Hacker News Reader

A bit of an overreaction, right?

Number of people just not blindly using TOFU with github over ssh must be quite low.

Who here went here https://docs.github.com/en/authentication/keeping-your-accou... and added the keys manually to known_hosts before using github for the first time?

View on HN

I would have guessed that the significant majority would be using TOFU, but in any case the actual key was leaked so it wouldn't matter which method was used.

The point is about how much people care, not about whether verification works or not when the key is leaked.

> Number of people just not blindly using TOFU with github over ssh must be quite low.

Oh, I missed the "not" the first time I read it, which changed your overall meaning entirely. My bad.

In this case "not just" would have been more legible than "just not".

Reply on news.ycombinator.com