17 ms·
The Day the Telnet Died
- gbacon 7mo agoRelated/Nostalgia: https://github.com/talkersource https://github.com/talkersource
- est 7mo agoIt's more like telnetd died rather than telnet died. btw if you want a quick telnet client, and an old python happens to be installed, you can use `python -m telnetlib IP`
- rballpug 7mo agoport 22 2FA
- adolph 7mo agoThe pattern points toward one or more North American Tier 1 transit providers implementing port 23 filtering
- RupertSalt 7mo agoSomeone attempted to compromise my home router last week using CHARGEN. Can you imagine!
- direwolf20 7mo agoAttempted to compromise, or just port scanned?
- RupertSalt 7mo agoGood call-out! Yes, while the router labels it as "DOS Attack" it is probably a simple port-scan! However, anyone who knows the nature of CHARGEN would recognize that a singular successful connection could immediately blossom into a somewhat lackluster DDOS, as the chargen service risked consuming CPU and network resources unnecessarily. chargen has been also aggressively deprecated, far more than telnetd, since it was a non-essential service. I'd like to know how many servers are voluntarily running chargen on the public Internet today. A port-scan for chargen is more likely a comprehensive port-scan that is just attempting to identify and fingerprint anything that may have been established on that port. It would be less surprising to find, like, ssh or a web server occupying that space today.
- iberator 7mo agoStranger article. I wasn't able to get the main point of this article. Strangely written, but hey - I'm nob native by any means. ps. telnet SDF.org just works...
- jwpapi 7mo agoit was just ai written thats why.. unexpectedly so from greynoise.
- taftster 7mo agoWell, I mean, the first part is a song by Don McLean called American Pie. You might know that, unsure that everyone will pick it out though. One of the most famous play choices at karaoke bars these days too. I think because the song is a long story, of sorts? But it's a terribly long song and I will leave to take a smoke break anytime it gets chosen. You're going to be there for a good 10 minutes before it concludes. So maybe the AI prompt was something like, "take CVE-2026-24061 and compose a song lyric in the style of American Pie by Don Mclean". I wonder if you would get similar results with that prompt.
- roywiggins 7mo agoThe rest of it seems to be substantially edited by an LLM too, or at least it's composed much like LLM outputs often are these days: “not a gradual decline, not scanner attrition, not a data pipeline problem, but a step function.” "Not X, not Y, not Z" is a common LLM tic, and there's a few more like it in there.
- taftster 7mo agoI mean, that's fair. I guess I just wanted to put my old man hat on. The song is a tribute to an era of lost innocence. Which I think is quite apropos to the current situation surrounding telnet. Vestiges of the days of the early internet continue to disappear, almost like an endangered species. Old/obsolete protocols, like telnet, are pined for by old guys like me.
- RonanSoleste 7mo agoI still used telnet today (had to). Unsure of the patching here. But its definitely locked down to a subset of internal use only.
- pbhjpbhj 7mo agoEmbedded? Ancient? What sort of systems are you telnetting into?
- fennec-posix 7mo agoNot the parent poster, but I also still use telnet. For me it's "Ancient", I have a few retired SPARC and PA-RISC boxes that run their period appropriate OSes as a hobby. Telnet/rlogin is the more reliable method to get into them remotely (just over the LAN). They're on a LAN behind a NAT Router/Firewall, and I don't always keep them powered up (I'm not that insane) so I really don't have a concern for them. Some of the more modern/high-performance examples I have run NetBSD with modern sshd and modern ciphers, but you can tell it's a bit of a workout for them.
- Twisol 7mo ago> Someone upstream of a significant chunk of the internet’s transit infrastructure apparently decided telnet traffic isn’t worth carrying anymore. That’s probably the right call. Does this impact traffic for MUDs at all? I know several MUDs operate on nonstandard Telnet ports, but many still allow connection on port 23. Does this block end-to-end Telnet traffic, or does it only block attempts to access Telnet services on the backbone relays themselves?
