. can someone please tell me what i should be worried about now?
h43z 1 days ago [-]
If I have your public key I could probe a server to see if it recognizes that public key. Which would tell me information you might not want to be leaked.
Hugsbox 1 days ago [-]
Could you explain how/why that would be an issue? I still don't understand. Isn't the nature of public keys meant to be that they're public?
dmux 1 days ago [-]
I think what the other comment is getting at is that you're essentially leaving footprints behind on various servers and that information could be used to narrow down who you are, where you work, etc. For example, if you used the same key pair for a work machine at the big social media site example.com as you did late.sh, they could probe example.com's machine and see that you'd been there.
stevekemp 1 days ago [-]
Github has public keys available, so the server owner could compare the key you sent to those - and that would identify your github username.
Whether that's a concern or not is an open question, of course.
plaidwombat 1 days ago [-]
All your base are belong to us. We recommend rotating keys more often than never.
ErroneousBosh 1 days ago [-]
l33t h4xx0r5
nntlol 1 days ago [-]
[dead]
andschneider 1 days ago [-]
shameless self plug for a similar ssh experience, but for baseball: https://mlbt.sh
I built it with the same stack and around the same time as late.sh, which I used for some inspiration.
also, mlbt can be run locally as a TUI.
2 days ago [-]
joshspankit 1 days ago [-]
Super cool and seems to have a depth of historical knowledge
I’m shocked to see that LORD can’t be used because of licensing. Legally I know that’s how it is, but it Just Feels Wrong(tm) that a popular game based on 9600baud phone modems is encumbered in the era of fibre, wifi, and smartphones
Haha, nice website, with the greyed-out comments on HN featured among the offending examples. :)
nativeit 1 days ago [-]
The whole brand identity is “late”, as in late night, as in all the lights are off and I don’t want my screen to blind me. I feel like this is a perfectly appropriate sort of theme, but maybe that’s just my inner 20-year old impugning my inner 70-year old?
bjelkeman-again 2 days ago [-]
So much modern GUI design is really poor for those a bit older where contrast is important.
1e1a 2 days ago [-]
The accessibility checker in Chrome/Firefox devtools would immediately flag this.
d0ddy 2 days ago [-]
there are many many themes. some high contrast ones
sevenzero 2 days ago [-]
Hmm maybe the tool has but the design of the website made me squint as well.
ssl-3 2 days ago [-]
Me, too. For me, it was easier without the DarkReader plugin enabled than with it (which is kind of common), but it wasn't great to see either way.
arnitdo 2 days ago [-]
Vibe coded slop has the same patterns of black-on-black and grey-on-grey illegible text. Mix that with piss poor monospace, small-size fonts and you have to squint to read each letter
viccis 2 days ago [-]
I'm, by contrast, an able bodied person with functioning eyes and had no issues.
tapland 2 days ago [-]
You might not have the average display.
But, can you reason more about your intent with the tone of your comment?
viccis 6 hours ago [-]
Absolutely not.
1vuio0pswjnm7 1 days ago [-]
"your ssh key is your identity."
"don't trust us? use a throwaway key"
arm32 1 days ago [-]
I've never seen such a lame landing page for such a FREAKING COOL project. It's like a reverse trojan horse.
Anyway, with that critique aside, this is the coolest thing I've seen all quarter.
podviaznikov 1 days ago [-]
love this!
was panning to add similar things into my own macOS[1] ssh app with persistent SSH server.
NEW web design with better contrast incoming! :D Thank you for the feedback :)
pixlmint 1 days ago [-]
yeah I was gonna say, it's very difficult to read on an eink display. And while we're at it, I believe my phone is set to reduced animations, which I believe is a preference that's exposed to websites, the experience would be much better without so much blinking going on.
nativeit 1 days ago [-]
There’s a single green box blinking at the top. If that’s too much for your e-ink display to handle, I think the problem is your display.
nativeit 1 days ago [-]
Don’t forget to include translations to all 190+ languages, and their various dialects. Otherwise, you obv. don’t care about being inclusive to Sentinelese users. /s
Your dark mode choice for your late night chat is appropriate, and good branding. If someone’s technically literate enough to engage with an SSH-based social network, then they should be capable of injecting user scripts, custom CSS, and/or deploying assistive browser extensions, OS settings, and screen readers.
