Discussions, summarized

Sumcast distills Slack conversations, Reddit discussions and more into a concise daily newsletter that only takes a few minutes to read. Or, listen to it in your favorite podcast app.

• Hacker News1ssholeSince 2016, OpenSSH on musl-based Linux systems like Alpine and OpenWrt has let anyone log into locked accounts, such as root or key-only users, with any password over 256 characters. Update OpenSSH or disable password logins.Root cause in musl and OpenSSH:musl's crypt() returns "*" on errors, and OpenSSH's fake-user timing defense can pass it a real hash. The "*" then matches a locked account's hash, so the password check succeeds.In-band signaling and magic strings:Commenters blame in-band error values like "*" and call for exceptions or Result types. Others suggest unmistakable sentinel strings, and note the same pattern appears in LLM-based systems.Musl's reliability and design choices:Commenters criticize musl's "convenient" changes to crypto functions and its history of bugs. Others argue glibc is better tested, and some counter that the failure was really in OpenSSH's control flow.
• Reddit science1In January 2026, the federal government launched a pilot program in Medicare requiring advance approval for certain medical treatments and encouraging the use of AI to review requests. Doctors had rarely needed approval before providing treatments. This led to an immediate drop in use of services.In January 2026, a federal pilot program called WISeR began requiring prior approval for 41 medical services in traditional Medicare across six states. A JAMA study found use of targeted services fell significantly, with epidural steroid injections down 15% and other services nearly 20%.Reduced care as intended:Commenters say the drop in services was the program's real goal, citing physicians forced into less effective therapies and patients delayed or denied care, with AI reviews and profit incentives blamed.Unclear whether cuts reduced waste:Many question whether the 15-20% drop reflected waste or necessary care, noting the study lacks outcome data, and raise ethical concerns about unconsented research on Medicare patients.Partisan blame over death panels:Users contrast Republican "death panels" rhetoric with today's AI approval systems, accusing the GOP of sabotage, while others argue for single-payer care and more physician training.
• Create your own,
  personal Sumcast