Hacker News Reader

At this writing, I see a HN title of

> Critical default credentials in Kubernetes allows SSH root access

but the actual article title is

> Critical default credential bug in Kubernetes Image Builder allows SSH root access

which is an extremely important distinction: The bug is that something called the "Kubernetes Image Builder" is creating images that set an insecure default password, though some versions proceed to disable that password at the end of the build so the attack window is smaller.

what are critical default credentials?

Probably load bearing. If you remove them, the whole thing crumbles. Before attempting it, I suggest adding multiple support accounts.

They had a local user name builder with a static password that is in the image builder source code, so someone could log into the image as the builder user and deploy malware or the like into the image.

yes I know, those are called default credentials, not critical default credentials.

The title should be: “Critical flaw in title causes HN readers to click on mostly irrelevant article.”