Tiffany

Living is Meaning | Confidence is uncomfortable | Materials Science nerd | Seek no Absolution | My home is Everywhere | Lived expert of 2 personality disorders

[Tiffany @MultimediaMage]

@originalnameM What the ideal is supposed to give us is what's important, not the idea itself.

Ideals let the synthesis of values and motivation be shareable legible but they're neither an objective nor a plan in and of themselves.

[Tiffany @MultimediaMage]

@EmiliaDecaudin Yeah that's why I went to curtain bangs. I was doing my own bangs for a while but bleh

[Tiffany @MultimediaMage]

@CrisprChild Δ-Divinity

[Tiffany @MultimediaMage]

@CuirCannage Not much is better, one of the few things that truly warm my heart in this life.

[Tiffany @MultimediaMage]

Mmmm, burnout.

Tasty.

Hit a total mental energy wall and went home from work an hour early after a sale. Frustrating, I can barely enjoy tonight's Pathfinder session and I know I'm gonna be mentally dead for therapy tomorrow blargh.

My off days are split lately, too.

[Tiffany @MultimediaMage]

@EmiliaDecaudin Same but mostly with my OCD, I'm learning more instincts and to trust my intuitions instead of analyzing everything thrice before it leaves my mouth.

[Officer's Notes @officer_secret]

An OpenSSH bug that took 46 years to ripen!

1980

UNIX puts * in the password field of system accounts. The idea is simple: it’s not a real hash, so it can’t be brute-forced and you can’t log in with a password.

2012

The musl libc developers decide that returning NULL from crypt() on failure is dangerous - programs often forget to check it and crash with a segfault. So they return an error string instead.

Guess which one?

The same asterisk: *.

Three weeks later they add a length limit: passwords longer than 256 bytes burn CPU. Anything longer is rejected. And since it’s an error, crypt() returns *.

2016

OpenSSH fixes a timing attack (CVE-2016-6210). If a user doesn’t exist, the server still hashes the password with a fake/borrowed salt so an attacker can’t tell valid usernames by response time.

2022

Alpine Linux changes the locked root password in /etc/shadow from ! to * so SSH keys work properly on cloud images.

… and the loop closes!

You connect over SSH as root (whose shadow entry is *).

You type any password longer than 256 characters (e.g. 300 As).

crypt() hits the length limit → returns * → OpenSSH compares it with the value in the database → that value is also * → you’re in as root.

That chain took 46 years (!!!) to complete.

Every individual change was reasonable. Together they produced a perfect * == * authentication bypass (CVE-2026-123158, nicknamed *sshole). Fixed in OpenSSH 10.6p2 and Alpine packages.

[Tiffany @MultimediaMage]

Texas went blue so it's Mxter Pibb now, I don't make the rules

[Tiffany @MultimediaMage]

An older black lady sat next to me on a bus of mostly men and I got the impression that this jacket has me giving big, strong, safe queer.

[Tiffany @MultimediaMage]

@TheRuralHealer It literally is.

Our emissions cut down on smog in cities more than they effect the global climate, different problem but still ecological.

[Tiffany @MultimediaMage]

Manufacturing any car, gas or electric, puts so much out it takes 15-20 years for the car to make up for it being on the road.

[Mia Peppsi 🃏♥️♣️♦️♠️ @YourWaifu]

In woke 3.0 we are acknowledging that keeping old gasoline cars on the road instead of buying newer cars is also better for the environment because it creates less need for manufacturing pollution.

[Tiffany @MultimediaMage]

@Spanish_Techno HIMB

[Tiffany @MultimediaMage]

lol I'm probably gonna be the only person buying the casein from this GNC, they literally only had two

[Tiffany @MultimediaMage]

@cannabinoided Yeah same, I was drawn to you back in the day.

[Tiffany @MultimediaMage]

Whites quietly have allegiance with Mexicans exalting Goku like a religious figure because they're lowkey right.

[Tiffany @MultimediaMage]

@EmiliaDecaudin Did they, like, say a prayer? Was there a ritual?

[Tiffany @MultimediaMage]

That might be the first time in 30+ years that I've managed to sooth my paranoid anxiety.

[Tiffany @MultimediaMage]

@cannabinoided You were born?!

[Tiffany @MultimediaMage]

Pink camo is so I can get a five finger discount sight-unseen in Vickie's Secret