Top
Best
New

Posted by josemrb 6 hours ago

sshole(sshhole.com)
1389 points | 371 commentspage 2
vova_hn2 4 hours ago|
Offtopic: this is a very cool way to present commits and code excerpts. Love classic Windows styling.

Were those pictures with links generated using a publicly available tool that we could use, or were it custom (vibe)coded specifically to create this page?

dpacmittal 3 hours ago|
This looks entirely vibe-coded to me. No one is going to put so much effort for a vuln.
chris_wot 2 hours ago||
To be honest, I love this sort of vibe-coding. Explains it really well, in an interesting way. If this is vibe-coding, then the AI has done a great job.
marcelox86 51 minutes ago||
It was fun to see this type of style around the release of Opus 4.6, but its really tired now. I've seen countless landing pages like this...its basically ritual
neuroticnews25 5 hours ago||
That's a well-made site, yet I feel nothing.
tasuki 5 hours ago||
Maybe that's on you though. I enjoyed it, though the discrepancy between the `*sshole` name and the `sshhole.com` domain made me twitch. How is anyone[0] obsessive enough to find this and write it up and yet not obsessive enough to make the amount of `h` consistent?

[0]: Be they human or LLM. Or an entity with any proportion of the two. I do not judge nor discriminate.

glibg10b 5 hours ago||
Look closely. The second h is behind the word and almost as dark as the background
tasuki 5 hours ago||
Oh. Thank you!
cpach 5 hours ago|||
LLM output fatigue?
amelius 4 hours ago|||
Apple sideways traffic light fatigue.
hagbard_c 4 hours ago|||
Good to know I'm not the only one annoyed by that superfluous piece of ${whatever} signalling.
riffraff 5 hours ago|||
I didn't hate the writing even if it's AI, but I deeply disliked the animations. I don't know if that's LLM fatigue or not.
oneeyedpigeon 4 hours ago|||
I thought it was a great write up. It did feel a bit AI-coded, but whether it actually was or not, it's still a good bit of work imo.
xnorswap 4 hours ago|||
It would be weird to spend this much effort doing the site by hand, for a bug that the author says was found by a swarm of agents.
phyzome 4 hours ago||||
I dunno, there were some strange discrepancies in the explanation (and captions). Didn't really hang together.
user43928 4 hours ago|||
Looks good overall, but I was wondering if eg. "the timer learns nothing" and "no X, no Y, no Z" was slop rather than a deliberate choice.
bonplan23 3 hours ago|||
I do actually. My guess is that this was not just one-prompted, but someone took the time to refine it based on their tastes and expectations until it matched something they would actually like.

However, if someone already developed a strong AI-slop-tingle it will still be triggered by some telltale signs and let their subconsciousness know that they can't possible enjoy this.

jonstewart 5 hours ago|||
What is dead can never die. All blueteamers are ironborn these days.
mrguyorama 2 hours ago||
It has a crap load of text but says very little and is very bad at conveying the details because it thinks it has to tell some weird story.
marcelox86 48 minutes ago||
I had this classmate that had their ChatGPT instructions to respond in this same laidback, lowercase, gen-z style. i recognized the output as a lot of llm writing almost immediately
0812037123158 4 hours ago||
It's amazing how similar this exploit payload is to the 20+ year-old Quake 3 vulnerabilities found by Luigi Auriemma (aluigi), which also used the exact same 256-to-1024 character range and nothing more than a long string of AAAA.... Here you're feeding >256 A's up to a 1024-byte limit to trip musl's defensive length cap, whereas back in the mid-2000s, Luigi was famous for publishing one-line .cfg scripts where the entire exploit was literally "say aaaaa..." repeated a few hundred times overflowing server's memory.¹ ²

A great example is Jedi Academy, a 2003 Quake 3 engine game whose multiplayer is still actively played today (its open-source engine port, openjk, is even in the Debian repos btw). Luigi had two classic scripts for it on his site: Jedi Academy <= 1.011 in-game server buffer-overflow (jamsgbof)¹, which crashed the server just by pushing a string of as past the 1024-byte console buffer, and Quake 3 engine in-game players kicking (q3msgboom)², where a wall of as hit the engine's 1022-char truncation limit and the leftover bytes confused the parser into disconnecting everyone on the server.

Kind of wild that 20 years later, the exact same payload goes from crashing Quake 3 matches from the tilde console to getting root on some SSH servers.

[1] https://web.archive.org/web/20101227181948/http://aluigi.alt... [2] https://web.archive.org/web/20060522175643/http://aluigi.alt...

0x0 5 hours ago||
For OpenWRT, AsusWRT etc, I believe they use dropbear ssh by default instead of OpenSSH, which apparently isn't affected?
dhx 4 hours ago||
Yes, correct for OpenWrt. OpenWrt defaults to dropbear for both server and client. However, more advanced users may optionally choose to replace it with OpenSSH, or install OpenSSH side-by-side, to gain additional features of OpenSSH.

