Wikipedia:Wikipedia Signpost/2016-04-01/Technology report

Technology report

Browse Wikipedia in safety? Use Telnet!

Contribute —

Share this

By Tim Starling

Telnet, circa 1988.

HTTPS was a good start. But to be really secure, it's not enough.

The FBI's attacks against the Tor network have been in the news this week. In events reminiscent of the famous Operation Onymous, the FBI seized control of a web server and then used it to compromise the browsers of visitors to the site.

Could the same thing happen to Wikipedia? Absolutely. We follow industry standard best practice in keeping our servers secure, but this is in an industry where "best practice" means running code which is not known to be vulnerable. The more ignorant you are about the code you are running, the more secure you are. The mind boggles.

Just about every layer of our software stack has had security vulnerabilities of one kind or another disclosed and fixed, and yet we keep using it, because there is no alternative. And Pwn2Own proves every year that there is no reason to trust our web browsers.

Of course, the tools of the trade are not restricted to law enforcement. Anyone with patience and talent can find and exploit vulnerabilities. So what do you do if you want to learn about dancing mania but you don't want to expose your computer to complete compromise? Reduce the attack surface:

Wikimedia is pleased to announce the launch of a Telnet gateway to Wikipedia.

Sorry, there are no images, but you don't want them anyway, libpng vulnerabilities will own your phone.

If you care about privacy, you should access the gateway via the Tor hidden service at lgcjxm7fttkqi2zl.onion port 23. If you care about security, maybe you shouldn't. Who knows what vulnerabilities are hidden in the Tor client? Maybe it's best to run the Tor proxy on a separate server in an air-gapped, soundproof room, connected only by an optically-isolated RS-232 link to your secure laptop.

When it comes to choosing the Telnet client, there are two main approaches.

One is to use old, small, well-tested code, generally recognised to be safe, in the desperate hope that with enough eyes, all bugs are shallow. In this vein you might consider the BSD telnet client, running on a Linux virtual terminal console.

The BSD telnet client was written in about 1983, and is available in all major Linux distributions. Its manpage lists only a single bug: "The source code is not comprehensible." Well, surely in 33 years at least one person must have comprehended it by now and reviewed it for security, right? Right?

While you admire the pretty colours in your Linux console, you might reflect on the fact that they are brought to you by C code which interprets terminal escape sequences while running in Ring 0.

The other approach is defense in depth. Perhaps JTelnet, with an extremely restrictive Java security policy which denies all local access, running as an unprivileged user in a chroot in a VM.

We'll leave the details up to you. Stay safe, folks.

For more information about connecting and further technical details, please see the wiki page.

P.S.: please don't ask for a web gateway to the Telnet server. That really misses the point.

Tim Starling is lead platform architect on the parsing team at the Wikimedia Foundation

← Previous "Technology report"

Next "Technology report" →

In this issue

Discuss this story

These comments are automatically transcluded from this article's talk page. To follow comments, add the page to your watchlist. If your comment has not appeared here, you can try purging the cache.

Hmm I feel some of the hardware hasn't been properly battle tested yet. Something a bit more old school might be a better choice:

https://www.youtube.com/watch?v=X9dpXHnJXaE

Good one! -- [[User:Edokter]] {{talk}} 21:23, 1 April 2016 (UTC)[reply]

This may have comic aspects, but it is well informed and insightful. And it is true that TELNET had one clear advantage - it dates back to a time when program was program and data was data. There probably really isn't a special character sequence that indicates the following output should actually be saved and executed to take over your computer. I miss that kind of program that you could look and see you genuinely can't hack me with it, versus these things that have a new critical vulnerability whenever the old one expires. That said, I wouldn't be surprised if even the TELNET approach doesn't work against that Tor exploit, because (even if Snowden has never said a peep about it) I am suspicious that your saved uuencoded kiddie porn would be recognized by your friendly local antivirus program as a "threat", duly reported to their site, and it would upload a "patch" to you to help fix the virus, with predictable results. But I've never heard such a thing in the news ... and doubt I will this time either. Wnt (talk) 14:38, 2 April 2016 (UTC)[reply]
- @Wnt: [1] [2]. Bawolff (talk) 22:38, 4 April 2016 (UTC)[reply]
  - Oh hell no, that wasn't supposed to happen! Wnt (talk) 22:51, 4 April 2016 (UTC)[reply]
It's always better to write your own telnet client. Every session, for the best security. All the best: Rich Farmbrough, 19:30, 2 April 2016 (UTC).[reply]

Hmm. So how long until Wikimedia provides a gopher server? Or does Tim's refusal to consider "a web gateway to the Telnet server" answer that question? -- llywrch (talk) 20:25, 3 April 2016 (UTC)[reply]
- If they need a copy of the source, I recommend using the Archie search engine. Praemonitus (talk) 21:45, 4 April 2016 (UTC)[reply]

The temptation to actually download Tor and find if there's anything listening at that onion address is almost overwhelming. Lankiveil ^{(speak to me)} 10:51, 4 April 2016 (UTC).*[reply]
I thought "manpage" was a typo but the URL seems to suggest that's the correct spelling.— Vchimpanzee • talk • contributions • 20:11, 4 April 2016 (UTC)[reply]
If you're wondering what it looks like, check out my user page from nearly 5 years ago. In August, I created a Telnet IEG proposal for an nCurses-style Wikipedia interface. A month later, User:cscott built this simple scraper + telnet server in Node.js. — Dispenser 03:35, 17 April 2016 (UTC)[reply]
Where do I submit feature requests? This needs to be more like the old www browser that put [number] after each link and put a table-of-links at the end of every page. davidwr/(talk)/(contribs) 03:17, 27 April 2016 (UTC)[reply]
- https://github.com/cscott/wikipedia-telnet/issues is a reasonable place to put feature requests and bug reports. C. Scott Ananian (talk) 18:45, 28 April 2016 (UTC)[reply]

The Signpost is written by editors like you — join in!

Home

About