Devzat – Chat over SSH, with some nice quality-of-life features

Original Article ↗ Hacker News Discussion ↗

A terminal-based chat service built on SSH, Devzat shows how an SSH server can act as a multi-user chat room, inspiring comparisons to classic tools like `talk`, `write`, IRC, and even the old finger protocol. Commenters explore how to lock an SSH account to a single program (for chats or text games) using custom shells, `authorized_keys` commands, or Go-based SSH libraries, while highlighting privacy and security issues such as terminal escape codes, agent forwarding, and lack of widespread SSH PKI. The project’s popularity also exposes practical concerns around scalability and robustness, reinforcing that SSH chat is compelling for hobbyist and small-scale use but not yet suited to sensitive or high-volume workloads.

Implementation approaches & related projects

  • Several comments note you can make “chat over SSH” by setting a user’s shell to any binary (chat app, IRC client, game) or by using command="..." in authorized_keys to force a single command.
  • Suggestions include trapping signals and removing escape/exec features from clients, and using libraries like gliderlabs/ssh to avoid shell escapes entirely.
  • Some prefer reusing OpenSSH + LibreSSL rather than a custom Go SSH stack, citing maturity.
  • Related projects mentioned: ssh-chat (long‑running SSH chat), a Go “shell replacement,” and SSH-based access to IRC bouncers.
  • People also discuss exposing single apps (e.g., games, streaming video, text services) via SSH for frictionless, cross-platform access.

Security and privacy considerations

  • Concerns raised about:
    • Terminal escape codes and malicious text in TTYs.
    • SSH agent forwarding; advice is to disable forwarding when connecting to random SSH chats.
    • Lack of widely deployed SSH PKI; practical use is often TOFU, making MITM easier.
    • SSH features like forwarding and agents as attack surface, and limited auditing/monitoring tools.
  • Some argue that using a new Go SSH implementation is riskier than trusted daemons; others note this app doesn’t use sshd at all.
  • Privacy angle: public SSH chats reveal IPs and public keys; users can mitigate by using separate throwaway keypairs.

Comparisons to IRC and classic Unix tools

  • Multiple comments compare this to IRC, talk, ytalk, write, wall, and finger, framing Devzat as a modern twist on long-standing text chat mechanisms.
  • Some still use write/wall for real-time coordination and run DIY “poor man’s IRC” on small servers.
  • Finger and .plan files are reminisced about as proto-social media and inspiration for decentralized status updates.

Stability, scalability, and reception

  • The main public instance experiences crashes, freezes, and “Hacker News hug of death” load issues; the author attributes this partly to weak hosting.
  • Offers are made to donate more powerful servers; some worry future users might find ways to escape the Go binary.
  • Overall tone mixes enthusiasm for the idea and implementation with caution about security and operational robustness.