OpenSSH "sshole" can open password-disabled Alpine accounts
A bug in OpenSSH plus musl lets someone log into accounts that should have passwords blocked, if they send a password longer than 256 bytes. It hits Alpine, OpenWrt, Buildroot and Yocto setups that turn password auth on but leave PAM off. Cloud Alpine's default "alpine" account is an easy target. Fixes are OpenSSH 10.6p2, or turn PasswordAuthentication off.
If you run a home NAS, router, or homelab on Alpine or OpenWrt, update OpenSSH and turn off password logins in favor of keys. Don't leave default cloud accounts open to the internet.
Source: BleepingComputer
FBI and CISA warn hackers are targeting refrigeration and freezers
A Nov 5 joint advisory from the FBI, CISA, HHS, USDA and DOT says attackers are hitting internet-exposed temperature controllers on commercial refrigeration. They force heat or defrost cycles, spoil stock, and create fire risk. Europe already saw hits; this is the U.S. warning to pull those controllers off the public internet, change defaults, patch, and isolate that gear from the rest of the network.
Most home fridges aren't on the public internet, but smart freezers and garage units with cloud apps can be. Use unique passwords, keep firmware updated, and don't port-forward appliance controllers. If a walk-in or commercial cooler at a rental or side business is online, treat it like OT and keep it off the open web.
Source: BleepingComputer
OLED touch MacBook Pro reviews land as units ship
Reviews are out ahead of the ~Nov 6 ship date. The PROLED XDR OLED screen is the clear win. Touch helps for photo zoom, movies and iPhone Mirroring, but most reviewers forget it once they're deep in work. No Apple Pencil support. The chassis is lighter, and the logo on the lid glows again.
If you're shopping for a laptop for blueprints, invoices or family photo edits, wait for a few more hands-on reviews after shipping before you pull the trigger. The screen is the reason to care; touch is optional.
Source: MacRumors
ACiQ splits R-32 and R-454B lines — don't mix them
ACiQ's Essentials line uses R-32; the Standard and Extreme multi-zone lines use R-454B. Both are A2L refrigerants under the AIM Act with GWP under 700. Never cross-charge between them. Existing R-410A systems are still serviceable — nobody is forcing a rip-and-replace just because the new lines exist.
Refrigerant work is never DIY. If you're shopping for a new system, ask which refrigerant it uses and write it on the service sticker. If your current R-410A unit is acting up, I can still service it — call for a $79 diagnostic or a $79 tune-up.
Source: Freedom Room
Motorola Watch 2 Fit and Buds 2 Ultra lean on Polar and Bose
Motorola is bringing the Watch 2 Fit (Polar insights, long battery claim, 1.85-inch OLED) and Buds 2 Ultra (Bose SoundDesign plus QuietControl ANC, Dolby Atmos) to North America and other regions in the coming weeks. They're pairing fitness and audio with names homeowners already know.
Fine for workouts and calls around the house. Don't rely on any wearable as a medical device, and keep firmware updated when the app prompts you.
Source: Android Authority
Gemini Omni 1.2 Flash makes short video edits conversational
Google made Gemini Omni 1.2 Flash generally available Nov 5 on the Gemini API and Cloud. You can generate up to 15-second clips, edit them with multi-turn chat, and stick reference looks better than before. Upscale goes to 1080p or 4K when you need it.
Fun for short family clips and project demos. Don't upload private home footage, kids' faces, or documents you wouldn't want shared into any AI video tool.
Source: Google
Safety reminder from me
Cold nights are when furnaces, water heaters and space heaters work hardest. If you smell gas, leave the house first and call your gas company from outside. Never open up gas lines, refrigerant lines or your electrical panel yourself. For anything electrical inside the panel, call a qualified electrician. For heating trouble, I can help with a $79 diagnostic or a $79 tune-up.
