A critical vulnerability (CVE-2025-32433) exists in Erlang/OTP's SSH implementation, affecting versions prior to 26.2.1 and 25.3.2.6. This flaw allows unauthenticated remote attackers to execute arbitrary code on the server. Specifically, a specially crafted SSH message can trigger the vulnerability during the initial handshake, before authentication occurs, enabling complete system compromise. Users are urged to update their Erlang/OTP installations to the latest patched versions as soon as possible.
Erlang's defining characteristics aren't lightweight processes and message passing, but rather its error handling philosophy. The author argues that Erlang's true power comes from embracing failure as inevitable and providing mechanisms to isolate and manage it. This is achieved through the "let it crash" philosophy, where individual processes are allowed to fail without impacting the overall system, combined with supervisor hierarchies that restart failed processes and maintain system stability. The lightweight processes and message passing are merely tools that facilitate this error handling approach by providing isolation and a means for asynchronous communication between supervised components. Ultimately, Erlang's strength lies in its ability to build robust and fault-tolerant systems.
Hacker News users discussed the meaning and significance of "lightweight processes and message passing" in Erlang. Several commenters argued that the author missed the point, emphasizing that the true power of Erlang lies in its fault tolerance and the "let it crash" philosophy enabled by lightweight processes and isolation. They argued that while other languages might technically offer similar concurrency mechanisms, they lack Erlang's robust error handling and ability to build genuinely fault-tolerant systems. Some commenters pointed out that immutability and the single assignment paradigm are also crucial to Erlang's strengths. A few comments focused on the challenges of debugging Erlang systems and the potential performance overhead of message passing. Others highlighted the benefits of the actor model for concurrency and distribution. Overall, the discussion centered on the nuances of Erlang's design and whether the author adequately captured its core value proposition.
This blog post explains how one-time passwords (OTPs), specifically HOTP and TOTP, work. It breaks down the process of generating these codes, starting with a shared secret key and a counter (HOTP) or timestamp (TOTP). This input is then used with the HMAC-SHA1 algorithm to create a hash. The post details how a specific portion of the hash is extracted and truncated to produce the final 6-digit OTP. It clarifies the difference between HOTP, which uses a counter and requires manual synchronization if skipped, and TOTP, which uses time and allows for a small window of desynchronization. The post also briefly discusses the security benefits of OTPs and why they are effective against certain types of attacks.
HN users generally praised the article for its clear explanation of HOTP and TOTP, breaking down complex concepts into understandable parts. Several appreciated the focus on building the algorithms from the ground up, rather than just using libraries. Some pointed out potential security risks, such as replay attacks and the importance of secure time synchronization. One commenter suggested exploring WebAuthn as a more secure alternative, while another offered a link to a Python implementation of the algorithms. A few discussed the practicality of different hashing algorithms and the history of OTP generation methods. Several users also appreciated the interactive code examples and the overall clean presentation of the article.
"Learn You Some Erlang for Great Good" is a comprehensive, beginner-friendly online tutorial for the Erlang programming language. It covers fundamental concepts like data types, functions, modules, and concurrency primitives such as processes and message passing. The guide progresses to more advanced topics including OTP (Open Telecom Platform), distributed systems, and how to build fault-tolerant applications. Using humorous illustrations and clear explanations, it aims to make learning Erlang accessible and engaging, even for those with limited programming experience. The tutorial encourages practical application by incorporating numerous examples and exercises throughout, guiding readers from basic syntax to building real-world projects.
Hacker News users discussing "Learn You Some Erlang for Great Good!" generally praised the book as a fun and effective way to learn Erlang. Several commenters highlighted its humorous and engaging style as a key strength, making it more accessible than drier technical manuals. Some noted the book's age and questioned whether all the information is still completely up-to-date, particularly regarding newer tooling and OTP practices. Despite this, the overall sentiment was positive, with many recommending it as an excellent starting point for anyone interested in exploring Erlang. A few users mentioned other Erlang resources, like the "Elixir in Action" book, suggesting potential alternatives or supplementary materials for continued learning. There was some discussion around the practicality of Erlang in modern development, with some arguing its niche status while others defended its power and suitability for specific tasks.
