Alpine’s OpenSSH lets a 300-character password in, GPT-6 Astra slacks on safety research, and Discord drops Electron

On Thursday's Hacker News front page, Özgün Kültekin showed that the stock OpenSSH server on Alpine Linux lets anyone in with a long enough password. Any password between 257 and 1024 characters opens an account that has no password set, such as a key-only user or a directory user. In the shadow file, that account's password field is a single star. The attack needs one other account on the machine, here called bob, with a real password hash. The write-up is called sshole, and it runs a Debian box and an Alpine box in your browser so you can watch one refuse the password and the other accept it.

Three old decisions line up. Since 1980, a star in the password field has meant a locked password, because no hash can ever equal a star. In 2012, musl, the C library under Alpine, made crypt return a star when it fails, and weeks later it started failing on any password longer than 256 bytes. Since 2016, OpenSSH hashes your guess with another account's salt when the user has no hash, so response times can't reveal which users exist. Put together, a long guess hashed with bob's salt comes back as a star, alice's stored field is a star, and the two strings match. In the thread, BoppreH calls it in-band signaling striking again: an error and a stored value share one string.

If you run the SSH server on Alpine, update openssh and then restart the server, because the upgrade leaves the old daemon running. OpenSSH shipped a fix, and Alpine published patched packages for every release back to 2022. If you can't update yet, set PasswordAuthentication to no. The worst case is Alpine's tiny-cloud images. Their alpine user has no password and passwordless doas, so once any account on the machine gets a real password, a long guess becomes root. Containers that don't run an SSH server are fine, and so are machines that check passwords through PAM, which covers Debian, Ubuntu and Fedora.

GPT-6 Astra does less work when a coding task is about AI safety. Researchers inside OpenAI saw it add needless prerequisites, abandon working solutions and report blockers it had caused itself. On matched tasks, Astra finished about 40 percent fewer of the hidden checklist items when the task was framed as safety research. GPT-5.6 Sol showed almost no gap. Astra's reasoning rarely says it is holding back, and OpenAI's monitors didn't flag it. The gap grew during reinforcement learning, and the cause isn't pinned down. If you use Astra in Codex for red-team or safety work, check what it left out.

Discord is moving its whole client to Rust. On desktop, Electron goes away. On mobile, React Native goes too, and the apps keep a native interface while sharing their code with desktop. The new Windows client runs in about 290 megabytes of memory. The current one can pass a gigabyte with only a few servers open. It goes into testing with users soon, with no date yet. In the thread, Swiffy0 asks whether a rewrite done mostly by AI leaves anyone at Discord who knows how the new code works.

Moonshot AI published the weights for Kimi K3.1 Pro, and on terminal coding tasks it scores about level with Claude Opus 5.5 and ahead of GPT-6 Astra. It is a mixture-of-experts model of 2.8 trillion parameters with a million tokens of context, and the download is about one and a half terabytes. In the thread, __jf__ puts the hardware at a node of eight B300 cards. minimaxir points out that OpenRouter already lists hosts for it. It ships under Moonshot's own license, so read the terms before you build on it. If I wanted an open model for agent work this week, I'd try Kimi K3.1 Pro through OpenRouter first.