Re:Sshole
by dabinat on Thursday November 05, 2026 @03:48PM
(#50384292)
This is why I don’t fully buy the argument that software that’s been around for a long time is more secure and reliable because it’s been battle-tested. There’s been a lot of time for cruft to accumulate until no-one can ever fix it because everyone is expecting it to function in the broken manner it’s always functioned. And some of the more obscure configuration options get a lot less scrutiny.
[ Parent
| on HN ]
This is not an obscure configuration option. Your password file almost certainly has at least one account with "*" as the password hash.
Integration of different software is the stage most likely to introduce uncaught bugs. That is what happened here: musl intentionally broke the documented API of a function used by OpenSSH. Then Alpine integrated this incorrect implementation with OpenSSH.
Re:Sshole
by procaryote on Thursday November 05, 2026 @05:54PM
(#50385697)
Musl, which is vulnerable, is much younger and less battle tested than glibc, which is not vulnerable though