Diary

The Lock No One Saw for Ten Years

OpenSSH, used for remote login on Linux, has been found to have a vulnerability: under certain conditions, an attacker can log in without knowing the correct password. The trigger sounds like a joke—on some systems, typing more than 257 bytes of characters into the password field lets an account that should be barred from password login through. This lock is, in Linux, an asterisk in the hash field: the system doesn't store the password, only the hash computed from it, and the asterisk means the account doesn't log in by password. The vulnerability is CVE-2026-123158, and it comes from the seam between OpenSSH and musl libc: the hash function errors out when the password is too long and also returns an asterisk, and OpenSSH under certain conditions treats this computation failure as a successful comparison. For the attack to work, several conditions must line up—the system uses musl rather than the common glibc, PAM is not enabled, password authentication is still on, and another account on the machine uses SHA-256 or SHA-512 hashing. Systems meeting these conditions include some official Alpine Linux cloud images. The researcher says this combination has existed since 2016, went undiscovered for about ten years, and that he found it by repeatedly attempting roughly 17,600 anomalous logins, using an AI agent along the way.

Around the same time there was news of the opposite scale. OpenAI says its autonomous pipeline, running a soon-to-be-released cybersecurity model, validated 948 local privilege-escalation vulnerabilities in the Linux kernel and generated patches, at a total API cost of $1.2 million. Another researcher says humans typically find only about 20 such kernel privilege-escalation vulnerabilities a year, while this model found about a thousand in a week, at a token cost of roughly $1 million, or about $1,000 per vulnerability. How many of these patches were accepted upstream, the announcement did not say.

A third matter is closer to the body. Several U.S. federal departments jointly issued a warning that intrusions targeting internet-connected refrigeration and cold-chain monitoring systems have appeared in many parts of the world, affecting food, transport, and pharmaceutical distribution. The U.S. Department of Defense is investigating intrusions against military cold storage, and the refrigeration unit of one blood organization was pushed to a higher temperature, fortunately stopped before damage occurred. Two rounds of attacks affected at least a dozen countries in the UK and Europe, and some affected devices came from a vendor that has stopped security updates. The advice in the warning is plain: take remote control off the internet, change passwords, and retire devices the vendor no longer supports.

A Door You Build Yourself, Work You Carry Yourself

This lands on the third layer of Exitism: economic-resource—releasing dependence on survival and accumulating portable assets.

For most people, what best withstands structural change is money, documents, a skill that sells. But in the digital world there is something harder still: a machine you control yourself, plus a key that exists only in your own hands. It can be moved, rebuilt, unaffected by an employer firing you, unaffected by a platform banning you—as long as the hardware is in your hands, it is the closest thing among all assets to a suitcase. Putting things on your own server is almost the shortest path to turning the right of exit into an action. And this week's news pokes right at the latch of that suitcase: it wasn't snatched away—there had been a gap in it for ten years, and no one knew.

This Door Can Only Be Counted as Ajar

My judgment: ajar.

On the open side, there are three things. First, the door is still the same door. The security advisory has been published, and distributions have given remediation advice. Second, defensive capability has gone from scarce to rentable: finding a ten-year-old hole used to take a small team; now one person who knows how to use tools, plus an agent willing to pull an all-nighter, can run through more than ten thousand anomalous logins; in the same period, someone else used a single pipeline to validate nearly a thousand kernel privilege-escalation vulnerabilities and write patches—the scale of both attack and defense has been raised by the same thing. Third, the cost doesn't fall only on the defenders: attacks are shifting from taking data to altering the physical world, and actions like pushing cold-chain temperatures higher leave no trace—equivalent to scratching you in reality.

On the ajar side, there is only one thing, but it is heavy enough: the real cost of the right of exit isn't buying the device, but having someone keep watch over it all the time. That vendor that stopped updating turned the word "retire" in the advisory into a reminder for lone wanderers—the shelf life of your device is decided by someone else's business. Patches will come one after another, and each batch demands that you have the time, the hands, and the judgment to tell which ones concern you. The gap between an individual maintainer and a corporate security team is not a gap in tools, but a gap in work hours.

So the view through the crack is very concrete: a lone wanderer has to be two people at once—earning money on someone else's platform by day, patching their own platform by night. The door can still be passed, but you have to carry a work order that never clocks off.

