Viewing profile — jamiesonbecker

Rotating keys is easy with the right software. (I work @ Userify) Agree with the auditing point Token-based keys, to tptacek's point, is that they can be a giant pain once you star…

One key per device is exactly what we recommend too. Private keys should always be protected as much as possible within that device and should never leave that device. Just paste a…

The next one linked at the bottom, https://jonno.nz/posts/stealing-nanoclaw-patterns-for-webapp... has this bold and frankly unbelievable claim: "70% of startups fail due to premat…

Then install your own: curl i.userify.com | sudo - sE

The experience might be better right up until you're running it in prod and someone happens to ask about: Cert revocation (or even expiration) Sudo roles User removal and process t…

Honestly, we used to replace a lot of pam_ldap and similar sorts of awful solutions. With those, if your LDAP went down even for a heartbeat, you couldn't log in at all. So I total…

Great question. Not yet ;)

Well, TOFU is really just the model for how the chain of trust is established. In practice there isn’t really trust on first use : there’s verify the key matches what’s expected , …

That works for authn in the happy path: short-lived cert, grab it, connect, done. Except for everything around that: * user lifecycle (create/remove/rename accounts) * authz (who g…

SSH certs quietly hurt in prod. Short-lived creds + centralized CA just moves complexity upward without solving the core problem: user management. The system shifts from many small…

But then you can't log in if your box goes offline for any reason.

We're in the process of updating the experience to this century ! ;) We've always taken the stance that crusty is better than vulnerable, but it turns out that not having a modern …

Exactly. We'd had discussions about building https://Userify.com (plug!) around SSH certificates, but elected to go with keys instead, because Userify delivers most of the good thi…

Classic OpenSSH safety check: if /home/$user (or ~/.ssh) is too open, or ownership/modes are off, sshd will refuse pubkey auth. Annoying, but correct. If you still have some access…

at least it had a minimum of Clause. Clause. Punchline.

I like it too, even though it has that distinctive odor of being totally written by chatgpt though. (a bit distracting tbh)

One of the big issues was latency.

Thank you for the comprehensive answers! (By the way: NVIDIA AIstore is NOT a proxying/caching engine, although it can, which is somewhat unique among these types of stores. AIstor…

These questions are meant to be constructively critical, but not hyper-critical: I'm genuinely interested and a big fan of open-source projects in this space: * In terms of a high-…