4 ms·
If you didn’t know about SSH certs, you shouldn’t be giving advice. You should study the fundamentals
by imwillofficial 5y ago
If you didn’t know about SSH certs, you shouldn’t be giving advice.
You should study the fundamentals
- OrvalWintermute 5y agoI think you may also have missed the context that he/she used, as they described running an x509 CA first. In an organizational context, many organizations are not going to jump to creating a novel CA type (SSH CA) when in fact regular x509 CAs are well known and the basis for much security, and many in regulated industries are using them already. Additionally, given that he/she is running an x509 CA, telling someone with that experience to study the fundamentals is not very polite. It assumes the author of the comment is not educated, but the very description of his/her use-cases are not simplistic ones. Engineering is all about tradeoffs after all.
- blueflow 5y agoYour pronoun thing makes your text painful to read.
- jjulius 5y ago... it genuinely pains you to read "he/she"?
- deleted 5y ago[deleted]
- egberts1 5y agoThat’s why I use “one”.
- OrvalWintermute 5y agoI just didn't want to assume gender, and didn't want to go through comment history in order to find it.
- rfrey 5y agoYou would seem to have a very low pain threshold.
- imwillofficial 5y agoThat’s a fantastic point. Mea culpa
- digitallyfree 5y agoI'm not familar with SSH certificates, but I do know the fundamentals of certificate-based authentication. If you don't have a way to revoke the cert, then the server will assume that your properly signed unexpired certificate is valid. You will need some way to let the server know that the previously issued cert is not valid anymore. This is how this type of authentication works, and the article did not address the important case of wanting to revoke a user's credentials.