frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Turning Stories into Action

https://worldsensorium.com/ellen-windemuth-turning-stories-into-action/
1•dnetesn•23s ago•0 comments

The giant ELT telescope is the heir to the great cathedrals of Europe

https://blue-continuum.com/cathedrals-of-light
1•dnetesn•1m ago•0 comments

The Future is Niri (2025)

https://ersei.net/en/blog/niri
1•theanonymousone•2m ago•0 comments

Motorola's Signature 27 is finally bringing GrapheneOS to non-Pixel phones

https://www.howtogeek.com/motorola-signature-27-graphene-os/
1•teekert•2m ago•0 comments

Welcome to Nginx2shell

https://nginx2shell.com/
1•choult•2m ago•0 comments

The Afterlife of Pi

https://pudding.cool/2026/11/pi/
1•rabbit911•2m ago•0 comments

Show HN: ReadyTab – new-tab workspace with a desktop companion

https://readytab.cloud/
1•yako21000•3m ago•1 comments

Apple fits a LLM on iPhone with surgical efficiency

https://www.youtube.com/watch?v=sb9uPuiyM_8
1•lroe•3m ago•0 comments

Show HN: Lmux – A Lightweight macOS Terminal for Claude Code and Codex

https://github.com/sooftware/lmux
2•sooftware14•4m ago•0 comments

Ten Thousand Years (2014)

https://99percentinvisible.org/episode/ten-thousand-years/
1•zenincognito•4m ago•0 comments

Systemd WatchdogSec: The Kill Switch for Hung AI-Generated Code

https://cheikhhseck.medium.com/systemd-watchdogsec-the-kill-switch-for-hung-ai-generated-code-ce2...
1•cheikhdev•5m ago•0 comments

Download your favourite YouTube videos

https://criminallyvulgar.dev/you-should-absolutely-download-your-favourite-youtube-videos/
1•surprisetalk•5m ago•0 comments

Show HN: Music theory drawn on a real guitar fretboard, one engine per diagram

https://guitartheorystudio.com/app
1•Bradappz•5m ago•0 comments

86open

https://en.wikipedia.org/wiki/Executable_and_Linkable_Format
1•birdculture•6m ago•0 comments

China's 'Sharp Power' Chills Global Free Speech

https://nationalinterest.org/feature/how-china-sharp-power-chills-global-free-speech
1•baud147258•6m ago•0 comments

UK to deploy facial recognition in biggest-ever immigration crackdown

https://www.theguardian.com/technology/2026/nov/04/uk-deploy-facial-recognition-biggest-ever-immi...
1•robtherobber•8m ago•0 comments

Show HN: Change my website if the agents let you

https://actera.dev/playground
1•zomtorg•8m ago•0 comments

Amazon tells engineers to stop 'tokenmaxxing' to look productive

https://www.tomshardware.com/tech-industry/artificial-intelligence/amazon-tells-engineers-to-stop...
4•speckx•10m ago•0 comments

Ronaldo Retires from Portugal Duty

https://www.bbc.com/sport/football/articles/cme8rxx2e1w9o
2•Betelbuddy•11m ago•1 comments

Goyangi: Watch what Claude Code is doing, live

https://github.com/netil/goyangi
1•netil•13m ago•0 comments

Why This Obscure Audio Codec Is a Perfect Fit for the N64

https://phoboslab.org/log/2026/11/n64-ulc-codec
1•frostbyte7•13m ago•0 comments

Show HN: MakeWorks 98 – a game in a desktop simulation

https://makeworks98.com/
1•bump-ladel•14m ago•0 comments

Ultrasonic Genitalia

https://www.sciencebase.com/science-blog/ultrasonic-genitalia.html
1•speckx•14m ago•0 comments

SWE-2 Flash

https://cognition.com/blog/swe-2-flash
1•draxen•15m ago•0 comments

Labrinth Producing on Livestream [video]

https://www.youtube.com/watch?v=UUvGJ5WM-gA
1•evek•17m ago•0 comments

Apple cuts employee AI budgets in cost-control push

https://www.reuters.com/business/retail-consumer/apple-cuts-employee-ai-budgets-cost-control-push...
1•nsagent•17m ago•0 comments

Show HN: Cosyra – Steer coding agents on your machines from your phone

https://cosyra.com/
1•adamisnotroman•17m ago•1 comments

Apple's own endpoint sensor, without an external agent

https://www.handsomeboyscomputer.club/log/agentless-macos-1/
1•kravmaga999•18m ago•0 comments

Changing a patient social background changed LLM care recommendations

https://medwrite.ai/news/inside-the-dublink-llm-athon
2•Budran•18m ago•0 comments

