Details
-
AboutEnthustiastic Backend Dev / DevOps / Manager / Architect. A jack of all trades.
-
SkillsC#, Postgres, Python, K8s, Terraform, GCP, AWS, Azure + all of the other shit I've toyed with for years
-
LocationDenmark
-
Github
Joined devRant on 6/28/2016
Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
-
When a website enforces "overflow: hidden" on all content elements, so you hit them with the good ol'
for(let e of document.querySelectorAll("*")) {
e.style.overflow = "scroll";
}
14 -
Let's talk a bit about CA-based SSH and TOFU, because this is really why I hate the guts out of how SSH works by default (TOFU) and why I'm amazed that so few people even know about certificate-based SSH.
So for a while now I've been ogling CA-based SSH to solve the issues with key distribution and replacement. Because SSH does 2-way verification, this is relevant to both the host key (which changes on e.g. reinstallation) and user keys (ever replaced one? Yeah that's the problem).
So in my own network I've signed all my devices' host keys a few days ago (user keys will come later). And it works great! Except... Because I wanted to "do it right straight away" I signed only the ED25519 keys on each host, because IMO that's what all the keys should be using. My user keys use it, and among others the host keys use it too. But not by default, which brings me back to this error message.
If you look closely you'd find that the host key did not actually change. That host hasn't been replaced. What has been replaced however is the key this client got initially (i.e. TOFU at work) and the key it's being presented now. The key it's comparing against is ECDSA, which is one of the host key types you'd find in /etc/ssh. But RSA is the default for user keys so God knows why that one is being served... Anyway, the SSH servers apparently prefer signed keys, so what is being served now is an ED25519 key. And TOFU breaks and generates this atrocity of a warning.
This is peak TOFU at its worst really, and with the CA now replacing it I can't help but think that this is TOFU's last scream into the void, a climax of how terrible it is. Use CA's everyone, it's so much better than this default dumpster fire doing its thing.
PS: yes I know how to solve it. Remove .ssh/known_hosts and put the CA as a known host there instead. This is just to illustrate a point.
Also if you're interested in learning about CA-based SSH, check out https://ibug.io/blog/2019/... and https://dmuth.org/ssh-at-scale-cas-... - these really helped me out when I started deploying the CA-based authentication model.
19 -
Some days I just want to shoot myself.
I get why... someone might do this, but sweet mother of god!
17 -
That, my friends, is a Dell Poweredge r610, with 2x e5670 and 48GB of registered ECC memory, mounted underneath my desk at work, using mounts I 3D printed at home.
Roughly £140 all in, and I now have a nice little development server, AND leg heater!
28 -
First time me ranting about PHP.
First time. I still really like the language.
But what the fuck.
I am debugging, I narrowed down bug to my validator.
I played with php console and debugger and narrowed down to that one offending line.
Narrowing down to smaller and smaller examples when it dosent work, confusion and tension grows in me.
And then it hit me.
Confusion got to apogeum.
Anyone, if you know the anwser, please tell me.
WHAT THE FUCK?
maybe thats task for stack overflow? Hrm...
No, I dont have time to explicitly tell what I tried to google and spend 4 hours to have all checkmarks ticked before asking lol
39 -
Here’s a poster with a super short description of each one to help you keep track and find some new useful Linux tools.
16