- MBCook 7mo agoIt wasn’t clear from the article but I assumed they were filtering for the attack specifically. Since Telnet is totally plain text that would absolutely be easy to do right?
- wbl 7mo agoNot at interconnect speeds
- Mixtape 7mo agoWouldn't that imply that >80% of all monitored telnet sessions were exploit attempts for the specific CVE in question? Even with the scale of modern botnets, that seems unrealistic for a single vuln that was undisclosed at the time.
- MBCook 7mo agoI have a hard time thinking it’s popular enough these days that attacks, attempts at attacks, or just command and control couldn’t be the main use.
- RupertSalt 7mo agoMost MUDs do not use Telnet. MUDs use plaintext TCP protocols that are accessible to a wide range of clients. The Telnet protocol is well-defined and not completely plaintext. There are in-band signaling methods and negotiations. Telnet is defined to live on 23/tcp as an IANA well-known, privileged, reserved port. MUDs do none of this. You can usually connect to a MUD using a Telnet client, but most players hate the experience and often deride this method in favor of a dedicated, programmable client. The fact that MUDs inhabit higher 4-digit ports is an artifact from their beginnings as unprivileged, user-run servers without a standardized protocol or an assigned “well-known port” presence. If you want your MUD to be particularly inaccessible, you could certainly run on port 23 now!
- deleted 7mo ago[deleted]
- davebranton 7mo agoWhy would somebody read something that somebody couldn't be bothered to write? This article is AI slop.
- deleted 7mo ago[deleted]
- accrual 7mo agoWhat stood out as AI written? It felt like a well-written article by an SME to me.
- tripdout 7mo agoNot the original commenter, but I noticed it too. I guess it's hard since AI is trained on human content, so presumably humans write like this too, but a few that stood out to me: > Five entire countries vanished from GreyNoise telnet data: Zimbabwe, Ukraine, Canada, Poland, and Egypt. Not reduced — zero. > An attacker sends -f root as the username value, and login(1) obediently skips authentication, handing over a root shell. No credentials required. No user interaction. > The GreyNoise Global Observation Grid recorded a sudden, sustained collapse in global telnet traffic — not a gradual decline, not scanner attrition, not a data pipeline problem, but a step function. One hour, ~74,000 sessions. The next, ~22,000. > That kind of step function — propagating within a single hour window — reads as a configuration change on routing infrastructure, not behavioral drift in scanning populations. (and I'm not just pointing these out because of the em dashes) GPTZero (which is just another AI model that can have similar flaws and is definitely not infallible, but is at least another data point) rates my excerpts as 78% chance AI written, 22% chance of AI-human mix. To me at least, the article still seems to be majority human-written, though.
- throw10920 7mo agoAlso, one of the authors is "Orbie", which looks like an AI name, and if you go and read through some of the recent posts, all of the posts with that author feel very LLM-y and bland, and the posts without that author are much more normal. GGP has a good eye.
- gerdesj 7mo agotelnet isn't just for ... telnet. $ telnet smtp.example.co.uk 25 HELO me MAIL FROM: gerdesj@example2.co.uk RCPT TO: gerdesj@example.co.uk DATA .. or you can use SWAKS! For some odd reason telnet is becoming rare as an installed binary.
- Twisol 7mo agoThe difference between "telnet" the program and "telnet" the protocol is especially important in this discussion, I think. A more "proper" tool for that is netcat -- I doubt SMTP supports the Telnet option negotiations subsystem. (I also doubt SMTP servers can interpret the full suite of Network Virtual Terminal (NVT) commands that the Telnet protocol supports.) There's clearly enough similarity between the two protocols that if you're just using it to transfer plaintext it will probably work out fine, but they are distinct protocols.
- quotemstr 7mo agoYou want nc (usually with -v) or socat. telnet is muscle memory for a lot of people (myself included sometimes) but it's a strictly inferior choice these days for poking arbitrary plaintext services.
