Why SSH Agent Forwarding Is Risky and How ProxyJump Replaces It

·1 views

SSH agent forwarding (-A flag) is a widely recommended but risky practice that exposes your SSH agent socket on remote servers. While connected, any root user on that server can use your agent to authenticate as you to other machines, without ever copying your private key. A safer alternative, ProxyJump (-J flag), tunnels connections through a bastion host while keeping your key on your local device, so the intermediate server never touches your credentials. For running git commands on remote servers, scoped deploy keys or HTTPS tokens are safer substitutes that keep personal keys off servers entirely. If agent forwarding is truly necessary, it should be limited to fully trusted, controlled hosts and paired with confirmation prompts and key expiry settings via ssh-add flags.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

NiceGUI lets Python developers build full web apps without writing JavaScript

NiceGUI is a Python framework that allows developers to create complete web applications — including buttons, forms, charts, and navigation — using only Python, with no HTML, CSS, or JavaScript required. It is built on top of FastAPI for the backend and Quasar/Vue for the frontend, automatically syncing interface state in the browser. A functional app with interactive elements can be written in as few as four lines of Python code. NiceGUI is well suited for MVPs, internal dashboards, data panels, and AI model demos, though it relies on client-side rendering, which may require extra configuration for SEO-sensitive public pages. It deploys like any standard FastAPI/Uvicorn application, typically behind nginx with systemd managing the process.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Java 11: Key Features, API Upgrades, and Performance Gains Explained

Released in September 2018, Java 11 is a Long-Term Support (LTS) version and the first such release after Java 8, making it a preferred upgrade target for enterprises seeking production stability. The release introduced several developer-friendly improvements, including new String methods like strip(), isBlank(), and repeat(), along with simplified file read/write operations via Files.readString() and Files.writeString(). Java 11 also standardized the HttpClient API under java.net.http, adding native support for HTTP/2, WebSocket, and both synchronous and asynchronous request handling. On the performance side, it introduced the experimental Epsilon and ZGC garbage collectors, catering to use cases ranging from short-lived benchmarking jobs to low-latency applications with large heaps. Additional enhancements included running Java source files directly without compilation, extended use of var in lambda parameters, and improvements to the default G1 garbage collector.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Launches Suzi Chat, a Retro Browser Platform With Built-In Multiplayer Games

A developer has built and launched Suzi Chat, a web-based chat platform inspired by late-1990s and early-2000s browser chat rooms. The platform allows users to instantly create and join public or private chat rooms directly from their browser without any complex setup. It also features built-in multiplayer board games including Chess, Checkers, and Gomoku. The application runs on a NestJS backend hosted on a dedicated Linux VPS and is live at suzichat.com. The developer is currently seeking feedback from other developers on the UI, room creation flow, and multiplayer lobby stability.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MyZubster builds automated GitHub bounty lifecycle system across 17 repositories

MyZubster, a distributed open-source ecosystem, has developed and tested a real-time GitHub bounty lifecycle system to safely automate contributor reward workflows without conflating GitHub events with payment or settlement. The system defines an explicit multi-stage lifecycle — from PROPOSED through SETTLED — where GitHub automation only handles a limited middle portion, moving bounties from APPROVED to UNDER_REVIEW based on issue assignments, pull requests, and reviews. Webhooks were configured across 17 first-party repositories, with all incoming payloads validated via HMAC-SHA256 signatures to reject unauthorized requests. During deployment, a production bug was discovered where PM2 was running with a stale environment secret, causing every webhook delivery to return a 401 Unauthorized error until the process was restarted with the updated variable. An end-to-end test using a reward-free bounty successfully validated all three automated transitions — assignment, pull request linkage, and review submission — confirming the lifecycle system works as intended.

0 comments Read more at DEV Community