First screen, captured 8 days ago. Open the video.

Alpine Linux Security Advisory: OpenSSH-server password authentication bypass

What HN thinks

A single asterisk walks into sshd, and every passwordless account walks out with it; meanwhile the thread relitigates Rust vs C and Java checked exceptions.

musl's sentinel return is the bug
Returning "*" from crypt() on error deviates from POSIX's NULL return and collides with the shadow-file marker for no-password accounts. Others note most libcs return a "*"-prefixed string, but only musl's was exactly "*".
Result types would prevent this
Rust-style Result/Option forces callers to confront errors, so nobody would invent an in-band sentinel; skeptics call it a logic bug any language could produce, sparking a long tangent on error handling and checked exceptions.
Alpine in containers: risk varies
Some expect wide Docker impact, while others say few run sshd with password auth in containers; a side debate questions musl and static linking altogether.

Consensus: Most agree in-band error signalling with a value that is also a meaningful shadow entry was a dangerous design, and that disabling password auth or using keys mitigates it.

Recommended in the comments

NixOS (product): Cited as showing how to rebuild everything easily, answering the static-linking patching concern.

Summarised by Claude from the comment thread 7 days ago.

Points: 610
Comments: 128
Best rank: #2
Posted: 2026-11-05 by pantalaimon
Category: Security

openssh alpine-linux authentication-bypass musl sshd security-advisory

All captures:

Full page

Captured 8 days ago. Click for the whole screenshot.

Looks similar

Screenshot of alpinelinux.org: Alpine Linux 3.24.0 Released

Alpine Linux 3.24.0 Released (alpinelinux.org)

109 points by fossdd 5 months ago | 19 comments

Screenshot of alpinelinux.org: Implementing /Usr Merge in Alpine

Implementing /Usr Merge in Alpine (alpinelinux.org)

21 points by rascul 1 year ago | 25 comments

Screenshot of alpinelinux.org: GitLab Security Incident: Attempted Exploitation of CVE-2026-97229

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229 (alpinelinux.org)

236 points by sashk 16 days ago | 109 comments

Alpine Linux incident report on an attempted exploitation of a critical GitLab/Ruby Onigmo vulnerability against its GitLab instance, with timeline, impact assessment and remediation.

alpine-linux gitlab incident-report ruby