1
Sign arbitrary data with your SSH keys
ssh-keygen can sign and verify signatures, and it's way better than PGP
Andrew Ayer
I'm a software engineer who works on security, usability, networking, and cryptography. I'm the bootstrapped founder of SSLMate , which makes it easy to obtain and monitor SSL certificates, and DNS Helper , which helps your customers add DNS records so you don't have to.
- Popular posts
- 12
- Total points
- 3,222
- HN comments
- 1,555
- Rank
- #437 personal
Visit agwa.name → RSS feedOn Hacker News Jul 2014 – Apr 2026
Security & Privacy 5Networking & Internet 4Systems & Performance 3Web & Frontend 2Software Engineering 2Open Source 2
2
FastCGI: 30 years old and still the better protocol for reverse proxies
For FastCGI's 30th birthday, let's look at how it avoids the security problems inherent in HTTP reverse proxying
3
Google suspended my company's Google cloud account for the third time
On each of the last two Fridays, Google has suspended SSLMate 's Google Cloud access without notification, having previously suspended it in 2024 without notification. But this isn't just another cautionary tale about using Google Cloud Platform; it's also a story about usable security and how Google's capriciousness…
4
No, Google did not hike the price of a .dev domain from $12 to $850
But domain pricing is very confusing. Let's demystify it.
5
Always Review Your Dependencies, AGPL Edition
Before adding a dependency to one of my software projects, I do some basic vetting of the dependency. Among the things I check are:
6
How to Crash Systemd in One Command
After running this command, PID 1 is hung in the pause system call. You can no longer start and stop daemons. inetd-style services no longer accept connections. You cannot cleanly reboot the system. The system feels generally unstable (e.g. ssh and su hang for 30 seconds since systemd is now integrated with the login…
7
Last week's Let's Encrypt downtime
How I detected that Let's Encrypt issued 645 non-compliant certificates
8
LibreSSL's PRNG is Unsafe on Linux
The first version of LibreSSL portable, 2.0.0, was released a few days ago (followed soon after by 2.0.1 ). Despite the 2.0.x version numbers, these are only preview releases and shouldn't be used in production yet, but have been released to solicit testing and feedback. After testing and examining the codebase, my…
9
SQLite's documentation about its durability properties is unclear
Is SQLite durable by default? What settings guarantee durability? The documentation and even comments from its creator give conflicting answers.
10
Using SNI proxying and IPv6 to share port 443 between webapps
I hate HTTP reverse proxies and want my webapps to listen directly on port 443. How can I make this work in a world of IPv4 scarcity?
11
Independently verifying Go's reproducible builds
Introducing Source Spotter, a Go Checksum Database auditor and Go toolchain reproducer
12
Thoughts on the Systemd Root Exploit
Sebastian Krahmer of the SUSE Security Team has discovered a local root exploit in systemd v228 . A local user on a system running systemd v228 can escalate to root privileges. That's bad.