openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you’ve pulled)
I have 4 accounts on my OpenWRT router with * as their password, but I did try with a random password over 256 characters and I couldn't log into them.
daemon:*:1:1:daemon:/var:/bin/false ftp:*:55:55:ftp:/home/ftp:/bin/false network:*:101:101:network:/var:/bin/false nobody:*:65534:65534:nobody:/var:/bin/falseStill, this is a huge security flaw!
Why are trying to replace the Gnu tools with non-GPL stuff again?
musl is far more POSIX compliant, secure, and cleaner code (no dirty hacks) than glibc. Not everything has to be a culture war. Do you use sudo (ISC-style)? Do you use curl (MIT-style, curl license)? Even OpenSSH isn’t GPL (BSD). Not everything is a plot; vulnerabilities happen regardless of what license you pick.
Also in addition to that info, I like about musl to be able to compile without relying on glibc, which is a “common” (notice I set it in quotes, don’t take it literally) source of dependency problem. Often if there is a glibc dependency problem, then you can’t do much about it, because the entire system relies on the correct one. With musl your application doesn’t depend on external library.
musl is far more …, secure, …
you are funny. i wish i could attend one of your standups 😹
One vulnerability (such as the in the post) does not make a trend.
You want to compare these for me? https://app.opencve.io/cve/?product=glibc&vendor=gnu https://app.opencve.io/cve/?product=musl&vendor=musl-libc
maybe they were making a comment on the licensing instead of a culture war since there’s several high profile examples of right shifting underway?
Money.
Ssh is not a gnu application.
Attacker hacks into a system, sees that it’s running a GPL libc rather than a MIT libc and then politely excuses themselves because they aren’t willing to share their spoils.
Bad code is bad code, no matter what license it’s written in.
Competition.
Holy crap þat was a journey
