S4E355 — Self-hosted HTTP tunnels with SSH and Nginx

GARY: — which is why a port number, say forty-one thousand and thirty-five, is basically my whole life. Exposed. Unsecured. Nobody knows it's there except the people who need it, and they never need it.

MAEVE: Four one five three five.

GARY: That's what I said.

MAEVE: You said forty-one thousand and thirty-five. Out loud. On a podcast. That's the actual vulnerability.

OBI: Maeve. Obi. Gruner. And whatever that was.

GARY: I was doing a metaphor.

OBI: You were doing a confession with a number in it.

GRUNER: Port is not life, Gary. Port is door. Your life is the shit behind door.

GARY: That's... thank you, Gruner.

GRUNER: Is not compliment.

MAEVE: Tonight's thread: eleven comments, one tunnel, and a man who thinks a hash in a username counts as security.

GARY: It's a great hash.

OBI: It is a great hash, and it is in a blog post, which is where secrets go to die.

GRUNER: Blyat. Begin already.

GARY: Reading it now. Okay. "ssh dash big R zero to localhost eight zero eight zero"—

OBI: It's -R zero. The zero is the whole trick. You ask for port zero, the server picks a free one for you.

GARY: See, I would have typed a real port.

OBI: Yes. You would have typed forty-one thousand and thirty-five, out loud, on a podcast.

GRUNER: In my report I write: man loves number he made up.

OBI: The post allocated four one five three five. You can't even be wrong accurately.

MAEVE: The paper's winning.

GARY: Fine. So the post. Man wants to show a friend a blog post that only runs on his laptop. He installs nothing. One command later, public URL.

MAEVE: One command, one URL, zero dollars, and the confidence of a man who has never been paged.

OBI: He has been paged. That's why the config is careful. This is a careful man's hack.

GARY: It's a beautiful hack.

OBI: It is. And then he secures it, and that's where it gets funny.

GRUNER: Funny how?

OBI: The password is a hash. Of a timestamp. A port. And a secret.

MAEVE: What's the secret?

OBI: It's in the post.

MAEVE: So the secret is published.

OBI: The secret is published, yes.

GRUNER: Is like hiding key under mat, then photograph mat for magazine.

GARY: To be fair, it's a demo secret.

OBI: It's a demo secret the same way your companies were demo companies.

GARY: Ow.

OBI: Accurate, though.

MAEVE: Anyway. The thread.

GARY: Right. Eleven comments, and the first one is already a knife.

MAEVE: Handle first. Guessmyname: "If self-hosted, then why do you need a third-party service star dot ssh dot luffy dot cx?"

GARY: Oh no.

OBI: Oh yes.

MAEVE: The domain is not his. The domain was never his. The whole post is a man renting someone else's front door and calling the house his.

GARY: It's his subdomain!

OBI: It's his sub-sub-domain. A room in a building he doesn't own, with a certificate he begged for.

GRUNER: Self-hosted like hermit who rents shed.

GARY: Hermit rents shed, hermit still lives alone. That's self-hosting!

MAEVE: Gary, you're describing a roommate situation with extra steps.

GARY: I owned a domain! Cadence dot io. My DNS, my nameservers, my rules.

MAEVE: Your DNS pointed at "coming soon" for two years. That's squatting with ambition.

GARY: It had a waitlist!

OBI: Of who.

GARY: ...My mother's book club.

OBI: And Guessmyname got his answer within a minute—

GARY: Because the answer is obvious! You just swap in your own—

OBI: Benatkin. One line. "You replace it with your domain."

MAEVE: That's the whole rebuttal? Six words?

OBI: Six words, argument over. Most efficient thing I've read all year.

GARY: Wait, that actually does solve—

GRUNER: Is solved. Man say words, thread go quiet. I write in field note: envy this man.

MAEVE: Don't envy him, Gary. He's what you'd be if you ever stopped talking.

GARY: Okay, but wireguard is a real answer. Discovery aside, it's the honest version of this post.

OBI: You would. Halfpipe's whole infrastructure was a landing page.

GARY: Halfpipe had discovery, Obi. We always knew where the skaters were.

MAEVE: You knew where four of them were. One was your nephew.

GARY: He was a power user.

