Signing .jars is not worth the effort

Re:Signing .jars is not worth the effort by forty on Sunday July 26, 2020 @01:17PM (#23958501)

SSH certificates avoid this issue and are used in real life. We make them with hashicorp vault, it works well and is really convenient.

[ Parent | on HN ]

Re:Signing .jars is not worth the effort by MaxBarraclough on Sunday July 26, 2020 @01:41PM (#23958700)

Have to admit I'm not very familiar with SSH certs.

I'm generally just spinning up a fresh Ubuntu instance on EC2, so I have an entirely 'vanilla' SSH set-up. Small scale, so I don't especially mind the ritual of verifying the fingerprint. It's annoying though that it takes a few minutes for the EC2 system-log to be populated with the 'true value' of the fingerprint.

[ Parent | on HN ]

Re:Signing .jars is not worth the effort by GordonS on Sunday July 26, 2020 @01:40PM (#23958686)

Huh, I had no idea there was even such a thing as SSH certificates!

Presuming you mean X.509 certificates, is this part of the standard spec (e.g. should work with OpenSSH etc)? Do you know if it works with PuTTY?

[ Parent | on HN ]

Re:Signing .jars is not worth the effort by jbreiding on Sunday July 26, 2020 @02:36PM (#23959109)

Here is a guide I've found useful in the subject, https://engineering.fb.com/security/scalable-and-secure-acce....

[ Parent | on HN ]

Re:Signing .jars is not worth the effort by TimWolla on Sunday July 26, 2020 @02:00PM (#23958860)

They are not based on X.509. I recommend taking a look at the CERTIFICATES section of the ssh-keygen man page, because I am unable to find a good reference on the web right now.

[ Parent | on HN ]