Hacker News Reader

Looks reasonably secure! I expected some horrifying engineering mistake, but the system looks well-designed by modern standards.

View on HN

It allows ssh login to system accounts without passwords, that seems like a pretty big mistake.

From what did you conclude this? I read it as if it allowed login over serial for those accounts, he didn't mention ssh in that context.

Still, unprotected accounts seem like a pretty insecure idea to me. That's how our "attacker" got themselves in.

Of course in a free world physical access to a device you own would mean that you can modify its behavior ("hack" the software).

Sure, of course, but requiring a serial connection through a physical cable is still a less useful attack vector than ssh over wifi, which is what I gathered from the grandfather post - but not the article.

You are correct. I don't believe those accounts worked over ssh due to a lack of password, just local serial.

Reply on news.ycombinator.com