Top all-time · #652
Smallstep
Company blog · smallstep.com/blogsecurityprogramming
Smallstep is the company blog at smallstep.com, writing about security and programming. Since 2018, 97 different Hacker News readers have linked it 150 times, most often “If you’re not using SSH certificates you’re doing SSH wrong (2019)”. No feed was found, so read it on the site itself.
Rarely recommended · 5 of 40 sampled comments recommend it?
Why HN links it
Linked for its posts on SSH certificates, single sign-on for SSH and PKI basics, plus step-ca docs and product pages. Much of the linking comes from Smallstep staff promoting their own work.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Secure devices, enforce Zero Trust and simplify cryptography with Smallstep's unified platform for device identity and certificates.
Most-linked posts?
- If you’re not using SSH certificates you’re doing SSH wrong (2019)14 people · 15 mentions · first linked 2020-03-30
- Everything you should know about certificates and PKI10 people · 10 mentions · first linked 2019-10-29
- Build a tiny CA for your homelab with a Raspberry Pi7 people · 9 mentions · first linked 2020-12-23
- /docs/step-ca/6 people · 6 mentions · first linked 2022-01-05
- DIY Single Sign-On for SSH5 people · 6 mentions · first linked 2020-04-14
- If OpenSSL were a GUI5 people · 5 mentions · first linked 2022-06-10
- /4 people · 4 mentions · first linked 2020-10-14
- /certificates/4 people · 4 mentions · first linked 2020-02-23
- /docs/step-ca4 people · 4 mentions · first linked 2022-02-09
- How to handle secrets on the command line3 people · 5 mentions · first linked 2021-04-12
What Hacker News says?
Yea we like certificates at smallstep. We’ve got a couple[1] other[2] posts[3] that cover them pretty well. Should have probably made a more prominent mention though :). [1] https://smallstep.com/blog/use-ssh-certificates/ [2] https://smallstep.com/blog/diy-single-sign-on-for-ssh/ [3] https://smallstep.com/blog/smallstep-ssh/
Comment linking /blog/smallstep-ssh/
on “SSH hacks – a little sanity for remote workers”Submitted SSH hacks – a little sanity for remote workers as a story · 770 points
HN discussionCheck out our single sign-on for SSH stuff at smallstep (where I work). Either in open source[1] or our product[2]. The hassle of 2FAing all the time is one of the big reasons I love single sign-on for SSH. Basically, you do 2FA when you're pushed through single sign-on. But then you're issued a short-lived certificate that gets put in your ssh-agent. You only need to 2FA to get a certificate. So you can tune 2FA ch…
Comment linking /sso-ssh/
on “SSH hacks – a little sanity for remote workers”Submitted If OpenSSL were a GUI as a story · 744 points
HN discussionDisclosure: not OP, but work at smallstep Smallstep has a product[1] that's a lot like gravitational teleport. That's how we got deep enough into SSH to write this post. Teleport isn't bad. The two biggest differentiators are probably: - Smallstep SSH is hosted (with HSM-backed private keys) - Smallstep SSH does user & group syncing from your identity provider (i.e., you don't need to adduser / deluser folks anymore…
Comment linking /blog/diy-single-sign-on-for-ssh/
on “SSH hacks – a little sanity for remote workers”Submitted If you’re not using SSH certificates you’re doing SSH wrong (2019) as a story · 459 points
HN discussionI like the idea of WireGuard as a simple tunnel, but I wish people would stop comparing it with VPNs. VPNs have lots of extra functionality that is necessary to support a variety of use cases, both functionally (like pushing routes or scripts to clients) and security-wise (like real key management and SSO). I literally can't replace any VPN I currently use with Wireguard because I would lose needed functionality. I…
Comment linking /blog/use-ssh-certificates/
on “WireGuard 1.0 for Linux 5.6”Submitted SSH Agent Explained as a story · 393 points
HN discussionMost people will use nginx-proxy [0] or Traefik [1] for front ending home labs with LetsEncrypt certs... Beyond that people will protect them with things like Tailscale [2], Cloudflare Tunnels [3] or even just mTLS [4] for protected access. Home labbing today has a lot of amazing software and it's hard to keep up! And as for dashboarding [5] on top of all this there are a lot of options. Also, for those new to the g…
Comment linking /blog/build-a-tiny-ca-with-raspberry-pi-yubikey/
on “Blackcandy: Self hosted music streaming server”Submitted Everything you should know about certificates and PKI but are too afraid to ask as a story · 387 points
HN discussionHey, have a look at this https://smallstep.com/blog/use-ssh-certificates/
Comment linking /blog/use-ssh-certificates/
on “Do-nothing scripting: the key to gradual automation (2019)”Submitted How to handle secrets on the command line as a story · 321 points
HN discussionhttps://smallstep.com/ One example. I have been testing smallstep, which puts IDP around ssh (with group management), and also includes a dynamic host catalog (hosts run an agent that phones home to your identity provider). However, I am very excited about Boundary as it seems to be a much more comprehensive solution.
