3 ms·

I had this phase where I tried to do everything the right way. I used to check whenever I thought I could, including to my own servers. And you know what? 100%

I had this phase where I tried to do everything the right way. I used to check whenever I thought I could, including to my own servers. And you know what? 100% of the time the check passed. After a while I sat back and thought to myself "is this really worth the cost in time?" And I concluded that no it wasn't. Plenty of people run scanners looking for bad stuff online, ranging from poisoned SSH to supply chain attacks on OSS. These are the people that find the baddies and the baddies eventually get targeted. Me as a lowly developer is just not spending time fruitfully by checking github.coms SSH fingerprint. It would be better if I scanned the web app that I'm working on for, say, SQL injection bugs or misapplied CORS headers or whatever else. Ultimately security checks are an economic activity. The likelihood you are targeted via a given threat, the payoff to the attacker if you are targeted, the downside to the attacker if they are caught, etc. I think being realistic is prudent.

Muromec 3y ago
>Me as a lowly developer is just not spending time fruitfully by checking github.coms SSH fingerprint ... and when you don't you drive up the probability of enabling the 4-stage attack that leaks private keys to Chines govt. Of course the probability is only 0.01% and it's worth to spend time on something better. And when you do check and other 1000 devs in the organization don't, what's the point, right? This is how this stuff happens and we all read a nice post morten here somewhat 2 years later.
taberiand 3y ago
I think that's the crux of the problem: we should do this check, and perhaps the first few times we do - but it's a chore every time and infrequent enough that the process has to be rediscovered, with the associated uncertainty that entails (sure I checked - but did I do it properly?) If it's so important to validate then it shouldn't be left up to a human to choose, it should be mandatory - but the process needs to be straightforward. Why isn't there a built in tool that we can trust to check for us when these alerts happen? Or at least streamline the process and provide certainty
- 3pt14159 3y ago
  Nothing stopping Apple from working in SSH fingerprint gossipping with an opt-out option for weird corporate people. I already trust Apple to secure my computer and my SSH client I see no downside to protecting this threat vector automatically too.

Muromec 3y ago

>Me as a lowly developer is just not spending time fruitfully by checking github.coms SSH fingerprint ... and when you don't you drive up the probability of enabling the 4-stage attack that leaks private keys to Chines govt. Of course the probability is only 0.01% and it's worth to spend time on something better. And when you do check and other 1000 devs in the organization don't, what's the point, right? This is how this stuff happens and we all read a nice post morten here somewhat 2 years later.

taberiand 3y ago

I think that's the crux of the problem: we should do this check, and perhaps the first few times we do - but it's a chore every time and infrequent enough that the process has to be rediscovered, with the associated uncertainty that entails (sure I checked - but did I do it properly?) If it's so important to validate then it shouldn't be left up to a human to choose, it should be mandatory - but the process needs to be straightforward. Why isn't there a built in tool that we can trust to check for us when these alerts happen? Or at least streamline the process and provide certainty

3pt14159 3y ago
Nothing stopping Apple from working in SSH fingerprint gossipping with an opt-out option for weird corporate people. I already trust Apple to secure my computer and my SSH client I see no downside to protecting this threat vector automatically too.