AI and Tech Summaries - AI Weekly Malaysia

Summaries

Short AI and tech summaries with source links, signal scores, and why each update matters for builders, founders, and Malaysian tech workers.

Window

Today Yesterday This week Last week This month Last month All time

Showing 1-1 of 1 results

Date	Provider	Score	Summary
05 Nov 2026, 8:19 PM	Hacker News	7.5	sshole OpenSSH on musl-based Linux (Alpine, OpenWrt, Buildroot, Yocto, many Docker images) has since 2016 accepted any password longer than 256 characters for accounts whose password field is `` — root, key-only deploy users, LDAP users, and Alpine's default AWS/Azure user. The chain: musl's `crypt()` returns `` when SHA-512 crypt fails on >256-byte input, so sshd compares `` to the stored `` and authenticates. The write-up traces the `` convention to 1980 Unix and the musl commits from 2012. Why:* If you run sshd inside an Alpine/musl container or appliance and rely on `*` to lock accounts, password auth is not actually disabled for >256-char inputs; set `PasswordAuthentication no` and `KbdInteractiveAuthentication no`, or patch/upgrade, and check whether your images even include openssh-server. security openssh musl alpine docker

Date

Provider

Score

Summary

05 Nov 2026, 8:19 PM

Hacker News

7.5

sshole

OpenSSH on musl-based Linux (Alpine, OpenWrt, Buildroot, Yocto, many Docker images) has since 2016 accepted any password longer than 256 characters for accounts whose password field is `*` — root, key-only deploy users, LDAP users, and Alpine's default AWS/Azure user. The chain: musl's `crypt()` returns `*` when SHA-512 crypt fails on >256-byte input, so sshd compares `*` to the stored `*` and authenticates. The write-up traces the `*` convention to 1980 Unix and the musl commits from 2012.

Why: If you run sshd inside an Alpine/musl container or appliance and rely on `*` to lock accounts, password auth is not actually disabled for >256-char inputs; set `PasswordAuthentication no` and `KbdInteractiveAuthentication no`, or patch/upgrade, and check whether your images even include openssh-server.