Support




Contact
Ace:
aceofspadeshq at gee mail.com
Buck:
buck.throckmorton at protonmail.com
CBD:
cbd at cutjibnewsletter.com
Doof:
doof2112 at proton.me
joe mannix:
mannix2024 at proton.me
MisHum:
petmorons at gee mail.com
J.J. Sefton:
sefton at cutjibnewsletter.com
Powered by
Movable Type





Daily Tech News 6 November 2026

Top Story

  • Well, that's dumb: A configuration flaw in certainly flavours of Linux - most of them uncommon but the list includes OpenWRT and Alpine - allows anyone to log in using SSH to account that explicitly forbid logins. (Bleeping Computer)

    You can disable logins in several ways, one of which is to replace the password hash on the account with * - an invalid hash that can never match any password.

    A patch to OpenSSH in 2016 made it always try to hash the password even though it knew there was no way it could match, to prevent sidechain attacks.

    And then it all went wrong:
    The problem is that the musl C library's crypt() function also returns * when password hashing fails, including when a submitted password exceeds its 256-byte limit.
    Because null is too hard.
    This means an attacker can submit an oversized password and cause OpenSSH to compare the returned * against the account's stored *, resulting in a successful login.
    Ouch.

    It isn't open season; the bug is more specific than that. But the default AWS template for Alpine Linux is affected.

Tech News



Musical Interlude





Disclaimer: One way ticket to a Mobius strip.

Posted by: Pixy Misa at 04:00 AM




Comments

(Jump to bottom of comments)

1 BOING!

Present!

Posted by: Biden's Dog sniffs a whole lotta malarkey, at November 06, 2026 04:04 AM (lgmVC)

2 NEVER use password authentication in SSH. Use pre-generated keys.

Posted by: Grumpy and Recalcitrant, a Moron behind enemy lines at November 06, 2026 04:04 AM (O7YUW)

3 Posted by: Pixy Misa at 04:00 AM
-

YOU LIE!

slap-slap

Posted by: Biden's Dog sniffs a whole lotta malarkey, at November 06, 2026 04:05 AM (lgmVC)

4 Insomnia sucks.

Posted by: "Perfessor" Squirrel at November 06, 2026 04:05 AM (s2iZv)

5 Insomnia sucks.

Posted by: "Perfessor" Squirrel at November 06, 2026 04:05 AM (s2iZv)
-

You should write a book about it. You've already given us the title.

Posted by: Biden's Dog sniffs a whole lotta malarkey, at November 06, 2026 04:08 AM (lgmVC)

6 . A math professor from Florida reflects on Philippians 4:6-7 and A small act of kindness:

https://tinyurl.com/5yuhpex4

Posted by: FenelonSpoke at November 06, 2026 04:09 AM (JrHfD)

7 Saw a terrible but funny joke online...

Q: Why are there no Mexican Olympics?

A: Because everyone that can run, jump, or swim has already crossed the border.

Posted by: jim (in Kalifornia) at November 06, 2026 04:10 AM (l3cgK)

8 I took Millard, the kitten in to be neutered . I got a sheet of instructions, but he is not following them. He’s not supposed to go upstairs. He did. He's not supposed to be jumping up on things. He jumped on the sofa. He's supposed to have several days of rest. Nope, although he's taking more naps . This cat obviously has a problem with reading which was never diagnosed before😉

Posted by: FenelonSpoke at November 06, 2026 04:15 AM (JrHfD)

9 Further, here's some of my changes to OpenSSH's config file in /etc/ssh/sshd_config

PermitRootLogin no

(Don't want anyone able to directly shell into root via ssh.)

StrictModes yes

(Make sure the user hasn't done something stupid like leaving their ssh keys world writable)

PasswordAuthentication no

Password authentication is denied. You need a pre-generated public key in ~/.ssh/authorized_keys that matches the private key of the person trying to connect, or you can just pound salt, Skippy.

PermitEmptyPasswords no

Duh, of course.

ChallengeResponseAuthentication no

This is one sometimes missed. If the public key doesn't work for any reason, if this is turned on, if this is 'yes', SSH will fall through to asking for a password. NO!

Posted by: Grumpy and Recalcitrant, a Moron behind enemy lines at November 06, 2026 04:16 AM (O7YUW)

10 @8/FenelonSpoke: This cat obviously has a problem with reading which was never diagnosed before

*snorts*

Posted by: Grumpy and Recalcitrant, a Moron behind enemy lines at November 06, 2026 04:17 AM (O7YUW)

11 Astronaut spent many days in space. What he saw pointed him back to God , the creator, and the Bible. Faithpot site:

https://tinyurl.com/aum32787



Posted by: FenelonSpoke at November 06, 2026 04:19 AM (JrHfD)

12 That SSH exploit requires password authentication to be enabled, hence why I'm real happy I got Draconian with my configuration files a long time ago.

