New startup sells coffee through SSH

Original Article ↗ Hacker News Discussion ↗

A new side project is selling specialty coffee exclusively through an SSH-based terminal interface, blending retro tech nostalgia with ecommerce. Commenters are intrigued by the TUI experience and underlying stack (e.g., Go, Charmbracelet, Cloudflare), but debate security and privacy pitfalls such as SSH agent forwarding, trust-on-first-use host keys, and PCI/Stripe compliance when handling card data over SSH. Others question the high price and limited scalability of coffee as a business, seeing the project more as a fun, niche experiment than a defensible startup.

Concept, Novelty, and Prior Art

  • Many find the “coffee over SSH” idea fun and nostalgic, comparing it to past telnet/CLI services (EverQuest’s /pizza, old telnet bookstores, Pizza Party CLI, Sun’s pizzatool).
  • Several commenters say they’d happily see more terminal-based consumer services and link to other console/TUI projects and MUD-like services.

Ordering Experience and Business Model

  • Store quickly sold out; current SSH interface mainly collects emails, frustrating people who want to browse or see the FAQ.
  • Some suspect email harvesting; others report having successfully ordered and even sampled the physical coffee at events, seeing it as a real (small, self-funded) business, not VC-backed.

Security, Privacy, and Trust

  • Strong debate over the claim that SSH ordering is “arguably more secure than your browser.”
  • Points raised:
    • SSH’s TOFU model vs browser PKI and certificate validation.
    • Need to verify host keys; risk of MITM via DNS without that.
    • Warnings about SSH agent forwarding and how a malicious host could use forwarded agents to access other systems.
    • Privacy concerns about public keys as identifiers; mitigation via separate keys or disabling agent forwarding.
  • One critic demonstrates a MITM-style SSH endpoint to highlight practical risks if users don’t verify keys.

Implementation Details

  • Identified stack: Go-based SSH server using the Charm ecosystem (Wish/TUI libs), fronted by Cloudflare Spectrum for TCP proxying.
  • Payments reportedly go through Stripe; FAQ says they avoid keeping their own purchase DB.

PCI, 3‑D Secure, and Compliance

  • Discussion on PCI DSS:
    • If card data transits the merchant’s system (as over SSH), higher PCI burden (SAQ D) than Stripe’s browser widgets/iframes.
    • Some downplay the difficulty; others stress costs and required pen testing.
  • Questions about supporting EU-style 3‑D Secure flows and whether that can be done purely in a TUI.

Coffee, Pricing, and Ethics

  • $25 for a 12oz bag seen by many as expensive vs supermarket or local specialty roasters; others note it’s within high-end specialty range.
  • Some want more info: origin transparency, roast date, decaf/single-origin options.
  • One notes the “ethical” branding while not shipping to the producing country.

UI/UX and Audience Fit

  • TUI is widely praised (low bandwidth, focus, fun), but discoverability and color-contrast issues (especially on light terminals) are noted.
  • Disappointment that sold‑out state hides navigation and details.
  • Several wish for more CLI-like commands and for broader, non-SSH or SMS-based analogs.