THE ROOT FIVE / NOVEMBER 6, 2026
Five stories. One strange world of technology.
A Linux login fix starts with a single character. GitHub’s status log shows several parts of a release pipeline slowing down together. At the workbench, a DOS port bends display timing, spinning LEDs draw in midair, and a robot’s fingertips get a faster say in what its hands do.
Root Note
The smallest interface can set the rules for the whole system.
Root Note
From a password marker to a display scan line or a fingertip sensor, each of today’s stories turns on what happens at a boundary most of us rarely look at.
01 / Security / Systems administration
A password marker can become a login on some Alpine systems
Alpine Linux and OpenSSH published fixes on November 5 for a password-authentication bypass in certain Linux builds of the OpenSSH server. Alpine’s advisory describes a narrow combination involving a reachable server using musl without active PAM, password authentication allowed, a target account marked with an asterisk in its password field, and another account with a compatible local password hash. The library can return an asterisk to signal an error, and the vulnerable comparison can mistake that value for a match.
That combination is easy to miss when reviewing an image and its provisioning script separately. Alpine notes that some older tiny-cloud images are safe on first boot but can become exposed when provisioning adds an applicable password hash. An Alpine container that never runs the SSH daemon has no exposure through that container’s SSH service.
Root Access Take · Treat authentication policy as something the running service enforces. An updated package sitting on disk tells you little about a daemon that has yet to restart. A vendor backport can also fix the problem without changing the package to the upstream release number.
Useful next step · Use Alpine’s branch-specific fixed version, then restart the service and verify it. If password login must be disabled as a temporary measure, verify key access and keep an existing session open until a fresh login succeeds.
Sources · Alpine advisory, affected configurations and fixed packages · OpenSSH 10.6p2 release notes · AWS vulnerability record
02 / Cloud operations / Release engineering
GitHub’s disruption reached beyond the build queue
GitHub began reporting degraded performance at 23:36 UTC on November 5. Its official incident log mentions Actions, Pages, Git operations, Issues and API access over the course of the investigation. GitHub warned that some users could see slow responses or failed requests. A mitigation was in place around 00:06 UTC on November 6, and the incident was marked resolved at 00:20. The status log says a root-cause analysis will follow.
For a team shipping software, this kind of overlap matters. The same release can rely on a Git fetch, a hosted runner, an API call to record progress, and a downstream deployment. A client timing out while a job is being started leaves open the possibility that the job already exists. An immediate retry can make that ambiguous state harder to untangle.
Root Access Take · Recovery starts with knowing which steps are safe to replay. Keep a release identifier that survives retries and make your deployment target report whether it has already applied that identifier. A green status page means the vendor is recovering or has recovered. Your release still needs a decision about where to resume.
Useful next step · Replay a partial release in staging. Simulate a failed status check after a deployment starts, then confirm the workflow can resume without applying it twice.
Sources · GitHub Status incident record and update timeline · GitHub’s incident permalink
03 / Retrocomputing / Graphics
A Flash-era game gets rebuilt for the original IBM PC
TheRasteri’s DOS port, demonstrated on November 4 and featured by Hackaday on November 5, brings a game from the Flash era to a machine from a different computing era altogether. The project rebuilds the game for DOS using Open Watcom rather than trying to run a Flash player on an IBM 5150. The biggest change is how it gets a picture onto a CGA display with enough detail for the game.
Hackaday’s account of the build describes the trick. The port changes character height on the fly using the Motorola 6845 family of CRT controllers, making CGA text output behave more like a small graphics window. A few carefully placed register writes buy screen space that the usual presentation of text mode would leave on the table. The maker also tests the port across several DOS machines, where graphics behavior and timing can vary.
Root Access Take · A platform can expose capabilities that its usual software interface hides. This is the fun version of a production lesson. When you lean on a timing quirk or a low-level setting, put the hardware and emulator assumptions in the README. Someone will eventually run your supposedly universal fix on the one machine that disagrees.
Useful next step · Watch the build and ask which parts depend on CGA behavior, then compare those assumptions with the graphics hardware your emulator presents.
Sources · TheRasteri’s source and hardware requirements · TheRasteri’s original build demonstration · Hackaday’s technical account of the port
04 / Clever builds / Display engineering
Vortex draws 3D shapes with a pair of spinning LED panels
Hackaday’s November 5 feature on AncientJames’s Vortex revisited a December 2024 build that makes a lit shape appear to occupy space inside a clear enclosure. Two back-to-back LED panels sweep through the volume as a Raspberry Pi drives the display. Each angular position gets a different slice of the scene. A viewer can walk around the resulting image and see it from another angle.
The maker’s repository separates the driver from the content. A client writes voxels, the three-dimensional counterparts of pixels, into a shared-memory buffer. The driver reads that buffer and lights the panels in step with the physical rotation. The same buffer can feed an X11 simulator. That division is handy because a bad shape and a synchronization problem can both look like a garbled image, and the simulator helps distinguish the two.
Root Access Take · The panels do the visible work, but the timing determines where every visible point lands. Think of it as a display whose clock has bearings. Better content can make a correct image prettier. It takes synchronized rotation and stable mechanics to make the image stay put.
Useful next step · Start with the software simulator and a simple calibration grid. It lets you investigate the content pipeline without building or operating a high-speed rotor.
Sources · AncientJames’s Multivox source and simulator documentation · AncientJames’s December 2024 build video · Hackaday’s feature and build walkthrough
05 / Robotics / Feedback control
T-Rex gives robot fingertips a faster say
Panasonic highlighted T-Rex on November 5, a collaboration with several academic and industry partners. The team’s preprint was posted June 15. The robot uses a vision-and-language module to generate motion at roughly five updates per second and a tactile module to correct it at about twenty. When contact changes, the fingertips can inform a correction before the next round of high-level planning.
The researchers tested twelve contact-rich tasks, including turning pages and transferring eggs. Panasonic reports average success of 65 percent for T-Rex and 42 percent when tactile information was removed in the team’s evaluation. Those figures describe the tested tasks and setup. The paper is worth revisiting because its contribution is a measured comparison of two feedback paths in the same system.
Root Access Take · Give a fast, narrow loop the work it can actually finish on time. A slow planner can decide where the hand ought to go, while a local correction handles the moment the object starts to slip. A production system would still need to define what happens when contact data is stale or contradictory.
Useful next step · Compare how a system behaves with feedback delayed, absent or noisy. For anything that moves in the physical world, decide which condition should trigger a stop or request for help.
Sources · Panasonic’s November research announcement · T-Rex preprint · Research team’s demonstrations
The Root Five archive · Root Forward · Security Watch. For another example of a short incident leaving work behind, see the November 5 discussion of Cloudflare errors.