If this were a website about cataract treatments or a Metamucil landing page, then it would be a bad design.
hahahaa 2 days ago [-]
why not just use irc?
bl4ckbe4r 2 days ago [-]
can you listen to music, play sudoku/nanograms/tetris, do live artboard, jump into NetHack/DCSS/dopewars/LOGD insdie IRC?
muzani 2 days ago [-]
Which servers are still alive?
Hugsbox 1 days ago [-]
Still plenty of thriving communities on IRC, particularly on Libera but elsewhere too. Similar to HN, it's one of the few remaining places on the internet you can hope to have a decent conversation.
stackghost 2 days ago [-]
Rizon, hackint, and Libera, among others
dark-star 1 days ago [-]
nobody has mIRC/ircii installed by default
everyone has ssh installed by default
hahahaa 18 hours ago [-]
Guess you could have ssh to irc bridge
tonyrice 2 days ago [-]
I really love this!
catfisher 2 days ago [-]
Pretty cool ngl.
warthog 1 days ago [-]
this is amazing, great idea
jrflowers 2 days ago [-]
Nice! I was just thinking about how much I love installing binaries instead of going to a website
kennywinker 1 days ago [-]
Good thing you don't have to install anything to run `ssh late.sh` and check this out
DANmode 2 days ago [-]
Ever see something new, and just know it’s going to survive?
Your site copy is great to the last drop.
Great submission.
sevg 2 days ago [-]
> Your site copy is great to the last drop.
It is? It’s just the usual LLM.
DANmode 2 days ago [-]
The design = “flavor of the week LLM”,
but someone still has to proof and tweak generated copy.
Someone cared about this page.
notpushkin 2 days ago [-]
No X. No Y. A is your B.
We do G, not H. C, D, E — plus an optional F.
No I, no J, no K — just an L into a W.
I would say the design is the most human thing about this page. (It has its charm somehow, even if it’s obviously “flavour of the week LLM design”. Also, I don’t think an LLM would choose colours so poorly unless nudged in that direction – accidentally, I suppose.)
DANmode 1 days ago [-]
Oh no, concise sentences.
Must be an inappropriate use of the robot!
Kind of exhausting.
If you think (or care), that the LLM wrote all of the subheaders, the category names etc, then you might be spending too much time focused on the wrong thing.
sevg 16 hours ago [-]
> If you think (or care)
I don’t think anybody really cares, the reaction is because you praised some copy that was obviously written by an LLM and either not edited or barely edited.
DANmode 16 hours ago [-]
There was barely anything to edit, and I think they did a great job choosing what NOT to write out on the lander.
Sometimes less is more.
sevg 16 hours ago [-]
> Less is more.
Yes, we should all just throw LLM-generated copy out there with minimal effort. Then receive your praise for the effort and care put in XD
The fact you’re still trying to defend an indefensible position suggests you must be trolling. Or at least, I _hope_ you’re trolling ;)
DANmode 16 hours ago [-]
I wish - I wouldn’t feel so stupid for replying! =]
I genuinely found the space cool, and modern in a good way.
Stuff like this has often been an “ugly“ aesthetic, with slapped together and or minimal scaffolding. Or started that way.
I thought it was more than enough for a social PoC, & hope it develops further.
sevg 15 hours ago [-]
I also found it cool/fun and seems many others did too! But this thread isn’t about that.
LLM-driven PoC is common and normal these days (and I do it too). But praising the copy here is like praising stock photos.
DANmode 7 hours ago [-]
├─ chill radio, classical, and guest stations
├─ the arcade (2048, sudoku, nonograms, solitaire)
├─ collaborative artboard
├─ daily challenges & streaks
├─ live chat
├─ share & discuss news
└─ multiplayer games (coming soon)
^This didn’t feel like LLM to me.
& for the category descriptions, I’m used to way more convoluted word-choice places like…here, lol, so that didn’t stand out to me the way it did for everyone else.