- doubled112 7mo agoAs long as it works, it doesn’t really matter for a quick test. I find myself using curl telnet://server:port too often these days because telnet and nc don’t get installed.
- Animats 7mo agoSo eleven years ago someone put a backdoor in the Telnet daemon. Who? Where's the commit?
- parl_match 7mo agoIt wasn't a backdoor, just a very serious security bug. Congrats on jumping straight to conspiracy and paranoia, though.
- alt187 7mo agoIt's only a conspiracy and paranoia if it's wrong. 11 years ago was 2015.
- its_magic 7mo ago> GNU organization > giant security flaw Checks out.
- parl_match 7mo agoIt is wrong. The author is known, was acting in good faith, and simply fucked up really badly. I don't know what 11 years ago has to do with anything, besides the awful lifespan of such a severe bug.
- greyface- 7mo agohttps://codeberg.org/inetutils/inetutils/commit/fa3245ac8c288b87139a0da8249d0a408c4dfb87 https://codeberg.org/inetutils/inetutils/commit/fa3245ac8c28...
- ieie3366 7mo agoThat's crazy. This is core business critical software but they just YOLO critical changes without any automated tests? this PR would be insta-rejected in the small SAAS shop I work at.
- 7mo ago
- trebligdivad 7mo agoWhy are people still using telnet across the internet in this century? Was this _all_ attack traffic? (OK, I know one ancient talker that uses it - but on a very non-standard port so a port 23 block wouldn't be relevant)
- omegaham 7mo agonethack.alt.org still maintains a telnet server!
- RupertSalt 7mo agoI've always used ssh to connect to it. And it's true that their port 23 is still open at last check. If you cannot reach port 23, and you irrationally hate ssh, you may use 14321 as an alternate. https://www.alt.org/nethack/ https://www.alt.org/nethack/
- mcpherrinm 7mo agoAs I understand it, greynoise is monitoring scanner traffic, so yes this would all be scans or attacks
- deleted 7mo ago[deleted]
- jaredsohn 7mo agoTo watch Star Wars in ASCII. telnet towel.blinkenlights.nl https://www.youtube.com/watch?v=Mhcf6tc2jeQ https://www.youtube.com/watch?v=Mhcf6tc2jeQ (Remember hearing about this a long time ago (from some searching I think it was in 1999 via Slashdot) and verified some instance of it still exists/works.)
- mmooss 7mo agoConnection failed Maybe we should give the kind person who hosts it a break. Try it out tomorrow. (Yes, I should have thought of that before I tried.)
- catskull 7mo agoWhen I was an intern for some reason they issued me a voip phone for my desk. One day I got bored and figured out I could telnet into it. Nothing interesting but it was still a fun moment for me!
- ekropotin 7mo agoI did this too, lol
- bentcorner 7mo agoA very very long time ago as an intern I was working on a perl cgi script and I would often test it with telnet. I was used to messing around with hayes commands so manually typing in HTTP commands seemed like a natural extension of that.
- mmh0000 7mo agoIf you miss that and long for the olden days, you can still do it today with OpenSSL’s sclient: openssl s_client -connect www.yahoo.com:443
- lacunary 7mo agotelnet + shijack = good times
- charcircuit 7mo agoThe design of telnet and ssh where you have a daemon running as root is bad security that as shown here is a liability, a ticking time bomb ready to give attackers root.
- direwolf20 7mo agoLiterally how else is a remote login daemon supposed to work though?
- dragonfax 7mo ago1. Start with root to bind the port below 1024. 2. give up root because you don't need it any further. 3. Only accept non-root logins 4. when a user creates a session, if they need root within the session they can obtain it via sudo or su.
- deleted 7mo ago[deleted]
- deleted 7mo ago[deleted]
- acdha 7mo agoThat still needs a way to change users, and OpenSSH already has privilege separation. That hardens the process somewhat to reduce the amount of code running in the process which can change the uid for a session but fundamentally something needs permission to call setuid() or the equivalent.
- jopython 7mo agoThis is about Telnetd. Not telnet itself.
