On: XZ backdoor: "It's RCE, not auth bypass, and gated...

[1oooqooq]

edit your .ssh/config.

add one Host entry per domain.

on the end of the file add one catch all host rule with IdentityFile /dev/null

otherwise you're sending default key names to all hosts.

...and you are not sending id_rsa.pub to every single place you add a key, like most guides suggests, right? right?

[ykonstant → 1oooqooq]

I would be interested in a comprehensive guide on "doing it right", or a link to a guide that suggests the right thing.

[1oooqooq → ykonstant]

already exists. "man sshconfig" or something.

guides dumbing down things are the root of evil.