| 26 Apr 2025 |
 K900 | Uhh | 11:42:13 |
| K900 | Possibly? | 11:42:15 |
| K900 | The entire thing is extremely fucked | 11:42:19 |
 helle (just a stray cat girl) | In reply to @k900:0upti.me
It fucks with pipes somehow huh, I am actually surprised at that, but given how weird the openssh code base is once you get authentication, willing to believe it, guess I may have to look at the openssh code base some more | 11:49:23 |
| K900 | You might want to ask horrors for details | 11:49:39 |
| helle (just a stray cat girl) | (openssh challenge, execute a command in any way other then using the user's shell even if that takes a special permission) | 11:53:10 |
 piegames | Is there any chance of talking to upstream and asking for a flag that can bypass login shell? | 12:00:56 |
| K900 | AFAIUI the upstream stance is that the shell is part of the security posture | 12:02:04 |
| K900 | So arbitrary execution of non-shells is a violation | 12:02:11 |
| helle (just a stray cat girl) | Yep, git-shell and nologin is a thing for example, but the fact there is no flag even to allow bypassing is interesting, there is some magic you can do with PAM to just let it in certain circumstances give a different shell for a logging in user, but uh, we haven't quite finished experimenting with that option | 12:08:42 |
| K900 | The thing is | 12:10:11 |
| K900 | We can't really rely on too much SSH fuckery | 12:10:18 |
| K900 | Because if we do, we just lose the point in the first place | 12:10:31 |
| K900 | SSH only makes sense as a transport because it requires minimal setup | 12:11:03 |
| helle (just a stray cat girl) | yep, it is why I ideally want to go to a situation where it is only one single command we need to be able to execute and everything else either is directly to that, or via extra unix pipes that are passed via channels through ssh | 12:11:56 |
| helle (just a stray cat girl) | having a single command accepted by "-c" is a definitial requirement of a shell you can use with ssh | 12:12:21 |
| K900 | That's basically what we're currently doing with bash | 12:12:31 |
| K900 | Ideally the next step would be to make this nix-store instead | 12:12:37 |
| K900 | But that requires Shenanigans | 12:12:43 |
| helle (just a stray cat girl) | the worst bit is that you probably should not even rely on passing in a parameter | 12:14:45 |
| K900 | Definitely not any complex one yes | 12:15:00 |
| helle (just a stray cat girl) | but all the discussion on "should we have a non-ssh based protocol" like, the reason we now have a way to do builds remotely was that the only thing a friend needed to do was give me ssh access, this is like hard to beat | 12:39:06 |
| helle (just a stray cat girl) | really need to learn how to write shorter comments on bugs, lol, sorry everyone | 14:48:32 |
|  vringar joined the room. | 18:23:44 |
 jade_ | great, let's put it in the styleguide. I have also an abandoned wip to ruff-format all our python code, but iirc it got stalled because of me being grumpy about the handling of not combining multiple ( and { etc onto one line, but i think that is fixable. i just also have to do some python modernization first so the diff isn't ugly. | 20:48:17 |
| jade_ | also ssh completely punts the auth to someone else | 20:48:38 |
| jade_ | i think the future better ssh based protocol is probably to try to forward a socket directly without doing the stdin/stdout crimes that seem to cause us reliability problems | 20:49:06 |
| jade_ | * also ssh completely punts the auth to someone else. i don't want our legacy C++ exposed on the open internet. | 20:49:28 |
| jade_ | https://wiki.lix.systems/books/lix-contributors/page/code here is the styleguide page I fixed | 21:23:08 |
 KFears (burning out) | Apparently Xonsh doesn't have any editor support in Neovim whatsoever... | 21:30:01 |
