4 ms·

Here's the fundamental problem. If you can't understand very basic security tools and concepts, you cannot securely operate a computer, much less hope to ever w

by nknight 14y ago

Here's the fundamental problem. If you can't understand very basic security tools and concepts, you cannot securely operate a computer, much less hope to ever write secure code. SSH is one of the easiest security tools to use safely that has ever existed. I would say it is second in usability only to HTTPS in browsers, while having a much better actual security record, and is infinitely more powerful, while keeping basic operation so simple I once taught my mother to use it. I am 100% confident that anyone competently engaged in development or systems administration can understand the basic concepts and operations of SSH in five minutes. Any fear of it is irrational. It is not hard, it was specifically designed not to be hard. I'm equally confident you've not taken the five minutes to understand these relevant concepts, because your statement about setting up a "safe" environment makes no sense in the context of OpenSSH. The defaults are inherently safe, as they should be. You must take specific actions to make the system unsafe.

nailer 14y ago
> Here's the fundamental problem. If you can't understand very basic security tools and concepts, you cannot securely operate a computer, much less hope to ever write secure code. He didn't say he was incapable of understanding it. > SSH is one of the easiest security tools to use safely that has ever existed. I would say it is second in usability only to HTTPS in browsers Perhaps that's true, but I suggest testing it would show a massive discrepancy between ease of HTTPS use and SSH use. In short: I think this is a UX issue, not a PEBCAK one.
- nknight 14y ago
  There is no UX issue, it's entirely an irrational fear of having to read. Putting it in a GUI accomplishes nothing but clutter the screen with irrelevant crap. nknight@unassigned-hostname:~$ ssh-keygen -t rsa -C "foo@example.com" Generating public/private rsa key pair. Enter file in which to save the key (/home/nknight/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/nknight/.ssh/id_rsa. Your public key has been saved in /home/nknight/.ssh/id_rsa.pub. The key fingerprint is: d3:c0:19:ae:5b:ff:46:fd:a0:b5:9c:a2:93:a4:ca:c2 foo@example.com The key's randomart image is: +--[ RSA 2048]----+ | . | | o o | | = | | . o | | . S . . | | o o. . + | | . . o.o + = | | E. . o.+ + .| | .o. .+.. | +-----------------+ nknight@unassigned-hostname:~$ Read. READ. Comprehend. Don't throw your hands up and say "But it's sooooo confusing!". It's not. It's very simple, and it is not possible to simplify further, no matter how you try to dress it up in eyecandy, you still must read and comprehend the exact same concepts. If you do not, you cannot be secure. Ever. The basic concepts of public key crypto are mandatory knowledge for everybody. Get over your irrational fear and you will have no more trouble than you would reading a technical book.
  - CJefferson 14y ago
    That is an excellent example of "scary crypto stuff". Most people aren't going to change where the file is saved, or care. They don't know, or care what a fingerprint is. I still have no idea what the 'randomart' images are about. I don't see any benefit to all of that over having a button marked "make keys" which just gets me set up so I can use github. Of course, you could force people to care about what files are placed where, and their permissions. Then you should probably remove the default values of course.
    - nknight 14y ago
      > They don't know, or care what a fingerprint is. Then they cannot use the system safely and should walk away. > I still have no idea what the 'randomart' images are about. First result for "ssh randomart" in Google: http://superuser.com/questions/22535/what-is-randomart-produced-by-ssh-keygen http://superuser.com/questions/22535/what-is-randomart-produ... So long as you're unwilling to learn, very simple things will forever elude you. > I don't see any benefit to all of that over having a button marked "make keys" which just gets me set up so I can use github. It's not that the form has any strong benefit in itself, it's that if you understand what is going on, which is required for security, the text form is in no way mysterious, complicated, or intimidating. The GUI isn't fixing anything, it's just masking a serious problem with the user. I also like being told where semi-automated processes are placing critical files on my filesystem. I'm surprised that annoys you.
      - CJefferson 14y ago
        Just one point: > I also like being told where semi-automated processes are placing critical files on my filesystem. I'm surprised that annoys you. No, it really doesn't annoy me. I'm very happy for you to use git from the command line. I use git from the command line and don't intend to use this new GUI. It would be no good to me anyway, as I use linux. However, I get the feeling that you are annoyed that other people might want to have a full automated process, and not care where the critical files are being placed. As time goes by I feel one of the most important things is to reduce the amount of work it takes for people to get started with something, particular because I have wasted so much time on it. Did I waste the time I spent getting started with git? vim? python? Not at all. Did I waste the time I spent getting started with emacs? ruby on rails? mercurial? FreeBSD? Arch Linux? screen? To be honest yes. Each of these things, in their own way, had an annoying and non-user friendly setup and start, and I've since stopped using them and don't believe the skills were transferable. While I enjoy learning things, sometimes I just want to get started. Also, sometimes I want to get many collegues, who are less computer literate but still experts in their own fields, started.

