–Rank now
#1Peak rank
2Days on list
409Score · 7d
Nov 5, 2026First seen
Rank · 7 days
On Hacker News
Related: https://hachyderm.io/@damienmiller/117563026759098135 / https://news.ycombinator.com/item?id=50377221 https://www.openssh.org/releasenotes.html#10.6p2 https://alpinelinux.org/posts/2026-11-05-openssh-password-au...
- Points
- 2767
- Comments
- 670
- Submitted by
- josemrb
- Posted
- Nov 5, 2026
- Site
- sshhole.com
Story details from Hacker News ↗ · linked article on sshhole.com.
Trending history
Sshole was first seen on Hacker News · Front page on Nov 5, 2026. Since then it has appeared in 119 checks on 2 different days. Its best position was #1 of 30, reached on Nov 5, 16:37 UTC. It dropped off the list after Nov 6, 18:07 UTC.
Rank history
Position on Hacker News · Front page at every check (lower is better).
Last 14 days
Best rank per day (UTC).
1
1
Oct 26today
Metric history
Platform metric as reported by Hacker News.
From the discussion
A few top-level comments from Hacker News, shortened. Read the full thread on Hacker News.
OK, I think I see what’s going on with this, in this configuration. The goal from an attacker’s perspective is to get this to be true: `$ret = crypt($pw, $hash); $ret == $hash` when called by OpenSSH’s sshd. This is how sshd validates that the user logging in knew the account password. The `$hash` is the “settings”…
In-band signaling[1] strikes again. * should not have been used as special value, neither for "no password" in /etc/passwd nor "error while hashing the password" in crypt. I'm afraid we'll find many more of these abuses, specially in string manipulations. The null was ok, an exception (or equivalent) better, and…
The whole story is a bit worse than this. Musl already worked around this type of failure. See the second-to-last line here: https://git.musl-libc.org/cgit/musl/tree/src/crypt/crypt_des... (hey, this workaround is wrong if the salt is "x"!) but they forgot to work around it here:…
Featured in
Archived daily, weekly and monthly lists that include this entry.
Hacker News 2 days, best #1
Questions
Is Sshole trending on Hacker News right now?
Not at the moment. It was last on the list on Nov 6, 18:07 UTC, after 2 days of trending.
What is the highest rank Sshole reached?
#1 on Hacker News · Front page, on Nov 5, 16:37 UTC. Trendoday checks this list every 15 minutes.
How long has Sshole been trending?
It was first seen on Nov 5, 2026 and has been on the list on 2 days (119 checks) since.
How much discussion did it get on Hacker News?
2767 points and 670 comments; submitted by josemrb on Nov 5, 2026.