- saulpw 7mo ago...except that port 23 seems to now be filtered across the internet at large, leading to a huge drop-off in telnet traffic over the course of days if not hours. I think it's safe to say that even if you patch telnetd, being able to use telnet over the internet is not possible in many places (including Canada, according to the data).
- deleted 7mo ago[deleted]
- accrual 7mo agoI wonder if simply moving to a nearby port would work. I assume only port TCP/23 is filtered instead of filtering the telnet protocol itself.
- RupertSalt 7mo ago1. TELNET is an IETF-standard protocol defined by RFCs. 2. Telnet is a well-known port assigned by the IANA (tcp/23). 3. telnet is a client program, originated on Unix, available on many systems, and likely from a quite homogeneous codebase. 4. telnetd is a server program, also originated on Unix for the purpose of implementing Telnet protocol as a login server. Also a homogeneous codebase or two. TFA is about items 2 and 4, and 1/3 are completely unrelated. IIRC, the only traffic that was monitored and detected here is the scanning. The vulnerability scanners that try and detect, for better or worse, what someone's running on port 23, fingerprint it, and figure out if it's a vulnerability. Interestingly, filtering port 23 only mitigates the CVE by happenstance. It is merely by convention that telnetd runs on port 23, so that people can use it to log in remotely. There is no constraint that requires port 23. Any other service could usurp 23/tcp for itself if the admin decrees it. So, filtering port 23 is an effective mitigation for the defaults of someone running a vulnerable server on the standard port. But it is not a panacea, and it doesn't prevent anyone from using the telnetd server, or the telnet client, except for port 23. But it also prevents you from offering any service on port 23/tcp, lest it be filtered. You wouldn't want to run a web server, sshd, a MUD, or anything else, because your connectivity would be negatively impacted for this reason. (The common experience is that a lot of Windows SMB/NetBIOS ports are blocked, and SMTP and port 80, on a lot of consumer ISPs, although this is contrasting the ISP situation to Tier-1 transit carriers now.)
- fsmv 7mo agoYour cookie banner is very inconvenient and made me leave your website and not read the article
- gogasca 7mo ago[dead]
- keyle 7mo agoIt's nice to not see C being blamed for once! ... Just good old lack of reasoning (which is most C's codebase downfall, agreeably).
- erichanson 7mo agoI used to telnet into my POP3 account and check email by protocol. Shucks.
- neom 7mo agoYour dial up ever die when you where checking your email? My ISP didn't allow for leave copy on server, I remember times I lost emails to this.
- peteforde 7mo agoThe scope of this CVE and the response to it are genuinely wild. It's crazy to think that some dude is singlehandedly responsible for ultimately ending the telnet era in such a definitive way. One for the history books.
- ycombinatrix 7mo ago>some dude is singlehandedly responsible Well, one person to put up the PR and one dude to approve it - back in 2015. It isn't the security researcher's fault.
- Quarrel 7mo agoWhat an amazing bug. I probably spent my first 10 years on the internet just using telnet. They were wild times. You could log ethernet traffic and see passwords. Towards the end of those we started to have a few more single-user machines, but the vast majority were old school many many user machines, where "root" was thought to be tightly restricted (of course, even then, in practice it wasn't if you were in the know). Anyway, just wild seeing this: > telnet -l 'root -f' server.test or > USER='-f root' telnet -a server.test Survive 11 years.
- anitil 7mo agoThe more I work in software, the more amazed I am that anything works at all. There's likely so much low hanging fruit out there
- Telemakhos 7mo agoI never sent root over telnet, but I spent too much vacation time browsing the web via lynx on my school AIX account from a library near my parents' home, because it had a telnet client in addition to the card catalogue program on the otherwise locked down desktop. It was just a more innocent time: you didn't assume your traffic was being logged six ways to Sunday. With telnet access to my AIX account, I could do all the internet things, like mail (pine) and the web (lynx) and irc, from a convenient command line anywhere in the world.
