Yet another Hacker News

Sshole

156 points josemrb 39 minutes ago 20 comments

rvz 25 minutes ago | parent

Related discussion: [0]

[0] https://news.ycombinator.com/item?id=50377221

pluc 22 minutes ago | parent

A+ name

hypfer 14 minutes ago | parent

A* name

bombcar 21 minutes ago | parent

The real name of this is sshole - the is the "star" of the show, after all.

yreg 18 minutes ago | parent

*sshole, the * is the star of the show

You can use \ to escape formatting.

illusive4080 17 minutes ago | parent

From the other thread’s source [1], it affects musl without PAM. You can set PasswordAuthentication=no or update to remediate.

[1] https://hachyderm.io/@damienmiller/117563026759098135

hypfer 16 minutes ago | parent

What is out there that uses musl without PAM and hosts an OpenSSH SSHd with PasswordAuthentication?

As in: "Actually out there"

The hypothetical Alpine exists, yes, but what runs that like that?

jbyers 13 minutes ago | parent

A large number of Docker containers?

hypfer 11 minutes ago | parent

Docker containers that run sshds?

ekidd 10 minutes ago | parent

Many, many Docker containers rely on "docker exec" or the kubectl equivalent to gain CLI access when needed. To have sshd in an Alpine Docker container, you're generally need to be running init and a bunch of demons, not just a single standalone service.

I'm guessing in practice relatively few people are actually exposed. But if they are, it's catastrophic.

stingraycharles 7 minutes ago | parent

Docker containers run sshd?

Bender 6 minutes ago | parent

Possibly public SFTP servers. I've allowed null passwords in the past for anonymous public SFTP and I run Alpine Linux exclusively for my servers both VM's and physical. The shadow package (PAM) did not get installed by default.

gosen 13 minutes ago | parent

I really like creativity in the name, the way website built and the content

"tl;dr" was a bit of a downgrade though, but that's fine

it's a nice way to promote the company behind it

neuroticnews25 12 minutes ago | parent

That's a well-made site, yet I feel nothing.

cpach 9 minutes ago | parent

LLM output fatigue?

cube00 11 minutes ago | parent

> except a lot of programs never check for NULL. they just compare whatever crypt() gives back with the stored field, hit the NULL, and crash

> so musl (the libc under alpine) goes ok fine, crypt() just won't return NULL anymore. if it fails, it returns a single character instead.

Considering it's been accepted that crashing if malloc returns a NULL is your fault, did musl really feel the need to accommodate bad implementations like this or is this just AI dribble?

jdw64 9 minutes ago | parent

I liked that this site explained the vulnerability in an easy-to-understand way.

sneela 7 minutes ago | parent

Yet another clankered finding creating a clankered website with clankered explanations. To be fair, this one's a lot better than the other clankered equivalents, but I wonder whether these people even know enough about their bug to have their own write-up?

Also, what's with this damn trend of typing in lowercase only? Why is this a thing?

> oh did i say "i"? sorry. i had agent swarms. a lot of them. let's not get into it

Still a cool finding... it's just the communication is becoming a lot worse these days - I want to understand the findings please, not be impressed by your webpage! Biggest gripe in recent memory is https://github.com/xoreaxeaxeax/skitter-creek-bath-salts