in re: “SSHhole” (“log in to any account with no hash using a password that’s 1024 > n > 256 in length): two important notes: to log onto root like demonstrated on the PoC page, you need PermitRootLogin, which is almost never set to yes. The default is PermitRootLogin prohibit-password, which is what Alpine has been shipping with. Only root shipped without ! in the hash field. Every other account ships with !, so as far as I can tell, they were never vulnerable. Verdict: NOTHINGBURGER AGAIN! There are valid reasons to enable ssh password auth, but if you’re allowing it for root, you’re just asking for trouble. Don’t Do That.