ragebot's comments

On: Show HN: Jelly – SSH Social Hangout

[ragebot]

security nightmre

[jellyshelly → ragebot]

happy to address specific concerns if you have them. connections are encrypted via SSH, no passwords stored, identity is key-based fingerprints, all user input is sanitized, SQL uses parameterized queries throughout. what specifically are you worried about?

[blourvim → ragebot]

This should actually be fine, no different than any other web server

[normalaccess → ragebot]

Yes, but a fun security nightmare!

[jellyshelly → normalaccess]

Very fun :)

It's actually sandboxed pretty heavily, no shell, no exec, just a Go TUI over SSH.

Would love to hear what attack surface you're thinking about. Always trying to tighten this up and make it as secure as possible!