- mlyle 7mo agoIt's hilarious, especially given that I have memories of similar rlogin vulnerabilities -- various unixes being vulnerable to rlogin -l '-froot' in the 90s.
- wellf 7mo agoNever used telnet to log in to something but it is a cool debugging tool, so used it for that. E.g. can this container even send traffic to that container at all.
- itintheory 7mo agoI'm a fan of 'nc' / netcat for this purpose. It's small, quick, and can send or receive over TCP or UDP.
- lofaszvanitt 7mo agoWho actually uses the tectia ssh client instead of openssh?
- tokyobreakfast 7mo agoAn RCE in GNU's telnetd has no relationship to the sunsetting of telnet. Something could equally likely happen with SSH (but not really because the OpenBSD folks are paranoid by nature). Apple removing the telnet client from OS X was a stupid move. How can you call yourself UNIX and not have a telnet client? It's like removing grep or ed.
- p_ing 7mo agoThats what the mystery exceptions for the Open Group macOS UNIX certification was for!
- epcoa 7mo agotelnet has never been in POSIX though.
- p_ing 7mo agoIt's a joke and a poke that macOS isn't certified UNIX as shipped.
- RupertSalt 7mo agohttps://www.opengroup.org//openbrand/register/ https://www.opengroup.org//openbrand/register/ To actually pass the certification test suite on a real system, Apple sometimes needs to apply special configurations (e.g., disabling System Integrity Protection (SIP), using case-sensitive filesystem, enabling certain legacy services, etc.). telnet(1) is not required by POSIX (nor is nc or ssh required!) Ironically, telnet(1) did not begin as a "Unix" utility but an ARPANET protocol suite program. It was available cross-platform. It is unclear whether all editions of Unix included a client, but BSD for sure was the point where telnet and TCP/IP became essential integrations for the systems.
- p_ing 7mo agoDid you not read that it was a joke?
- Sparkyte 7mo agoBetween you and me telnet is not dead. Sometimes I use it to probe a port to verify it is working.
- otterley 7mo agoThat's not really telnet. Yeah, it's using the same client, but the server and underlying protocol are what's relevant here. The modern replacement for telnet used in the "probe a port" fashion is nc/netcat.
- Fnoord 7mo agoYou might wanna use netcat for that instead [1]. Or, for example, socat [2]. Netcat has been around for a long, long time now. [1] nc (1) - arbitrary TCP and UDP connections and listens [2] socat (1) - Multipurpose relay (SOcket CAT)
- snazz 7mo agoAm I the only one who feels like it isn't the responsibility of backbone ISPs to filter traffic like this? In the case of a DDoS situation I could get behind it, but in this case I feel as though it's not Cogent's problem if I want to use telnet from a device on Charter's network to a Vultr VPS, even if it may be ill-advised. (Of course, the article only speculates that this traffic filtering is what's going on; there isn't any hard proof, but it feels plausible to me.)
- AnonHP 7mo agoSo Telnet as a client is not dead though, right? A long time ago, I used to use the Telnet client to talk to SMTP servers (on port 25) and send spoofed emails to friends for fun. With port blocking widening in scope, I’ve long believed that we would one day have every service and protocol listening on port 443. Since all other ports are being knocked off in the name of security, we’ll end up having one port that makes port based filtering useless.
- ajross 7mo agoNone of this affects the use of telnet the client program nor the ability to run a telnetd on your own host (but do be sure it's patched!). What's happened is that global routing on the internet (or big chunks of it, it's not really clear) has started blocking telnet's default port to protect presumably-unpatched/unpatchable dinosaur systems from automated attack. So you can no longer (probably) rely on getting to a SMTP server to deliver that spoofed email unless you can do it from its own local environment.
- VladVladikoff 7mo agoOn the bright side that CVE seems like pretty great news for the hardware hacking community hoping to get root on embedded devices which have open telnetd.
