Show HN: tor_ssh.sh – One command to enable SSH access via Tor

Re:Show HN: tor_ssh.sh – One command to enable SSH access vi... by v_lisivka on Tuesday March 05, 2019 @10:27AM (#19311101)

No, you can't. Nothing will check SHA256 of a malware downloaded in this way, so nothing will stop malware from owning your host. To check, just put "127.0.0.1 gitlab.com" into your /etc/hosts and try to serve your own file from your URL. Git will detect this, curl will not.

[ Parent | on HN ]

Re:Show HN: tor_ssh.sh – One command to enable SSH access vi... by vegardx on Tuesday March 05, 2019 @10:42AM (#19311215)

Yes, try it. Unless something has changed drastically curl still checks that certificates are valid.

[ Parent | on HN ]

Re:Show HN: tor_ssh.sh – One command to enable SSH access vi... by v_lisivka on Tuesday March 05, 2019 @10:59AM (#19311356)

It looks like you assume that SSL guarantees correctness of the file.

First, I had experience with substituted SSL certificates (by our government, at revolution), when errors were reported by Chrome only due to certificate pinning for Google services.

Second, site can be hacked and replaced directly at the site.

[ Parent | on HN ]

Re:Show HN: tor_ssh.sh – One command to enable SSH access vi... by vegardx on Tuesday March 05, 2019 @11:12AM (#19311469)

When your threat level is government agencies then, sure, you have issues. But git wouldn't solve anything, unless you have a way to verify the hash or signature.

[ Parent | on HN ]