by nknight 14y ago

nailer 14y ago

> Here's the fundamental problem. If you can't understand very basic security tools and concepts, you cannot securely operate a computer, much less hope to ever write secure code. He didn't say he was incapable of understanding it. > SSH is one of the easiest security tools to use safely that has ever existed. I would say it is second in usability only to HTTPS in browsers Perhaps that's true, but I suggest testing it would show a massive discrepancy between ease of HTTPS use and SSH use. In short: I think this is a UX issue, not a PEBCAK one.

nknight 14y ago
There is no UX issue, it's entirely an irrational fear of having to read. Putting it in a GUI accomplishes nothing but clutter the screen with irrelevant crap. nknight@unassigned-hostname:~$ ssh-keygen -t rsa -C "foo@example.com" Generating public/private rsa key pair. Enter file in which to save the key (/home/nknight/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/nknight/.ssh/id_rsa. Your public key has been saved in /home/nknight/.ssh/id_rsa.pub. The key fingerprint is: d3:c0:19:ae:5b:ff:46:fd:a0:b5:9c:a2:93:a4:ca:c2 foo@example.com The key's randomart image is: +--[ RSA 2048]----+ | . | | o o | | = | | . o | | . S . . | | o o. . + | | . . o.o + = | | E. . o.+ + .| | .o. .+.. | +-----------------+ nknight@unassigned-hostname:~$ Read. READ. Comprehend. Don't throw your hands up and say "But it's sooooo confusing!". It's not. It's very simple, and it is not possible to simplify further, no matter how you try to dress it up in eyecandy, you still must read and comprehend the exact same concepts. If you do not, you cannot be secure. Ever. The basic concepts of public key crypto are mandatory knowledge for everybody. Get over your irrational fear and you will have no more trouble than you would reading a technical book.
- CJefferson 14y ago
  That is an excellent example of "scary crypto stuff". Most people aren't going to change where the file is saved, or care. They don't know, or care what a fingerprint is. I still have no idea what the 'randomart' images are about. I don't see any benefit to all of that over having a button marked "make keys" which just gets me set up so I can use github. Of course, you could force people to care about what files are placed where, and their permissions. Then you should probably remove the default values of course.
  - nknight 14y ago
    > They don't know, or care what a fingerprint is. Then they cannot use the system safely and should walk away. > I still have no idea what the 'randomart' images are about. First result for "ssh randomart" in Google: http://superuser.com/questions/22535/what-is-randomart-produced-by-ssh-keygen http://superuser.com/questions/22535/what-is-randomart-produ... So long as you're unwilling to learn, very simple things will forever elude you. > I don't see any benefit to all of that over having a button marked "make keys" which just gets me set up so I can use github. It's not that the form has any strong benefit in itself, it's that if you understand what is going on, which is required for security, the text form is in no way mysterious, complicated, or intimidating. The GUI isn't fixing anything, it's just masking a serious problem with the user. I also like being told where semi-automated processes are placing critical files on my filesystem. I'm surprised that annoys you.
    - CJefferson 14y ago
      Just one point: > I also like being told where semi-automated processes are placing critical files on my filesystem. I'm surprised that annoys you. No, it really doesn't annoy me. I'm very happy for you to use git from the command line. I use git from the command line and don't intend to use this new GUI. It would be no good to me anyway, as I use linux. However, I get the feeling that you are annoyed that other people might want to have a full automated process, and not care where the critical files are being placed. As time goes by I feel one of the most important things is to reduce the amount of work it takes for people to get started with something, particular because I have wasted so much time on it. Did I waste the time I spent getting started with git? vim? python? Not at all. Did I waste the time I spent getting started with emacs? ruby on rails? mercurial? FreeBSD? Arch Linux? screen? To be honest yes. Each of these things, in their own way, had an annoying and non-user friendly setup and start, and I've since stopped using them and don't believe the skills were transferable. While I enjoy learning things, sometimes I just want to get started. Also, sometimes I want to get many collegues, who are less computer literate but still experts in their own fields, started.