News for hackers. Stuff that matters.

A comment on Signing .jars is not worth the effort. Parent comment

Re:Signing .jars is not worth the effort by still_grokking on Sunday July 26, 2020 @01:44PM (#23958726)
I would recommend using the original tooling.

The ssh CLI shows the fingerprint, and explicitly asks:

  $ ssh example.com
  The authenticity of host 'example.com (1.2.3.4)' can't be established.
  RSA key fingerprint is SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.
  Are you sure you want to continue connecting (yes/no/[fingerprint])?
[ Parent | on HN ]
Re:Signing .jars is not worth the effort by MaxBarraclough on Sunday July 26, 2020 @01:52PM (#23958788)
That's roughly what I've ended up doing. [0]

Both OpenSSH and PuTTY ask you to confirm the fingerprint, but PuTTY's fingerprint scheme is MD5/hex, whereas modern versions of the OpenSSH client use SHA256/Base64.

[0] https://serverfault.com/questions/996828/#comment1296514_996...

[ Parent | on HN ]