A friend wants to proofread your work-in-progress blog post, but its preview
only runs on localhost:8080. Several tools can help. Some run as a
commercial service, like ngrok or Cloudflare Quick Tunnels. Some are
self-hostable but require a specific client, like frp or localtunnel.
Some only require a plain SSH client but rely on a specific SSH server, like
sish. Let’s implement a self-hosted solution with only OpenSSH and
nginx!
Log in$ ssh -R 0:localhost:8080 http-over-ssh
Allocated port 41535 for remote forward to localhost:8080
https://6J3jK1WmB15c6WmjW_X-Wg--1789928654@p41535.ssh.luffy.cx/
First, we forward connections from a port on a remote server to your local service:
$ ssh -N -R 0:localhost:8080 web02.luffy.cx
Allocated port 41535 for remote forward to localhost:8080
When you specify 0 as the remote port, the server allocates a free port.
Then, we configure nginx to proxy requests from https://p41535.ssh.luffy.cx to
http://127.0.0.1:41535:
server {
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name ~^p(?<port>\d\d\d\d\d)\.ssh\.luffy\.cx$;
location / {
proxy_pass http://127.0.0.1:$port;
}
}
We also need to add DNS records for *.ssh.luffy.cx and get a wildcard
certificate through Let’s Encrypt:
*.ssh.luffy.cx. CNAME web02.luffy.cx.
ssh.luffy.cx. CAA 0 issuewild "letsencrypt.org"
_acme-challenge.ssh.luffy.cx CNAME ssh.luffy.cx.acme.luffy.cx.
acme.luffy.cx is a zone hosted on Route 53. I use it for ACME DNS-01
challenges, both for wildcard certificates and for domains served by
several web servers. In my case, NixOS gets the certificates
automatically.
The port is the only “secret”1 keeping the content confidential. Other forwarding solutions add a random string to the domain name to prevent an intruder from enumerating the possible values.
Thanks to ngx_http_secure_link_module, we can secure
this setup a bit. This module computes a hash2 over a set of values,
including a secret, and compares it with the hash from the request. The hash is
base64-encoded, so we cannot put it in the domain name, which is
case-insensitive. Instead, we put it in the URL as a username, along with its
expiration timestamp:3
https://6J3jK1WmB15c6WmjW_X-Wg--1789928654@p41535.ssh.luffy.cx/en/blog
╰─────────┬──────────╯ ╰───┬────╯ ╰─┬─╯ ╰──┬───╯
hash expires port path
The client sends the username to the server with HTTP basic
authentication. This works with most HTTP clients, including curl.
Nginx exposes the username in the $remote_user variable. The module expects
the hash and the expiration timestamp separated by a comma. We use a map
directive to extract the two parts from $remote_user and join them with a
comma.4 We also give the module the string to hash. It contains the
expiration timestamp, the port, and a secret:
map $remote_user $httpssh_link {
"~^([-_A-Za-z0-9]{22})--([0-9]+)$" "$1,$2";
}
server {
# […]
location / {
secure_link $httpssh_link;
secure_link_md5 "$secure_link_expires $port ZuPerS3cr3!";
}
}
The module returns the status of the check in the $secure_link variable:
"0" if they match but the link has expired, or"1" otherwise.If the hash is incorrect or missing, we return a 401 error with a
WWW-Authenticate header to ask for credentials. If the link has expired, we
return a 410 error. We remove the Authorization header before forwarding the
request and add a few directives to proxy WebSocket connections.
Here is the complete configuration:5
map $remote_user $httpssh_link {
"~^([-_A-Za-z0-9]{22})--([0-9]+)$" "$1,$2";
}
server {
listen 0.0.0.0:443 ssl ;
listen [::0]:443 ssl ;
server_name ~^p(?<port>\d\d\d\d\d)\.ssh\.luffy\.cx$;
location / {
secure_link $httpssh_link;
secure_link_md5 "$secure_link_expires $port ZuPerS3cr3!";
if ($secure_link = "") {
add_header WWW-Authenticate 'Basic realm="tunnel"' always;
return 401;
}
if ($secure_link = "0") {
return 410;
}
proxy_pass http://127.0.0.1:$port;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Authorization "";
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_buffering off;
proxy_read_timeout 30m;
}
}
I think you are now asking yourself the obvious question: “How should I generate the hash?” Easy peasy!
