sshhole

A musl/OpenSSH interaction can let an attacker log into certain passwordless accounts using a long arbitrary password when sshd runs without PAM. The affected configuration also needs password authentication enabled, a target with * as its password field, and another account with a SHA-256 or SHA-512 password hash.

Alpine recommends upgrading OpenSSH and restarting sshd; disabling password authentication and restarting also mitigates it. Default OpenSSH root-login restrictions matter, but other login-capable accounts may still be exposed. Alpine says its official tiny-cloud images can be affected.

HN commenters explain how musl’s crypt() error sentinel can equal the target’s shadow field after OpenSSH selects another account’s salt; they disagree about how common the required configuration is. Lobsters readers also note the default root restriction and criticize the disclosure’s presentation.

• Alpine security advisory
• Hacker News discussion
• Lobsters discussion

Valen experiments with a borrow checker that walks functions backwards

Instead of scanning forward, this experimental language’s safety pass walks a function from its end toward its start. It tracks references that will be used later, then rejects mutations that would invalidate them before those uses; the author also explains how the approach handles loops.

The write-up is a detailed look at a new compiler algorithm, not a settled design: Valen is still experimental, control-flow cases and closures remain unfinished, and the author has not benchmarked the claimed speed advantage. In the small HN thread, the author invited people to try to break the algorithm, while a reader offered encouragement. HN discussion: https://news.ycombinator.com/item?id=50140383

The Missing Piece in Rust Error Handling

This article argues that Rust’s error APIs can preserve concrete error types without forcing each combination into a bespoke enum. It presents an error-set approach, using eros to compose errors from operations while keeping function signatures explicit; the trade-off is an additional library and API pattern to evaluate against existing typed-enum and opaque-error approaches.

The Lobsters page showed no readable comments when checked, despite the front-page snapshot listing five.

• Lobsters discussion

The Missing Piece in Rust Error Handling

This article argues that Rust’s error APIs can preserve concrete error types without forcing each combination into a bespoke enum. It presents an error-set approach, using eros to compose errors from operations while keeping function signatures explicit; the trade-off is an additional library and API pattern to evaluate against existing typed-enum and opaque-error approaches.

The Lobsters page showed no readable comments when checked, despite the front-page snapshot listing five.

• Lobsters discussion

The Async Multiprocessing Has Sound Foundations in Linux, But Further Testing Is Needed

Linux already has the core pieces for asymmetric multiprocessing (AMP), but maintainers need more reviewers, contributors, and repeatable hardware tests to keep them healthy.

Wolfram Sang’s survey follows his effort to upstream a hardware-spinlock driver. It explains how Linux combines remoteproc, RPMsg, mailboxes, shared memory, and SCMI to coordinate application CPUs with real-time cores—and why firmware-specific mailbox arrangements complicate the textbook diagrams. One practical bottleneck is that testing a driver can require modified firmware and U-Boot; OpenAMP’s examples also do not yet run uniformly across supported boards.

InfoQ has no reader-comment section for this article.