Posted by: Grumpy and Recalcitrant, a Moron behind enemy lines at November 06, 2026 04:21 AM (O7YUW)

13 He shall not be afraid of evil tidings; his heart is fixed, trusting the the Lord.

Posted by: Kings man at November 06, 2026 04:22 AM (KVjz6)

14 Klein Bottle Neck would be a good name for a funk album.

Posted by: Warai-otoko at November 06, 2026 04:22 AM (aKiSo)

15 14 Klein Bottle Neck would be a good name for a funk album.

Posted by: Warai-otoko at November 06, 2026 04:22 AM (aKiSo)

A Klein Bottle would be terrible for drinking beer from...

Posted by: jim (in Kalifornia) at November 06, 2026 04:24 AM (l3cgK)

16 The best security is running an absolute potato with nothing of any value on it.

It's served me well all my life, at least.

Posted by: Warai-otoko at November 06, 2026 04:25 AM (aKiSo)

17 15 14 Klein Bottle Neck would be a good name for a funk album.

Posted by: Warai-otoko at November 06, 2026 04:22 AM (aKiSo)

A Klein Bottle would be terrible for drinking beer from...
Posted by: jim (in Kalifornia) at November 06, 2026 04:24 AM (l3cgK)

Great way to get non-orientable, though.

Posted by: Warai-otoko at November 06, 2026 04:28 AM (aKiSo)

18 @Pixy: "Anyway, total cost was about the same as a 2TB SSD these days."

So you're broke, massively in debt, and are now an indentured servant for the rest of your life.

Posted by: Grumpy and Recalcitrant, a Moron behind enemy lines at November 06, 2026 04:30 AM (O7YUW)

19 "How much have you had to drink tonight, sir?"

"Just one glass."

"How big was the glass?"

"I have to plead the fifth."

"You don't need to plead the fifth amendment, sir, this is just a traffic stop."

"No, not the fifth amendment. Chapter 5 of Burkhoff and MacLane."

Posted by: Warai-otoko at November 06, 2026 04:33 AM (aKiSo)

20 Posted by: Kings man at November 06, 2026 04:22 AM (KVjz6)

Thanks and may God bless you and all here. .

Posted by: FenelonSpoke at November 06, 2026 04:34 AM (JrHfD)

21 There really is a kind of bell curve with regards to religiosity versus scientific expertise, isn't there?

If you know absolutely nothing about how the universe works, you naturally want to ascribe everything that happens to some kind of supernatural forces. If you know just a bit about it, you think "Look at me, I know things, I don't need stupid myths to explain the world".

Then if you really dig in and get to the nitty gritty of how the universe is built, you go right back to having to believe that nothing at all makes sense without some kind of divine power in play, because every discovery you make just pushes the question further back and muddles your perception of what the meaning of "is" even is.

Posted by: Warai-otoko at November 06, 2026 04:41 AM (aKiSo)

22 Mornin'

Posted by: Puddleglum at work at November 06, 2026 04:44 AM (byWhc)

23 There is a game idea I've been tossing around for many years. A favorite early 80s (same board as Pac-man) arcade machine from NAMCO that never got a sequel, Bosconian. For some reason, NAMCO hates this game and often pretends it never existed, leaving out of retro collections even though it is a tiny ROM using the same emulator as many other machines.

I've wanted to do a sequel that would add bosses to the game built from the existing battle stations. They'd join together to form much more formidable enemies, even taking on animalistic forms. This would mean adding scaling to the design, which would be easily enable by doing it in 3D with a flattened Z plane. (Kind of like how Futurama was made.) This would also open the possibility of reimagining the game in a full 3D setting.

I've gotten interested in possibly pursuing this again now that much or most of the heavy lifting can be automated. It doesn't have to be high quality code since it's expanding a 45 year old game on modern hardware.

Posted by: Epobirs at November 06, 2026 04:45 AM (/0z9K)

24 Well, that's dumb, and worthy of dismissal for cause: Several staffers at the White House are using personal electronic devices with VPN exit nodes running on them. (Krebs on Security)

A lot of paid services block known VPNs, so VPNs pay users to host exit nodes on their residential devices that aren't blocked.

Bringing such a device to work when you work at the White House is beyond retarded.


I don't use a VPN but if I did I'd turn that feature off no matter how much they paid me.

The last thing I want is my IP to show up on a list because some dickhead was using a VPN to surf child porn and my IP was the unlucky one that was his endpoint that day.

No way I'm allowing random people all over the world to use my IP.

Posted by: SpeakingOf at November 06, 2026 04:50 AM (6ydKt)

25 G'Day everyone

Posted by: Skip at November 06, 2026 05:01 AM (Ia/+0)

26 How big does a black hole have to get for it to explode because that’s what they want us to believe. The pointy heads now think black holes evaporate over 10^100 years.

