I agree that more supply would be great and building factories can pay off. It's still very expensive though, and some banks are growing skeptical of the ballooning costs of AI-related projects.

Unfortunately there's a huge number of MySQL servers that are using latin1 charset and collation, even when storing Unicode data. Surprisingly it "works" as long as your DB client treats the data as raw bytes (ie you don't do any sort of string manipulation in MySQL), the same way that UTF-8 "works" in PHP even though native strings are just raw bytes.

,Obviously sorting and filtering won't take any sort of case insensitivity / case folding into account though, which is an issue.

I hit issues with this recently at work, because for some reason all our MySQL servers still use latin1 by default. Unicode characters were getting corrupted in JSON columns, because MySQL forces them to use utf8mb4 as per the JSON spec (JSON sent between multiple systems should always be encoded as UTF-8), and mixing "real UTF-8" with "fake UTF-8" (UTF-8 in latin1) doesnt end well.

My guess would be that they are sanitizing them, but their WAF blocks requests with particular characters in these fields in order to try and block SQL injection or something.

One of the big four banks in Australia (Westpac) used to limit you to a password of EXACTLY 6 characters, case insensitive. Another one (NAB) required 6 to 8 characters, case insensitive, with NO special characters.

Thankfully they've both changed these limits.

NAB no longer has a length limit, and they're actually planning on completely removing passwords in favour of passkeys. Westpac allow up to 30 characters now.

My guess is that it's not a vulnerability but their WAF still flags/blocks it so they don't want people using those characters.

I bought a new Nokia E63 for AU$199 in 2009 (around US$160 at the time). I liked that phone! It had a QWERTY keyboard. Replaced it with a Samsung Galaxy S3 in 2013.

$100 or even $200 is likely not doable for a modern touchscreen phone, unfortunately.

and the reason manufacturers aren't building many more factories is because they're extremely expensive and there's no guarantee the same demand will still exist in 5 or 10 years. What if the AI bubble bursts, the market is flooded with second-hand supply, and all the new factories aren't needed?

Micron is building new factories in New York, and they expect the first factory there to be online by 2030 at a cost of $50 billion (which is more than their entire 2025 revenue).

There's Dropbear SSH, which is the most common choice for a minimal SSH server and client, but even that is around 50,000 lines of code.

Technically they're correct though, in a way. If every account has a password, the system isn't vulnerable.

You're also not vulnerable if you use two factor auth, because all 2FA modules require PAM, whereas this vulnerability only exists when PAM is disabled or not installed.

Not just rootless and read-only, but distroless/chiseled too. There's no reason to have unneeded parts of an OS in your Docker containers. It should just be one app along with any libraries it needs (or just statically compile the app)

"passwordless" here means that the account doesn't have a password. What the person you're replying to means is that password authentication should be completely disabled in the SSH config, as that's the only way to exploit this issue.

Wireguard and apps based on it (like Tailscale) don't respond at all unless the data is signed with the key of a configured peer (or with Tailscale, a system on your tailnet that passes the ACL). It's literally impossible for an outsider/attacker to detect with a port scan since it just ignores unauthenticated packets.

The Wireguard codebase is also extremely small. The core Wireguard implementation (the version in the Linux kernel) is around 5,000 lines long, so an experienced developer can read through all the code if they dedicate a day or two to it, and understand how it works.

For comparison, OpenVPN is around 70,000 lines of code and OpenSSH is around 150,000 lines of code. There's a huge number of features in SSH!