Show HN: ssh ssh.place

Original Article ↗ Hacker News Discussion ↗

An experimental multiplayer pixel-art canvas accessible via SSH (`ssh ssh.place`) is drawing interest as part of a broader trend of playful “SSH apps,” alongside projects like terminal-based games and shared shells. Commenters enjoy the low-friction, nostalgic terminal interface but raise serious concerns about security, including agent forwarding, terminal escape vulnerabilities, lack of strong PKI, and the risks of connecting to arbitrary SSH servers. The young creator shares implementation details and open-source code, while others critique AI-generated marketing copy and note familiar issues like bots, color palettes, and coordination dynamics reminiscent of Reddit’s r/place.

Project concept and related SSH apps

  • Collaborative pixel-art canvas over SSH; users appreciate the novelty of “SSH apps.”
  • Several similar or tangential SSH services are mentioned (games, shared BBS, “paint” and “ski” apps, IPv6-only shared Postgres box, VPS-as-a-service over SSH), showing a small ecosystem of SSH-based experiences.
  • Some wish for a standardized “WebSSH” protocol similar to WebSockets / IRCv3.

User experience and technical issues

  • Reports of cursor visibility problems when placed on previously colored cells; maintainer promises a fix.
  • Some terminals (e.g., kitty, Ghostty, Ubuntu WSL default) cause crashes or disconnects, or render colors poorly / identically.
  • Users share commands to inspect and tweak terminal color palettes; request for adding orange to the canvas.
  • One project using IPv6-only DNS had initial firewall/DNS issues that were later fixed.
  • “Parked” sessions are clarified as suspended with storage and processes preserved.

Social dynamics and bots

  • Users try to organize factions (e.g., a “purple frame”) and debate whether coordination should live on HN, on the project site, or remain organic.
  • Comparisons are made to r/place: social coordination is seen as key, but bots and multiboxing already reduce the fun for some.
  • Creator acknowledges bots as inevitable in a free public service and mentions basic anti-bot measures (cooldowns tied to SSH key, IP, device, other factors) with plans to improve if traffic surges.

Security discussion

  • Several comments question the safety of SSH-ing into random servers, raising:
    • SSH agent forwarding and X11 forwarding leaking credentials.
    • Terminal emulator vulnerabilities via escape sequences (recent CVEs cited, including iTerm2 and libssh2).
    • Possibility of malicious servers exploiting SSH client bugs for RCE.
  • Others argue the practical risk is low compared to running random binaries or browsing the web, citing OpenSSH’s relatively small, security-focused codebase.
  • Debate over SSH lacking a global PKI and being vulnerable during TOFU; SSHFP, DNSSEC, and SSH CAs are mentioned but described as rarely deployed in the wild.
  • Some worry about SSH being repurposed for payments and hiring flows without sufficient attention to these risks.

Implementation details and advice

  • Creator is a teenager building for fun, inspired by previous SSH games.
  • Stack: Charm’s wish, bubbletea, and lipgloss; fully open source on GitHub with GitHub Actions for deployment.
  • For others wanting to build similar products, suggestion is to pick something fun or useful that works well in a terminal and leverage simple SSH-based UX (e.g., “ssh host”).

Copywriting and AI-generated text

  • Several comments criticize the project’s website copy as generic “LLM style” (e.g., punchy fragments, “no X, no Y” constructions), calling it clichéd and off-putting despite liking the project itself.
  • Discussion explores why LLMs converge on this voice:
    • Possibility it stems from training data (Medium/LinkedIn-like content).
    • Stronger claim that RLHF explicitly pushes a clickbait “headline voice” because it scores well with most users, even if a minority find it grating.
  • Some note that LLM output feels especially stale because a single “voice” appears everywhere, whereas human writers diversify and tire of their own tropes.
  • The creator takes the feedback and notes the goal was to appeal to non-hackers and emphasize how easy it is to log in.