3 ms·
I think that's the crux of the problem: we should do this check, and perhaps the first few times we do - but it's a chore every time and infrequent enough that
by taberiand 3y ago
I think that's the crux of the problem: we should do this check, and perhaps the first few times we do - but it's a chore every time and infrequent enough that the process has to be rediscovered, with the associated uncertainty that entails (sure I checked - but did I do it properly?)
If it's so important to validate then it shouldn't be left up to a human to choose, it should be mandatory - but the process needs to be straightforward. Why isn't there a built in tool that we can trust to check for us when these alerts happen? Or at least streamline the process and provide certainty
- 3pt14159 3y agoNothing stopping Apple from working in SSH fingerprint gossipping with an opt-out option for weird corporate people. I already trust Apple to secure my computer and my SSH client I see no downside to protecting this threat vector automatically too.