this post was submitted on 06 Nov 2026
145 points (99.3% liked)
Lemmy Shitpost
42768 readers
3620 users here now
Welcome to Lemmy Shitpost. Here you can shitpost to your hearts content.
Anything and everything goes. Memes, Jokes, Vents and Banter. Though we still have to comply with lemmy.world instance rules. So behave!
Rules:
1. Be Respectful
Refrain from using harmful language pertaining to a protected characteristic: e.g. race, gender, sexuality, disability or religion.
Refrain from being argumentative when responding or commenting to posts/replies. Personal attacks are not welcome here.
...
2. No Illegal Content
Content that violates the law. Any post/comment found to be in breach of common law will be removed and given to the authorities if required.
That means:
-No promoting violence/threats against any individuals
-No CSA content or Revenge Porn
-No sharing private/personal information (Doxxing)
...
3. No Spam
Posting the same post, no matter the intent is against the rules.
-If you have posted content, please refrain from re-posting said content within this community.
-Do not spam posts with intent to harass, annoy, bully, advertise, scam or harm this community.
-No posting Scams/Advertisements/Phishing Links/IP Grabbers
-No Bots, Bots will be banned from the community.
...
4. No Porn/Explicit
Content
-Do not post explicit content. Lemmy.World is not the instance for NSFW content.
-Do not post Gore or Shock Content.
...
5. No Enciting Harassment,
Brigading, Doxxing or Witch Hunts
-Do not Brigade other Communities
-No calls to action against other communities/users within Lemmy or outside of Lemmy.
-No Witch Hunts against users/communities.
-No content that harasses members within or outside of the community.
...
6. NSFW should be behind NSFW tags.
-Content that is NSFW should be behind NSFW tags.
-Content that might be distressing should be kept behind NSFW tags.
...
If you see content that is a breach of the rules, please flag and report the comment and a moderator will take action where they can.
Also check out:
Partnered Communities:
1.Memes
10.LinuxMemes (Linux themed memes)
Reach out to
All communities included on the sidebar are to be made in compliance with the instance rules. Striker
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
ssh allows you to add trusted public key. When you ssh from a computer that has the private key, it will immediately log you in without asking for your password.
Ok, but what's a certicate?
Oh, a certicate is a typo that most people miss
Overly basically, it's a file based way to prove you can log into an account
There is information in file that the computer can verify that you created the certificate on this computer while already having access to this account, therefore you are allowed access.
In most contexts, digital certificates are considered more secure than a password for authentication, so in creating one, it's a pretty typical thing to disable being able to log in with a password. However, this bug allows account access with a garbage password.
OK, but what's a certicate?
I've never seen one before, no one has... But I'm guessing it's a white hole.
I think they meant certificate, and are perhaps referencing the eMudhra incident?
No, there was an SSH vulnerability discovered a day or two ago, which allows anyone to bypass the certificate check during authentication. So if your SSH is configured to only use a certificate, (not cert and password) then anyone can log into your shit.
Huh, I must have missed that one. Alpine/musl as well then? Got a ref?
Yes, it specifically affects the OpenSSH/Alpine/musl interaction. It’s a vulnerability in how Alpine/OpenSSH interfaces with musl, and allows anyone who can reach your SSH port to instantly log into a passwordless account by entering over 256 characters into the password field.
The vuln is nicknamed *sshole, if you want to search it. Because it only works on passwordless accounts, (meaning it has a * in the password field). And the most common use-case for passwordless accounts is because you’re using cert-based authentication instead. Thus the warnings that if you’re using cert-only SSH, you’re most likely vulnerable.