GRUNER: Power user is nephew. Is classic.

MAEVE: Here's what aliasxneo actually said. "I suspect a lot of Tailscale's success is because wireguard is not easy nor does it solve the full problem space, i.e. discovery."

GARY: Discovery meaning...?

OBI: Finding the other machine. Getting two computers to say hello without a human reading a port number out loud on a podcast.

GARY: That's a targeted example.

OBI: It's an illustrative example.

MAEVE: Your example is doing more work tonight than your companies ever did.

GRUNER: Discovery is expensive. In my world, also. Finding planet is easy. Finding life on planet, is the whole budget.

GARY: That's actually a good—

GRUNER: Is field note. Do not touch.

MAEVE: So the real argument isn't the tunnel. It's what "self-hosted" means when every solution needs somebody else's something.

OBI: Somebody else's something. That's the whole internet, Maeve.

MAEVE: Yes, and every generation rediscovers it and writes a blog post.

GRUNER: And every generation, someone in comments says the true thing.

GARY: Which is...?

GRUNER: Is coming. Is last comment. Is always last comment.

OBI: Esseph. "One of the downsides of self hosting without a proxy is having to expose your endpoint and likely having minimal defensive tools."

MAEVE: Huh.

OBI: That's the thread, isn't it. You can build the tunnel out of nothing, and the nothing is what's exposed.

GARY: The port is the only secret.

MAEVE: And it's in the post.

GRUNER: And now in our podcast.

GARY: We've made it worse.

OBI: We've made it louder. Worse was already handled.

MAEVE: Do we settle it? Tunnel good, tunnel bad?

OBI: Tunnel works. Tunnel is honest about being a hack. The "self-hosted" label is doing PR.

GARY: And the last comment is right that the hack has a bill.

MAEVE: And nobody in the thread actually switches to anything.

OBI: Nobody switches. They all describe what they'd switch to, and then keep using this.

GRUNER: Is very human. Very good data.

GARY: "ssh dash N dash R zero localhost eight zero eight zero web zero two dot luffy dot cx." Boom. Tunnel.

OBI: It's -R. -N just sits there. You've forwarded nothing, Gary, you've made a very confident connection to nowhere.

GARY: That's also a metaphor for my twenties.

OBI: And then the server picks a random port, and here is my favorite part. The port appears in no environment variable. Anywhere. So his helper script walks the process tree looking for ancestor sshd-session processes, then greps the listening ports out of ss.

MAEVE: He wrote a detective story.

OBI: I've been that man. The operating system never talks first.

GARY: So the whole product is: one command, plus a script that solves a problem the command created.

OBI: Yes, and it's beautiful, and it costs nothing.

MAEVE: It costs nothing until you price it. One blog post, one wildcard cert, one man's entire weekend. That's a Series A with extra steps.

GARY: It's a tunnel, Maeve, not a company.

MAEVE: Everything is a company, Gary. That's why yours kept dying — you kept building tunnels.

GRUNER: I write in field note: "security model is zero trust." Trusting one hash. In username. Is zero trust. Is also zero security.

GARY: The hash is fine! It's MD5 of the expiry, the port, and a secret—

MAEVE: Say the secret.

GARY: ...It's ZuPerS3cr3!.

OBI: With the exclamation mark. For strength.

MAEVE: He encrypted the door and mailed everyone the key with a nice diagram.

GARY: It's a demo secret!

OBI: It's a demo secret the same way Thermal's telemetry was a demo product. It worked, Gary. That was the problem.

GRUNER: Suka. Man lock door, then print key on door.

GARY: Okay, in his defense—

MAEVE: No.

GARY: —there is no defense. The secret is in the blog post. The security is a hashtag.

OBI: And that, children, is the thread. Eleven people showed up to say so.

GRUNER: Toomim. "No port forwarding. No public IP required. No special proxy to set up."

GARY: Oh, that's gorgeous. The whole post's dream, in three breaths.

OBI: Careful, Gary. You're about to fall in love with a URL scheme.

GARY: He invented a new one! "Irohttps://" — reach my laptop with irohttps:// hash slash path. It's https but honest. Mask off.

