Alpine Linux Security advisory: OpenSSH-server password authentication bypass
0 comments
- Points599
- Comments128
–Rank now
#2Peak rank
2Days on list
243Score · 7d
Nov 5, 2026First seen
Rank · 7 days
On Hacker News
- Points
- 599
- Comments
- 128
- Submitted by
- pantalaimon
- Posted
- Nov 5, 2026
- Site
- alpinelinux.org
Story details from Hacker News ↗ · linked article on alpinelinux.org.
Trending history
Alpine Linux Security advisory: OpenSSH-server password authentication bypass was first seen on Hacker News · Front page on Nov 5, 2026. Since then it has appeared in 52 checks on 2 different days. Its best position was #2 of 30, reached on Nov 5, 19:07 UTC. It dropped off the list after Nov 6, 03:52 UTC. The same link also trended on Lobsters, which raises its cross-platform score.
Rank history
Position on Hacker News · Front page at every check (lower is better).
Last 14 days
Best rank per day (UTC).
2
2
Oct 26today
Metric history
Platform metric as reported by Hacker News.
Where it trended
| List | Best | Days | Checks | Last seen |
|---|---|---|---|---|
| Hacker News · Front page | #2 | 2 | 52 | |
| LLobsters · Hottest Alpine Linux : openssh-server password authentication bypass | same link | |||
From the discussion
A few top-level comments from Hacker News, shortened. Read the full thread on Hacker News.
musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password, so the “hash” matches and the login succeeds. Does anyone know why musl does this? Are they the only C library that behaves this way? For…
IMO this is where languages like Rust shine. The design patterns built into the language for handling errors (Result) - force you to handle errors / function results with sentinels, null pointers, or errnos are so much more error prone than handling a Result<T,E> using a match statement. crypt() returning `*` is…
Discussion from a few hours ago: https://news.ycombinator.com/item?id=50377221
Featured in
Archived daily, weekly and monthly lists that include this entry.
Hacker News 2 days, best #2
Questions
Is Alpine Linux Security advisory: OpenSSH-server password authentication bypass trending on Hacker News right now?
Not at the moment. It was last on the list on Nov 6, 03:52 UTC, after 2 days of trending.
What is the highest rank Alpine Linux Security advisory: OpenSSH-server password authentication bypass reached?
#2 on Hacker News · Front page, on Nov 5, 19:07 UTC. Trendoday checks this list every 15 minutes.
How long has Alpine Linux Security advisory: OpenSSH-server password authentication bypass been trending?
It was first seen on Nov 5, 2026 and has been on the list on 2 days (52 checks) since.
How much discussion did it get on Hacker News?
599 points and 128 comments; submitted by pantalaimon on Nov 5, 2026.