$ expires=$(( $(date +%s) + 86400 ))
$ port=41535
$ secret='ZuPerS3cr3!'
$ printf '%s %s %s' "$expires" "$port" "$secret" \
> | openssl md5 -binary \
> | openssl base64 \
> | tr +/ -_ | tr -d =
6J3jK1WmB15c6WmjW_X-Wg
Well, I suppose you are now saying: “Vincent, this is not very convenient! I’ll stick with ngrok if you don’t mind.” Okay, I hear you. Let’s write a helper script.
The main difficulty is finding the ephemeral port that OpenSSH allocates, as it
does not appear in any environment variable.6 To work around this obstacle,
we look for the ancestor sshd-session processes:7
pids=$(
pid=$$
while [ "$pid" -gt 1 ]; do
line=$(ps -o comm=,pid=,ppid= -p "$pid")
echo "$line"
pid=${line##* }
done | awk '$1 == "sshd-session" { printf "pid=%s,\n", $2 }'
)
if [ -z "$pids" ]; then
echo "not an ssh session" >&2
exit 1
fi
Then, we get the listening ports associated with these sshd-session
processes:8
ports=$(sudo -n ss --listening --numeric --tcp --processes --no-header \
| grep -F "$pids" \
| awk '{ print $4 }' | awk -F: '{ print $NF }' \
| sort -un)
if [ -z "$ports" ]; then
echo "no forwarded port, use ssh -R 0:localhost:PORT" >&2
exit 1
fi
Finally, we display the URLs and keep the session open:
lifetime=86400
secret='ZuPerS3cr3!'
expires=$(( $(date +%s) + lifetime ))
for port in $ports; do
token=$(printf '%s %s %s' "$expires" "$port" "$secret" \
| openssl md5 -binary \
| openssl base64 \
| tr +/ -_ | tr -d =)
echo "https://$token--$expires@p$port.ssh.luffy.cx/"
done
sleep infinity
I install this script as http-over-ssh on the server and add this entry to my
~/.ssh/config:
Host http-over-ssh
Hostname web02.luffy.cx
RemoteCommand http-over-ssh
ControlPath none
With this solution, I only rely on OpenSSH and nginx, two pieces of software
already running on this server. One short command gives me a self-hosted tunnel
and a URL to share. To try it, grab the complete helper script, which
includes a few minor improvements. If you run NixOS, as any person of taste
would, have a look at my http-over-ssh.nix instead. ❄️
Update (2026-10)
This post was widely discussed on Hacker News.
Update (2026-10)
I have since switched to Caddy, which does not include a
module to check the validity of a URL. Instead, Caddy queries a local HTTP
service written in Go through the forward_auth directive. As a bonus,
this lets me put the token in the domain name.
Since the kernel allocates it from the local port range, its entropy is low. Moreover, on Linux, we lose one more bit because the kernel favors odd ports when it picks a random free port.
$ sysctl -n net.ipv4.ip_local_port_range \
> | awk '{print $1"—"$2" ≈ "log($2-$1+1)/log(2)" bits"}'
32768—60999 ≈ 14.785 bits
The module relies on MD5. Its security is weak but good enough for this use. ↩
We need an expiration date because a later session could reuse the port, and we have no way to detect this case. ↩
The username could use a comma directly instead of a double dash. But some applications do not recognize the URL correctly, making it harder to share. ↩
This configuration exposes any TCP port listening on 127.0.0.1 or
0.0.0.0 to anyone with the secret, bypassing most firewall rules. You
could strengthen it by limiting the server_name regex to the ephemeral
port range. ↩
One SSH session can contain several tunnels, and the client can add or
remove them at any time. This is unlike tun device forwarding (ssh -w),
which gets its own SSH_TUNNEL environment variable. ↩
Since OpenSSH 9.8, sshd-session is the name of the helper handling the
session. With older versions, look for sshd instead. ↩
We need sudo because the sshd-session process dropped its privileges.