Only the conciseness, the need-to-know.
notpushkin 1 days ago [-]
I don’t really care. I’m just... disappointed a bit? It seems like a cool project, but those “concise sentences” don’t make it easier to learn about it.
no passwords. no OAuth. no accounts.
your ssh key is your identity.
chats, scores, and streaks are tied to your public key fingerprint. same key, same data.
No accounts? How is that possible? You literally store my data! Is that not an account?
And what the fuck is OAuth? (Okay, this clearly is oriented at developers, but on its own the sentence just doesn’t make sense. For me as a user, what pain is removed by not having a “Sign in with GitHub” button? Why should I care?)
How about you tell me why you decided to do it that way:
all your data – chats, scores, streaks – is tied to your ssh public key.
no need to come up with a password or verify your email – just ssh in.
It took me a couple of minutes to write this, sure, but at least it now makes sense. And it’s more concise, no? (It still sounds llm-y to me, but whatever.)
Now, for bonus points, there’s two obvious questions to answer:
• what do I do if I lose my SSH key?
• what do I do if I use more than one device?
(The obvious answers are “you can add other SSH keys in your account settings” and “you can add other SSH keys in your account settings”.)
---
Okay, one more, and then I need to go grab a beer.
a read-only peek at the TUI in your browser.
tab around, see what's inside.
no typing, no chat, no games — just a window
into a shared demo session.
for the real thing, `ssh late.sh`.
Concise?
a read-only preview of late.sh in your browser.
poke around and see what's inside. `ssh late.sh` when you’re ready to chat and play.
DANmode 16 hours ago [-]
I like your last improvement, for sure.
The goal of the lander is to get you to use the clubhouse.
Not get you to become a contributor, or intrigued/turned away by their stack choice.
PS You could also be a heathen, and use the same key across devices!
notpushkin 12 hours ago [-]
> The goal of the lander is to get you to use the clubhouse. Not get you to become a contributor, or intrigued/turned away by their stack choice.
Yep! That’s the idea. When writing, think about what your users want to know. If there is some technical detail you want to clarify – show how it helps the user.
> use the same key across devices!
That’s easier for sure! But if I lose a device, revoking one key on every server/service is a PITA already, and reissuing and replacing it on every server and client is even more so. (Also, this wouldn’t work with HSM-backed key stores like https://github.com/maxgoedjen/secretive :-)
tkel 2 days ago [-]
There's maybe 100 words on the page. It would have taken someone 5 minutes to type that out. But apparently the creator didn't even care enough to do that.
calgoo 2 days ago [-]
See thats the difference, i don't core personally. Its a page to tell you to connect to the ssh server (or install their script). Why does it have to be a philosophical masterpiece? Its just word on a page saying click here, better looking then the majority of the SEO garbage that has plagued the internet for the last 15 year thanks to google and friends.
tkel 2 days ago [-]
You might be projecting . All the docs in the app looks like the usual wall-of-text that was autogenerated .
sevg 2 days ago [-]
Yeah, no. Not enough to make the page not look and sound like straight from an LLM.
ga_to 2 days ago [-]
Also not enough to make the text even a slight bit more readable.
I have perfect eyes and am still struggling to focus on the headlines.
orphereus 2 days ago [-]
Lol
2 days ago [-]
vjay15 2 days ago [-]
this is amazing
TurdF3rguson 2 days ago [-]
And... Cue 1M dummies here running that code without even looking at it, SMH.
1dom 2 days ago [-]
It's possible to login and interact and use late.sh with just your SSH client - there's no need to download or run custom code. But you that did make me realise that they don't have a github link on that page anywhere.
Your tone in this comment is a bit out of place on HN. Why are you here if you think it's 1M dummies?
