Non-Unique SSH Host Keys Ed25519 on Hetzner
In this technical retrospective (2015), @jonaslejon shares practical architectural lessons learned from running, scaling, or migrating production software under lean constraints.
Core Principles for Independent Builders:
Defaulting to simpler architectures (such as monolithic frameworks, SQLite, or managed VPS) prevents early engineering bankruptcy.
Evaluating true compute and egress costs reveals that high cloud bills can often be slashed by 80%+ through judicious re-platforming.
Code you write at 2 AM as a solo engineer must be easy to debug six months later without complex microservice dependencies.
Community Debate Themes:
HN engineers debated the tradeoffs between cloud convenience and raw server economics, database indexing strategies, and resisting premature architectural complexity.
CATEGORY Frugal Engineering →
HISTORICAL ERA Cloud & Mobile Era (2014–2019)
COMMUNITY SCORE ★ 127 points
TOTAL DISCUSSIONS 58 comments
Some additional details and their mail to customers here: http://blogs.intevation.de/thomas/hetzner-duplicate-ed25519-ssh-host-keys/ "I must say, I’m impressed. Especially at this time of the year I would have expected a slower reaction or a less detailed announcement."
Affected customers have received an email about the issue. I got mine about 2 hours ago.
It would be great not to publish an article like that until some time later, so that everyone gets a chance to fix the problem on their machines before it goes fully public - especially since it's the holiday season and some people don't check email or news that often.
This is probably pretty common. When I first deployed virtualization at a previous job ~5 years ago, it took almost two years before I realized all images used the same host keys.
Can someone versed in cryptography comment on whether this allows passive eavesdropping? Active MITM sure, but I thought session keys would be unique.
Yet another reason not to use images provided by your hosting company.
In anycase, if you are relying on hosting company images (complete with their root backdoor for "performance monitoring control panel!"), it's not like you care very much about your servers' security in the first place...
This is very widespread.
I reported a similar issue on Chunkhost (https://chunkhost.com/) back in 2011... They never responded to my email about remediation, but hopefully the issue was fixed.