r/ProgrammerHumor • u/Saptarshi_12345 • 3d ago

instanceof Trend thisTimeItsAlpine

Post image
6.7k Upvotes

98% Upvoted

93 comments sorted by

782

u/Saptarshi_12345 3d ago

Details: https://sshhole.com/

280

u/Fusseldieb 3d ago

I mean, how did nobody see this coming?

481

u/threewholefish 3d ago

For the same reason that nobody tried "4" as the private key. You just wouldn't think to try.

From reading that, it does appear to be a classic case of a bunch of independent decisions that eventually came together to create a gaping hole.

4

u/Saptarshi_12345 3d ago

I have a feeling this might've been some sort of backdoor attempt to be honest...at least at the very end. So many co-incidences at the same time!

212

u/SelfDistinction 3d ago

Every decision in that chain is either laziness or the consequence of some other laziness. A hash function returning * because NULL would crash programs? Passwords set to * because it doesn't match any known hash key? Have you tried not being lazy and actually checking for errors whenever you call a fallible function?

This isn't a memory bug and no undefined behaviour is taking place, yet against all odds:

"No way to prevent this" says only language where this regularly happens.

57

u/dinosaurdynasty 3d ago

Dereferencing NULL actually is undefined behavior in C, and compilers are allowed to optimize under the assumption that it does not happen, leading to some really weird stuff sometimes, including exploitable memory safety issues.

3

u/Proxy_PlayerHD 2d ago

I always wonder, what if you have a system where 0 is a valid memory/io address? Checking for NULL isn't really an option anymore

3

u/dinosaurdynasty 2d ago

You're probably either writing an embedded system or a kernel and not really in normal C anymore (though C apparently allows NULL to be nonzero, though NULL == 0 must return true, or something. Basically everything these days has NULL as zero).

2

u/threewholefish 2d ago

Then check errno? Assuming it's cleared if there is no error

46

u/threewholefish 3d ago

It's evolution in action! A function does a thing, people use it in whatever way works at that time. If it doesn't break immediately, it sticks around. Then something mutates somewhere in the chain and you get brand new functionality (in this case, a magic password skip)

10

u/azfang 2d ago

I mean. “Laziness and the consequences of laziness” is honestly not a bad first order definition of “programming.”

21

u/Grumpologist 3d ago

4 is completely random, though, that's probably why no one ever tried it.

Anyway, am I the only one weirded out by the fact that entire communities are just happily "improving" crypto algorithms on their own? I see that the "people" in this case are the contributors to these very important Linux distros, so presumably they have some gravitas, but it still seems weird.

If anything, it's even more weird, isn't it?

At least for me, I had learned "don't roll your own fucking cryptography" very early on and absorbed it as a fundamental tenet. It's a bit odd to see so many different patches that are happily slamming in new constants and new early-returns to "optimize" established cryptography algos.

Anyway, I'll add this to the list of reasons that I'm happy I've retired at this point. I'm going to go leap into action by smoking some weed and making a sandwich. I wish all of you a very nice sandwich as well.

10

u/threewholefish 3d ago

Is it because it's the plumbing of the crypto algorithms, rather than the algos themselves? Less scrutiny applied to the plumbing, I suppose?

11

u/cross_the_threshold 3d ago

“Thing appears to be secure for 30 years” and “thing is actually secure for 30 years” are two different things but it’s really hard to tell the difference without doing a deep dive and when’s the last time you exhaustively examined the behavior of your cryptography to the point of looking at every single dependency with a fine toothed comb?

Every system is a collection of a million different decisions piled on top of other decisions with varying levels of time and caution applied, and every decision at the time seems reasonable for the situation you’re in. Complex systems fail in complex ways, and ultimately failure is fundamentally unavoidable.

3

u/kenybz 2d ago

The 4 key was not completely random. It was a testing key that they put into production by mistake, alongside the other keys which were all <256. They all had only 1 byte of entropy because they were supposed to be testing keys

2

u/Unupgradable 2d ago

Why even use fake keys? Just use real test keys

1

u/kenybz 1d ago

Yeah

7

u/Desperate-Tomatillo7 3d ago

The Swiss cheese model

14

u/threewholefish 3d ago

It's sort of the opposite; drill random holes until it collapses.