This blog post demonstrates how to build an agent-less system monitoring tool using Elixir and Broadway. It leverages SSH to remotely execute commands on target machines, collecting metrics like CPU usage, memory consumption, and disk space. Broadway manages the concurrent execution of these commands across multiple hosts, providing scalability and fault tolerance. The collected data is then processed and displayed, offering a centralized overview of system performance. The author highlights the benefits of this approach, including simplified deployment (no agent installation required) and the inherent robustness of Elixir and its ecosystem. This method offers a lightweight yet powerful solution for monitoring server infrastructure.
Hacker News users discussed the practicality and benefits of the agentless approach to system monitoring described in the linked blog post. Several commenters appreciated the simplicity and reduced overhead of not needing to install agents on monitored machines. Some raised concerns about potential security implications of running commands remotely via SSH and the potential performance bottlenecks of doing so. Others questioned the scalability of this method, particularly for large numbers of monitored systems. The discussion also touched on alternative approaches like using message queues and the potential benefits of Elixir's concurrency features for this type of monitoring system. A compelling comment suggested exploring the use of OSquery for efficient data gathering, which prompted further discussion on its pros and cons. Finally, some commenters expressed interest in the author's open-sourcing of their project.
Summary of Comments ( 11 )
https://news.ycombinator.com/item?id=43716526
Hacker News users discuss the severity and impact of the Erlang/OTP SSH vulnerability. Some highlight the potential for widespread exploitation given Erlang's usage in telecom infrastructure and distributed systems. Several commenters question the assigned CVSS score of 9.8, finding it surprisingly high for a vulnerability that requires non-default configuration (specifically enabling password authentication). The discussion also touches on the practical implications of the vulnerability, acknowledging that while serious, exploitation might be limited by the need for open SSH ports and enabled password logins. Others express concern about the potential for nested exploitation, as vulnerable Erlang systems might host other exploitable services. Finally, some users note the responsible disclosure and patching process.
The Hacker News post titled "Unauthenticated Remote Code Execution in Erlang/OTP SSH" (https://news.ycombinator.com/item?id=43716526) has several comments discussing the vulnerability (CVE-2025-32433).
Several commenters highlight the severity of the vulnerability, being an unauthenticated remote code execution flaw. One user points out the particularly dangerous combination of this being a pre-auth vulnerability and Erlang's frequent use in distributed systems, increasing the potential attack surface. They mention that distributed Erlang systems often run with minimal firewalling, making them easier targets.
Another commenter notes that exploitation is straightforward, quoting the NIST advisory that "Successful exploitation of this vulnerability requires only sending a crafted SSH message." This emphasizes the low barrier to entry for potential attackers.
Discussion also revolves around the practical impact. One user questions how many publicly exposed Erlang SSH servers exist, suggesting that while serious, the impact might be limited depending on the prevalence of such deployments. This prompts another commenter to mention that while direct SSH access to Erlang nodes might be less common, many systems likely use distributed Erlang for backend communication, which could be vulnerable.
A commenter with experience in securing Erlang systems suggests that the vulnerability reinforces the importance of employing robust network security measures, like firewalls and VPNs, even within internal networks. They highlight that assuming internal networks are safe is a dangerous misconception.
There's some discussion of the technical details. One user dives deeper into the mechanism of the vulnerability, explaining that it arises from the way the
ssh_packet_set_size/1function handles size limits before authentication, allowing malicious actors to bypass checks and execute arbitrary code.Finally, several commenters express concern about the vulnerability's potential to affect critical infrastructure and industrial control systems, given Erlang's presence in those sectors. One user speculates about the potential for this vulnerability to be exploited in targeted attacks.