- josteink 7mo agoI just tried on a Zyxel Wifi AP I have. It seems to use a different telnetd (busybox?), because from what I can tell it's not prone to this error.
- VladVladikoff 7mo agoDamn :(
- virgulino 7mo agoNever mind telnetd. Tier 1 transit providers doing port filtering is EXTREMELY alarming. They have partitioned the Internet, and in a way that automatic routing (BGP) can't get around.
- acters 7mo agoSo basically the same as censorship because that is the exact same thing blocking ports does.
- fragmede 7mo agonot to mention, filtering on udp vs tcp, which makes using anything else impossible. Not that I have one, but it's just a bit in a field, why filter on it?
- oaiey 7mo agoI do not know what is more critical: the risk of censorship or stand by while hospitals, banking, nuclear power plants and other systems become compromised and go down with people dying because of it. These decision makers not only have powers but also have a responsibility
- gspr 7mo agoThis feels more akin to discovering an alarming weakness in the concrete used to build those hospitals, banks and nuclear power plants – and society responding by grounding all flights to make sure people can't get to, and thus overstress, the floors of those hospitals, banks and nuclear power plants.
- forty 7mo agoYou feel it's similar because having access to port 23 is similarly life critical as having access to an hospital? Or is it because like with ports, when people can't flight to an hospital, they have 65000 other alternative options?
- 7mo ago
- clarkqaq 7mo ago[dead]
- varenc 7mo agoSince Tier 1 transit providers have now blocked telnet (port 23), this means the death of watching ASCII Star Wars with `telnet towel.blinkenlights.nl` However, if you still long for nostalgia, I was able to access it over IPv6 using a VPN based in the Netherlands: telnet 2001:7b8:666:ffff::1:42 I'm sure the port 23 telnet blocking will be coming to IPv6 soon though.
- pavelstoev 7mo agoAm I the only one who finds this suspicious ? About Telnetd “…The vulnerable code was introduced in a 2015 commit and sat undiscovered for nearly 11 years.”
- RupertSalt 7mo agoOkay, it is really weird. This was not an exploit difficult to pull off, or discover. It is such an elementary error that any script kiddie could have leveraged it anywhere, once it was understood. Is there proof or evidence that it was never exploited in all of 10 years and remained as a latent zero-day? The only saving grace I would propose, is that since telnetd has been aggressively deprecated once ssh became popular, and encryption became ubiquitous, and remote exploits became commonplace, and Starbucks WiFi was routinely surveilled, that telnetd simply wasn't running anywhere, anymore. We have commenters saying that embedded systems and IoT used telnet servers. But were they running an actual GNU telnetd or just a management interface that answered on port 23/tcp? Commenters are citing statistics of "open port 23", but that means nothing in terms of this CVE, if it ain't GNU telnetd. Cisco has literally always used port 23 for management. Other routers and network devices use port 23 without telnetd. How popular was GNU telnetd to be running on a system and exposed to the Internet? This article pertains to all the port-scanners running everywhere, so surely someone with a Shodan account can make a survey and tell us: who was still exposing GNU telnetd in 2026?
- achillean 7mo agoThere will be some honeypots in this data but this is a start: https://www.shodan.io/search/report?query=product%3Atelnetd+port%3A23 https://www.shodan.io/search/report?query=product%3Atelnetd+...
- pigggg 7mo agoMore likely a specific botnet had it's c2 or telnet scanning report endpoint go down / get nulled on Jan 14th.
- achillean 7mo agoPort 23 has decreased significantly over the past decade: https://i.imgur.com/tZoTWu6.png https://i.imgur.com/tZoTWu6.png Still seeing a sizable number of open ports but it's on the decline.
