TIL. Thanks! Gonna do wonders when working at places where I can't use a hardware key with physical confirmation of use.

My assessment still stands. Use proxyjump (-J) instead of proxy command whenever possible.

What can also help is specifying the right options right in ~/.ssh/config for certain hosts and domains: E.g. do "ForwardAgent no" globally, use a "Match *.my-trustworthy-company-domain.com" block and add "ForwardAgent yes" there.

Also very good for other options that are useful but problematic when used with untrustworthy target hosts, like ForwardX11, GSSAPIAuthentication, weaker *Algorithms (e.g. for those old Cisco boxes with no updates and similar crap).

Another neat trick is just using a ""Match *.my-trustworthy-company-domain.com" block" with an "IdentityFile ~/.ssh/secret-company-internal-key" directive. That key will then be used for those company-internal things, but not for any others, if you don't add it to the agent.

Whenever possible, yes, but AIUI it's not always possible; the one use case for which I believe full-on forwarding is required is using your personal credentials to transfer data between two remote servers (ex. rsync directly between servers). If there's a way to do that I would actually much appreciate somebody telling me, but I have looked and not found a way.

I just got a corporate buzzword bingo!

Sorry, English is not my native language. I know I sometimes sound strange because most of my use of the language is around the internet and at work, not that much casual "normal" conversation.

English is my native language and I have no idea what that person was talking about. Your post is fine.

I think that person was talking about having had 4 out of 5 squares in a line on their bingo card already, and stumbling across "baby+bathwater" earned them bingo. The card is metaphorical though... more of a mental buffer that just overflowed.

That makes more sense than my solution.

As far as I’m concerned the baby and the bath water is just a normal expression.

I thought it was something about the use of “confirm,” haha.

Mine too, and I think the post is fine also, but I have some idea of what that person was talking about. For a while, in some corporate environments, it was a recurring phenomenon to hear someone dismiss an urge to be cautious by saying "You're throwing out the baby with the bathwater."

So I can see where someone might count it toward buzzword bingo. But this post also offered an alternate solution when saying "baby+bathwater", so the bingo caller should refuse to score this one.

Your English is fine. That person was violating HN rules about snark (“Be kind. Don't be snarky. Converse curiously; don't cross-examine. Edit out swipes.”)

Learned that rule the hard way. It’s crucial to the success of HN and I am grateful dang corrected me.

I don't see a rule where joking is prohibited. People sure love their buzzwords though. Must bring them a feeling of synergy in these unprecedented times :)

Glad that at least a few people above got the joke

Did I mention joking?

In your list of prohibited items? No. That's my point.

Or use a hardware backed ssh key you have to tap once for every use, like a Yubikey or Nitrokey.