Hacker News new | ask | show | jobs
by xenadu02 42 days ago
As a kid in the late 90s my mind was blown when I realized I could telnet to port 80, 25, or 110 and interact with the servers manually.

Simple get: GET / HTTP/1.1 Content-Type: text/html User-Agent: l33t hax0rs lol X-Funny-Monkey: farts

For sending a mail message on port 25: HELO mail-from: whoever@whatever.com mail-to: sysadmin@yaya.com <other headers> <blank line> Body of the message yay. <two blank lines to end>

POP3 was so long ago I forgot but you could list the mailboxes then get individual messages and so on.

This revelation was the beginning of "there is no magic" for me. The realization that every part of the computer was built by human beings and was at some level understandable if one undertook the effort.

Perhaps most people in the future won't bother. They'll just let agents do it all. I'm sure that will leave some interesting holes in various systems for people willing to actually learn how they work without the filter of a model (or its safety rails).

15 comments

I sent many an email from jacques.chirac@elysee.fr, the veneer of the terminal helping, my friends were quite impressed by how good a hacker I was. Good olde days when many DKIM/SPF weren't a thing yet and SMTP servers weren't even authenticated.
It was quite fun.

But at my first work (begining of 2000s) there was one person that made a fun email, using From of head of company (or was it head of that particular division) to his coworker with congratulations for pay increase and promotion. It would be all great, but that coworker didn't catch the joke and replied to it (person in the From wasn't amused). Author of the joke was fired (which is not easy thing to do in Europe), some people don't catch jokes.

Screwing with someones career isn't a joke. Shitcan-ee fully deserved it.
When I was working at the computing center at University of Illinois at Chicago in the 80s, we found a fairly simple route to spoofing emails from other users through batch jobs on the MVS side of our mainframe. It came crashing to a halt when someone sent a spoofed email from the director to one of the other employees saying that they were fired and to bring their keys to her office immediately. I think the person responsible nearly lost his job over that, but as I recall, the ability to do this was never closed.
I ran an EFnet server in the mid-90s and therefore could fake DNS entries for myself. I was often on IRC from "aliens.gov" which seemed funny at the time, but now that domain finally became an unfunny reality.
"Cher compatriote, voici, rédigé avec mes clavier et mulot, mon programme de l'an 2000 que j'ai après la dissolution..."
Back in those days not only was there was no DKIM or SPF, most SMTP servers would accept email from anyone anywhere to anyone anywhere (i.e. 'open relay').
[ Note: Anyone who has been a geek since the 90s, there's nothing you don't already know here ]

> most SMTP servers would accept email from anyone anywhere to anyone anywhere (i.e. 'open relay').

to date that claim, I'd say that by the late 90s at least, true open relays ("from anyone to anyone") were still numerous but carried a huge assumption of being part of spam operations (willingly or through ineptitude), and the most basic spam filtering would reject mail that came out of one.

That said, (before things like SPF) it was easy enough to deliver email to anyone you wanted even if you didn't have your own real email account and SMTP server; you could just look up the destination's MX and connect to it with telnet like that. Since your own random IP probably wasn't blocklisted it would generally be accepted and delivered.

Back then it was still basically considered bad form to reject email simply because the server didn't know where it was from... sadly, if we were still playing by those rules today, I can only imagine how useless email would be. Now it's definitely guilty-till-proven-innocent.

The magic for me, to this day in fact, is knowing that mail is essentially anyone on the internet being allowed to write to a mail servers disk.

There are rules now, but the concept is still almost intact, random people writing to the servers disk - to be later read by someone

It used to be even more literally so - network mail started off as using FTP to SNDMSG onto a remote system instead of your own. In RFC475, FTP has MAIL and MLFL (mailfile) commands to support this.

I think it's neat that you can still find echoes of this. MAIL worked by just appending to MLFL, separating records with CRLF.CRLF - which is still how Data segments are terminated in SMTP.

Was that before or after UUCP? I know that UUCP carried a command in each message, so you would specify a message body with a tag that says pass it to the mail receiving peogram.
SNDMSG-over-ftp pre-dates UUCP by 5 years, so I think that one's pretty clear-cut.

(Not that I'm claiming anything's original here, ftp & smtp are both in the nwg/ietf family tree, which makes it easy to draw parallels. There's probably 100 other influences.)

This generalises to NNTP, in which anyone writes to everyone and is read by no-one.
> That said, (before things like SPF) it was easy enough to deliver email to anyone you wanted even if you didn't have your own real email account and SMTP server

Yup, this was also a fun exercise. Use nslookup, find the MX records, then telnet to them and deliver some mail destined for domains that email server handled. At that point you're just a slower version of a mail daemon.

