First screen, captured 8 days ago. Open the video.

OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability

What HN thinks

A Swiss-cheese vulnerability where the holes line up mostly in Alpine, and everyone rediscovers that passwords over SSH were always a bad idea.

Narrow conditions, mostly Alpine
The bug needs musl, no PAM, password auth on and a '*' shadow entry, so it mainly hits stock Alpine images, containers and some embedded systems; glibc, PAM, OpenBSD and Dropbear setups are fine.
Root cause is musl's crypt()
Many blame musl for returning '*' instead of NULL on failure, violating POSIX, though some note OpenSSH's trick of hashing against another user's hash contributed.
Just disable password auth
Most say PasswordAuthentication should be off anyway, with key-only auth or SSH behind a VPN, though some note enterprise clients and recovery scenarios still push people toward passwords.

Consensus: Most agree the practical exposure is limited to musl-based systems like Alpine with password logins enabled, and that key-only SSH auth is the sensible default. Many also expect short embargoes to become normal now that AI agents rediscover bugs quickly.

Recommended in the comments

WireGuard (tool): Putting SSH behind WireGuard adds a layer with minimal configurable auth and no reply to unauthenticated probes.
Dropbear (tool): Reported unaffected, so OpenWrt devices using it by default are fine.
1Password (product): Suggested as a recoverable home for SSH private keys so password auth isn't needed for recovery.

Summarised by Claude from the comment thread 7 days ago.

Points: 176
Comments: 212
Best rank: #14
Posted: 2026-11-05 by Animux
Category: Security

openssh musl alpine-linux vulnerability ssh linux mastodon

All captures:

Full page

Captured 8 days ago. Click for the whole screenshot.

Looks similar

Unlocking any car from X brand in most of the world (shubs.io)

578 points by infosecau 5 days ago | 317 comments

Screenshot of lists.trustedfirmware.org: Future Maintenance of Mbed TLS

Future Maintenance of Mbed TLS (lists.trustedfirmware.org)

61 points by jonesjohnson 10 days ago | 17 comments

Mailing list announcement that current Mbed TLS maintainers will stop maintaining the TLS and X.509 libraries from April 2027 unless new maintainers step in, with user replies.

mbed-tls tls x509 tf-psa-crypto

Screenshot of gyptazy.com: Live-migration support in FreeBSD and bhyve coming

Live-migration support in FreeBSD and bhyve coming (gyptazy.com)

64 points by JohnDohnBohn 5 hours ago | 15 comments

Blog post presenting a work-in-progress RFC implementation of live VM migration for bhyve on FreeBSD 15.1, covering design, test results, and blockers to upstreaming.

freebsd bhyve live-migration virtualization

Screenshot of erikgahner.github.io: Awesome repositories are no longer awesome

Awesome repositories are no longer awesome (erikgahner.github.io)

239 points by erikgahner 8 days ago | 116 comments

A blog post arguing that GitHub 'awesome' curated lists have become less useful due to outdated content and floods of AI-generated pull requests promoting vibe-coded sites.

awesome-lists github ai-slop pull-requests

Screenshot of lesswrong.com: I struggle to believe that AI R&D is ingenious

I struggle to believe that AI R&D is ingenious (lesswrong.com)

136 points by porridgeraisin 7 days ago | 155 comments

A LessWrong shortform comment by Arjun Panickssery arguing AI agents show poor research judgment in autonomous R&D side projects like a Scrabble engine and philosophy research.

ai-research-agents autonomous-r-and-d llm-capabilities lesswrong