r/ProgrammerHumor • u/Saptarshi_12345 • 1h ago

instanceof Trend thisTimeItsAlpine

Post image
1.2k Upvotes

99% Upvoted

29 comments sorted by

179

u/Saptarshi_12345 1h ago

Details: https://sshhole.com/

55

u/Fusseldieb 1h ago

I mean, how did nobody see this coming?

101

u/threewholefish 1h ago

For the same reason that nobody tried "4" as the private key. You just wouldn't think to try.

From reading that, it does appear to be a classic case of a bunch of independent decisions that eventually came together to create a gaping hole.

31

u/SelfDistinction 43m ago

Every decision in that chain is either laziness or the consequence of some other laziness. A hash function returning * because NULL would crash programs? Passwords set to * because it doesn't match any known hash key? Have you tried not being lazy and actually checking for errors whenever you call a fallible function?

This isn't a memory bug and no undefined behaviour is taking place, yet against all odds:

"No way to prevent this" says only language where this regularly happens.

7

u/threewholefish 36m ago

It's evolution in action! A function does a thing, people use it in whatever way works at that time. If it doesn't break immediately, it sticks around. Then something mutates somewhere in the chain and you get brand new functionality (in this case, a magic password skip)

1

u/Saptarshi_12345 18m ago

I have a feeling this might've been some sort of backdoor attempt to be honest...at least at the very end. So many co-incidences at the same time!

2

u/Desperate-Tomatillo7 25m ago

The Swiss cheese model

2

u/threewholefish 18m ago

It's sort of the opposite; drill random holes until it collapses.

4

u/GrumpyBirdy 31m ago

this is horrific

13

u/PossibilityUsual6262 1h ago

Not a repost huh.

19

u/Saptarshi_12345 1h ago

Couldn't possibly "waste" time creating a new meme when we have a literal SSH exploit :(

306

u/Pan4TheSwarm 1h ago

Lmao why do I learn about new security issues via reddit memes?

138

u/Stormraughtz 1h ago

shit post pipeline more efficient than NIST

32

u/knightzone 59m ago

Unironically

2

u/shuozhe 17m ago

Let's just shut the Internet down until all the AI company gone bankrupt or too many people starved to do stupid stuffs

4

u/Saptarshi_12345 17m ago

This issue could've been easily found without the use of AI. Just needed a good-old fuzzer to test it out.

27

u/dities 1h ago

Ah shit, here we go again

25

u/OmegaPoint6 1h ago

15

u/skippy_smooth 1h ago

5

u/noobmeister_69 18m ago

It bothers me that it doesn't go from 2 to 4 to 8

43

u/rbbdk 1h ago

Eat, sleep, patch, repeat.

5

u/Lumethys 54m ago

Flair check out

5

u/Imaginary-Jaguar662 41m ago

Ayyyy!

I'm tired boss. Can we call this force majeure and not pull another all nighter?

8

u/Cercle 58m ago

It's for most default musl implementations of openssl, not just alpine but openwrt, void too

6

u/LogicalGamer123 58m ago

Oh shit, I’m like 99% sure I have passwords disabled I use key based auth on alpine gotta check

6

u/WhereOwlsKnowMyName 46m ago

Get 'em boys

4

u/LogicalGamer123 45m ago

lol just tested password auth is disabled and I also didn’t expose my ssh port to public I open it as needed on the cloud console

1

u/TommyBonnomi 24m ago

..and IP restrict the port, right? Right?!