In 2006 when FIOS first rolled out they assigned ARIN IP blocks to anyone who requested a static IP and I hosted my own webserver and email server on the web. So for a long time I had my own netblock and my email server had been around for so very long it was in everyone's legacy trusted list. Even gmail never bounced emails from me, despite not having SPF or DKIM and whatever else. Though I did eventually set those up. Only authed users could send email and that was a limited list so my netblock never actually delivered a spam message.

Funny enough I also setup default routing so all non-registered addresses went into a separate mailbox for me and I used the "companyname@mydomain.net" for everything. For many years I knew about every single data breech before anyone else. Often months or years ahead as spam would arrive out of nowhere to that address.

When I finally moved to the bay area to work in tech for real the entire world had changed. You couldn't just get a netblock assignment anymore. And lord knows even if your ISP wasn't deliberately sabotaging your ability to run a server every other system on the internet would assume you're a scamming spammer. I had to give up self-hosting on-prem.

With agents in the house now, we don't use curl at all. Slowly they all are becoming implementation details.
Probably curl is safer than whatever cobbled up bash script your agent invented. Battle tested for years, and free, why replace that?
He probably means using curl directly. Indirectly it's still curl the LLM will default to, but that is an implementation detail.
Also considering libcurl which is an excellent, feature rich, high performance, and battle tested http client.
Why? Your agents knows rhyme but no reason.
Guess streams was a mixed analog / digital world thing[0]. Is 'curl' the higher order wave crest of LC_NETWORK (aka 'sane' http protocol reference to type bundled 0,1,2 file descriptors)

One can have curl as a bash loadable routine without the need to recompile bash. Headless or not, much more sane[4] than ctypes.sh[1] as curl binary epilog/prolog handle the non-http protocol items within the context of curl module/program. More relevant logic level related to topic beyond http protocol only curl : socat[2] and gnu netcat[3].

Ah, HN doesn't provide a way to conjure up * data tapes (comments not withstanding). Ebnf being battle tested for years & grepping the ANTLER[7] by the horns:

awk interpeting http stream via http protocol[5] via ebnf of http protocol likely to better handle the different protocal layers more gracefully than bash script. Would need to make sure awk is in bit mode and not character/byte mode to avoid line discipline issues / 'stty sane'[4]. Note:

Perl/python provide better layers of abstraction than shell coding for the different levels of protocols used in/with http protocol/ ebnf,Kleene* coding.[6] In shell, having a different command programm for every ebnf set/protocol level vs. awk, different ebnf for each Kleene* protocol level)

---------------------------------------------------------------------------------------------

[0] : Your trerminal is not a terminal: An Introduction to Streams : https://www.lucasfcosta.com/blog/streams-introduction

[1] : ctypes.sh : https://github.com/taviso/ctypes.sh

[2] : socat : https://github.com/3ndG4me/socat/releases

[3] : gnu netcat: https://netcat.sourceforge.net/

[4] : stty sane : https://real-world-systems.com/docs/stty.1.html

      https://jaredgorski.org/notes/unix-tty/
[5] : https://www.rfc-editor.org/rfc/rfc9110.pdf

[6] : https://grokipedia.com/page/Kleene_star

[7] : https://en.wikipedia.org/wiki/ANTLR

I was in the hospital at 13, 7 hours from home, and lonely. They had a councilor there who took pity on me and agreed to let me use her computer to check my email. Only provision was that I couldn't install anything, and couldn't change any settings.

She stood behind me and watched bemused as I fired up telnet, connected to my ISP's pop server and started reading emails from friends. I think I did manage to send some emails back via SMTP but I was not as good with that protocol.

If you could bottle the creativity and enthusiasm of a bored teen, I'm pretty sure you could take over the world

Yep! It’s all just text files. Lots of acronyms in top of lots of ways to generate, send, and read structured text files.

One day I realized even databases were just text files and I had to sit down.

There are also many binary files. Most databases are binary files which are wide trees of some kind (e.g. B-trees, B+trees)
Also memories of making printing work on Linux in the late 90s to some old beast of an HP Laserjet. CUPS exited but was a pain to configure, so I’d just convert whatever I wanted to print to postscript, then

    Cat homework.ps > /dev/lp0
Ah this one was so long ago I forgot about it.

The realization that (on DOS) "copy con file.txt" as the world's worst text editor or "copy file lpt1:" was treating physical devices as files. Everything on the computer was arbitrary so you could make anything behave like anything else (for some definition of behave like)!

Not a great insight I'll grant but a key one that everyone has to go through to be any good.

Last century I would read and send personal email from work using telnet to pop3 and smtp respectively.
I also have a tendency to say "Last century", thinking it comedically suggests "a long time ago" without it actually being that long ago. But as time goes by it obviously becomes legitimately a long time ago, and I suspect young people wouldn't see the attempted irony at all.
'last century' 'turn of the century' etc just make me think the 1800s. So I just say last millennium.

