Above all, I’m a little sad that the musl developers decided to make a lot of “well it’s convenient” changes to core crypto functions — at least without the level of auditing that would have caught this! It’s tarnished their reputation in my eyes a little.
neuroticnews25 18 minutes ago [-]
That's a well-made site, yet I feel nothing.
cpach 15 minutes ago [-]
LLM output fatigue?
jonstewart 6 minutes ago [-]
What is dead can never die. All blueteamers are ironborn these days.
scandinavian 5 minutes ago [-]
Did anyone get it to work? I tried on the official alpine docker image, enabled password login for root. The shadow entry has ! as password by default, this didn't work with a > 256 character password (i also did passwd -l which also does !). I manually changed it to * and it still didn't work.
Am I doing anything wrong here?
OpenSSH_10.3p1, OpenSSL 3.5.9 29 Sep 2026
PRETTY_NAME="Alpine Linux v3.24"
hypfer 22 minutes ago [-]
What is out there that uses musl without PAM and hosts an OpenSSH SSHd with PasswordAuthentication?
As in: "Actually out there"
The hypothetical Alpine exists, yes, but what runs that like that?
jbyers 19 minutes ago [-]
A large number of Docker containers?
Edit: Sure, a small minority presumably run sshd under these conditions. But a small minority times the number of Alpine containers still gets to a large absolute number with a trivial exploit. It's bad.
ekidd 16 minutes ago [-]
Many, many Docker containers rely on "docker exec" or the kubectl equivalent to gain CLI access when needed. To have sshd in an Alpine Docker container, you're generally need to be running init and a bunch of demons, not just a single standalone service.
I'm guessing in practice relatively few people are actually exposed. But if they are, it's catastrophic.
stingraycharles 13 minutes ago [-]
Docker containers run sshd?
hypfer 18 minutes ago [-]
Docker containers that run sshds?
Bender 13 minutes ago [-]
Possibly public SFTP servers. I've allowed null passwords in the past for anonymous public SFTP and I run Alpine Linux exclusively for my servers both VM's and physical. The shadow package (PAM) did not get installed by default. I installed it but I had to specify it in the installation.
illusive4080 23 minutes ago [-]
From the other thread’s source [1], it affects musl without PAM. You can set PasswordAuthentication=no or update to remediate.
> except a lot of programs never check for NULL. they just compare whatever crypt() gives back with the stored field, hit the NULL, and crash
> so musl (the libc under alpine) goes ok fine, crypt() just won't return NULL anymore. if it fails, it returns a single character instead.
Considering it's been accepted that crashing if malloc returns a NULL is your fault, did musl really feel the need to accommodate bad implementations like this or is this just AI dribble?
bombcar 28 minutes ago [-]
The real name of this is sshole - the is the "star" of the show, after all.
yreg 24 minutes ago [-]
*sshole, the * is the star of the show
You can use \ to escape formatting.
jdw64 15 minutes ago [-]
I liked that this site explained the vulnerability in an easy-to-understand way.
gosen 19 minutes ago [-]
I really like creativity in the name, the way website built and the content
"tl;dr" was a bit of a downgrade though, but that's fine
it's a nice way to promote the company behind it
lclc 7 minutes ago [-]
One more reason to build your (own) Docker images on 'FROM scratch' (basically nothing).
blueflow 3 minutes ago [-]
No, the Alpine containers don't come with sshd preinstalled. You'd have to manually install via dockerfile and leave it unconfigured.
henry700 3 minutes ago [-]
at this point my only reaction is "are you fucking kidding me"
Yet another clankered finding creating a clankered website with clankered explanations. To be fair, this one's a lot better than the other clankered equivalents, but I wonder whether these people even know enough about their bug to have their own write-up?
Also, what's with this damn trend of typing in lowercase only? Why is this a thing?
> oh did i say "i"? sorry. i had agent swarms. a lot of them. let's not get into it
Still a cool finding... it's just the communication is becoming a lot worse these days - I want to understand the findings please, not be impressed by your webpage! Biggest gripe in recent memory is https://github.com/xoreaxeaxeax/skitter-creek-bath-salts
ChrisRR 6 minutes ago [-]
Can we just have a site with the text and images without the awkward scrolling crap? Hijacking basic features is an instant click away from sites for me
Edit: It seems to work fine on mobile. I'm not sure why the scrolling behaviour was added on the desktop version of the site
Rendered at 13:04:01 GMT+0000 (Coordinated Universal Time) with Vercel.
Am I doing anything wrong here?
OpenSSH_10.3p1, OpenSSL 3.5.9 29 Sep 2026
PRETTY_NAME="Alpine Linux v3.24"
As in: "Actually out there"
The hypothetical Alpine exists, yes, but what runs that like that?
Edit: Sure, a small minority presumably run sshd under these conditions. But a small minority times the number of Alpine containers still gets to a large absolute number with a trivial exploit. It's bad.
I'm guessing in practice relatively few people are actually exposed. But if they are, it's catastrophic.
[1] https://hachyderm.io/@damienmiller/117563026759098135
> so musl (the libc under alpine) goes ok fine, crypt() just won't return NULL anymore. if it fails, it returns a single character instead.
Considering it's been accepted that crashing if malloc returns a NULL is your fault, did musl really feel the need to accommodate bad implementations like this or is this just AI dribble?
You can use \ to escape formatting.
"tl;dr" was a bit of a downgrade though, but that's fine
it's a nice way to promote the company behind it
[0] https://news.ycombinator.com/item?id=50377221
Also, what's with this damn trend of typing in lowercase only? Why is this a thing?
> oh did i say "i"? sorry. i had agent swarms. a lot of them. let's not get into it
Still a cool finding... it's just the communication is becoming a lot worse these days - I want to understand the findings please, not be impressed by your webpage! Biggest gripe in recent memory is https://github.com/xoreaxeaxeax/skitter-creek-bath-salts
Edit: It seems to work fine on mobile. I'm not sure why the scrolling behaviour was added on the desktop version of the site