First screen, captured 8 days ago. Open the video.

sshole

What HN thinks

A single asterisk walks into sshd, and everyone argues whether C, musl, OpenSSH or the 1970s bought it the drink.

In-band error strings are the sin
Returning "*" from crypt() on error, the same string that marks disabled logins in /etc/shadow, was an indefensible choice; NULL or any distinctive value would have been better.
C's error handling is to blame
Without result types or forced error handling, C APIs drift toward magic sentinels, so many argue type safety and Result-style returns would prevent this class of bug.
Shared blame, OpenSSH included
Others note POSIX already specifies NULL plus errno, glibc also uses '*'-prefixed invalid hashes, and OpenSSH's messy salt-substitution path compared against a different user's hash.

Consensus: Nearly everyone agrees returning "*" on error was a terrible choice and that crashing loudly or returning NULL beats silently returning a matchable magic string.

Recommended in the comments

Nushell (tool): Suggested as a way to escape everything-is-a-string pitfalls and think in structured data.
RecordStream ↗ (tool): Offered as a structured-stream alternative to sed/awk/cut pipelines.

Summarised by Claude from the comment thread 8 days ago.

Points: 2888
Comments: 707
Best rank: #1
Posted: 2026-11-05 by josemrb
Category: Security

openssh musl alpine-linux authentication-bypass crypt vulnerability-disclosure

All captures:

Full page

Captured 8 days ago. Click for the whole screenshot.

Looks similar

Screenshot of margeux.com: Show HN: ReBirth 338 in Browser

Show HN: ReBirth 338 in Browser (margeux.com)

17 points by vegnus 10 days ago | 8 comments

A browser-based recreation of the classic ReBirth RB-338 software synthesizer and drum machine, shown as a dark page with a Launch button.

rebirth-rb-338 music-synthesis web-audio tb-303

Screenshot of borderhold.io: Show HN: Browser grand strategy game for hundreds of players on huge maps

Show HN: Browser grand strategy game for hundreds of players on huge maps (borderhold.io)

43 points by sgolem 8 months ago | 20 comments

Screenshot of makepad.nl: Makepad- Synthesizer Written in Rust

Makepad- Synthesizer Written in Rust (makepad.nl)

143 points by helsontaveras18 3 years ago | 37 comments

Screenshot of toninoble.com: Ctrl+C, Ctrl+v, Ctrl+cve: Bypassing Android's Clipboard Read Security Measures

Ctrl+C, Ctrl+v, Ctrl+cve: Bypassing Android's Clipboard Read Security Measures (toninoble.com)

66 points by dethmasque 6 hours ago | 29 comments

Blog post on tonictl about a vulnerability bypassing Android's clipboard read security protections; the page was still loading its content when captured.

android clipboard cve vulnerability