Unixwiz
unixwiz.net · Personal blog · on HN since 2007
Steve Friedl's Unixwiz site hosts illustrated technical guides on SSH, DNS, cryptographic hashes, SQL injection, and C declarations, plus consulting advice.
What HN saysCommenters call his work excellent, recommending his SSH agent forwarding guide, his consulting essay, and his x86 calling convention notes.
77HN people shared it
44linked it in comments
41stories submitted
1.1Kstory points
4 months agolast shared
2007people per year2026
Most-shared posts
- 1So you want to be a consultant?22 people · 534 points · first shared 2007 · 42 comments on HN
- 2An Illustrated Guide to SSH Agent Forwarding12 people · 75 points · first shared 2010 · 8 comments on HN
- 3How to read C type declarations (2003)11 people · 156 points · first shared 2013 · 131 comments on HN
- 4An illustrated guide to the Kaminsky DNS vulnerability (2008)8 people · 37 points · first shared 2008 · 6 comments on HN
- 5An Illustrated Guide to Cryptographic Hashes7 people · 86 points · first shared 2009 · 11 comments on HN
- 6SQL Injection Attacks by Example5 people · 11 points · first shared 2008 · discussion on HN
- 7Intel X86 Function-Call Conventions – Assembly View4 people · 1 points · first shared 2011 · discussion on HN
- 8An Illustrated Guide to IPSEC3 people · 3 points · first shared 2011 · discussion on HN
- 9Using Win32 calling conventions3 people · 2 points · first shared 2011 · discussion on HN
- 10"No Dashes Or Spaces" Hall of Shame2 people · 105 points · first shared 2008 · 62 comments on HN
- 11Techtips2 people · first shared 2012
- 12Chroot – Best practices (2002)1 people · 20 points · first shared 2015 · 1 comments on HN
- 13So you want to be a software engineering consultant?1 people · 14 points · first shared 2011 · discussion on HN
- 14So you want to be a consultant...?1 people · 3 points · first shared 2010 · discussion on HN
- 15Handy netmask reference1 people · 3 points · first shared 2009 · 1 comments on HN
What HN people wrote when they linked it
chb · 2026-06-24
Reminiscent of Steve Friedl's excellent work: http://www.unixwiz.net/techtips/ssh-agent-forwarding.html
miles · 2021-04-30
Start by reading Steve Friedl's excellent "So you want to be a consultant...?" http://unixwiz.net/techtips/be-consultant.html .
rmhsilva · 2021-02-07
Ahh this was a great great article back in the day. Lots of fun on smashthestack.
See also:
- Standard x86 calling conventions -- http://unixwiz.net/techtips/win32-callconv-asm.html
- A x86 instruction reference -- http://ref.x86asm.net/
EDIT: formatting
userbinator · 2014-11-23
I think C declaration syntax is a bit of an acquired taste --- it looks confusing at first but once you "get" it everything falls into place and it feels completely natural. Arguments that it is difficult to read because it is not "left to right" contrast with the fact that the expression syntax is not "left to right" either in most programming languages; 2 + 3 * 4 parses as 2 + (4 * 3) in most languages that use this syntax.
Also worth mentioning that the "clockwise/spiral rule" that this article links to for reading C declarations is actually wrong, as Linus Torvalds helpfully points out here: https://plus.google.com/111049168280159033135/posts/1ZhdNwbjcYF
This is probably a better article for understanding them: http://www.unixwiz.net/techtips/reading-cdecl.html
beosrocks · 2012-05-01
Steve Friedl's So you want to be a consultant...? ( http://www.unixwiz.net/techtips/be-consultant.html ) is also a must-read. Not only is Steve a Unix expert (and the brother of Jeff Friedl, regex legend), he's an excellent writer as well.
f1shy · 2025-01-01
I find this description way better: http://unixwiz.net/techtips/reading-cdecl.html
dapperdrake · 2025-01-01
UnixWiz put it well: "Go right if you can. Go left if you must." [1]
[1]http://unixwiz.net/techtips/reading-cdecl.html
pjmlp · 2023-07-28
squirrel · 2022-08-20
From 2005 (see bottom of http://unixwiz.net/techtips/ )
Also, Alan Weiss and Jonathan Stark cover similar material in more depth, for those interested.
tyingq · 2021-04-24
"I was lucky to collaborate on DNS issues with Dan when he discovered a new form of DNS cache poisoning"
A really good, and really detailed, overview of what Kaminsky found: http://www.unixwiz.net/techtips/iguide-kaminsky-dns-vuln.html Kaminsky references this from the sidebar in his blog.
throw0101a · 2020-07-09
> Teleport handles the auth at its entry point, so you don't need a keypair for every node in your cloud. Just one for Teleport.
From ssh(1):
-J destination
Connect to the target host by first making a ssh connection to
the jump host described by destination and then establishing a
TCP forwarding to the ultimate destination from there. Multiple
jump hops may be specified separated by comma characters. This
is a shortcut to specify a ProxyJump configuration directive.
