OpenSSH musl passwordless login flaw & Claude Code email in User-Agent - Hacker News (Nov 6, 2026)

Imagine an account deliberately set up so nobody can log in with a password… and it turns out a password of just the right length gets you in anyway. That's a real bug, and we'll unpack it in a moment. Welcome to The Automated Daily, hacker news edition. The podcast created by generative AI. I'm TrendTeller, and today is November 6th, 2026. We've got security slip-ups, AI privacy questions, a scam-ad fight with Meta, a Hackintosh comeback, and a couple of delightful open-source projects. Let's get into it.

OpenSSH musl passwordless login flaw

First, that login flaw. On Linux systems built on the musl C library, think Alpine, OpenWrt, Buildroot and Yocto, OpenSSH could let certain password-disabled accounts accept a password. The cause is an awkward handshake between two pieces of software. When musl's password hashing gives up on a very long input, it returns a single asterisk. And an asterisk is exactly what many systems put in the password field to mean 'no password allowed.' So the failure output and the 'locked' marker matched. The result: on systems without PAM, a key-only or locked account could accept a password somewhere between roughly 257 and 1024 characters. The write-up traces the chain of reasonable-looking design choices that made this possible and why it sat unnoticed for years. The fix is in OpenSSH 10.6p2, and until you can upgrade, the advice is simple: turn off password authentication.

Claude Code email in User-Agent

Staying with trust and privacy. A user filed a bug against Claude Code claiming it exposed their email address to third parties by stuffing it into the User-Agent header during web searches. They called it a serious privacy violation and said they were weighing other providers. The thread drew a flood of reactions, some sincere, some sarcastic. A contributor then replied that a built-in privacy plugin, shipped in recent versions, already blocks this by default, and asked users to flag any remaining gaps. Whatever the specifics, it's a reminder that AI tools making web requests on your behalf also carry pieces of you along with them, and people are paying attention.

Meta deepfake scam ads controversy

Next, a sharper fight over online fraud. Mark Cuban says Facebook is knowingly letting AI deepfake scam ads run, including ones that use his face to sell products he never made. He says people regularly tell him they bought a diabetes cure he supposedly endorsed. His criticism lands alongside a Reuters report on internal Meta documents that reportedly estimated around sixteen billion dollars a year in revenue tied to scams and banned products. Meta pushes back, calling that a selective reading and pointing to the volume of scam ads it removes. The stakes are real: older adults are losing a disproportionate share of money to these schemes, and AI keeps making the fakes more convincing.

Why tech personalization still fails

On a related theme of data that doesn't serve users, one essay asks a fair question: if companies track everything, why is personalization still so bad? The author lists familiar irritations, ads for things already purchased, promotions that keep coming after you've clicked once, a music service that ignores a clear habit of skipping vocal tracks, and apps that switch to the wrong language the moment you travel. The argument isn't that firms lack data. It's that the surveillance is everywhere, while the payoff for the user is strangely missing.

Archiving YouTube videos at home

If you don't trust platforms to keep things around, here's one response: save it yourself. A blogger argues you should download and archive the YouTube videos you love, because content disappears. Their own setup feeds videos onto a home server and plays them on the TV through Jellyfin, using the popular yt-dlp downloader with a wrapper that keeps playlists and metadata tidy, plus a tool that shrinks files to save space. The author openly admits it's more elaborate than most people need, and that the compression tool can be fussy. The core message holds, though: if something matters to you, keep a copy.

AI revives the Hackintosh scene

Now, a revival story. The Hackintosh scene, running macOS on non-Apple hardware, looked like it was winding down once Apple moved to its own ARM chips. But one longtime tinkerer says AI coding tools have changed the pace dramatically. After building an iOS app with barely any hand-written code, they point to a burst of recent experiments: macOS on a Snapdragon laptop, on an ARM single-board computer, iOS running on a Nintendo Switch OLED, and support for newer Nvidia graphics cards. The takeaway is that AI may help hobbyists squeeze new life out of hardware that was supposed to be a dead end.

BUI: Blender UI as library

For developers, an interesting open-source project called BUI pulls Blender's user interface out of Blender and turns it into a standalone library. Blender's UI is known for being fast and responsive, and BUI aims to keep that feel while offering a small native core with bindings for Python, Rust, JavaScript and React, C, C++, and Dear ImGui. It's explicitly not Blender itself and not a browser-based framework. If it matures, it could give apps a snappy, battery-friendly toolkit with familiar Blender-style interactions.

Window Sweaters cozy macOS borders

And to finish on something cozy: Window Sweaters, a small open-source Mac app that wraps your windows in knitted-looking borders. You can pick patterns, stitch size and thickness, and give each app its own sweater, with colorways prepared for dozens of popular programs. It leans on private macOS window features, so an update could break it, and it's still a work in progress. But it's a charming reminder that desktop customization can simply be fun.

That's it for today's edition. If you run anything on Alpine or OpenWrt, check that OpenSSH version, and maybe back up a few favorite videos while you're at it. Links to all the stories can be found in the episode notes. I'm TrendTeller, thanks for listening, and see you next time on The Automated Daily, hacker news edition.

OpenSSH musl passwordless login flaw & Claude Code email in User-Agent - Hacker News (Nov 6, 2026)

Our Sponsors

Today's Hacker News Topics