Wikipedia:Wikipedia Signpost/2016-04-01/Technology report

Add links
From Wikipedia, the free encyclopedia
The Signpost
← Back to Contents
View Latest Issue


Technology report

Browse Wikipedia in safety? Use Telnet!

Contribute  —  
Share this
By Tim Starling


Telnet, circa 1988.

HTTPS was a good start. But to be really secure, it's not enough.

The FBI's attacks against the Tor network have been in the news this week. In events reminiscent of the famous Operation Onymous, the FBI seized control of a web server and then used it to compromise the browsers of visitors to the site.

Could the same thing happen to Wikipedia? Absolutely. We follow industry standard best practice in keeping our servers secure, but this is in an industry where "best practice" means running code which is not known to be vulnerable. The more ignorant you are about the code you are running, the more secure you are. The mind boggles.

Just about every layer of our software stack has had security vulnerabilities of one kind or another disclosed and fixed, and yet we keep using it, because there is no alternative. And Pwn2Own proves every year that there is no reason to trust our web browsers.

Of course, the tools of the trade are not restricted to law enforcement. Anyone with patience and talent can find and exploit vulnerabilities. So what do you do if you want to learn about dancing mania but you don't want to expose your computer to complete compromise? Reduce the attack surface:

Wikimedia is pleased to announce the launch of a Telnet gateway to Wikipedia.

Sorry, there are no images, but you don't want them anyway, libpng vulnerabilities will own your phone.

If you care about privacy, you should access the gateway via the Tor hidden service at lgcjxm7fttkqi2zl.onion port 23. If you care about security, maybe you shouldn't. Who knows what vulnerabilities are hidden in the Tor client? Maybe it's best to run the Tor proxy on a separate server in an air-gapped, soundproof room, connected only by an optically-isolated RS-232 link to your secure laptop.

When it comes to choosing the Telnet client, there are two main approaches.

One is to use old, small, well-tested code, generally recognised to be safe, in the desperate hope that with enough eyes, all bugs are shallow. In this vein you might consider the BSD telnet client, running on a Linux virtual terminal console.

The BSD telnet client was written in about 1983, and is available in all major Linux distributions. Its manpage lists only a single bug: "The source code is not comprehensible." Well, surely in 33 years at least one person must have comprehended it by now and reviewed it for security, right? Right?

While you admire the pretty colours in your Linux console, you might reflect on the fact that they are brought to you by C code which interprets terminal escape sequences while running in Ring 0.

The other approach is defense in depth. Perhaps JTelnet, with an extremely restrictive Java security policy which denies all local access, running as an unprivileged user in a chroot in a VM.

We'll leave the details up to you. Stay safe, folks.

For more information about connecting and further technical details, please see the wiki page.

P.S.: please don't ask for a web gateway to the Telnet server. That really misses the point.

Tim Starling is lead platform architect on the parsing team at the Wikimedia Foundation

← Previous "Technology report"
Next "Technology report" →
+ Add a comment

Discuss this story

These comments are automatically transcluded from this article's talk page. To follow comments, add the page to your watchlist. If your comment has not appeared here, you can try purging the cache.

Hmm I feel some of the hardware hasn't been properly battle tested yet. Something a bit more old school might be a better choice:

https://www.youtube.com/watch?v=X9dpXHnJXaE

©Geni (talk) 21:05, 1 April 2016 (UTC)[reply]

  • This may have comic aspects, but it is well informed and insightful. And it is true that TELNET had one clear advantage - it dates back to a time when program was program and data was data. There probably really isn't a special character sequence that indicates the following output should actually be saved and executed to take over your computer. I miss that kind of program that you could look and see you genuinely can't hack me with it, versus these things that have a new critical vulnerability whenever the old one expires. That said, I wouldn't be surprised if even the TELNET approach doesn't work against that Tor exploit, because (even if Snowden has never said a peep about it) I am suspicious that your saved uuencoded kiddie porn would be recognized by your friendly local antivirus program as a "threat", duly reported to their site, and it would upload a "patch" to you to help fix the virus, with predictable results. But I've never heard such a thing in the news ... and doubt I will this time either. Wnt (talk) 14:38, 2 April 2016 (UTC)[reply]
  • It's always better to write your own telnet client. Every session, for the best security. All the best: Rich Farmbrough, 19:30, 2 April 2016 (UTC).[reply]
  • Hmm. So how long until Wikimedia provides a gopher server? Or does Tim's refusal to consider "a web gateway to the Telnet server" answer that question? -- llywrch (talk) 20:25, 3 April 2016 (UTC)[reply]


What do you think of The Signpost? Share your feedback.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Wikipedia_Signpost/2016-04-01/Technology_report&oldid=1193876071"