*sshole, or when are we going to get rid of C?

Software engineer Will Sunshowers (sunshowers.io) uses a reported OpenSSH authentication bypass on musl-based systems without PAM, such as the official Alpine AWS image, to argue for Rust over C. He says musl's crypt returns "*" for overlong passwords, which Unix treats as a locked-account hash, and that this deviates from POSIX's null-return rule. His claim is that language norms, not only memory safety, shape such bugs, and that coding agents won't remove the difference. The musl behavior and exploit details are unverified here, and the norms argument is opinion.