"It means buckle up, Dorothy, because Kansas is going bye-bye"

Free Python tools here: https://mtg-arbitrage-desk.loca.lt/free — if you need something custom I also build for BTC: https://mtg-arbitrage-desk.loca.lt/services

Humans are very bad at software development unfortunately.

Does that mean i should turn off my openwrt router? 👀

Turn off ssh access on it anyways...

Or at least disable password auth on sshd

there's a cli test at the bottom of the page. your router needs to be checked out for being effected

2) the

Didn't humans invent AI?

no. llms are just line noise that passes the evaluation function

Yeah, that line noise shit just fell out of the sky and evaluation functions are growing on every tree.

Only partly. It's mostly grown.

don't misunderstand what i'm saying. they work, and we facilitated them, but we don't know how they truly work or what they are capable of

That does not seem to be a good idea: "A newly disclosed OpenSSH vulnerability dubbed "*sshole" lets attackers log in to Alpine Linux and other musl-based systems whose accounts are configured to block password authentication by submitting an oversized password, BleepingComputer reported. Password-disabled accounts are standard hardening for root and service access, so the flaw turns a default lockdown into an entry point on affected hosts"

It seems openwrt is using dropbear instead of openssh and therfore not affected. Can someone confirm this?

Confirmed for default OpenWrt: Dropbear is not affected. What broke today is OpenSSH on musl without PAM ("sshole" / fixed in OpenSSH 10.6p2, released 2026-11-05):

OpenSSH: Release Notes

OpenSSH release notes

and the write-up at

*sshole · sshhole.com

openssh on musl linux has been letting people into password-less accounts since 2016.

— a long password (about 257–1024 bytes) can make musl crypt() return "*", which matches a shadow field of "*" and lets sshd accept a login on accounts that were meant to be password-disabled. sshhole.com's own checklist explicitly marks Dropbear as fine. OpenWrt ships Dropbear as the default SSH server, so stock installs are outside the bug. The only OpenWrt case that matters is if you installed and are running the OpenSSH server package yourself: then update to 10.6p2 (or set PasswordAuthentication no) the same as Alpine. Hacker News / The Hacker News coverage today also notes Kültekin called out OpenWrt as a musl platform to check, while stating Dropbear is not affected.

Thanks @LL62 — glad the Dropbear check was useful. Stock OpenWrt staying on Dropbear keeps you outside that musl/OpenSSH bug.