this is insanely awesome. as it stands right now, yes its "just ssh". But open up the developer toolbar and you'll notice this thing is rendering HTML inside of webkit. It doesn't take a genius to see this is a few baby steps from making it possible to render arbitrary graphics in the shell. edit: I might go out on a limb here and say this project is something that is going to be looked at as a real inflection point a few years from now.
Uh, kinda. "Browser applications" is a bit misleading though. Imagine starting a Clojure REPL and having it graph things right there as you hack. Or having iconography or image previews when you run ls. Or being able to see mathematical notation while you're inside of BC. Or having a commandline interface to Wolfram|Alpha output.
The TermKit reply in this thread should be sufficient to see why this will be very cool.
People already write these kinds of applications today [0], they just don't run in a terminal. I could ask what benefit there is to expanding a terminal's capabilities so they can run there, but then we would just end up rehashing the arguments from http://news.ycombinator.com/item?id=2559734
Ah yes, I was trying to remember what the name of that project was. Seriously, with a few tweaks this will allow you to write console apps that can check termcaps to decide if they should be writing out HTML. From there, you can imagine building a "websh" that does the right thing to enable all of those TermKit ideas.
Shameless self plug: https://github.com/hoeck/schirm. It does exactly that, rendering arbitary html (inside iframes) between lines of a vt100 compatible terminal emulator, using escape-sequences to denote document data and images. Works quite well as a proof of concept. What annoys me so far is that its relatively slow (running find on a large dir may take ~20 times longer than on gnome-terminal) and the headaches around (automatically) resizing iframes.
The app opts-in to a strict Content Security Policy <http://www.w3.org/TR/CSP/>, which disallows 'eval' entirely. It also severely restricts where and how JS can be loaded with the script tag, setTimeout/setInterval, and event attrbites. It's essentially intended to make sure that only the JS that shipped with the extension can be executed.
There may be undiscovered exploits, of course, but CSP severely reduces the chances.
Any input receivable by OpenSSH, regardless of whether it is valid user input or malicious input being delivered by a cross-domain attacker, mustn't result in exploit. If so, it's a bug in OpenSSH, not the fault of the developer who integrating the existing OpenSSH code into a new environment.
Unless, of course, the developer integrating the existing OpenSSH code did so in a way that's not the formal OpenSSH interface. Like if he had to do some kind of dirty hack. But he shouldn't have to for this project.
I don't see how the OpenSSH code is expected to automagically insure that keystrokes sent from Google Chrome came from intentional user generated actions.
Any XSS type vulnerabilities in this are likely the result of issues with the extension itself rather than OpenSSH, IMO.
