justinsaccount

oooh, that'll do it.

Didn't notice that the openssh-server-10.3_p1-r2 was released today.

I can't reproduce it either. I used alpine:3.24.1 and openssh is openssh-server-10.3_p1-r2

I tried adding PermitRootLogin yes and PasswordAuthentication yes. Tried adding another user with a valid password.

Verified shadow entry has a *. Can't login as root or a test user. Tried another incorrect password first as well.

edit: can reproduce after `git revert 384e25e6bd1f2e7b30095900e48b570d46953510` in aports and rebuilding openssh without the fix. It also accepts the password on the 2nd+ attempt, NOT the first.

based only on the wording in the notice:

> APT can merge two different package downloads after an HTTP redirect gives them the same URI

It sounds like the verification is ran but there is some deduplication or caching involved keyed on the destination of the url redirect, not the original source.

So could imagine a malicious server that:

Responds for a request for foo.deb with a redirect to evil.deb containing the original foo.deb. This validates properly.

Responds with a second request for bar.deb with a redirect again to evil.deb that now returns a malicious package. The downloading code thinks it has already validated evil.deb

> Do you think it's likely someone goes looking for the real-time data processing platform, lands on this GitHub and gets confused?

No, but I do think it is likely that someone might find this while looking for the kinesis keyboard, a popular product which has been on the market for 34 years.

I think a lot of people out there are being manipulated about things that they don't understand.

I saw some comments from people against a proposed data center at the site of an old power plant. I pointed out that it was a mile from anything. Someone replied saying that that was still too close, and that they wouldn't want to live 50 miles from a data center.

We are 20 miles from Ashburn.

I'm a huge fan of N.S. and what he says might be true, but I have an aversion to writing by hand after being tortured while growing up in the late 80s.

I just couldn't seem to hold a pen or pencil the right way and would always fall behind following along with the rest of the class. I was forced to spend hours at home with worksheets tracing over letters. I was led to believe that if I couldn't write properly I would be a complete failure.

It turns out being able to use a computer and type quickly was a more useful skill.

The entire point of "SQLite should have editions" is so that projects can opt into a set of modern defaults for 2026 and not get all of those backwards compatible decisions from 20 years ago.

Sonic the Hedgehog 3 launch price was $69.99. in 1994.

That's $159.89 in today's dollars.

> You can't use many of the features it's capable of in gaming mode

It is trivial to switch between gaming mode and desktop mode. I'm not sure what point you are trying to make here.

> The Zig implementation that powered Bun is gone.

The Zig implementation is literally still there.

You can make predictions of what might happen in the future, but hard to take the rest of the article seriously when it has the basic facts wrong.

Wait, the example held up for "Stop ruining it" is a company that sells snake oil audiophile bullshit?

that quote seems to be a bit of an oversimplification to the point of being completely wrong.

> Without them, your system accepts arbitrary data from the public network.

Neither of these features change if you are accepting arbitrary data from the public network. They limit what an exploited process can do. It's explained properly in the 'Security' section, so I'm not sure where this came from.

I ran into the same thing with Kinesis. The Kinesis API has strict limits on batch size, message size, and rate limiting. Any client writing to Kinesis must deal with all of these constraints and handle errors properly.

I briefly looked at localstack to see how they implemented the Kenesis api and other than a `KINESIS_ERROR_PROBABILITY` option to simulate rate limiting, they did not implement any of the constraints.