openssh on musl linux has been letting people into password-less accounts since 2016.
Tailworm
The design choices of the open source tailscale and headscale software have created an environment ripe for risk, while marketing security as its design and purpose. Choices have been made to move away from security-in-depth, removing layers of authentication, and replacing daemons such as OpenSSH which employ privilege-separation with a highly-privileged process. Other findings include broader-than-advertised network security boundaries, which seems to be legitimate bugs, but the missing security and isolation is precisely what users are advertised by these tools.
Security advisory: openssh-server password authentication bypass | Alpine Linux
Alpine Linux
Mosh: the mobile shell
Mobile shell that supports roaming and intelligent local echo. Like SSH secure shell, but allows mobility and more responsive and robust.
trzsz/trzsz-ssh
trzsz-ssh ( tssh ) is an ssh client designed as a drop-in replacement for the openssh client. It aims to provide complete compatibility with openssh, mirroring all its features, while also offering additional useful features. Such as login prompt, batch login, remember password, automated interaction, trzsz, zmodem(rz/sz), udp mode like mosh, etc.
An Excruciatingly Detailed Guide To SSH (But Only The Things I Actually Find Useful)
Oh you like SSH? Name every flag.
Tailscale SSH: Findings and fixes
Tailscale SSH vulnerabilities from the Tailworm report: Findings, response timeline, security bulletins, and fixes in Tailscale v1.104.4.
Bluesky SSH Authentication #2
Addressing the glaring omissions from yesterday’s proof of concept, such as the fact that you could sign in as any user, you couldn’t revoke access, all hosts had the same users, and there was no mapping between Bluesky handles and POSIX users, I have updated mtelvers/bluesky-ssh-key-extractor and newly published mtelvers/bluesky-collection.
Open Source Password Manager for Teams | Passbolt
Manage and share passwords securely with Passbolt. Open source, audited and built for teams that need collaboration, compliance and control.
Bitwarden scrubs 'Always free' and 'Inclusion' values from its website as longtime execs step down - Fast Company
What is going on with the beloved open-source password manager?
SMM Tools • App Password or Oauth for Bluesky? - Hilary's Leaflet
Some work needs to be done before App Passwords can even remotely be retired. Make that a lot of work - none of these multi-platform tools have implemented it OR the two that did have not implemented Oauth for different PDSs.
長いパスワードで認証を回避する脆弱性「*sshole」、「Alpine Linux」などに影響／2016年から存在、「OpenSSH 10.6p2」で対策
「OpenSSH」に関連する脆弱性「*sshole」が報告され、影響する製品で対策が急がれている。
Why aren’t we using SSH for everything?
Dozens of facts about the SSH protocol and why we should use it for more things.
The new "Sign in with @cocore.dev" is awesome! The new ssh.socialweb.computer hosted requester uses them, it's a frontend to the AT-proto native compute marketplace, allowing you to simply ssh socialweb.computer to request a new VM from folks you have mutual tangled vouches with
Halfway through finishing my @astro.build @standard.site plugin to post my blog posts into #atproto and also pull my @leaflet.pub posts out and sync them! @pfrazee.com I hear you're building a full renderer!
