Pimp My IDE / Garage dispatch
Back to garage
October 16, 2026 | terminal craft / SSH / trust

The matinee is free. The host key still matters.

ASCII Theater streams a movie through SSH. Its website also tells viewers to turn off the check that catches a changed server key.

The take. A playful terminal demo does not need a security lecture. It does need a command that preserves the one warning SSH was built to give you.

A great trick arrives with one bad flag.

ASCII Theater turns a terminal into a text movie screen. The site currently advertises Kung Fury and gives visitors one SSH command. That command sets StrictHostKeyChecking=no.[1]

The visual idea rules. The connection advice does not. OpenSSH says no or off can allow a connection to continue when a host key changed. The exact behavior has restrictions, but the useful warning is weakened.[2]

The projector can be weird. The identity check should be boring.

Seeing a key is not verifying a key.

We queried watch.ascii.theater with ssh-keyscan at 11:03 UTC. The server offered one 3072-bit RSA key. Its SHA-256 fingerprint was YMc7KTNDH9riqnd3TGJN0OrAMEH8rzZUHFgYshMNYBE.

That fingerprint is an observation, not independent proof. The OpenBSD manual states that ssh-keyscan cannot verify the keys it collects. An attacker on the same network path could substitute another key. The manual says to compare the result through another channel or use it only when the network is trusted.[3]

ASCII Theater does not publish a fingerprint on its landing page. We found no independent value to compare. The honest state is observed, not verified.

Pin first, then press play.

We saved the observed key to a temporary file and connected with StrictHostKeyChecking=yes. A pseudo-terminal session received about 3 MB of ANSI output in eight seconds. We stopped the local client after that bounded check. This proves the service streamed terminal bytes through the key we had just observed. It does not prove who controls that key.

A stronger release path is short:

  1. The operator publishes the SSH fingerprint over HTTPS or DNSSEC-backed SSHFP.
  2. The viewer compares that value with the key offered by SSH.
  3. The viewer pins the matched key in a dedicated known-hosts file.
  4. The playback command keeps strict checking on.

The booth below teaches those claim levels. It does not fetch a key or decide that a fingerprint matches.

Interactive makeover / host-key claim levels

Projector key gate

Traditional purpose replaced: paste one command and suppress the warning. Better version: show what is known, keep each trust claim distinct, and produce a strict command template only after the final review state.

Advance the film

Choose the strongest state your evidence supports. Moving the control does not create that evidence.

Host-key evidence state
Gate 00 / UnseenHold playback
Host identity unknown
Trust claimNone
Next checkCollect the offered key

Do not start the screening.

The host key has not been recorded.

Print the key card

Replace every placeholder with reviewed data. The final control state means only that the command template is visible.

Sources read, not vibes

Open the source log
  1. ASCII Theater landing page, read October 16, 2026. Screening title, terminal playback claim, stop instruction, and the published SSH command.
  2. OpenBSD ssh_config manual, StrictHostKeyChecking, current manual read October 16, 2026. Behavior of yes, accept-new, ask, and no.
  3. OpenBSD ssh-keyscan manual, current manual dated June 26, 2026 and read October 16, 2026. Key collection behavior and the explicit warning that collected keys need verification through another channel.
  4. Hacker News item 50116813, October 16, 2026. Discovery route. It had no comments when read.

Exercise boundary. We observed one RSA key, pinned that observation in a temporary file, and received a bounded terminal stream. We did not find an independent fingerprint, verify the service operator, inspect the server code, or watch the full film. The fingerprint can change after publication. Compare a fresh observation with an operator-controlled source before trusting it.