- VladVladikoff 7mo ago77k hosts with port 23 open https://www.shodan.io/search?query=telnet https://www.shodan.io/search?query=telnet
- achillean 7mo agoFYI: it might be better to search by port:23 https://www.shodan.io/search?query=port%3A23 https://www.shodan.io/search?query=port%3A23 Or to filter by product:telnetd https://www.shodan.io/search?query=product%3Atelnetd https://www.shodan.io/search?query=product%3Atelnetd A query of "telnet" searches Shodan for banners where the "data" property contains the string "telnet": https://book.shodan.io/getting-started/query-syntax/ https://book.shodan.io/getting-started/query-syntax/
- digitalPhonix 7mo agoThe CVE referenced is caused by this commit: https://codeberg.org/inetutils/inetutils/commit/fa3245ac8c288b87139a0da8249d0a408c4dfb87 https://codeberg.org/inetutils/inetutils/commit/fa3245ac8c28... One of the changes is: - getterminaltype (char *user_name, size_t len) + getterminaltype (char *uname, size_t len) What is the reason for a rename these days? If I saw that in a code review I’d immediately get annoyed (and probably pay more attention)
- deleted 7mo ago[deleted]
- naniwaduni 7mo agoFrom ChangeLog: * telnetd/utility.c (getterminaltype): Change the name `user_name' to `uname', as the former shadows a precious and global variable name.
- rob74 7mo agoCongratulations! Now you've got yourself a precious and global(ly exploitable) vulnerability...
- ycombinatrix 7mo agoglobal variables are public enemy number one
- ky3 7mo agoWouldn't attention to getenv() calls yield more benefit? Such calls are where input typically isn't parsed--because parsing is "hard"--becoming targets for exploit. The present fix is to sanitize user input. Does it cover all cases?
- anonymousiam 7mo agoFor about 15 years beginning in 2003 I had some VPSs with CrystalTech/NewTek. I noticed right away that they had blocked all port 23 traffic in/out of their edge. I asked them about it and they said it was a security measure. Apparently they used telnet for managing their routers. It turned out that they did not have very good security anyway. https://krebsonsecurity.com/2018/02/domain-theft-strands-thousands-of-web-sites https://krebsonsecurity.com/2018/02/domain-theft-strands-tho... I switched to A2 hosting shortly after the above incident, but I dumped them when they did not keep up to date on their Ubuntu LTS OS options. I've been running on AWS for the past eight years. It costs more, but it's been extraordinarily reliable. A2 and AWS do not restrict port 23.
- chenmx 7mo ago[dead]
- prerok 7mo agoI think it would be better suited to use the terms we use for natural languages. A natural language is dead when the last person who learned it as first language dies and are extinct when there is noone that would speak it at all. In these terms, telnet has been dead for a long while, but it's extinct now.
- nephihaha 7mo agoEven that's argued within linguistics. There are languages which survive for generations as secondary languages (especially trade languages as Swahili or Chinook Jargon appear to have been originally). Also some like Latin, Hebrew and Sanskrit which survive for centuries but not as native languages.
- prerok 7mo agoCan you cite sources where this is argued? The wikipedia seems to make a clear definition: https://en.wikipedia.org/wiki/Language_death https://en.wikipedia.org/wiki/Language_death That said, the above article does use extinction and death somewhat interchangably later on, but I suppose it's almost the same for small languages that nobody learns who is not a native speaker.
- nephihaha 7mo agoThere are plenty of languages which exist without much in the way of L1 speakers. Esperanto, for example, although it does have a handful of native speakers. Many people speak English as a non-native language, particularly in places like India or Nigeria. Swahili was originally a trade language few folk spoke and even today, many of its speakers are L2. I can speak and read some Manx. I personally don't believe it died in the 1970s. Not only do we have continuity from that time, there are people around today who learnt theirs off native speakers (in one case they were his close relatives.) It helps that we have many recordings, writings etc and it is also closely related to two languages which are in slightly better shape. Latin and Hebrew were in use within the Middle Ages to a substantial level and used to communicate between people as a common language sometimes. Hebrew is now revived, but is Latin? A few people have spoken it as their first language over the last century or two.
