sshole

rvz

Related discussion: [0] [0] https://news.ycombinator.com/item?id=50377221

bombcar

The real name of this is sshole - the is the "star" of the show, after all.

illusive4080

From the other thread’s source [1], it affects musl without PAM. You can set PasswordAuthentication=no or update to remediate. [1] https://hachyderm.io/@damienmiller/117563026759098135

hypfer

What is out there that uses musl without PAM and hosts an OpenSSH SSHd with PasswordAuthentication? As in: "Actually out there" The hypothetical Alpine exists, yes, but what runs that like that?

gosen

I really like creativity in the name, the way website built and the content "tl;dr" was a bit of a downgrade though, but that's fine it's a nice way to promote the company behind it

neuroticnews25

That's a well-made site, yet I feel nothing.

cube00

> except a lot of programs never check for NULL. they just compare whatever crypt() gives back with the stored field, hit the NULL, and crash > so musl (the libc under alpine) goes ok fine, crypt() just won't return NULL anymore. if it fails, it returns a single character instead. Considering it's been accepted that crashing if malloc returns a NULL is your fault, did musl really feel the need to accommodate bad implementations like this or is this just AI speculation?

jdw64

I liked that this site explained the vulnerability in an easy-to-understand way.

lclc

One more reason to build your (own) Docker images on 'FROM scratch' (basically nothing).

ChrisRR

Can we just have a site with the text and images without the awkward scrolling crap? Hijacking basic features is an instant click away from sites for me Edit: It seems to work fine on mobile. I'm not sure why the scrolling behaviour was added on the desktop version of the site

nxobject

Above all, I’m a little sad that the musl developers decided to make a lot of “well it’s convenient” changes to core crypto functions — at least without the level of auditing that would have caught this! It’s tarnished their reputation in my eyes a little.

scandinavian

Did anyone get it to work? I tried on the official alpine docker image, enabled password login for root. The shadow entry has ! as password by default, this didn't work with a > 256 character password (i also did passwd -l which also does !). I manually changed it to * and it still didn't work. Am I doing anything wrong here? OpenSSH_10.3p1, OpenSSL 3.5.9 29 Sep 2026 PRETTY_NAME="Alpine Linux v3.24"

henry700

at this point my only reaction is "are you fucking kidding me"

RVuRnvbM2e

Wait so musl, famously a stickler for standards, just changed the behaviour of a POSIX function?

draxen

I avoided using alpine-based containers ever since finding out a lot of Linux server software is actually Linux + SystemD software. The union set API of both Linux and SystemD seems to be the default "Linux API" today.

stogot

Of all the named vulnerabilities, I appreciate the history lesson and screenshots of how it got there

oefrha

This is a super duper annoying site for people who just want to know if their systems are vulnerable, after patching like a dozen critical vulnerabilities in other software over the last week and are almost at the breaking point of resigning. Can we have a “don’t treat me like five/toddler” / “idgaf about the explanation” quick link to a section for adults who need to patch systems? (And if your reaction is “just scroll down, stupid”, I’m happy to report that with the scroll jacking, I scroll not enough / past the critical sections nine out of ten times.) Edit: You may want to read https://sshhole.com/#exposure .

traceroute66

To be fair, I have less than zero sympathy for anyone who runs SSH on any platform without `PasswordAuthentication=no` in 2026. Its not asking for trouble, it is there will be trouble, not if but when. As for the people who say "well, I run SSH on port 942329053052". Well guess what, the bots make short work on that. We tried it at $work as an experiment, multiple bots found it in less than a couple of hours. That's why your SSH config must be hardened, preferably running on a hardened OS too.

throooooo

The bugs and commits that "fix" them reveal somewhat of a shitshow for how musl is managed. All projects have bugs, but I can't help but question why the wheel was reinvented here. Many toes have been stubbed along the way.