121–130 of 430 posts
Earlier quoted context omitted.
> There are no trusted hosts. ...your own (headless) server that's in the same room as you, when you're using your laptop as a thin-client for it?
With all these recent exploits, I wouldn't even be 100% sure of that.
Hmm, a CLI interface for consumer purchasing. Can I pipe that order through to a payment processor and delivery method? Script my meals for the week?
Everquest has you beat by a couple decades: https://www.nbcnews.com/id/wbna7020132 In that game you can type /pizza and it'll get ordered and delivered
https://entertainment.slashdot.org/story/04/05/07/138238/piz...
Earlier quoted context omitted.
> There are no trusted hosts. ...your own (headless) server that's in the same room as you, when you're using your laptop as a thin-client for it?
With all these recent exploits, I wouldn't even be 100% sure of that.
One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)
I have a private key for my prod server, a private key for GitHub, and a private junk key for authenticating to misc stuff. I can discard any without affecting anything else that's important.
If I authenticated with my junk key, would my other keys still be at risk?
Earlier quoted context omitted.
Many people forget that their email is included in the public key that is presented to the ssh server by default. So, the email collection form is actually somewhat redundant. But yes, I added my share of funny email addresses to their list. Tradition is a tradition.
What do you mean? Public keys don't usually include an email address. They have an id that's usually in the form "user@host" but that's unlikely to be a valid email address. Maybe some systems use an email address there, but none of those I know.
They are valid email addresses most of the time, in my experience. :)
The founders have a great (if conversational and sometimes off topic) podcast about development topics: https://podcasts.apple.com/us/podcast/how-about-tomorrow/id1...
One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)
Is it not standard practice to make different keys for different important services? I have a private key for my prod server, a private key for GitHub, and a private junk key for authenticating to misc stuff. I can discard any without affecting anything else that's important. If I authenticated with my junk key, would my other keys still be at risk?
Earlier quoted context omitted.
It's a public key. You should operate under the assumption that anyone could have it at any time.
Still, it identifies you so it can be used to track you over visits to many different stores-over-ssh, just like third party cookies.
One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)
"ForwardAgent no" in ~/.ssh/config will do this automatically.