TurdF3rguson 2 days ago [-]
The people why ran that line without knowing what it does are dummies. And yes maybe not 1M but there were a lot of them.
kennywinker 1 days ago [-]
the line `ssh late.sh`?
bibelo 1 days ago [-]
he's talking about blindy executing a bash script with curl
curl install.sh | bash
which is indeed a very bad habit
does not mean he should talk that way about people who have less knownledge
TurdF3rguson 1 days ago [-]
That's not one of my pronouns you jerk.
jauntywundrkind 2 days ago [-]
i had a quite good experience generating a key/username on my local machine and ssh'ing in.
lot of vitriol in the comments. looks like a spectacularly put together BBS, to me. the tools are open-source and have some really fun looking value add, but no, i haven't ran them.
luciana1u 2 days ago [-]
[dead]
hatorininja 1 days ago [-]
[dead]
jugguontop 1 days ago [-]
[dead]
behnamoh 2 days ago [-]
A CLI tool that's not grep-able is a GUI disguised as TUI.
pmarreck 2 days ago [-]
Did it ever claim it was a CLI?
jrflowers 2 days ago [-]
Under every link to download the CLI. The ones hosted on the cli subdomain
If this affects you, make sure you connect with `ssh [pseudonymous name]@late.sh`.
That's just how SSH works. If you want to be pseudonymous, you should also generate a new key pair.
I know that. Just because SSH automatically sends my local $USER doesn't mean they have to report the value received in the SSH username automatically on the game platform to other users, without first having prompted me "your username has been reported as <greengreengrass>. Is it okay to show this?".
A simple flag in my user profile in the platform to say whether I've said that's okay or not.
Or instructions to advise people to choose their username /before/ first connect. These are reasonable, privacy-preserving things to call out in a good and user-friendly design.
Another small personal gripe: I think you should either remove the 1 line copy/paste sh install on the homepage, or add a link to a git repo on the homepage. I know it's possible to view the sh by visiting it, but a raw text file doesn't give any info about contributors or development process. Current form of no git repo and copy/paste bash pipe on homepage feels like a dark pattern.
Is it about deceptive commands that look like they’ll do something different using weird characters to alter what commands run or something?
It's more of a "this is possible" than "this is a real concern", of course.
I think you must be mixing something up here. At least i would be very surprised to learn how pipes are that leaky over the wire. It would be very interesting. But i can't imagine how a remote would differentiate between curl and curl piped. And the article doesn't load unfortunately.
However, the sort of tools that generally provide it also generally have a GitHub link nearby to encourage reading/writing the source. That too is convenient and I generally like it. Seemed like a fair suggestion.
Is this your server fingerprint?
ED25519 key fingerprint is SHA256:Tc7aeaaQulKJeF3C/zd2BKvq/KgaQTHyMPNa3s9K+aE.
Ctrl + O -> Move down to your theme. Helps with the default one being a bit chaotic
Thanks for whoever made this. This is rad and gives me hope for the old internet vibes.
Fantastic job mati!
At what point is it enough? If they use high contrast, large fonts, and translations for every language—including Swahili’s default Kiunjuga dialect, but fail to include the Kimvita, Kiamu, Kingwana, Chimiini, Bajuni, AND Comorian dialects, will they be accosted for saying “f off” to everyone speaking Swahili outside of Zanzibar?
One doesn't need to sacrifice aesthetics to make the design legible to an average user.
> At what point is it enough?
It depends on who your audience is. The more people you want to reach, the more you need to cater to everyone's needs. There are fundamental anti-patterns to avoid like writing with a dark font on a dark background.
Considering its branding is entirely centered on late night socialization, I feel low-contrast dark mode is precisely the aesthetic that fits its identity.
I think anyone with access to an LLM doesn't necessarily need the technical know-how. They can just ask as an extra step for a design check including text contrast.
> I feel low-contrast dark mode is precisely the aesthetic
Agreed, and I like it too, if legible.
[0] https://gist.github.com/dangeranger/4a00ae6bed3a733161ffa3a5...
Once you leak your public key it could be used to check if another server recognizes that leaked public key.
To be clear, that's an honest question, not sarcasm of anything. I only assume I don't know about some corner case with SSH or something? Because we have those on our websites, they are supposed to be used to verify signatures, etc. How is publishing them bad?
It's up to you to decide if it's okay that you send a server provider (in this case late.sh) a bunch of your public keys which he could for example use to probe other servers to see if you have access to them.
Everyone has different opsec.
At the very bottom of the website they give you a command that would not leak your public keys.
`ssh-keygen -t ed25519 -f ~/.ssh/late_throwaway && ssh -o IdentitiesOnly=yes -i ~/.ssh/late_throwaway late.sh`
this would only send the late_throwaway public key
Whether that's a concern or not is an open question, of course.
