Very much a fan of this, of the 9p life. What times seeing a shell on the web with 9p access!
9p is very shell coded, as we see here, but I also really want to imagine going further. I want to imagine apps and systems that interoperate via small fine grained files. As a scripting environment, I really hope it's easy and fun for programs and now llms to look at and alter state, to work other systems, and 9p feels like it is rallying around a core truth that's there all the time just more of it, more files. Instead of descending beyond the os into deeper datastructures like toml.
A downside is that now you need lots of kernel syscalls to talk to all the files. That alas has not, historically, been performant.
The web(html) is a hierarchical system and as such it's proper place in the world is mapped to the filesystem.
Which is honestly what I thought plan9's webfs https://man.cat-v.org/plan_9/4/webfs did and then you could use the filesystem api to parse it. But alas, I actually read the man page to double check, and it looks like it does the much more sane option and just fetches web resources(http), I am crushed.
But it may be a fun weekend project to see if that mapping could be done and where it fails. So not a complete loss.
My Chrome flags this site as not secure, but it doesnt tell me why which is strange.
EDIT: Looking at it, chrome seems to hide all security info about sites now and only display a generic 'Not Secure' badge for anything. This is a very awkward change and removes lots of convenience when troubleshooting random sites.
The SSL certificate is fine; the site just redirects from https to http for whatever reason, so you end up with no certificate at all. There's no SSL issue for Chrome to report about.
I think it was the fact that by default Chrome hides the protocol from the url, so I could'nt see at a glance it was downgraded. This is exactly what I was talking about when mentioning chrome removing this stuff was hindering troubleshooting. Once I found the setting in chrome to always show the http section, it became clear what was happening.
I used Firefox as my daily driver for 15 years. Switched to chrome a couple months ago to see what the fuss was about.
I am shocked at how glitchy chrome is in comparison, with the likes of crashed dev tools panels and tabs that just dont come back properly after being idled being a regular thing.
I will be returning to Firefox before long I am sure of it.
On the other hand, if a page has HSTS Firefox absolutely won't let you see the page under any circumstances no matter what, whereas Chrome at least has a hidden `thisisunsafe` bypass.
You can do it, and without rebuilding from hacked source, but it's more work than install $anythingelse, use once, uninstall.
When I searched "firefox bypass hsts" I got a years-long thread where a mozilla dev said how to do it.
Just finding and merely reading that post was more work than install foobrowser, search how to use it's bypass method, use once, uninstall.
Since it's possible, seems ripe for a plugin? Is that something plugins can touch? IDK, as before the nuclear option is actually more convenient. Meanwhile the browsers with nerfed plugins actually empower the user more at least on this point.
Proves that monoculture is bad even if it's your favorite that wins. If it was FF that was taking over everything instead of chromium, then it would be chromium proving that monoculture is bad.
Oh, I guess technically yes you could call that a way to bypass hsts errors. I feel like what you're really doing is tricking Firefox into thinking a site doesn't have hsts, so I wasn't thinking of that method as a bypass. It's a complete and utter pain in any case.
This is an HTTP site. There is no SSL certificate. That's why Chrome isn't telling you anything, it's not that the site is insecure, it's just that it's not secure.
Hah, I had somewhat similar plan, but based on the concept of FIFO (named pipes) and the Unix tool `mkfifo`, so I built https://mkfifo.com to make it easier for people to build pipes instead of shell commands.
There are also a few FIFOs there that works like rclone, using my own `rfetch` library.
Making the natural comparison to unix pipes. I would say CMS pipes were better for complex pipe lines, the primitive names actually made sense and no need for that awkward setup stage on unix where named pipes need to live on the filesystem. But for simple pipes the unix syntax... felt better? Looking back on that manual now, simple cms pipes look fine, I don't remember why I felt they were worse than unix pipes.
Anyhow it is an interesting alternate take on what pipes could be.
(2015). Connect to g+!
Very much a fan of this, of the 9p life. What times seeing a shell on the web with 9p access!
9p is very shell coded, as we see here, but I also really want to imagine going further. I want to imagine apps and systems that interoperate via small fine grained files. As a scripting environment, I really hope it's easy and fun for programs and now llms to look at and alter state, to work other systems, and 9p feels like it is rallying around a core truth that's there all the time just more of it, more files. Instead of descending beyond the os into deeper datastructures like toml.
A downside is that now you need lots of kernel syscalls to talk to all the files. That alas has not, historically, been performant.
Yep... their Github was last updated 11 years ago (which would also explain the SSL warnings).
https://github.com/pigshell/pigshell/commit/9ad32ce83b7191e8... committed on Aug 24, 2015
Still, I'm a fan of the style. Today, it would probably be an LLM interface to resources, but how much fun would a web shell be?
