The Grumpy Troll

Ramblings of a grumpy troll.

Golang SSH Redux

I’d like to set a couple of things straight, for the record. I’ll cover the post/blog, and then I’d like to counter some misconceptions. While part of me thinks “I must’ve been very unclear to have so many people misunderstand”, I also saw how many people commented without bothering to read, so really there’s a limit to how much self-flagellation will happen. I am not a security researcher. I do not try to get bug bounties.


Golang SSH Security

This is a tale of two attitudes. Working on a project for a client recently, I needed to speak the SSH protocol in Golang code. So I started with the x/crypto/ssh package, part of the suite of libraries from the Golang developers which is not part of the standard library and not part of their usual compatibility guarantees, but more along the lines of “useful stuff which might graduate to the standard library”.


Docking Compute

What I would like to see emerge as technology is “compute docking”. A dock which provides, as part of the peripherals, more CPUs and RAM. This partially demonstrates a failure of software, in that the operating systems approaches in widespread use today have abandoned the idea of the OS and trust boundaries being spread over multiple machines. You get clusters, and software written to run across clusters with a lot of heavyweight infrastructure for scheduling, deployment, etc.


OCSP Oops!

Conceptual Background OCSP provides a means for a TLS client to check that a certificate issued to a server is still valid, by asking for a “current proof”. In its original form, it’s a disaster: clients need to talk to the TLS server (typically a secure web server), find out who issued the certificates and where on the Internet they can talk to, to get a current cert, go off and talk to that OCSP server, get a current proof, then resume talking to the original server.


Jitsi & Certificates

I’ve been on the lookout for an XMPP client I could trust, for macOS. Trust is a loaded term, but in this context, it means: Either not written in C, or very proactive about security updates OTR support Source code available, should I choose If installing binary packages, signed releases which can be verified. Today I installed Jitsi. It’s written in Java and is a little slow to start, but I’ll take that if it means my account isn’t compromised by anyone who can send me a friend request.