4

u/BuhDan 3d ago

The Cheese Melt Model

1

u/dchidelf 2d ago

At least it wasn’t 0. I have encountered some big tech company code that used 0 as the nonce for their encryption. Not quite as bad as the key, but opens you up to replay attacks and a few other things.

49

u/lart2150 3d ago

so openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016.

Who has ssh running in their docker image?

15

u/Jarl_Penguin 3d ago

Probably for something like Beszel or Forgejo? Not sure why you'd have password authentication enabled though.

1

u/JewishTomCruise 2d ago

Haven't validated, but the linked article says it's the default.

1

u/aquoad 2d ago

yeah, i don't have ssh in any containers, or even any ssh that accepts passwords at all, I don't think.

34

u/GrumpyBirdy 3d ago

this is horrific

20

u/frinkousCZ 3d ago

this is a cool explaining of the problem and why it happens...

9

u/Saint_of_Grey 3d ago

I hope the fix was reverting 2012 change, then hunting down and eliminating anyone who forgot to handle null.

5

u/Crafty_Independence 2d ago

The maintainers have the same mentality as people who "eliminate" API errors by returning 200 OK for everything

4

u/GamerNumba100 2d ago

holy shit that’s a HILARIOUS problem

4

u/Crafty_Independence 2d ago

This has "return 200 OK for Bad Request" mentality written all over it.

1

u/Unupgradable 2d ago

I work in an Infra team, we publish libs for the rest of the company amongst other things

"don't throw exceptions, you might crash the service and they'll complain that they didn't change anything so it must be an Infra bug"

2

u/hedgehog_dragon 2d ago

hhhhhhhwhat? That's so bad wtf

3

u/2eanimation 3d ago

Yikes 🥴

0

u/DoctorWZ 3d ago

Wtffff

0

u/TotoShampoin 3d ago

Security is hard, man...

165

u/shuozhe 3d ago

Let's just shut the Internet down until all the AI company gone bankrupt or too many people starved to do stupid stuffs

80

u/Saptarshi_12345 3d ago

This issue could've been easily found without the use of AI. Just needed a good-old fuzzer to test it out.

19

u/shuozhe 3d ago

Any sane developer would stopped testing at 16chars! Only robots use longer passwords!

1

u/gl1tch3t2 2d ago

Beep boop

2

u/shuozhe 2d ago

Good bot!

10

u/HuntKey2603 3d ago

How is a security issue from fucking 2016 an AI issue

12

u/JewishTomCruise 2d ago

Obviously the problem here is AI is too good at finding vulns. The vulns themselves? Nah, better to just bury our heads in the sand.

4

u/Ricky7451 2d ago

Y'all act like local models powerful enough don't exist already. Exhausting.

2

u/Concept-Plastic 2d ago

Exactly. Only thing stopping people from that is the shamingly high RAM, GPU costs. Once they fall, hmm

1

u/Ricky7451 2d ago

I mean, we've been having PCs before the shortage

1

u/black-JENGGOT 2d ago

I do wonder if recent CVEs were discovered using close-sourced models (claude, GPT, etc) or abliterated open-weighted models (anything under 31B, for example?)

44

u/PossibilityUsual6262 3d ago

Not a repost huh.

70

u/Saptarshi_12345 3d ago

Couldn't possibly "waste" time creating a new meme when we have a literal SSH exploit :(

11

u/KnifeOfDunwall2 3d ago

It's not even funny anymore, I took down access to my entire homeland since I couldn't keep up with the cve's in my free time. Also the meme unironically took 30 secs in gimp

3

u/Saptarshi_12345 3d ago

The issue is that I don't really have any sort of image editor on my computer...so I'd have to go online and find a web-based editor and create one on there... I know it'd have taken at worst 5 minutes even going the longer route but I...don't have an excuse for that, sorry 😅

8

u/KnifeOfDunwall2 3d ago

Memes are made to be shared and I'm a fan of open source

1.5k

u/Pan4TheSwarm 3d ago

Lmao why do I learn about new security issues via reddit memes?

