Hacker News

points by tonnydourado 2 days ago | 0 comments

How many alpine installs are running sshd? Most containers using it as a base image aren't. Embedded Linux is unlikely to be running it, too. And if one IS running sshd, how often is it with unchanged defaults? I don't buy the inference here.

I'll concede that embedded linux might be my blindspot here. Maybe cheap web hosting, too, but that seems much less likely to be using musl.

[–] svnt 2 days ago

Embedded linux is your blindspot here.

[–] __MatrixMan__ 2 days ago

Rumor has it that Cisco has been hurriedly patching something and refusing to tell their customers what it is. I'm thinking it's this.

[–] tchebb 2 days ago

Most embedded systems I've seen use glibc or uClibc. I agree it would make sense for them to use musl, but the embedded space moves very slowly.

[–] pizlonator 2 days ago

Yes

[–] andix 2 days ago

A lot of embedded systems use musl and no PAM. Some of them might use Alpine, but the distribution doesn't matter that much.

[–] 3m4r 2 days ago

Most of those would be using dropbear rather than openssh.

[–] tonnydourado 2 days ago

And ssh? I'd assume most would use proprietary or industry-specific standard for data IO, or just https, for domestic IoT stuff

[–] andix 2 days ago

And also ssh in many cases.

[–] pera 2 days ago

I thought Dropbear was pretty much the defacto SSH server for embedded applications, is OpenSSH+musl actually a common combination for these scenarios?

[–] 0x457 2 days ago

Well, OpenWrt is OpenSSH + musl.

[–] pera 2 days ago

OpenWrt uses Dropbear by default:

https://openwrt.org/docs/guide-user/services/ssh/transfer_dr...

[–] pizlonator 2 days ago

We don’t know that dropbear isn’t vulnerable. The bug here is in musl and OpenSSH is just being a bro by working around it

[–] andix 1 day ago

Some use Dropbear, some use openssh.

This vulnerability clearly is not one that affects everyone like the PHP vulnerability did. But it's exposure is still significant and very easy to exploit. As easy as it gets.

[–] lucideer 2 days ago

> Most containers using it as a base image aren't.

On top of the embedded linux blindspot, this statement seems unfounded.

> if one IS running sshd, how often is it with unchanged defaults?

By definition, I would imagine the answer to this is most of the time.