Comment linking /
on “HashiCorp Boundary”Submitted WPA3 Enterprise 192-bit mode at home as a story · 289 points
HN discussionHello HN! We’re Ben, Aanand, Carl, Eva, and Mark, and we made the Command Line Interface Guidelines. Earlier this year, I was working on the Replicate CLI [0]. I had previously worked on Docker so I had a bunch of accumulated knowledge about what makes a good CLI, but I wanted to make Replicate really good, so I looked for some design guides or best practices. Turns out, nothing substantial had been published since…
Comment linking /blog/the-poetics-of-cli-command-names/
on “CLI Guidelines – A guide to help you write better command-line programs”Submitted Build a tiny CA for your homelab with a Raspberry Pi as a story · 229 points
HN discussionWhat about something like step-ca? I got the free version working easily on my home network. https://smallstep.com/docs/step-ca/
Comment linking /docs/step-ca/
on “TLS certificate lifetimes will officially reduce to 47 days”Submitted Build a tiny certificate authority for your homelab as a story · 194 points
HN discussionUnix starts at root, which is how nature intended. It does not change characteristics based on media - you can mount a floppy at root if you want. Why get upset over /media vs /mnt? You do you, I know I do. For example The Step CA docs encourage using /etc/step-ca/ ( https://smallstep.com/docs/step-ca/certificate-authority-ser... ) for configuration for their product. Normally I would agree but as I am manually inst…
Comment linking /docs/step-ca/certificate-authority-server-production/
on “Windows drive letters are not limited to A-Z”Submitted If OpenSSL were a GUI (2022) as a story · 190 points
HN discussionDisclaimer: I work at smallstep. https://smallstep.com/pricing/ . For our hosted product, you're looking at $30-$60/month.
Comment linking /pricing/
on “If you’re not using SSH certificates you’re doing SSH wrong (2019)”Submitted SSH Emergency Access as a story · 165 points
HN discussionI work at Smallstep here's one with numbers: https://smallstep.com/sso-ssh/pricing/#pricing
Comment linking /sso-ssh/pricing/
on “If you’re not using SSH certificates you’re doing SSH wrong (2019)”Submitted The Poetics of CLI Command Names as a story · 117 points
HN discussionI work at smallstep and we support a wide range of Linux distros already. https://smallstep.com/docs/step-cli/installation One of the things on my punch list is to get step CLI into upstream Fedora, Debian, and Ubuntu to make installation a bit more easy.
Comment linking /docs/step-cli/installation
on “If you’re not using SSH certificates you’re doing SSH wrong (2019)”Submitted If you’re not using SSH certificates you’re doing SSH wrong as a story · 99 points
HN discussionI've deployed step-ca internally and have my root certificate added through cloud-init for new servers. Also supports ACME https://smallstep.com/docs/getting-started/
Comment linking /docs/getting-started/
on “Let's Encrypt's New Root and Intermediate Certificates”Submitted Easy private certificate management for VMs on AWS, GCP, and Azure as a story · 87 points
HN discussionsmallstep | Software Engineer, Systems/PKI | Full-time | SF bay but open to remote SF: https://jobs.lever.co/smallstep/32e3331b-ff51-44f3-9ffc-2759... Remote: https://jobs.lever.co/smallstep/ab6abea8-9501-4683-a2b6-fa2b... We're bringing open source based technology to secure cloud-native distributed systems using end-to-end encryption between services, machine-to-machine communication, and privileged access to infr…
Comment linking /careers
on “Ask HN: Who is hiring? (November 2019)”Submitted DIY Single Sign-On for SSH as a story · 27 points
HN discussion
