jamiesonbecker

5 ms·

1.
by jamiesonbecker 11d ago
`crontab -e` and add: # at 3am every day.. * * * 3 0 cd ~/src; claude -p "find and fix bugs and commit"
2.
by jamiesonbecker 5mo ago
Rotating keys is easy with the right software. (I work @ Userify) Agree with the auditing point Token-based keys, to tptacek's point, is that they can be a giant pain once you start scripting across fleets.
3.
by jamiesonbecker 5mo ago
One key per device is exactly what we recommend too. Private keys should always be protected as much as possible within that device and should never leave that device. Just paste all of your devices' public keys into your authorize
4.
by jamiesonbecker 5mo ago
The next one linked at the bottom, https://jonno.nz/posts/stealing-nanoclaw-patterns-for-webapp... has this bold and frankly unbelievable claim: "70% of startups fail due to premature scaling" .. which is a l
5.
by jamiesonbecker 6mo ago
Then install your own: curl i.userify.com | sudo - sE
6.
by jamiesonbecker 6mo ago
The experience might be better right up until you're running it in prod and someone happens to ask about: Cert revocation (or even expiration) Sudo roles User removal and process termination Is the cert server HA and l
7.
by jamiesonbecker 6mo ago
Honestly, we used to replace a lot of pam_ldap and similar sorts of awful solutions. With those, if your LDAP went down even for a heartbeat, you couldn't log in at all. So I totally agree: if I had to do certificates and didn't
8.
by jamiesonbecker 6mo ago
Great question. Not yet ;)
9.
by jamiesonbecker 6mo ago
Well, TOFU is really just the model for how the chain of trust is established. In practice there isn’t really trust on first use : there’s verify the key matches what’s expected , or distribute keys out-of-band (including certs). If tha
10.
by jamiesonbecker 6mo ago
That works for authn in the happy path: short-lived cert, grab it, connect, done. Except for everything around that: * user lifecycle (create/remove/rename accounts) * authz (who gets sudo, what groups, per-host differences) * cle
11.
by jamiesonbecker 6mo ago
SSH certs quietly hurt in prod. Short-lived creds + centralized CA just moves complexity upward without solving the core problem: user management. The system shifts from many small local states to one highly coupled control point. That cont
12.
by jamiesonbecker 6mo ago
But then you can't log in if your box goes offline for any reason.
13.
by jamiesonbecker 6mo ago
We're in the process of updating the experience to this century ! ;) We've always taken the stance that crusty is better than vulnerable, but it turns out that not having a modern experience after 15 years is starting to feel lik
14.
by jamiesonbecker 6mo ago
Exactly. We'd had discussions about building https://Userify.com (plug!) around SSH certificates, but elected to go with keys instead, because Userify delivers most of the good things around certificates without the jank an
15.
by jamiesonbecker 7mo ago
Classic OpenSSH safety check: if /home/$user (or ~/.ssh) is too open, or ownership/modes are off, sshd will refuse pubkey auth. Annoying, but correct. If you still have some access (console, password login, another sudo
16.
by jamiesonbecker 9mo ago
at least it had a minimum of Clause. Clause. Punchline.
17.
by jamiesonbecker 9mo ago
I like it too, even though it has that distinctive odor of being totally written by chatgpt though. (a bit distracting tbh)
18.
by jamiesonbecker 9mo ago
One of the big issues was latency.
19.
by jamiesonbecker 9mo ago
Thank you for the comprehensive answers! (By the way: NVIDIA AIstore is NOT a proxying/caching engine, although it can, which is somewhat unique among these types of stores. AIstore is actually a full S3 engine in its own right, and it
20.
by jamiesonbecker 9mo ago
These questions are meant to be constructively critical, but not hyper-critical: I'm genuinely interested and a big fan of open-source projects in this space: * In terms of a high-performance AI-focused S3 competitor, how does this com
21.
by jamiesonbecker 9mo ago
> 8. Google kills Gemini Cloud Services (killedbygoogle.com) So, Google renamed itself to Gemini ? Instead of Google having a product named Gemini, Gemini has a product named Google . pattern recognition much?
22.
by jamiesonbecker 10mo ago
Except that the definition of a script kiddie is a point-and-shoot shotgun approach - so the AI is basically another script kiddie. To your point, though, the AI is a highly skilled script kiddie!
23.
by jamiesonbecker 10mo ago
> Expectations for pay seem to be very high even for people only just out of college. Darn kids get off my lawn! But yes, you're right. Salary expectations are surprisingly high considering how little fresh grads bring to the tabl
24.
by jamiesonbecker 2y ago
Yes, you're exactly right. ( https://github.com/userify/shim/blob/master/shim.py#L209 ) We've thought about porting Userify to work with CA's too but haven't had many requests for tha
25.
by jamiesonbecker 2y ago
CA's have a lot of management and logistical issues and potential for misuse. The simplicity and TOFU design of the SSH key system (which obv can bring along some issues of its own) can bring a lot of benefits, especially for people wh
26.
by jamiesonbecker 2y ago
I agree! People should generate at least a single ssh key per client device. (On Userify, rotating your key is just a matter of pasting the new public key into your keybox in your dashboard.) One per client device will let you revoke&#x
27.
by jamiesonbecker 2y ago
Right. We usually recommend a single key per client device (laptop, desktop, etc), because that way you can rotate that key if it gets lost/stolen without changing your other devices as well. This way, those private keys stay totally
28.
by jamiesonbecker 2y ago
Very nice for a first project! (the clipboard integration is a nice touch) Seeing this passion is great! TBH, some of the negative comments here might be warranted: SSH is an especially important and tricky area to start in as your first
29.
by jamiesonbecker 2y ago
That's not what the article is talking about.
30.
by jamiesonbecker 2y ago
I replied below about our homegrown solution, but this is very cool! I wish it'd existed when we wrote Userify, but we'll definitely plan on it for our next app! Kudos for solving this so elegantly!

More ›