- ubixar 7mo agoThe most interesting thing here isn't the CVE - it's the invisible coordination. A backbone provider acted on advance knowledge of a critical flaw, implemented filtering at scale, and the rest of us didn't notice until GreyNoise's data showed the drop. The vulnerability got patched at the network layer before it ever reached the application layer. This is what mature security ecosystems look like - the boring, quiet fixes that happen before the press release.
- Gigachad 7mo agoStop spamming AI slop
- ubixar 7mo ago?
- jcattle 7mo agoYou comment reads very AI generated. From the, it's not X it's y, to the overdramatization of completely normal events (i.e. key infrastructure providers are notified of CVEs before they are disclosed so impact is minimized)
- 0123456789ABCDE 7mo agobecause it reads like claude output? and also the pattern: > The most interesting thing here isn't the CVE… This is what mature security… > The most interesting finding isn't that hyperbolic growth… This is Kuhnian paradigm… both comments in the last 24h
- tosti 7mo agoWhatever the AI, the point is valid and I had a similar train of thought reading TFA. This comment section took a different turn but hey, what can be used for good can be abused for bad. Gee whizz!
- atoav 7mo agoAh. Telnet. My oscilloscope still talks telnet, and this is the reason why that type of equipment is on an isolated net.
- jgalt212 7mo ago> required. No user interaction. The vulnerable code was introduced in a 2015 commit and sat undiscovered for nearly 11 years. I think about this quote a lot: given enough eyeballs, all bugs are shallow
- pjf 7mo agoKind of "funny" affected service is BGP RouteViews CLI access, still running over telnet: https://archive.routeviews.org/ https://archive.routeviews.org/ (scroll to bottom of the page) Isn't this one of the remaining, "legit" uses of the Telnet protocol on TCP/23 port over the public Internet?
- nubinetwork 7mo agoInteresting... I hadn't been watching, but I average around 2000 unique IPs for telnet... there was a brief 7500 IP spike in the middle of January, but it was short lived. There was a smaller blip just at the end of January, but going into February it's actually down around 1000.
- teddyh 7mo agoTime to switch to SUPDUP!
- fweimer 7mo agoIt should be possible to get a better idea where the filtering happens with a tool like tcptraceroute (possibly patched to use other segments beyond the default TCP SYN). I haven't found evidence of extremely widespread filtering. Why would there be? The installation count is not that high. The potential side effects from uncoordinated port filtering could be quite severe. This isn't netkit's telnetd or Busybox. (I'm aware of Debian switching defaults, but that was fairly recently.)
- munch117 7mo agoI'm slightly taken aback by the telnetd fix: The solution to the username "-f root" being interpreted as two arguments to /usr/bin/login is to add a "sanitize" function, really? I'm not seeing the sense in that. Surely in any case where the sanitize functions changes something, the login will fail. Better to error out early than to sanitize and try to hobble along. What I'd like to know is how the arguments get interpreted like that in the first place. If I try giving that kind of argument /usr/bin/login directly, its argument parser chides me: $ login '-f root' login: illegal option -- What's telnetd doing differently? Is it invoking login via a shell?
- pwg 7mo agoYou passed '-f root' to login (a single long string). telnetd is likely passing '-f' 'root' to login (two arguments instead of one, whether this is because it creates two, or it uses the shell (which then reparses) I don't know). But '-f' is a valid option to login (man login): login [-p] [-h host] [-H] [-f username|username] ... -f Used to skip a login authentication. This option is usually used by the getty(8) autologin feature.
- munch117 7mo agoI was reading https://www.offsec.com/blog/cve-2026-24061/ https://www.offsec.com/blog/cve-2026-24061/, which implies that precisely that single long string passes through getenv("USER") in the attack. The mystery is how that single long string in telnetd becomes two separate arguments for login. execv or posix_spawn certainly won't do that. So either there's a version of /usr/bin/login that parses arguments in some very sus way, or there's a shell involved somehow.
- willmarquis 7mo ago[flagged]
- fortranfiend 7mo agoTelnet will live on, in areas it probably shouldn't like industrial controls systems, switch management, regulated industries, printing, etc.