People understand that such "reverse hacking" can happen when their browser connects to any site (including all the indirect connections from dependent resources), right? Or when resolving any domain name? Or when even just pinging an IP?

The risk is far, far lower than browsing the internet. Unlike the massive surface of a browser and all the libraries and processes it is comprised of, the OpenSSH client is a tiny, with a singular purpose, contained in a small and very well-vetted codebase.

From the perspective of connecting to a foreign network service, the OpenSSH client is about the safest thing you can possibly use. Note the use of relative words here - not claiming it is 100% bug-free.

(The main caveat is that you can manually configure the client to do unsafe things, like writing a configuration by hand that enables X forwarding or agent forwarding by default for any host - but you can also actively disable sandboxing in your web browser or run everything as root, and we will never be able to stop you from actively making things insecure.)

> People understand that reverse hacking can happen when connecting to random ssh server, right?

No, actually, I've never heard of such a vector. How would that work?

Would like to clarify that all my code is open source at https://github.com/jeninh/ssh.place , even the deployment is triggered through GitHub actions. I'm also a teen and not too familiar with most of these terms, so I might be forgetting something.

Prove it, I'll connect to any server you point me to, using default openssh client flags.

Is that more likely than getting hacked when visiting a website?

What exactly is the mechanism by which you think that an SSH RCE is "simple"?

Try me.