Posted by: Accomack at November 06, 2026 05:02 AM (Dpv2s)

27 Re Klein bottles and such. Of late, I've gotten into differential geometry mostly due to some GR/spacetime interests, and I began to appreciate topology and some things clicked in my brain that I hadn't realized before.

Topology is truly the supreme law of the land. There is great flexibility in the geometry of a manifold, but the topology puts fundamental constraints on it, and most importantly the very physics that can exist on that manifold, that space.

Posted by: Publius on Stupid Phone at November 06, 2026 05:02 AM (w6EFb)

28 Evening and morning, late toilers and early risers. It's Friday at last, the consummation devoutly to be wished!

Had a fairly lucid dream from the mid-'90s on how to get all the data from people applying to graduate school into digital format. In real life I did something like it, creating an Access database and typing in the *enrolled* students' data so we could produce pay forms for Payroll for them. This dream was more like, "The Grad School has already put these applicants into the mainframe. If I could search and pull up a link, the committee at my department should be able to click on that link." But in the dream, the search could not find not everybody they had entered. It looked like I'd have to photocopy all 620 (?) of our applications. Then I woke up.

Posted by: Wolfus Aurelius, Dreaming of Elsewhere at November 06, 2026 05:03 AM (56Qyq)

29 https://sshhole.com/

A really nice scrollable explanation of the SSH vulnerability, showing how the pieces of it were implemented over time, and how they came together to form the actual problem.

At the end is a "See for yourself" demonstration piece where you can paste in (or type in) passwords to see how the password hashing looks behind the scenes for both Debian and Alpine linux, and at 256 characters things still work, but type that last character in and go to 257, and... well...

Whoops. Whoopsie!

Posted by: Grumpy and Recalcitrant, a Moron behind enemy lines at November 06, 2026 05:05 AM (O7YUW)

30 66 F., humidity high of course, but wind very mild. Perfect workout conditions. If I go today I can skip tomorrow, or so I tell myself.

Posted by: Wolfus Aurelius, Dreaming of Elsewhere at November 06, 2026 05:06 AM (56Qyq)

31 Yesterday was Guy Fawkes Day. Anybody celebrate? "A penny for the Guy"?

Posted by: Wolfus Aurelius, Dreaming of Elsewhere at November 06, 2026 05:07 AM (56Qyq)

(Jump to top of page)






Processing 0.0, elapsed 0.0104 seconds.
14 queries taking 0.0048 seconds, 39 records returned.
Page size 41 kb.
Powered by Minx 0.8 beta.



MuNuvians
MeeNuvians
Frequently Asked Questions
The (Almost) Complete Paul Anka Integrity Kick
Top Top Tens
Greatest Hitjobs

The Ace of Spades HQ Sex-for-Money Skankathon
A D&D Guide to the Democratic Candidates
Margaret Cho: Just Not Funny
More Margaret Cho Abuse
Margaret Cho: Still Not Funny
Iraqi Prisoner Claims He Was Raped... By Woman
Wonkette Announces "Morning Zoo" Format
John Kerry's "Plan" Causes Surrender of Moqtada al-Sadr's Militia
World Muslim Leaders Apologize for Nick Berg's Beheading
Michael Moore Goes on Lunchtime Manhattan Death-Spree
Milestone: Oliver Willis Posts 400th "Fake News Article" Referencing Britney Spears
Liberal Economists Rue a "New Decade of Greed"
Artificial Insouciance: Maureen Dowd's Word Processor Revolts Against Her Numbing Imbecility
Intelligence Officials Eye Blogs for Tips
They Done Found Us Out, Cletus: Intrepid Internet Detective Figures Out Our Master Plan
Shock: Josh Marshall Almost Mentions Sarin Discovery in Iraq
Leather-Clad Biker Freaks Terrorize Australian Town
When Clinton Was President, Torture Was Cool
What Wonkette Means When She Explains What Tina Brown Means
Wonkette's Stand-Up Act
Wankette HQ Gay-Rumors Du Jour
Here's What's Bugging Me: Goose and Slider
My Own Micah Wright Style Confession of Dishonesty
Outraged "Conservatives" React to the FMA
An On-Line Impression of Dennis Miller Having Sex with a Kodiak Bear
The Story the Rightwing Media Refuses to Report!
Our Lunch with David "Glengarry Glen Ross" Mamet
The House of Love: Paul Krugman
A Michael Moore Mystery (TM)
The Dowd-O-Matic!
Liberal Consistency and Other Myths
Kepler's Laws of Liberal Media Bias
John Kerry-- The Splunge! Candidate
"Divisive" Politics & "Attacks on Patriotism" (very long)
The Donkey ("The Raven" parody)
News/Chat