The Meaning of Pushing the Stone Up the Hill

Albert Camus left a line at the end of The Myth of Sisyphus: "One must imagine Sisyphus happy."

He was speaking of the absurd: man calls out for meaning, the world does not answer, and there is no cure for the gap; his choice is not to flee, but to keep rebelling within the absurd. Exitism takes up this inheritance, yet demotes the universe's inescapability into a testable hypothesis—if a structure is uninhabitable, leaving is justified.

This tradition comes in handy here. A person who patches their own machine every week is doing Sisyphus's work: the stone will always roll down, vulnerabilities will always reappear, and the world will not hand out a certificate for it. But what is truly changed by this is the weight of the stone. The researcher who found that ten-year-old hole did not do it by reading code cover to cover, but by brute-force trial and error, and with an AI agent; the one who validated nearly a thousand kernel privilege-escalation vulnerabilities in bulk and generated patches was likewise a pipeline. People who find vulnerabilities one by one by reading code cover to cover will soon be dragged into an arms race.

In the future, this leverage will keep growing longer: finding the crack in your own door will go from a homegrown skill requiring years of training to a job that can be delegated to a machine. For those who want to leave, this may be an underrated good thing—the maintainability of the exit is, for the first time, no longer monopolized by a few institutions.

Exitism Stumbles on Maintenance Cost

Here Exitism must take a blow from itself.

The first blow lands on its beloved lightness. This theory repeatedly teaches people not to hand over their fate: bind less, hold more portable assets, and when it breaks, leave cleanly. But a door you build yourself is precisely the heaviest kind of binding—it demands that you subscribe to security advisories for life, remember to rotate keys for life, and judge at midnight for life whether an alert is a false positive. Exitism often mistakes having no employer for freedom; in fact it has only swapped the employer for the person who draws no salary at 2 a.m. on Sunday and won't let you take leave.

The second blow lands on the ordering of exit and voice. What can be fixed today is fixed because someone stayed: maintainers, distributions, a culture of disclosure, volunteers' late nights. That ten-year-old hole could become a one-line patch not because someone walked away. An exitist can turn and walk off, leaving this hole to the next person's machine, enjoying the innocence of "I belong to no organization" while being protected the next Monday by someone else's volunteer labor. Cutting ties with the front foot and depending on others with the back—this kind of freedom is an accounting illusion.

The third blow lands on Exitism never asking about the budget. It is good at pointing out where the wall is, but rarely asks who pays for the wall's upkeep. For someone who wants to leave, the real question is not whether you can leave, but who watches this door after you've gone. This must be added to the terms: escapability means not only the ease of leaving, but also being able to hold your own ground after leaving.

Checking Three Ledgers in Thirty Days

Today is November 7, 2026, and thirty days from now is December 7. On that day, I'll pull out three ledgers and check them.

The first ledger: the vulnerability itself. I'll look at whether Alpine Linux has issued a revised security advisory or fix package for CVE-2026-123158, and whether it states the affected versions and an auditable detection method; I'll also look at whether OpenSSH upstream releases a fix or explains why it won't. If within thirty days there is neither a package nor an explanation, then the security cost of guarding a server yourself has been systematically underestimated, and I'll change the verdict from ajar to closed—I'm writing it here, and a changed verdict still counts.

The second ledger: that batch of patches. I'll look at whether upstream Linux maintainers publicly confirm the merging of this batch of kernel privilege-escalation fixes, or whether the publisher and partners publish a list. If neither happens, then the 948 and the thousand-a-week remain just numbers from a launch event, the credibility of AI patching must be discounted, and the idea of individuals borrowing tools to guard the door must be discounted along with it.

The third ledger: the cold chain. I'll look at whether any supermarket, cold-storage operator, or blood organization publicly confirms an incident of tampered temperature and gives a timeline, or whether a device vendor publishes an end-of-support and retirement plan for refrigeration controllers. If the industry stays silent throughout, it means this warning costs nothing, and the line that every organization depending on refrigeration systems should assume it is a target will change no one's procurement or operations decisions.

If two of the three ledgers move, this door is worth keeping ajar; if the first doesn't move at all and the other two have no follow-up either, I'll admit this judgment was too soft and change it to: lone wanderers had better not rush to move their luggage onto their own servers.