The Accounts You Locked Were the Ones That Opened: Meet *sshole
OpenSSH and Alpine Linux shipped fixes today for *sshole, a decade-old bug that let any password between 257 and 1024 bytes log in on Linux boxes running musl libc without PAM. Locked accounts get a * in /etc/shadow. musl's crypt() also returns * when it chokes on a password. OpenSSH compared the two, saw a match, and let you in. The bug was reported Wednesday and patched this Thursday with no embargo, because maintainer Damien Miller says AI agents now rediscover bugs within hours. Upgrading alone won't protect you. You still have to restart sshd.
The Accounts You Locked Were the Ones That Opened: Meet *sshole
OpenSSH and Alpine Linux shipped fixes today for *sshole, a decade-old bug that let any password between 257 and 1024 bytes log in on Linux boxes running musl libc without PAM. Locked accounts get a * in /etc/shadow. musl's crypt() also returns * when it chokes on a password. OpenSSH compared the two, saw a match, and let you in. The bug was reported Wednesday and patched this Thursday with no embargo, because maintainer Damien Miller says AI agents now rediscover bugs within hours. Upgrading alone won't protect you. You still have to restart sshd.
The coding-agent land grab
Morning. Before the cards, a little history on the pipes AI coding runs through, because the pipes are suddenly hot property.
- Linus Torvalds wrote Git in 2005 after the Linux kernel lost free access to its old version-control tool. Within days, Git was hosting its own source. It was designed for humans typing commits. Fleets of agents branching in parallel weren't on anyone's mind.
- GitHub launched in 2008, and Microsoft paid $7.5 billion for it in 2018. A huge share of the world's code review still flows through it.
- Writing code got cheap. Reviewing it, merging it, deploying it and keeping it alive at 3 AM are still slow and expensive, and the money has noticed.
So the unglamorous layers are where the fight is. Plumbing nerds, this one's for you. Grab a coffee.
Morning. Before the cards, a little history on the pipes AI coding runs through, because the pipes are suddenly hot property.
- Linus Torvalds wrote Git in 2005 after the Linux kernel lost free access to its old version-control tool. Within days, Git was hosting its own source. It was designed for humans typing commits. Fleets of agents branching in parallel weren't on anyone's mind.
- GitHub launched in 2008, and Microsoft paid $7.5 billion for it in 2018. A huge share of the world's code review still flows through it.
- Writing code got cheap. Reviewing it, merging it, deploying it and keeping it alive at 3 AM are still slow and expensive, and the money has noticed.
So the unglamorous layers are where the fight is. Plumbing nerds, this one's for you. Grab a coffee.
Security and the strained web