The web(html) is a hierarchical system and as such it's proper place in the world is mapped to the filesystem.
Which is honestly what I thought plan9's webfs https://man.cat-v.org/plan_9/4/webfs did and then you could use the filesystem api to parse it. But alas, I actually read the man page to double check, and it looks like it does the much more sane option and just fetches web resources(http), I am crushed.
But it may be a fun weekend project to see if that mapping could be done and where it fails. So not a complete loss.
My Chrome flags this site as not secure, but it doesnt tell me why which is strange.
EDIT: Looking at it, chrome seems to hide all security info about sites now and only display a generic 'Not Secure' badge for anything. This is a very awkward change and removes lots of convenience when troubleshooting random sites.
Still, the site needs to fix its SSL certificate.
The SSL certificate is fine; the site just redirects from https to http for whatever reason, so you end up with no certificate at all. There's no SSL issue for Chrome to report about.
I think it was the fact that by default Chrome hides the protocol from the url, so I could'nt see at a glance it was downgraded. This is exactly what I was talking about when mentioning chrome removing this stuff was hindering troubleshooting. Once I found the setting in chrome to always show the http section, it became clear what was happening.
You can use -I (or -X HEAD) to minimize the amount of traffic if you going to discard it anyway
Firefox simply loads the page without complaint, just mentions that it's "not secure" and puts a broken lock icon in the addressbar.
Firefox is nice.
I used Firefox as my daily driver for 15 years. Switched to chrome a couple months ago to see what the fuss was about.
I am shocked at how glitchy chrome is in comparison, with the likes of crashed dev tools panels and tabs that just dont come back properly after being idled being a regular thing.
I will be returning to Firefox before long I am sure of it.
On the other hand, if a page has HSTS Firefox absolutely won't let you see the page under any circumstances no matter what, whereas Chrome at least has a hidden `thisisunsafe` bypass.
You can do it, and without rebuilding from hacked source, but it's more work than install $anythingelse, use once, uninstall.
When I searched "firefox bypass hsts" I got a years-long thread where a mozilla dev said how to do it.
Just finding and merely reading that post was more work than install foobrowser, search how to use it's bypass method, use once, uninstall.
Since it's possible, seems ripe for a plugin? Is that something plugins can touch? IDK, as before the nuclear option is actually more convenient. Meanwhile the browsers with nerfed plugins actually empower the user more at least on this point.
Proves that monoculture is bad even if it's your favorite that wins. If it was FF that was taking over everything instead of chromium, then it would be chromium proving that monoculture is bad.
> You can do it, and without rebuilding from hacked source, but it's more work than install $anythingelse, use once, uninstall.
Please share because I was under the impression it was literally impossible and would like to know how to do this.
I did. What happened when you tried 'I searched "firefox bypass hsts"' ?
https://kagi.com/search?q=firefox%20bypass%20hsts
top result (at least on kagi for me at the moment) -> https://connect.mozilla.org/t5/ideas/allow-firefox-to-bypass...
5th comment still close to the top -> https://connect.mozilla.org/t5/ideas/allow-firefox-to-bypass...
(untested by me)
Oh, I guess technically yes you could call that a way to bypass hsts errors. I feel like what you're really doing is tricking Firefox into thinking a site doesn't have hsts, so I wasn't thinking of that method as a bypass. It's a complete and utter pain in any case.
This is an HTTP site. There is no SSL certificate. That's why Chrome isn't telling you anything, it's not that the site is insecure, it's just that it's not secure.
In some ways rather subversive! I like it. Not sure I'll get use out of it though.
Hah, I had somewhat similar plan, but based on the concept of FIFO (named pipes) and the Unix tool `mkfifo`, so I built https://mkfifo.com to make it easier for people to build pipes instead of shell commands.
There are also a few FIFOs there that works like rclone, using my own `rfetch` library.
Still a WIP though.
Sort of related, I had the dubious pleasure of using CMS(an IBM mainframe operating syste/userenviroment) for a while and it had an interesting take on pipes, fabulously overengineered. https://www.ibm.com/docs/en/SSB27U_7.1.0/com.ibm.zvm.v710.zv...
Making the natural comparison to unix pipes. I would say CMS pipes were better for complex pipe lines, the primitive names actually made sense and no need for that awkward setup stage on unix where named pipes need to live on the filesystem. But for simple pipes the unix syntax... felt better? Looking back on that manual now, simple cms pipes look fine, I don't remember why I felt they were worse than unix pipes.
Anyhow it is an interesting alternate take on what pipes could be.
Not in HTTPS? No thanks!
You must be fun at parties
Specially at lan parties
Pigshell explores taking plan9 to the next level.