The kernel then marks it as not dumpable, and its /proc/PID/fd directory
belongs to root. Without access to this directory, ss cannot
find which process owns a socket. ↩
We have identified an issue affecting a small number of iPhone 18 Pro Max users on the AT&T network that may cause a device to lose service and be unable to make calls. We released iOS 27.0.1 earlier this week and strongly encourage all iPhone 18 Pro Max users to update now, and are also issuing a carrier settings update today. These updates together are meant to help prevent this issue from occurring.Notably, Apple said that iPhone 18 Pro Max devices that have been affected by this cellular issue on the AT&T network cannot have service reactivated with a software update. Instead, Apple said the device must be replaced entirely, and it advises affected customers to contact Apple Support or AT&T, or visit an Apple Store or AT&T location.
We give developers powerful APIs to build incredible capabilities into their apps for Apple products, backed by a set of controls designed to protect users' private data. Full Disk Access largely sidesteps these controls in order to allow backup apps to function properly on the Mac. Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users' full knowledge and understanding. For communication apps, this can also compromise the privacy of the people users are communicating with.Apple did not say when the new "Full Disk Access" controls will be implemented.
Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action. Addressing this is critical. As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially. We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.
Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.
Following more than three months of renovations, the Apple SouthGate store in Bath, England will be reopening on Friday, October 23, just in time for iPhone Duo launch day.
Tokyo has been raining for many days but finally there's some sunny days.
Hi, it's AT&T. Action needed: An important Apple software update for your iPhone 18 Pro Max is available. Some phones may be unable to complete calls/text/data, including to 911. Update to iOS 27.0.1 immediately — Settings > General > Software Update. Please contact AT&T or Apple if you have questions.Apple's release notes for iOS 27.0.1 did not mention a fix for AT&T cellular issues. Rather, the update fixed a Face ID issue on the iPhone 18 Pro models.
On his new Power On podcast, Bloomberg's Mark Gurman said Apple's smart home camera will have "no video recording."
A week ago, release
0.0.5 of the RcppFastAD package
went to CRAN, and we
noted that it provided a stop-gap measure against a gnarly segfault
with g++-16 under heavier optimization / inlining. We are
happy to now announce that a new and fixed version 0.0.6 of RcppFastAD is now
on CRAN, and has been built for
r2u as well as at r-universe.
RcppFastAD wraps the FastAD header-only C++ library by James which provides a C++ implementation of both forward and reverse mode of automatic differentiation. It offers an easy-to-use header library that is both lightweight and performant. With a little of bit of Rcpp glue, it is also easy to use from R in simple C++ applications.
This release takes advantage of some large-language model inference
access I now get via Debian. The Deepseek v4 flash-0731 model, driven in
a container via the pi.dev harness, took just about no time finding a
small workaround for the issue described
last week where we could see segfaults under heavier optimization
and inlining. The fix was to prohibit inlining the local
bind() reimplementation. We have also sent this upstream as
a patch. It is nice to have an option of querying something a little
more powerful than the local models I experimented with before. We
suppress more compiler warnings in local builds via another option, and
did some standard maintenance.
The NEWS file for this release follows.
Changes in version 0.0.6 (2026-10-01)
The expression-template view rebinding is protected against
g++ -O3(which led to wrongEigen::Mapdimensions, anEigen::Mapresize assertion, and a segfault.The
bind()helpers are marked non-inline and are also protected from operating on anullptr.Both items co-written with DeepSeek V4 Flash, and have been sent upstream in a PR.
Suppress another compiler warning when local build detected.
Add r-universe badge to README.md.
Courtesy of my CRANberries, there is also a diffstat report for the most recent release. More information is available at the repository or the package page.
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. If you like this or other open-source work I do, you can now sponsor me at GitHub.
Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running.
Satya Nadella, Chairman and CEO, and Ryan Roslansky, Executive Vice President of LinkedIn and Microsoft 365, shared the below communications with Microsoft and LinkedIn employees this morning.
After nearly 18 years at LinkedIn and Microsoft, Ryan Roslansky has decided to leave Microsoft and embark on his next chapter.
