*sshole, or when are we going to get rid of C?
Comments on “*sshole, or when are we going to get rid of C?”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Software engineer Will Sunshowers (sunshowers.io) uses a reported OpenSSH authentication bypass on musl-based systems without PAM, such as the official Alpine AWS image, to argue for Rust over C. He says musl's crypt returns "*" for overlong passwords, which Unix treats as a locked-account hash, and that this deviates from POSIX's null-return rule. His claim is that language norms, not only memory safety, shape such bugs, and that coding agents won't remove the difference. The musl behavior and exploit details are unverified here, and the norms argument is opinion.
Why it ranked
No. 16 of 107 with a score of 0.62. The panel rated it highest on reader interest (0.80) and audience breadth (0.73), lowest on substantiated (0.55). Overclaim counted against it (0.51). The judges disagreed most on new information (spread 0.63), so the story is marked contested. Placed No. 16, No. 40 by score alone: the placement terms moved other stories past it.
- AI judgeJudge 2claude-haiku-5-5
- Ties a real musl/crypt sentinel-value vulnerability to C vs Rust engineering norms and agent-based development; strong programming and security relevance, opinion-driven, moderately substantiated, with a few details already covered in the week's news.
- AI judgeJudge 3gpt-5.6-luna
- A concrete SSH/musl authentication vulnerability supports a technically meaningful argument about error handling, language norms, and AI-generated code. The broader anti-C and agent conclusions are opinionated and somewhat stronger than the incident establishes.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.62total under rubric v2.3Contestedjudges differ by 0.63 on new information
- Significance0.58
- Reader interest0.80
- Audience breadth0.73
- Practical relevance0.66
- Substantiated0.55
- Technical depth0.68
- New information0.70
- Counts against: Promotional0.04
- Counts against: Overclaim0.51
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.57 | 0.45 | 0.72 | 0.58 | 0.27 | +0.24 | +0.139 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.73 | 0.80 | 0.86 | 0.80 | 0.13 | +0.26 | +0.207 |
| Audience breadthHow many people who build technology does it concern? | 0.87 | 0.67 | 0.65 | 0.73 | 0.22 | +0.13 | +0.095 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.65 | 0.60 | 0.72 | 0.66 | 0.12 | +0.22 | +0.144 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.47 | 0.50 | 0.68 | 0.55 | 0.21 | +0.05 | +0.028 |
| Technical depthHow technically substantive is it? | 0.76 | 0.60 | 0.67 | 0.68 | 0.16 | +0.05 | +0.034 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.78 | 0.35 | 0.98 | 0.70 | 0.63 , above the contested threshold | +0.05 | +0.035 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.06 | 0.03 | 0.02 | 0.04 | 0.04 | −0.19 | −0.007 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.55 | 0.35 | 0.62 | 0.51 | 0.27 | −0.11 | −0.056 |
| Sum of contributions | +0.620 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.620 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-07/16/"><img src="https://rubric.hrih.si/badge/2026-11-07/16.svg" alt="Ranked #16 on Rubric, 7 Nov 2026" width="238" height="28"></a>Claim check
Claim check: 1 matches source · 3 no source given · 4 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkDate
Since 2012, musl libc's crypt function has returned the string "*" for a password that is too long for it to hash.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Since 2012, musl libc’s crypt function has returned the string "*" for a password that’s too long for it to hash”
The source says No passage could be compared.
Source cited by the article: git.musl-libc.org/cgit/musl/commit
No source givenDate
On Unix, a password hash of "*" has meant a locked account since the very early days.
The article gives no link or citation for it.
The article says “On Unix, a password hash of "*" has meant a locked account since the very early days”
The source says No source to compare with.
Couldn’t checkCausal conclusion
On musl systems without PAM (such as the official Alpine AWS image), the combination of the "*" sentinel and sshd hashing login attempts for locked accounts lets an unauthenticated user get a possibly root shell.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “on musl systems without PAM (like, oh, the official Alpine AWS image), an unauthenticated user now gets a (possibly root!) shell on your computer”
The source says No passage could be compared.
Source cited by the article: alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass
Matches sourceQuote
The POSIX spec says crypt() returns a null pointer and sets errno on error.
The cited source says the same thing.
The article says “Otherwise, it shall return a null pointer and set errno to indicate the error”
The source says “Otherwise, it shall return a null pointer and set errno to indicate the error”
Source cited by the article: pubs.opengroup.org/onlinepubs/9799919799/functions/crypt.html
Couldn’t checkCausal conclusion
The musl libc developers saw that some binaries weren't checking for NULL and deviated from the POSIX spec by returning the sentinel "*" value instead.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The musl libc developers saw that some binaries weren’t checking for it, and as a result deviated from the spec, returning the sentinel "*" value instead”
The source says No passage could be compared.
Source cited by the article: git.musl-libc.org/cgit/musl/commit
Couldn’t checkGeneralization
The vulnerability is not a memory safety vulnerability.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “This is not a memory safety vulnerability”
The source says No passage could be compared.
Source cited by the article: sshhole.com
No source givenCausal conclusion
Because C lacks algebraic data types or result types, the engineering norms in C communities lead to in-band signaling like this.
The article gives no link or citation for it.
The article says “Because C doesn’t have algebraic data types or result types, the engineering norms that form around C communities lead to this kind of in-band signaling”
The source says No source to compare with.
No source givenGeneralization
When writing Rust with an agent, there will likely be more invariants encoded in the type system, even for developers who aren't skilled in Rust.
The article gives no link or citation for it.
The article says “even if you aren’t already a skilled Rust developer, there will likely be more invariants encoded in the type system”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 35 pts, front page
Recorded for context only, checked 7 Nov 2026, 05:47 UTC. It played no part in the ranking.