Auth to the jump/bastion host and then have key(s) on that, or tunnel back the internal auth requests over to your desktop via ssh-agent(1) forwarding:
* http://www.unixwiz.net/techtips/ssh-agent-forwarding.html#fwd
* https://www.cloudsavvyit.com/25/what-is-ssh-agent-forwarding-and-how-d…
victor106 · 2018-07-12
Another good(but old) IPSec article
http://www.unixwiz.net/techtips/iguide-ipsec.html
Sharlin · 2017-10-07
Definitely subjective. It's easy to argue that it's actually the C family of languages that have a backwards declaration syntax - in case of complex declarations, not just backwards but completely crazy inside-out zigzag [1]. Yes, there's a logic in it, but it's definitely not intuitive. On the other hand, the "type-on-the-right" syntax is quite popular outside the C family. Pascal, Ada, Go, Scala, Rust...
[1] http://www.unixwiz.net/techtips/reading-cdecl.html
dnquark · 2017-01-19
The trick to reading crazy C declarations is learning the "spiral rule": http://c-faq.com/decl/spiral.anderson.html (here are more examples, with nicer formatting: http://www.unixwiz.net/techtips/reading-cdecl.html)
icebraining · 2016-07-26
If the server randomizes both the Query-ID and source port, the attacker has less than 1/100000000 chance of sending a valid reply: http://unixwiz.net/techtips/iguide-kaminsky-dns-vuln.html#fix
Piskvorrr · 2016-01-21
An illustrated explanation how ssh-agent is not like copying private key anywhere. http://www.unixwiz.net/techtips/ssh-agent-forwarding.html
daurnimator · 2016-01-20
The default settings are bad for the majority of sysadmins. See http://unixwiz.net/techtips/ssh-agent-forwarding.html#sec
With the ssh-agent defaults, if I have root/sudo access on a server you are logged into with ssh on, I practically have free use of your private SSH key.
I use gpg's ssh-agent emulation (See the man page for gpg-agent under --enable-ssh-support), and store my ssh private key on my yubikey. With this setup, the yubikey's light flashes when something wants to use my private key, and you can just touch the button on it to approve.
msutherl · 2015-07-19
Turns out this enduringly useful text was on the front page when I joined: http://www.unixwiz.net/techtips/be-consultant.html
Bonus, also interesting: http://www.forbes.com/special-report/2011/migration.html
sn · 2014-03-06
I agree with everything except using ssh-agent to forward the key. The reason is that if that one server is compromised, the root user can forward your credentials to any other server that you have access to and if it is set up the same way, also get root there. If you use password for sudo authentication on that machine, they have your password but still don't have your credentials to get into the other server. Reference: http://unixwiz.net/techtips/ssh-agent-forwarding.html
AsymetricCom · 2013-10-11
The original vuln that invited in this kludge:
http://unixwiz.net/techtips/iguide-kaminsky-dns-vuln.html
The solution to this kludge?
> What has ANSSI done to improve the security of the DNS?
> ANSSI led a 4 months alert campaign, warning DNS software vendors and critical DNS operators (such as the root operators and several TLD operators).
aka, nothing, more kludge, push complexity off onto clients.
throw7 · 2013-08-01
I've always liked the presentation of the "spiral rule" at this page:
http://www.unixwiz.net/techtips/reading-cdecl.html
ddunkin · 2013-05-31
That is what public key/agent forwarding is for.
This will explain it better than I ever could:
http://www.unixwiz.net/techtips/ssh-agent-forwarding.html
matt4711 · 2012-05-09
blogspam. real link: http://www.unixwiz.net/techtips/ssh-agent-forwarding.html
cstuder · 2011-11-28
The article reports about the collision paper from 2004: http://unixwiz.net/techtips/iguide-crypto-hashes.html#bignews
And it seems to be written sometime in 2004, see the update and linked blogposts at the end.
No need to yell.
keenerd · 2011-09-11
Sort of. See http://www.unixwiz.net/techtips/ssh-agent-forwarding.html#sec for more details.
I left out a few steps, but at the very least the system you connected to through kernel.org could be compromised.
foxit · 2011-08-21
I liked Steve Friedl's thoughts on this. (Skip to the Billing heading.)
http://www.unixwiz.net/techtips/be-consultant.html
jolan · 2011-08-17
Some good tips on cashflow:
http://unixwiz.net/techtips/be-consultant.html
nyellin · 2011-08-16
Here is another useful reference which discusses __cdecl and __stdcall: http://www.unixwiz.net/techtips/win32-callconv-asm.html
bedris · 2011-07-10
I agree that Secrets of Consulting is a terrific book. I've always been amused by Weinberg's The Lone Ranger Fantasy: "When the clients don't show their appreciation, pretend that they're stunned by your performance--but never forget that it's your fantasy, not theirs."
In addition to Weinberg's writings, Steve Friedl's advice on consulting is terrific: http://www.unixwiz.net/techtips/be-consultant.html
erikig · 2011-04-02
Thanks for this one. You just added a few days to my life and helped push out the onset of carpal tunnel/arthritis.
~
http://www.unixwiz.net/techtips/ssh-agent-forwarding.html