Comment

Comment by gassius

Actually I am not seeing the fingerprint they announce in the blogpost

When I tried to pull from my repo I got the warning message, right

I removed the old keys with ssh-keygen -R github.com

Then, trying with `ssh -T [email protected]` I see this

The authenticity of host 'github.com (140.82.121.3)' can't be established. ECDSA key fingerprint is SHA256:p2QAMXNIC1TJYWeIOttrVc98/R1BUFWu3/LiyKgUfQM.

So, first thing of course, is that the fingerprint does not match the one in the blogpost which is SHA256:uNiVztksCsDhcc0u9e8BujQXVUpKZIDTMczCvj3tD2s

Second problem, is that ip 140.82.121.3 seems to be reported as HIGH RISK[0]

So basically, how should I proceed? I am not security expert but I would say I am not an illiterate on this, and I have no idea. I guess the majority of users would you accept the new key, but is this the right move? I would need to do it if I want to do some work, that is for sure

EDIT: Formatting

[0]https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test...

parent gassius 3 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton