{
  "id": 18794763,
  "title": "*sshole, or when are we finally going to get rid of C?",
  "url": "https://urgent.news/2026/11/07/sshole-or-when-are-we-finally-going-to-get-rid-of-c",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-07T21:05:35.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://sunshowers.io/posts/sshole/"
  },
  "original_language": "en",
  "account": "Another day, another security flaw emerges in core C code. This particular vulnerability stems from a combination of two conditions using the same sentinel value. The issue arises in sshd hashing login attempts for locked accounts on musl systems without PAM, like the official Alpine AWS image, which allows an unauthenticated user to gain a potentially root shell on your computer. This isn't a memory safety issue; it's a problem with the norms of C developers that allows the sentinel value * to indicate an error, despite the POSIX spec suggesting otherwise. The C type system doesn't enforce checks on the return value, leading to this kind of in-band signaling. In contrast, Rust developers handle such cases with error variants, compelling the caller to address them. The engineering norms of C communities result in such in-band signaling, while Rust norms enforce better error handling. This discrepancy in norms reflects a principal-agent problem where distro maintainers resist adapting to new engineering norms, prioritizing their interests over users. The argument against Rust's benefits often overlooks the role of community norms in shaping code quality. In the Rust world, skilled developers contribute to robust type systems, while C developers may neglect error handling norms. As a skilled Rust developer, you'll likely identify inadequacies in first-pass invariants and participate in thorough review cycles to fix them.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}