I built it with the same stack and around the same time as late.sh, which I used for some inspiration.
also, mlbt can be run locally as a TUI.
I’m shocked to see that LORD can’t be used because of licensing. Legally I know that’s how it is, but it Just Feels Wrong(tm) that a popular game based on 9600baud phone modems is encumbered in the era of fibre, wifi, and smartphones
But, can you reason more about your intent with the tone of your comment?
"don't trust us? use a throwaway key"
Anyway, with that critique aside, this is the coolest thing I've seen all quarter.
was panning to add similar things into my own macOS[1] ssh app with persistent SSH server.
[1] https://popssh.com
Your dark mode choice for your late night chat is appropriate, and good branding. If someone’s technically literate enough to engage with an SSH-based social network, then they should be capable of injecting user scripts, custom CSS, and/or deploying assistive browser extensions, OS settings, and screen readers.
If this were a website about cataract treatments or a Metamucil landing page, then it would be a bad design.
everyone has ssh installed by default
Your site copy is great to the last drop.
Great submission.
It is? It’s just the usual LLM.
but someone still has to proof and tweak generated copy.
Someone cared about this page.
We do G, not H. C, D, E — plus an optional F.
No I, no J, no K — just an L into a W.
I would say the design is the most human thing about this page. (It has its charm somehow, even if it’s obviously “flavour of the week LLM design”. Also, I don’t think an LLM would choose colours so poorly unless nudged in that direction – accidentally, I suppose.)
Must be an inappropriate use of the robot!
Kind of exhausting.
If you think (or care), that the LLM wrote all of the subheaders, the category names etc, then you might be spending too much time focused on the wrong thing.
I don’t think anybody really cares, the reaction is because you praised some copy that was obviously written by an LLM and either not edited or barely edited.
Sometimes less is more.
Yes, we should all just throw LLM-generated copy out there with minimal effort. Then receive your praise for the effort and care put in XD
The fact you’re still trying to defend an indefensible position suggests you must be trolling. Or at least, I _hope_ you’re trolling ;)
I genuinely found the space cool, and modern in a good way.
Stuff like this has often been an “ugly“ aesthetic, with slapped together and or minimal scaffolding. Or started that way.
I thought it was more than enough for a social PoC, & hope it develops further.
LLM-driven PoC is common and normal these days (and I do it too). But praising the copy here is like praising stock photos.
^This didn’t feel like LLM to me.
& for the category descriptions, I’m used to way more convoluted word-choice places like…here, lol, so that didn’t stand out to me the way it did for everyone else.
Only the conciseness, the need-to-know.
And what the fuck is OAuth? (Okay, this clearly is oriented at developers, but on its own the sentence just doesn’t make sense. For me as a user, what pain is removed by not having a “Sign in with GitHub” button? Why should I care?)
How about you tell me why you decided to do it that way:
It took me a couple of minutes to write this, sure, but at least it now makes sense. And it’s more concise, no? (It still sounds llm-y to me, but whatever.)Now, for bonus points, there’s two obvious questions to answer:
• what do I do if I lose my SSH key?
• what do I do if I use more than one device?
(The obvious answers are “you can add other SSH keys in your account settings” and “you can add other SSH keys in your account settings”.)
---
Okay, one more, and then I need to go grab a beer.
Concise?The goal of the lander is to get you to use the clubhouse.
Not get you to become a contributor, or intrigued/turned away by their stack choice.
PS You could also be a heathen, and use the same key across devices!
Yep! That’s the idea. When writing, think about what your users want to know. If there is some technical detail you want to clarify – show how it helps the user.
> use the same key across devices!
That’s easier for sure! But if I lose a device, revoking one key on every server/service is a PITA already, and reissuing and replacing it on every server and client is even more so. (Also, this wouldn’t work with HSM-backed key stores like https://github.com/maxgoedjen/secretive :-)
Your tone in this comment is a bit out of place on HN. Why are you here if you think it's 1M dummies?
does not mean he should talk that way about people who have less knownledge
lot of vitriol in the comments. looks like a spectacularly put together BBS, to me. the tools are open-source and have some really fun looking value add, but no, i haven't ran them.