Sshole

In 1980, Unix systems stored password hashes in a world-readable file, with non-login accounts marked with an asterisk (*) as a placeholder. Decades later, when the musl C library stopped returning NULL on failed cryptographic operations in 2012, it chose the asterisk as the failure indicator—inadvertently creating a security vulnerability where passwords longer than 256 bytes would be accepted on systems using SHA512 crypt. In 2016, OpenSSH had to implement timing attack mitigations to prevent attackers from enumerating valid usernames through response time differences.