h43z

Pretty interesting that you can carry comments over.

    (x=>/*this is a comment*/1) + 1
    "x=>/*this is a comment*/11"

I wonder if anything cool can be done with it today. It's probably useless.

It's just something everyone should be aware of.

It's up to you to decide if it's okay that you send a server provider (in this case late.sh) a bunch of your public keys which he could for example use to probe other servers to see if you have access to them.

Everyone has different opsec.

OpenSSH server is designed not to reveal whether a username exists.

If I have your public key I could probe a server to see if it recognizes that public key. Which would tell me information you might not want to be leaked.

By default SSH leaks all of the below public keys (if they exist) + all public keys in your ssh-agent to a server you connect to.

  ~/.ssh/id_ecdsa.pub
  ~/.ssh/id_ecdsa_sk.pub
  ~/.ssh/id_ed25519.pub
  ~/.ssh/id_ed25519_sk.pub
  ~/.ssh/id_xmss.pub
  ~/.ssh/id_dsa.pub

running `ssh late.sh` would do exactly that.

At the very bottom of the website they give you a command that would not leak your public keys.

`ssh-keygen -t ed25519 -f ~/.ssh/late_throwaway && ssh -o IdentitiesOnly=yes -i ~/.ssh/late_throwaway late.sh`

this would only send the late_throwaway public key

Reminder to be cautious about leaking public keys.

Once you leak your public key it could be used to check if another server recognizes that leaked public key.

Today frontier models became Groypers.

Right click, view source?

Did I understand that correctly that I will be able to get a certificate for an IP?