frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

Alpine Linux Security advisory: OpenSSH-server password authentication bypass

https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
102•pantalaimon•1h ago

Comments

throwa356262•56m ago
Discussion from a few hours ago:

https://news.ycombinator.com/item?id=50377221

NewJazz•43m ago
musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password, so the “hash” matches and the login succeeds.

Does anyone know why musl does this? Are they the only C library that behaves this way?

For a C library that famously tries to adhere to POSIX as much as possible, this seems like a crazy choice. From POSIX standard:

Upon successful completion, crypt() shall return a pointer to the encoded string. The first two bytes of the returned value shall be those of the salt argument. Otherwise, it shall return a null pointer and set errno to indicate the error.

https://pubs.opengroup.org/onlinepubs/9699919799/functions/c...

hnfong•26m ago
There's a very detailed trace of how the bug was developed over decades at sshhole.com and the relevant discussion in https://news.ycombinator.com/item?id=50378228
NewJazz•10m ago
Thanks yeah just woke up, finished making my way through the single-article website and still unclear if other libcs do the same thing (the article says libxcrypt picked it up, but only after musl did it).
api•17m ago
TBH that sounds like a straight up bug in that it deviates dangerously from the spec.
worksonmine•4m ago
Apparently because some devs didn't check for NULL which resulted in crashes. Weird choice to fix other peoples' bad programming by deviating from the spec.

Sshole

https://sshhole.com
1054•josemrb•3h ago•294 comments

Alpine Linux Security advisory: OpenSSH-server password authentication bypass

https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
102•pantalaimon•1h ago•6 comments

September in Servo: <progress>, rounded rectangles, and more

https://servo.org/blog/2026/11/05/september-in-servo/
42•iamnothere•1h ago•8 comments

OpenSSH 10.6p2 Critical workaround for alpine without PAM

https://www.openssh.org/releasenotes.html#10.6p2
121•selckin•4h ago•5 comments

MCP Explained

https://mcp-explained.com/
97•rwilinski•1h ago•43 comments

Download your favourite YouTube videos

https://criminallyvulgar.dev/you-should-absolutely-download-your-favourite-youtube-videos/
68•surprisetalk•3h ago•34 comments

Obscure audio codec is a perfect fit for the N64

https://phoboslab.org/log/2026/11/n64-ulc-codec
57•frostbyte7•3h ago•1 comments

Baidu released ERNIE 5.5 Flash Base

https://ernie.baidu.com/release/ernie-5-5-flash-base/
129•pretext•6h ago•73 comments

Vivaldi 8.3 for Desktop: make bad ads sad

https://vivaldi.com/blog/vivaldi-on-desktop-8-3/
35•speckx•3h ago•39 comments

Lemmings CSS Animation

https://markblah.github.io/lemmings/
320•MarkBlah•11h ago•64 comments

Awesome repositories are no longer awesome

https://erikgahner.github.io/posts/2026/awesome-repositories-are-no-longer-awesome/
173•erikgahner•4h ago•91 comments

GPT-6 Astra covertly underperforms on safety research

https://alignment.openai.com/misalignment-reports/covert-underperformance-on-safety-research-tasks/
119•lucrbvi•8h ago•43 comments

Image of Our Satellite-Choked Night Skies

https://kottke.org/26/11/stunning-image-of-our-satellite-choked-night-skies
61•amatheus•1h ago•54 comments

An intuition for how neural nets can understand text

https://info.zairai.ai/neurons-understanding-text
12•luisvalerio•3d ago•2 comments

A thousand fewer paths to root

https://openai.com/index/a-thousand-fewer-paths-to-root/
445•dangelosaurus•16h ago•329 comments

Nordstjernen, Northstar, Southstar: minimalist webbrowsers in C and Rust

https://nordstjernen.org/
3•Propelloni•49m ago•1 comments

So my ISP was hijacking my DNS

https://www.karthihegde.dev/posts/dns_tampering
121•frostbyte7•1d ago•94 comments

Images 2.6

https://openai.com/index/introducing-images-2-6/
364•davidbarker•16h ago•218 comments

Kimi K3.1 Pro model weights are out

https://huggingface.co/moonshotai/Kimi-K3.1-Pro
602•abrarthought•1d ago•173 comments

I wish tech companies knew more about me

https://rakhim.exotext.com/i-wish-tech-companies-knew-more-about-me
55•freetonik•2h ago•38 comments

Spreading Liquid with Three.js

https://mofu-dev.com/en/blog/fluid-foundation/
191•mooreds•2d ago•26 comments

Partial Operator Precedence

https://ziglang.org/devlog/2026/#2026-10-24
84•tosh•2d ago•51 comments

Ripple-65B Preview: U.S. Open-Weight SOTA on Agentic Coding

https://www.ricursive.com/ripple
324•Philpax•21h ago•116 comments

Being a kid making games in the early 2000s

https://jaytholen.net/teengamedev/
87•farmerbb•10h ago•37 comments

A new Go API for JSON

https://go.dev/blog/jsonv2
367•olexsmir•22h ago•189 comments

Residential proxies detected on White House network

https://layer3intel.com/blog/residential-proxies-white-house-network
1212•Rasbora•19h ago•403 comments

Ask HN: What's your current AI agentic setup?

462•eggbrain•1d ago•560 comments

Starfall – Affordable, routine access to microgravity

https://www.spacex.com/starfall
240•gmays•15h ago•185 comments

TextEdit vs. Pages

https://leancrew.com/all-this/2026/10/textedit-vs-pages/
51•surprisetalk•2d ago•32 comments

Insects don't swarm at LED lights

https://www.birdsoutsidemywindow.org/2026/11/03/insects-dont-swarm-at-led-lights/
299•speckx•20h ago•152 comments