OpenSSH 10.6p2 Critical workaround for alpine without PAM

related (and good writeup): https://news.ycombinator.com/item?id=50378228

brynet 4 hours ago | parent | prev | next [-]

Damien Miller also provided some further details on openssh-unix-dev@: https://marc.info/?l=openssh-unix-dev&m=179388064263131&w=2

▲

ChrisArchitect an hour ago | parent | prev | next [-]

Some earlier discussion: https://news.ycombinator.com/item?id=50377221

▲

SV_BubbleTime 2 hours ago | parent | prev | next [-]

> because we have recently observed multiple cases of rapid bug rediscovery by AI agents, sometimes within hours, and so now consider long embargo periods to be a dangerous practice that primarily benefits attackers.

Seems quite reasonable. It’s quite obvious that black hats have day jobs as White hats and have been privy to embargoes for probably decades.

	▲	InsidiousWombat an hour ago \| parent \| next [-]
		Embargo should last at most to the moment fix is made and code passes test suite. Anything longer is putting systems at danger. I can recompile the package with a patch (even if Ubuntu/RHEL takes 3 weeks to do it) myself in a pinch, and I'd like to have a chance for it before the bug gets re-discovered by malicious party
	▲	aomix 2 hours ago \| parent \| prev [-]
		I think this is a long held belief of the project and why they have been excluded from bug embargo’s in the past.

▲

selckin 6 hours ago | parent | prev [-]