New startup sells coffee through SSH

Original Article ↗ Hacker News Discussion ↗

Concept, Novelty, and Prior Art

  • Many find the “coffee over SSH” idea fun and nostalgic, comparing it to past telnet/CLI services (EverQuest’s /pizza, old telnet bookstores, Pizza Party CLI, Sun’s pizzatool).
  • Several commenters say they’d happily see more terminal-based consumer services and link to other console/TUI projects and MUD-like services.

Ordering Experience and Business Model

  • Store quickly sold out; current SSH interface mainly collects emails, frustrating people who want to browse or see the FAQ.
  • Some suspect email harvesting; others report having successfully ordered and even sampled the physical coffee at events, seeing it as a real (small, self-funded) business, not VC-backed.

Security, Privacy, and Trust

  • Strong debate over the claim that SSH ordering is “arguably more secure than your browser.”
  • Points raised:
    • SSH’s TOFU model vs browser PKI and certificate validation.
    • Need to verify host keys; risk of MITM via DNS without that.
    • Warnings about SSH agent forwarding and how a malicious host could use forwarded agents to access other systems.
    • Privacy concerns about public keys as identifiers; mitigation via separate keys or disabling agent forwarding.
  • One critic demonstrates a MITM-style SSH endpoint to highlight practical risks if users don’t verify keys.

Implementation Details

  • Identified stack: Go-based SSH server using the Charm ecosystem (Wish/TUI libs), fronted by Cloudflare Spectrum for TCP proxying.
  • Payments reportedly go through Stripe; FAQ says they avoid keeping their own purchase DB.

PCI, 3‑D Secure, and Compliance

  • Discussion on PCI DSS:
    • If card data transits the merchant’s system (as over SSH), higher PCI burden (SAQ D) than Stripe’s browser widgets/iframes.
    • Some downplay the difficulty; others stress costs and required pen testing.
  • Questions about supporting EU-style 3‑D Secure flows and whether that can be done purely in a TUI.

Coffee, Pricing, and Ethics

  • $25 for a 12oz bag seen by many as expensive vs supermarket or local specialty roasters; others note it’s within high-end specialty range.
  • Some want more info: origin transparency, roast date, decaf/single-origin options.
  • One notes the “ethical” branding while not shipping to the producing country.

UI/UX and Audience Fit

  • TUI is widely praised (low bandwidth, focus, fun), but discoverability and color-contrast issues (especially on light terminals) are noted.
  • Disappointment that sold‑out state hides navigation and details.
  • Several wish for more CLI-like commands and for broader, non-SSH or SMS-based analogs.