Probably get confusing again when people start referring to 'the 20s' not as the 1920s.

You can actually do that today. In fact I did that for some time, because I didn't want to configure e-mail client. The only hard thing is HTML. Average HTML e-mail is almost impossible to read and friction to extract it to a file to open in a browser is too much.
perhaps you meant "in previous millennium" ?
If someone referred to the "previous decade" in 2004, would you have said the same thing?

As the calendar rolled from 1999 to 2000, we entered a new millennium, century, decade, year, day, ...

Yes, absolutely. I use the largest interval any time I can get away with it!

Every Jan 2 I start saying "last year" and every Dec I say "see you next year"

Just following alignment rules right?
>As the calendar rolled from 1999 to 2000, we entered a new millennium, century, decade, year, day, ...

no, that all happened when we rolled from 2000 to 2001.

smh, even paedants today aren't what they used to be.

The entirety of 1999 and 2000 was a nightmare. "No, buddy, we won't change millenium next january." "Nope. We are still in the 20th century." And so on...

I think that's more or less when I lost faith in humanity.

But they were right and you were wrong. Your mistake is in thinking that years are cardinal numbers when they're actually ordinal.

The current year counting was based on the same way years were counted in the past, so you had things like "the 10th year of Caesar's reign". So the year 1 A D. was the first year of Christ's reign.

The year 2000 was the 2000th year of Christ's reign so that's what is celebrated.

Alternatively, you don't really care about that and it's called Common Era now anyway, but in that case it's entirely arbitrary. So either way, calling 2001 the New Millennium is wrong!

You lost faith in humanity because people disagree about an arbitrary zero offset?
when you compare tech from 1999 and today, it does feel like new millennium tbh
Presumably the years including 1999 and earlier
Excuse me while I crumble to dust...
perhaps you meant "in the Holocene"?
the Holocene is over, we are in the Anthropocene era
I know, that's why it'd be an alternative to "in the last millenium" if they try to use the largest time frame that just ended.
You can't do that with HTTP/2 (but thankfully every server still talks HTTP/1).

You also can't do that with TLS (and a lot of servers won't talk HTTP other than redirects). openssl s_client instead of telnet might allow you to tunnel text inside TLS, but that feels like a cheating.

And many other modern protocols, sadly, prefer binary encoding, which makes it impossible to tinker with it on wire level, not without specialized tools anyway.

I think people in the future will bother. I tried to make a fire with sticks once, I tried to burn a clay brick, these old things can be a lot of fun and sometimes of real use. If anything, AI actually makes tinkering a lot more easier. You don't need to dig into RFC to check your mail, you can just talk to LLM about it and it'll help you with most typical IMAP commands, for example.

openssl s_client -host google.com -port 443

You're welcome. Works like netcat plus TLS. Kind of inconvenient though. Hey someone should write tlsnc.

Nothing to regret. Text Protocol is too inefficient.
Compared to inefficiencies in the average payload? No, it doesn't really matter.
When I was 12, I learned about open SMTP relays and how to spoof email this way. I once spoofed an email between two rivals on a community I was a part of and started a flame war.

Good times.

When I was in high school in the mid 2010s, Verizon's email-to-SMS gateway didn't verify SPF/DKIM/DMARC, and I had a field day showing my classmates the Viagra ads that Hillary Clinton's "hacked" email server was sending me. In reality, it was an open relay, but Verizon didn't care; they always delivered it anyway.
I once made an enemy on AOL and he was a spammer--he put my email in the from: field and I got a lot of hostile emails.

But the joke's on him--it led directly to me meeting a lifelong friend & mentor.

It was also cool discovering the ATA commands to drive the modem. You could “war-dial” numbers, or manually initiate Internet connection, or connecting to a bbs
I never figured out you could do it with HTTP, but for some reason I did for FTP and IRC. I don't know why I first tried using a telnet client but I couldn't believe it when the server responded to me!
Me too! Writing Winsock and learning WinAPI on XP then Vista. It took me a while to realise Linux was better / OSX was my gateway drug haha
HELO is for SMTP, EHLO for ESMTP. You could access some “advanced” features of the server if you told it you speak ESMTP.
I must have tried to write the same "perfect" IRC client from scratch in C a dozen times growing up...
any cool features you can share?
Isn't that the whole point of TCP? Creating a pair of two streams you can read out of and write to out of less reliable network primitives?

I am not sure why this is a revelation. Any college level networking course would cover this?!

> Any college level networking course would cover this?!

As an actual kid it's easy for it to be a revelation, no? At least it was for me, with no college level networking course experience.

Sorry my brain somehow missed the literal first three words of the oc.
> Perhaps most people in the future won't bother. They'll just let agents do it all.

But can you imagine the look on some young teen’s face when they train their own GPT on their local computer for the first time?