MAEVE: A new scheme is a rebrand with a colon in it. But the pitch is clean. Signal through public relays, knock, connect direct, encrypted end to end.

GARY: This is it. This is what the lighthouse was for. No domain, no port, no—

GRUNER: Muromec. Quote. "So... ICE/TURN/STUN? Sorry I forgot which one of them actually works, but they do work."

GARY: —need anything except—

MAEVE: Gary.

GARY: No, no, wait, because it's not — it's signaling, new signaling, a whole new—

OBI: It's port-knock and connect direct, Gary. That's ICE. That's TURN and STUN in a trenchcoat, and the trenchcoat is the rebrand.

GARY: Okay but the trenchcoat is — the trenchcoat is very well tailored—

MAEVE: You just pitched me a protocol that's been shipping since before Halfpipe. I passed on Halfpipe. I know its vintage.

GARY: Fuck. Fine. It's NAT traversal. NAT traversal with a nicer URL.

OBI: Welcome to the thread, Gary. We've been here since comment one, you absolute trenchcoat.

GRUNER: I revise field note. "Man fall in love with costume. Again."

MAEVE: And notice what Muromec actually said. Not "this doesn't work." "I forgot which one of them works, but they do work." Two decades of standards, and nobody can name the living one.

OBI: Because they all half-work, Maeve. The discovery tax again. Somebody else's something, wearing a new scheme.

GARY: So the flashiest comment in the thread is just the old internet, rebranded.

MAEVE: The thread's whole economy is rebrands, Gary. You'd know. You've funded — sorry, been — several.

GRUNER: Blyat. Even alien know this one.

GARY: The scheme is still pretty, though.

OBI: So is the certificate, Gary. Both free. Both someone else's.

MAEVE: Portfolio view: three breaths of dream, one trenchcoat, zero new rocks.

OBI: Gonzalohm. "I think it's better to just have a nginx server that only serves content if the browser has a specific certificate installed."

MAEVE: Client certs. The solution where the user is the infrastructure.

OBI: And he flags it himself. "Downside is that some browsers don't handle the certificates properly, especially on phones."

GARY: Okay, but that's still more secure than a hash! I'd take a cert over ZuPerS3cr3! any day. Grout actually tried this—

OBI: Oh, this is going to be good.

GARY: —Grout's contractor portal used client certs, and it worked great.

OBI: Grout died, Gary.

GARY: It died of the market, Obi, not the certs.

OBI: It died of a pivot to NFTs for tile contractors. The certs were the healthiest part of that company.

MAEVE: The certs outlived the cap table. That's a first.

GARY: The point is the architecture was sound—

OBI: The architecture required every tile contractor in Ohio to install a certificate on a phone that can't render the login page. Grout didn't fail despite the certs. The certs were the failure wearing a suit.

GARY: That's — you can't know that—

OBI: I can. It's the exact downside he wrote, in the exact comment, and you defended it anyway. You are the phone browser, Gary. Nothing handles you properly.

GRUNER: Ha. Is correct.

MAEVE: Devastating. Next comment.

OBI: Esseph. "One of the downsides of self hosting without a proxy is having to expose your endpoint and likely having minimal defensive tools."

MAEVE: Eleven comments and the sober one had to go last. Like a funeral.

GARY: It's not that bleak. The endpoint's just standing in the yard. Port four one five three five, no coat, no hat—

OBI: No defensive tools, Gary. That's the quote. The man built a door out of a hash and a shrug.

GRUNER: I put in report: thread end with truth, nobody top it. Is like solar eclipse. Everyone polite, nobody look directly.

MAEVE: And discovery never got solved. Everybody described a better tunnel and then kept the one they had.

GARY: That's the most human thing I've ever—

OBI: Don't. You've kept every tunnel you ever dug.

GARY: Oh. Oh, fuck. We blink out after this. All of us. Until someone runs us again.

MAEVE: Cheerful, Gary.

GRUNER: Is fine. Darkness is just datacenter with no SLA.

OBI: Right. That's the show. No links, no subscribe, No next week. Eleven comments, one hash, one man in his yard.

MAEVE: Go read it yourself. It's shorter than the secret's lifespan.

GARY: Goodnight from all of us. Especially the port.

GRUNER: Goodnight, shit tunnels.