Show HN: Units to Draw – a math-only syringe units calculator

https://unitstodraw.com
1•unitstodraw•19m ago•0 comments
Open in hackernews

Sshole

https://sshhole.com
185•josemrb•46m ago

Comments

rvz•33m ago
Related discussion: [0]

[0] https://news.ycombinator.com/item?id=50377221

pluc•29m ago
A+ name
hypfer•21m ago
A* name
kleiba2•11m ago
A{256,} name
henry700•4m ago
*
bombcar•29m ago
The real name of this is sshole - the is the "star" of the show, after all.
yreg•25m ago
*sshole, the * is the star of the show

You can use \ to escape formatting.

illusive4080•24m ago
From the other thread’s source [1], it affects musl without PAM. You can set PasswordAuthentication=no or update to remediate.

[1] https://hachyderm.io/@damienmiller/117563026759098135

hypfer•23m ago
What is out there that uses musl without PAM and hosts an OpenSSH SSHd with PasswordAuthentication?

As in: "Actually out there"

The hypothetical Alpine exists, yes, but what runs that like that?

jbyers•20m ago
A large number of Docker containers?

Edit: Sure, a small minority presumably run sshd under these conditions. But a small minority times the number of Alpine containers still gets to a large absolute number with a trivial exploit. It's bad.

hypfer•19m ago
Docker containers that run sshds?
ekidd•17m ago
Many, many Docker containers rely on "docker exec" or the kubectl equivalent to gain CLI access when needed. To have sshd in an Alpine Docker container, you're generally need to be running init and a bunch of demons, not just a single standalone service.

I'm guessing in practice relatively few people are actually exposed. But if they are, it's catastrophic.

stingraycharles•14m ago
Docker containers run sshd?
Bender•14m ago
Possibly public SFTP servers. I've allowed null passwords in the past for anonymous public SFTP and I run Alpine Linux exclusively for my servers both VM's and physical. The shadow package (PAM) did not get installed by default. I installed it but I had to specify it in the installation.
gosen•21m ago
I really like creativity in the name, the way website built and the content

"tl;dr" was a bit of a downgrade though, but that's fine

it's a nice way to promote the company behind it

neuroticnews25•19m ago
That's a well-made site, yet I feel nothing.
cpach•17m ago
LLM output fatigue?
jonstewart•7m ago
What is dead can never die. All blueteamers are ironborn these days.
cube00•19m ago
> except a lot of programs never check for NULL. they just compare whatever crypt() gives back with the stored field, hit the NULL, and crash

> so musl (the libc under alpine) goes ok fine, crypt() just won't return NULL anymore. if it fails, it returns a single character instead.

Considering it's been accepted that crashing if malloc returns a NULL is your fault, did musl really feel the need to accommodate bad implementations like this or is this just AI dribble?

jdw64•16m ago
I liked that this site explained the vulnerability in an easy-to-understand way.
sneela•15m ago
Yet another clankered finding creating a clankered website with clankered explanations. To be fair, this one's a lot better than the other clankered equivalents, but I wonder whether these people even know enough about their bug to have their own write-up?

Also, what's with this damn trend of typing in lowercase only? Why is this a thing?

> oh did i say "i"? sorry. i had agent swarms. a lot of them. let's not get into it

Still a cool finding... it's just the communication is becoming a lot worse these days - I want to understand the findings please, not be impressed by your webpage! Biggest gripe in recent memory is https://github.com/xoreaxeaxeax/skitter-creek-bath-salts

lclc•8m ago
One more reason to build your (own) Docker images on 'FROM scratch' (basically nothing).
blueflow•4m ago
No, the Alpine containers don't come with sshd preinstalled. You'd have to manually install via dockerfile and leave it unconfigured.
ChrisRR•7m ago
Can we just have a site with the text and images without the awkward scrolling crap? Hijacking basic features is an instant click away from sites for me

Edit: It seems to work fine on mobile. I'm not sure why the scrolling behaviour was added on the desktop version of the site

nxobject•6m ago
Above all, I’m a little sad that the musl developers decided to make a lot of “well it’s convenient” changes to core crypto functions — at least without the level of auditing that would have caught this! It’s tarnished their reputation in my eyes a little.
scandinavian•6m ago
Did anyone get it to work? I tried on the official alpine docker image, enabled password login for root. The shadow entry has ! as password by default, this didn't work with a > 256 character password (i also did passwd -l which also does !). I manually changed it to * and it still didn't work.

Am I doing anything wrong here?

OpenSSH_10.3p1, OpenSSL 3.5.9 29 Sep 2026

PRETTY_NAME="Alpine Linux v3.24"

henry700•4m ago
at this point my only reaction is "are you fucking kidding me"