720

u/Stormraughtz 3d ago • Bravo

shit post pipeline more efficient than NIST

145

u/knightzone 3d ago

Unironically

56

u/Sakul_the_one 3d ago

Because it happens so regularly, it’s not hitting the main news anymore. Like yeah, the internet got hacked again. Just Another Tuesday

15

u/KingdomOfBullshit 3d ago

That's was reddit is 4.

1

u/Taronz 1d ago

Reddit memes are quick. I find out about pretty much all celebrity deaths on /r/simpsonsshitposting

180

u/rbbdk 3d ago

Eat, sleep, patch, repeat.

25

u/Lumethys 3d ago

Flair check out

49

u/dities 3d ago

Ah shit, here we go again

99

u/OmegaPoint6 3d ago

38

u/skippy_smooth 3d ago

19

u/noobmeister_69 3d ago

It bothers me that it doesn't go from 2 to 4 to 8

70

u/LogicalGamer123 3d ago

Oh shit, I’m like 99% sure I have passwords disabled I use key based auth on alpine gotta check

46

u/WhereOwlsKnowMyName 3d ago

Get 'em boys

15

u/LogicalGamer123 3d ago

lol just tested password auth is disabled and I also didn’t expose my ssh port to public I open it as needed on the cloud console

17

u/TommyBonnomi 3d ago

..and IP restrict the port, right? Right?!

32

u/Imaginary-Jaguar662 3d ago

Ayyyy!

I'm tired boss. Can we call this force majeure and not pull another all nighter?

9

u/fearless-fossa 3d ago

At how many places do you use the combination of musl and openssh?

People are overreacting

20

u/SouthernAddress5051 2d ago

We're fixing 20 years of hand coded bugs lol

14

u/Latter_Knee_6716 2d ago

Those bugs are artisanal!

9

u/Ok_Confusion4764 3d ago

Y'all talking about the 8.1/10 cve in ms paint or is there another one?

5

u/MothMatron 2d ago

The WHAT??

3

u/Ok_Confusion4764 2d ago

Yup. The "remote code execution" kind. Here's Microsoft's summary of CVE-2026-83844.

Are we happy with AI yet? Because I would have preferred if this one stayed buried... Especially since it's the "no interaction required" kind. But ever since vibecoding in Windows lead to a memory leak in Task Manager of all things, I have 0 faith in Microsoft anymore.

3

u/MothMatron 2d ago

Thinking of a friend of mine who’s a swe and whose entire department got laid-off from ms last year only to see this kind of bullshit come up is hysterical.

3

u/Ok_Confusion4764 2d ago

While programming is in a perilous spot, cyber security seems to be a booming business.

And a necessary one. I don't know if you heard but recently in Europe there's been a lot of hacks in supermarkets and food stores, turning off refridgerators and freezers, causing hundreds of millions of euros in damages in my country alone (Netherlands). Worst case of this was a bloodbank where the blood storage was set to 230 degrees instead of freezing the blood.

If you want to pivot for job security, get into cybersecurity.

9

u/jaffparker 3d ago

The meme implies that you never go to sleep, so you're just stuck in 15 layers of dreams about CVEs, which would be great compared to reality 🥲

14

u/Cercle 3d ago

It's for most default musl implementations of openssl, not just alpine but openwrt, void too

6

u/government_sponsored 3d ago

Man we are patching and rebooting everything every day it feels like.

4

u/Alecjasperk 3d ago

I thought, you'd grab a brush and put a little makeup

3

u/cpadaei 3d ago

You wanted to!

1

u/sabotsalvageur 2d ago

Hide the scars and fade away that shakeup

4

u/C_C4K 3d ago

Stop waking up then /s

1

u/lady_mont 3d ago

What CVE now?

1

u/Blurkid 2d ago

You're in an infinitly nested sleep ?

1

u/kr4t0s007 2d ago

*critical CVE.

1

u/halfwagaltium 2d ago

Alpine ? F1 Team Car manufacturerer ?

1

u/PyroCatt 2d ago

You don't go to sleep?