As Ryan and I have been discussing our roadmap and work ahead, we felt this was the right moment for this change. Ryan will stay through the end of the calendar year as an advisor to me and will support on the transition.
Ryan leaves the organization in a strong position. With Copilot, we are executing rapidly against our vision to build a new OS for work that spans every model, every form factor, and every task, with Office fully embedded in Copilot and vice versa! Over the past year, Ryan’s team has done critical work bringing together the product, engineering, and design foundations that have made this next phase possible. Last week’s launch was an important milestone in that journey, and the strong response from customers, partners, and the broader ecosystem reinforced both how far we’ve come and how much opportunity remains ahead.
At LinkedIn, we remain focused on our core vision of creating economic opportunity for every member of the global workforce, helping our 1.3 billion members access the knowledge, insights, and opportunities they need to navigate rapidly changing professional and labor markets.
Effective today we will make the following changes:
Over his nearly two decades at Microsoft, Ryan has helped shape how people around the world find opportunity, build their careers, and get their work done. I’ve always appreciated his clarity of thinking and I’m deeply grateful for everything Ryan has built, for the leaders and teams he has developed, and for his friendship and counsel.
Please join me in thanking Ryan for his extraordinary contributions to LinkedIn and Microsoft, and in wishing him the very best in what comes next.
Satya
Team,
In 1996, as a college freshman, I taught myself to code so a few friends and I could help other students find a place to live around campus. I didn’t know much. I did know the internet was about to change how people found things, and I wanted to be as close to that as possible.
In 2009, Jeff Weiner made me his first hire at LinkedIn. I’ve spent the nearly 18 years since working on a much bigger version of that same idea: helping people find opportunity, and then helping them do great work once they have it.
This has (obviously) been the best professional experience of my life.
As a product manager, I got to build dozens of features that are still around today (some good, some not so good!). When I became CEO in 2020, the world was months into a pandemic that changed what work even meant. Nobody hands you a playbook for that. This team wrote one anyway. Since then, LinkedIn has passed a billion members and nearly tripled its business, and every bit of that belongs to the people who built it.
Last year, Satya asked me to help build the future of M365. Once again, the old rules didn’t apply. AI was rapidly changing how professionals work, and the world’s largest productivity suite needed to lead the way. That meant figuring out what Copilot, and the future of work, should look like as one ecosystem.
We still have a ways to go, but the progress over the past year has been inspiring to watch. A lot of talented people set aside their own roadmaps to make that happen. Thank you. I know it wasn’t easy.
Satya, thank you. When LinkedIn joined Microsoft, you gave us room to build, and then trusted many of us with a lot more. I’ve learned more from you than I can fit in an email, and I’m grateful for the friendship that came with it.
All of which made this a hard decision. I know what it would take for me to lead the next phase of this work well: being in Redmond full time, every day. But my life and my family’s life are here in the Bay Area. My wife Leigh gives her time to more local organizations than I can keep track of. Our youngest daughter just started high school, and our dog Buddy remains deeply committed to the trails on the Peninsula!
I thought about this for a long time. It’s the right call. The work now goes to leaders who are set up to take it further. I can’t wait to see what they do with it.
Over the years, people have asked me what’s kept me so energized and motivated in this work. I think the answer is that I got to spend my career working where doing good and doing well are the same thing. In technology, that’s the best place to operate.
Most companies start by focusing on doing well, so doing good becomes a compromise. It’s the last slide of the PowerPoint, or a separate .org. But when doing good is built into the product itself, it becomes a real competitive advantage. When we build valuable products, people find jobs, they hire, they learn skills, they start companies, they run companies. That creates value for members, customers and the world. And for our business too.
Not many companies get to work this way, and not many people get the chance to build something like it. We do.
That matters more now than it ever has. Technology will continue to touch every job on the planet, and the people building it will decide what kind of world it helps create. I can’t think of a better group to figure that out than the people reading this note.
Thank you for the best 18 years I could have asked for.
RR
The post Microsoft 365 and LinkedIn leadership update appeared first on The Official Microsoft Blog.
