Schneier on Security

Clive Robinson • November 10, 2026 11:22 AM

@ ALL,

The name given to the vulnerability of “*sshole” is not supposed to be seen as “rude”.

The “sshole” is actually a contractin of “SSH hole”. The lead “” is part of what makes the vulnerability work. And is based on the *nix password file, where the “” was placed in the password field to indicate an account was not to be loged into from the login programe

The reason for the lead “*” is it was not a valid character in the password field and thus could be used for “in band signalling”

Some of you are possibly old enough to remember the arguments about which was better “C strings or Pascal strings”.

C strings used in-band signalling such that a string could be any length, but it alway terminated in the ASCII NUL character (from 1962 that had significant use in “super encryption” devices based on “One Time Tapes from earlier Baudot and ITU 2).

Pascal strings used out-of-band signalling, put simply the lead byte was used to store the length of the string.

The had advantages and disadvantages. An advantage was that string math was faster, and the first character of the string was not at position zero but position on that was easier for many people to get there heads around and more importantly all characters were valid. The downside was the string had to be 255 or less characters long. Which at first does not appear much of a disadvantage, but when you dig in, it quickly becomes clear that code is easier to make more general with unlimited length strings and is faster and takes up less program “code” store/memory and alows easy machine code tricks…

The other issue back then was “return values” from functions. Originally it was a type int that was the size of the machine dataword. For reasons to long to relate this turned out to be a bad idea…

So “in band signalling” became the norm under *nix with an integer holding a return / error code. Actual data was usually returned in a memory array that the calling code passed a pointer to into the function.

Security wise this is a bad way to do things even though it can be quite efficient.

Clive Robinson • November 11, 2026 2:08 AM

@ Scott,

Hark,

“What light through yonder window…”

With regards, your statement

“Of COURSE *sshole is meant to invoke the curse word for your rear end. Of COURSE it is. Are you kidding?”

At my comment of,

“The name given to the vulnerability of “*sshole” is not supposed to be seen as “rude”.”

It’s why I then gave the explanation you can say to your boss etc with a perfectly straight face… But I guess it’s lost on some people.

Pause and think how the two statements are both true and why?

Do you get it now?

But a clue for others who follow on who obviously don’t get it and never have, to the amusment of others,

It’s a game that has been going on since at least the times of Queen Elizabeth I of England and her censorship of plays by the Lord Chancellor. And why the works of Shakespeare are a little quirky in places in their original form.

Oh and why you can still see it in the published word world since shortly after editors were put in place…

Have a listen to,

https://m.youtube.com/watch?v=bPduoU826ew

It goes back to the early 1950’s showing a small part of it.

If you search this site you will find I’ve been telling certain people to,

“Brush up your Shakespeare”

For quite a few years now, but they just keep walking into it.

Also search for “Yellow Card” you will discover that @Wael and I were doing the same on this blog going back for years on the Friday Squid.