The details are here: http://hackaday.com/2009/07/29/black-hat-2009-breaking-ssl-with-null-characters/
One recommendation per post please.
from: http://seclists.org/fulldisclosure/2009/Jul/0388.html
If I understand it best from the posts from: http://news.ycombinator.com/item?id=723798 the Matasano guys left sshd internet accessible - any proposed solutions for this (from a programming point-of-view) ?