Pigshell: Unix the Web

Posted by pbohun 9 hours ago

Counter64Comment18OpenOriginal

Comments

Comment by alt227 6 hours ago

My Chrome flags this site as not secure, but it doesnt tell me why which is strange.

EDIT: Looking at it, chrome seems to hide all security info about sites now and only display a generic 'Not Secure' badge for anything. This is a very awkward change and removes lots of convenience when troubleshooting random sites.

Still, the site needs to fix its SSL certificate.

Comment by pred_ 4 hours ago

The SSL certificate is fine; the site just redirects from https to http for whatever reason, so you end up with no certificate at all. There's no SSL issue for Chrome to report about.

    $ curl -v https://pigshell.com 2>&1 | grep Location
    < Location: http://pigshell.com

Comment by alt227 3 hours ago

I think it was the fact that by default Chrome hides the protocol from the url, so I could'nt see at a glance it was downgraded. This is exactly what I was talking about when mentioning chrome removing this stuff was hindering troubleshooting. Once I found the setting in chrome to always show the http section, it became clear what was happening.

Comment by thaumaturgy 6 hours ago

Firefox simply loads the page without complaint, just mentions that it's "not secure" and puts a broken lock icon in the addressbar.

Firefox is nice.

Comment by alt227 6 hours ago

I used Firefox as my daily driver for 15 years. Switched to chrome a couple months ago to see what the fuss was about.

I am shocked at how glitchy chrome is in comparison, with the likes of crashed dev tools panels and tabs that just dont come back properly after being idled being a regular thing.

I will be returning to Firefox before long I am sure of it.

Comment by Wowfunhappy 6 hours ago

On the other hand, if a page has HSTS Firefox absolutely won't let you see the page under any circumstances no matter what, whereas Chrome at least has a hidden `thisisunsafe` bypass.

Comment by 5 hours ago

Comment by Brian_K_White 5 hours ago

You can do it, and without rebuilding from hacked source, but it's more work than install $anythingelse, use once, uninstall.

When I searched "firefox bypass hsts" I got a years-long thread where a mozilla dev said how to do it.

Just finding and merely reading that post was more work than install foobrowser, search how to use it's bypass method, use once, uninstall.

Since it's possible, seems ripe for a plugin? Is that something plugins can touch? IDK, as before the nuclear option is actually more convenient. Meanwhile the browsers with nerfed plugins actually empower the user more at least on this point.

Proves that monoculture is bad even if it's your favorite that wins. If it was FF that was taking over everything instead of chromium, then it would be chromium proving that monoculture is bad.

Comment by Wowfunhappy 5 hours ago

> You can do it, and without rebuilding from hacked source, but it's more work than install $anythingelse, use once, uninstall.

Please share because I was under the impression it was literally impossible and would like to know how to do this.

Comment by Brian_K_White 4 hours ago

I did. What happened when you tried 'I searched "firefox bypass hsts"' ?

https://kagi.com/search?q=firefox%20bypass%20hsts

top result (at least on kagi for me at the moment) -> https://connect.mozilla.org/t5/ideas/allow-firefox-to-bypass...

5th comment still close to the top -> https://connect.mozilla.org/t5/ideas/allow-firefox-to-bypass...

(untested by me)

Comment by thesuitonym 4 hours ago

This is an HTTP site. There is no SSL certificate. That's why Chrome isn't telling you anything, it's not that the site is insecure, it's just that it's not secure.

Comment by somat 6 hours ago

The web(html) is a hierarchical system and as such it's proper place in the world is mapped to the filesystem.

Which is honestly what I thought plan9's webfs https://man.cat-v.org/plan_9/4/webfs did and then you could use the filesystem api to parse it. But alas, I actually read the man page to double check, and it looks like it does the much more sane option and just fetches web resources(http), I am crushed.

But it may be a fun weekend project to see if that mapping could be done and where it fails. So not a complete loss.

Comment by nickdothutton 4 hours ago

In some ways rather subversive! I like it. Not sure I'll get use out of it though.

Comment by sntran 7 hours ago

Hah, I had somewhat similar plan, but based on the concept of FIFO (named pipes) and the Unix tool `mkfifo`, so I built https://mkfifo.com to make it easier for people to build pipes instead of shell commands.

There are also a few FIFOs there that works like rclone, using my own `rfetch` library.

Still a WIP though.

Comment by somat 5 hours ago

Sort of related, I had the dubious pleasure of using CMS(an IBM mainframe operating syste/userenviroment) for a while and it had an interesting take on pipes, fabulously overengineered. https://www.ibm.com/docs/en/SSB27U_7.1.0/com.ibm.zvm.v710.zv...

Making the natural comparison to unix pipes. I would say CMS pipes were better for complex pipe lines, the primitive names actually made sense and no need for that awkward setup stage on unix where named pipes need to live on the filesystem. But for simple pipes the unix syntax... felt better? Looking back on that manual now, simple cms pipes look fine, I don't remember why I felt they were worse than unix pipes.

Anyhow it is an interesting alternate take on what pipes could be.

Comment by jauntywundrkind 7 hours ago

(2015). Connect to g+!

Very much a fan of this, of the 9p life. What times seeing a shell on the web with 9p access!

9p is very shell coded, as we see here, but I also really want to imagine going further. I want to imagine apps and systems that interoperate via small fine grained files. As a scripting environment, I really hope it's easy and fun for programs and now llms to look at and alter state, to work other systems, and 9p feels like it is rallying around a core truth that's there all the time just more of it, more files. Instead of descending beyond the os into deeper datastructures like toml.

A downside is that now you need lots of kernel syscalls to talk to all the files. That alas has not, historically, been performant.

Comment by mbreese 6 hours ago

Yep... their Github was last updated 11 years ago (which would also explain the SSL warnings).

https://github.com/pigshell/pigshell/commit/9ad32ce83b7191e8... committed on Aug 24, 2015

Still, I'm a fan of the style. Today, it would probably be an LLM interface to resources, but how much fun would a web shell be?

Comment by aturek 2 hours ago

Not in HTTPS? No thanks!

Comment by dapperdrake 7 hours ago

Pigshell explores taking plan9 to the next level.