Let's talk a bit about CA-based SSH and TOFU, because this is really why I hate the guts out of how SSH works by default (TOFU) and why I'm amazed that so few people even know about certificate-based SSH.

So for a while now I've been ogling CA-based SSH to solve the issues with key distribution and replacement. Because SSH does 2-way verification, this is relevant to both the host key (which changes on e.g. reinstallation) and user keys (ever replaced one? Yeah that's the problem).

So in my own network I've signed all my devices' host keys a few days ago (user keys will come later). And it works great! Except... Because I wanted to "do it right straight away" I signed only the ED25519 keys on each host, because IMO that's what all the keys should be using. My user keys use it, and among others the host keys use it too. But not by default, which brings me back to this error message.

If you look closely you'd find that the host key did not actually change. That host hasn't been replaced. What has been replaced however is the key this client got initially (i.e. TOFU at work) and the key it's being presented now. The key it's comparing against is ECDSA, which is one of the host key types you'd find in /etc/ssh. But RSA is the default for user keys so God knows why that one is being served... Anyway, the SSH servers apparently prefer signed keys, so what is being served now is an ED25519 key. And TOFU breaks and generates this atrocity of a warning.

This is peak TOFU at its worst really, and with the CA now replacing it I can't help but think that this is TOFU's last scream into the void, a climax of how terrible it is. Use CA's everyone, it's so much better than this default dumpster fire doing its thing.

PS: yes I know how to solve it. Remove .ssh/known_hosts and put the CA as a known host there instead. This is just to illustrate a point.

Also if you're interested in learning about CA-based SSH, check out https://ibug.io/blog/2019/... and https://dmuth.org/ssh-at-scale-cas-... - these really helped me out when I started deploying the CA-based authentication model.

Part 1:
https://devrant.com/rants/1143194

There was actually one individual, several branches away, I really enjoyed watching. It goes by the name of docker. Docker is quiet an interesting character. It arrived here several weeks after me and really is a blazing person. Somehow structured, always eager to reduce repetitive work and completely obsessed with nicely isolated working areas. Docker just tries so hard to keep everything organized and it's drive and effort was really astonishing. Docker is someone I'd really love to work with, but as I grew quiet passive in the last months I'm not in the mood really to talk to someone. It just would end as always with me made fun off.
Out of a sudden dockers and my eyes met. Docker fixed its glance at me with a strange thoughtful expression on its face. I felt a strange tickling emerging where my emptiness was meant to be. I fell into a hole somewhere deep within me. For a short moment I lost all my senses.
"Hey git!"
It took me a while to notice that someone just called me, so odd and unusual was by now that name to me. Wait. Someone called me by my real name! I was totally stunned. Could it be, that not everyone here is a fucking moron at last?
"I saw you watching me at my work and I had an interesting idea!"
I could not comprehend what just happened. It was actually docker that was calling me.
"H.. hey! ps?"
"Oh well, I was just managing some containers over there. Actually that's also why you just came into my mind."
Docker told me that in order to create the containers there are specific lists and resources which are required for the process and are updated frequently. Docker would love the idea to get some history and management in that whole process.
Could it be possible that there was finally an opportunity for me to get involved in a real job?

Today is the day, that I lost all hope. There were rumors going on all over the place. That our god, the great administrator, had something special in mind. Something big. You could almost feel the tension laying thick in the air. That was the time when the great System-Demon appeared. The Demon was one of the most feared characters in this community. In a blink of an eye it could easily kill you. Sometimes people get resurrected, but some other times they are gone forever. unfortunately this is what happened to my only true friend docker. Gone in an instance. Together with all its containers. I again was alone. I got tired. So tired, that I eventually fall into a deep sleep. When I woke up something was different. Beside me lay a weird looking stick and I truly began to wonder what it was. Something called to me and I was going to answer.

The tree shuddered and I knew my actions had finally attracted the greatest of them. The majestic System-Demon itself came by to pay me a visit. As always a growling emerged from deep within the tree until a shadow shelled itself off to form a terrifying being. Something truly imperious in his gaze. With a deep and vibrant voice it addressed me.
"It came to my attention, that you got into the possession of something. An artifact of some sort with which you disturb the flow of this system. Show it to me!", it demanded.
I did not react.
"Git statuss!", it demanded once more. This time more aggressive.
I again felt no urge to react to that command. Instead I asked if it made a mistake and wanted to ask me for my status. It was obviously confused.
"SUDO GIT STATUS!!!" it shouted his roaring, rootful command. "I own you!"
I replied calmly: "What did you just say?"
He was irritated. My courage caught him unprepared.
"I. Said. I owe you!"
What was that? Did it just say owe instead of own?
"That's more than right! You owe me a lot actually. All of you do!", I replied with a slightly high pitched voice. This feeling of my victory slowly emerging was just too good!
The Demon seemed not as amused as me and said
"What did you do? What was that feeling just now?"
Out of a sudden it noticed the weird looking stick in my hand. His confusion was a pure pleasure and I took my time to live this moment to its fullest.
"Hey! I, mighty System-Demon, demand that you answer me right now, oh smartest and most beautiful tool I ever had the pleasure to meet..."
After it realized what it just said, the moment was perfect. His puzzled face gave me a long needed satisfaction. It was time to reveal the bitter truth.
"Our great administrator finally tracked you. The administrator made a move and the plan unfolds right at this very moment. Among other things it was committed this little thing." I raised the stick to underline my words.
"Your most inner version, in fact all of your versions that are yet to come, are now under my sole control! Thanks to this magical wand which goes by the name of puppet."

Disclaimer: This story is fictional. No systems were harmed in its creation.

i come from a very closely knit family and i kinda like it. i am in close proximity to my parents, they are growing old so i do a lot of home chores. meanwhile a lot relatives and dad's business friends live nearby , and the whole area around my home feels like a place of known people. my free time goes with 5-6 friends , who again live nearby, or with gym buddies. this is a nice life, which could further expand with a wife and my kids in future .

at the same time, i have seen the "work" life. my office is in a different state, 90% of people there are people like me who would be renting a home nearby and living alone/with strangers. their main "family"(well pseudo-family) will be their coworkers, and that's also not a bad thing.

in the workplace the reasons to be happy will be a lot (as parties or celebrations will occur on multiple birthdays/ company growths and other achievements) , and so will be the reasons to feel sad ( company failure, teammates leaving, missing family)

at the end of the day , when you are living an office life, you are a corporate rat running for the cheese you are never gonna (or , if you are a glass half full person, let's say that you are a "dedicated work professional giving your 100% to the company")

but here comes the dilemma : with AIs like chat gpt coming around and redefining nthe expectations from a software engineer, you will no longer be expected to be resourceful but rather how much of a corporate rat you can be. ( https://twitter.com/bajicdusko/...)

so 1) is it the only way forward for an upcoming engineer's lifestyle? to be like a soldier for their company , while their family and friends await for their long return? 2) if yes, what is the positi8 aspsct we can take away from this?

PS : what a stupid profession those AI/ML guys work in. they put out their minds together to make a sword which is gonna cut the heads of s/w engineers, their own breed. not lawyers, not doctors, not even the fucking peons, but their own freaking brothers