OpenSSH has a vuln condition which allows logging in without a password. A thread.
https://www.openssh.org/releasenotes.html
It only impacts Linux distributions which ship with musl libc and PAM disabled. I think that is just Alpine Linux (all versions).
It doesn’t impact Debian, Ubuntu, SUSE, Redhat or CentOS. Nor OpenWrt.
OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability.
https://openssh.com/releasenotes.html#10.6p2
If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.
This vulnerability does not exist on non-Linux systems, Linux/glibc systems and Linux systems that use PAM for password authentication.
We consider the root cause of this bug to be outside OpenSSH itself, but we're in a good position to deliver a mitigation quickly.
We are making this release as fast as possible (we learned of the problem yesterday) because we have recently observed multiple cases of rapid bug rediscovery by AI agents, sometimes within hours, and so now consider long embargo periods to be a dangerous practice that primarily benefits attackers.
Thanks for Özgün Kültekin of Wakefield (wakefield.co) for reporting this problem to us and for the Alpine Linux developers for making an updated release available at very short notice.
It’s not as remembered as it should be that besides being a horror icon, Vincent Price was an accomplished gourmet cook who co-wrote several cookbooks with his wife Mary. In this clip, he shows you how to make trout in your dishwasher.
Sprout is planning to sell replacement motherboards for certain iPods. “Sprout only replaces the motherboard and uses your iPod’s original parts. No soldering required, and fully reversible.” Bluetooth, WiFi, 500K songs, USB-C, even streaming. https://certainthings.studio/sprout
I would be very grateful if people out there could stop saying that "every FOSS project is turning towards AI" just because some prominent examples are.
My projects are not. And for OctoPrint I'm actually doubling down on the "made by humans" point in the upcoming website relaunch and am also considering adopting CASA¹
But it's really exhausting to fight this shit at two fronts.
Call to action to cis people: be assholes anytime you get asked for your sex assigned at birth. Write letters, complain to staff, refuse to answer. Make it impossible to collect sex assigned at birth. Be really offended that anyone would ask you. Make enough noise that if trans people want to quietly not answer or give whatever answer feels correct to them, no one will notice.
This Tea Rex is brought to you by insomnia #mastoart
I'd just like to interject for a moment. What you're refering to as Cowgirl, is in fact, Rez/Cowgirl
the democrats have the opportunity now to do something truly hilarious and pass a bill giving everyone $5000
In the most hilarious irony, Iran caused regime change in the US
Elon Musk apparently deleted all these tweets this morning.
I'm thinking someone advised him that personally picking a fight with a Senator of Texas was a dumb move.
(After all, that's what his bots are for...)
AI policy
Short video teasing an new collab between Daft Punk and Lego, including a forthcoming Lego set based on this fan-submitted entry. https://www.youtube.com/watch?v=t5rwOE3zpc8
I will say that it's important that the mainstream media continue to hold progressives in Congress accountable.
https://youtu.be/4vkqSigZeDI
Posting this one for posterity.
RE: https://mastodon.social/@rgarner/117556896025660928
"Couldn't get a Republican elected in Texas" is the new "couldn't organize a piss-up in a brewery."
As Alex Andreou is saying elsewhere: "Spare a thought for Elon Musk, who sunk half a billion into this, and still couldn't get a Republican elected. In Texas. 😂"
someone should invent a web search engine that when you type something into the search box it gives you the thing you searched for
Today's #Muppets GIF of the Day is...