  > root@OpenWrt:~# cat /etc/openwrt_release | grep DISTRIB_RELEASE
  > DISTRIB_RELEASE='25.12.6'

  > root@OpenWrt:~# which ssh
  > /usr/bin/ssh
  > root@OpenWrt:~# ssh -V
  > Dropbear v2025.89
  > root@OpenWrt:~# ldd /usr/bin/ssh
  >  /lib/ld-musl-aarch64.so.1 (0x7f8e120000)
  >  libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x7f8e0b8000)
  >  libc.so => /lib/ld-musl-aarch64.so.1 (0x7f8e120000)

  > root@OpenWrt:~# which dropbear
  > /usr/sbin/dropbear
  > root@OpenWrt:~# dropbear -V
  > Dropbear v2025.89
  > root@OpenWrt:~# ldd /usr/sbin/dropbear
  >  /lib/ld-musl-aarch64.so.1 (0x7fbb900000)
  >  libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x7fbb898000)
  >  libc.so => /lib/ld-musl-aarch64.so.1 (0x7fbb900000)

  > root@OpenWrt:~# apk search openssh
  > openssh-client-10.6_p1-r2
  > openssh-client-utils-10.6_p1-r2
  > openssh-keygen-10.6_p1-r2
  > openssh-moduli-10.6_p1-r2
  > openssh-server-10.6_p1-r2
  > openssh-server-pam-10.6_p1-r2
  > openssh-sftp-avahi-service-10.6_p1-r2
  > openssh-sftp-client-10.6_p1-r2
  > openssh-sftp-server-10.6_p1-r2
  > openssh-sk-helper-10.6_p1-r2
mkj 3 hours ago||
Dropbear added the 100 character password limit in 2019.77, so earlier versions might be susceptible.
RVuRnvbM2e 5 hours ago||
Wait so musl, famously a stickler for standards, just changed the behaviour of a POSIX function?
throwawayffffas 1 hour ago||
I learned maybe a year in software, should not match/happen are famous last words.

This is just negligent. Not a fan of rewrite in rust, but I find it highly unlikely this would happen in that community.

glennfiedler 1 hour ago||
It's time to switch to OpenBSD
stevenhubertron 3 hours ago||
I’m a smart person and none of this makes any sense to me. It’s like purposefully written poorly.
js2 3 hours ago|
Agreed. Much better explained here: https://news.ycombinator.com/item?id=50379342
tomaskafka 4 hours ago||
At this point it feels to me we aren’t discovering security bugs but a decade of planted backdoors.
jephs 3 hours ago||
Never attribute to malice that which yada yada yada

And like who even needed to plant back doors? If you're the NSA you already had an agent swarm in 1993, but it was made out of dudes from Berkeley and New Haven instead of racks in Prince William County and 印西 (and they were literal secret agents I guess, pretty metal). You can get back doors just by foraging, no need for agriculture.

tialaramex 4 hours ago|||
You have considerably underestimated both how fallible humans are, and how high their tolerance is for risks which aren't immediately visible.

This isn't even just the software industry, humans are like this about everything. Imagine explaining to something rational that (a) humans didn't realise that they won't be able to competently operate a motor vehicle while watching TokTok dances, and (b) when we finally made that illegal because it's such an obviously bad idea they would keep doing it anyway.

This is why those "What if it builds SkyNet?" conspiracies were so stupid. Why on Earth would you build SkyNet when you can just invent Weeaboo and the idiot humans will die playing ?

ImPostingOnHN 4 hours ago|||
True, but also, that is exactly the pretext that would allow someone to maliciously, intentionally commit a backdoor.

There was even a contest for hiding/obfuscating malicious code, e.g. as an honest mistake: https://www.underhanded-c.org/ . And what do you know, the most recent, common approach shown on the page, is: improper comparison inputs that give unexpected comparison results, which is... well... this submission.

tomaskafka 3 hours ago||
Yes, "this looks like an underhanded c challenge" was my first thought when reading this. See one mistake by one project, inject the matching intentional mistake into another project (that also conveniently fixes some known bug), and boom - plausibly deniable backdoor.

If I had a free afternoon, I'd ask a bunch of agents to track the people responsible and their other contributions (but usually the scheme is "contribute valuable patches to build reputation, and only inject an exploit when safe to do so").

zicixisi 4 hours ago|||
[flagged]
TZubiri 4 hours ago|||
actually this looks very underhanded indeed, what are the odds they pick the same sentinel character?!
jephs 3 hours ago|||
Like 1 in 5? The set of go-to characters for that kind of thing is pretty small.
robinpie 3 hours ago|||
Pretty big? For this purpose, my instinct would be to select an ASCII character that's not alphanumeric, not directional, and not a common separator, and that's like, what, a set of 11 characters?
ex-aws-dude 2 hours ago|||
No the biggest lesson of all this AI stuff to me is that we are just not smart enough as programmers

If you think about it that’s the whole idea of neural nets

We aren’t smart enough to design the function we want by hand as programmers so we need to learn it through weights

This lesson just keeps recurring in many different ways

octoberfranklin 3 hours ago||
Be careful, saying this gets you downvoted like https://news.ycombinator.com/item?id=50364646
NavinF 5 hours ago|
Wow. I wonder which of the common fuzzers would have found this a decade ago. If literally any password over 256 chars works, that means nobody has ever fuzzed openssh on musl linux
More comments...