News for hackers. Stuff that matters.

A comment on Signing .jars is not worth the effort. Parent comment

Re:Signing .jars is not worth the effort by laegooose on Sunday July 26, 2020 @02:01PM (#23958867)
Thank you for asking serverfault question and writing about it here.

When I started to work with EC2 and SSH few years ago I encountered this problem. However I was overwhelmed with the stuff I had to do for actual business and had no energy to investigate.

Next question is, how do we protect against this attack without waiting for few minutes and making all those clicks to find the fingerprints every time we launch an instance?

[ Parent | on HN ]
Re:Signing .jars is not worth the effort by MaxBarraclough on Sunday July 26, 2020 @02:06PM (#23958903)
Someone mentioned SSH certificates. My understanding is that it's the 'proper' solution, but is more work to set-up. Whether it's worth it will presumably be a question of scale.
[ Parent | on HN ]