Jonathan Corbet
Posts
586Following
38Followers
2412
Jonathan Corbet
corbet
@davidgerard According to this page:
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
they were informed of one of the vulnerabilities in 2024, and wasted much of the intervening time arguing about how to fix it. So I'm not sure this one qualifies as "quick fix".
(Still glad to not be running any PHP on anything I manage...)
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
they were informed of one of the vulnerabilities in 2024, and wasted much of the intervening time arguing about how to fix it. So I'm not sure this one qualifies as "quick fix".
(Still glad to not be running any PHP on anything I manage...)
1
1
15
Jonathan Corbet
corbet
@monsieuricon I can relate ... the pre-2002 LWN site was PHP and stayed PHP for a fair while, but I made it all static a while back. The .php URLs remain (didn't want to break them) but there's no PHP on the server...I'm curious to see how many attack attempts we get.
1
1
5
Jonathan Corbet
repeated
repeated
mhoye but seasonally spooky
mhoye@cosocial.ca
Edited 2 days ago
Edit: looks like it’s been shuttered.
pyconf dot org is a fake event, a scam.
Notes:
- Domain registered after CFP closed.
- Venue doesn't admit its existence: https://fortmason.org/events/
- AI gen headshots, and speakers who aren't, in 100% of the the companies my network can see into, employees at those companies and never have been. Those people don't exist.
A couple of the listed "sponsors'" corporate legal teams have already been advised and word is they're furious.
3
8
0
Jonathan Corbet
corbet
@mattst88 @amonakov Stuff on the lists, though, includes self-extracting compressed kernel images, perf improvements, and 700 lines of Tsunami machine-check work. The potatoes are growing :)
One can argue that this work is low-risk and hurts nobody, but one can also certainly ask whether the mainline kernel should still be adding features to a long-dead architecture.
One can argue that this work is low-risk and hurts nobody, but one can also certainly ask whether the mainline kernel should still be adding features to a long-dead architecture.
1
0
0
Jonathan Corbet
corbet
Scanning the linux-kernel mailing list just now (a bad habit I have), I see patches to add significant features to the Alpha architecture, convert Perl scripts that haven't been touched in decades to Python, and replace user and group IDs with UUIDs.
Not sure how we ever got by without these wonderful new tools.
Not sure how we ever got by without these wonderful new tools.
6
10
34
Jonathan Corbet
corbet
Perhaps never quite getting around to setting up that LWN Facebook account was a good move after all? :)
https://www.niemanlab.org/2026/10/metas-new-commercial-terms-will-allow-the-scraping-of-news-sites-legal-experts-say/
https://www.niemanlab.org/2026/10/metas-new-commercial-terms-will-allow-the-scraping-of-news-sites-legal-experts-say/
1
3
25
Jonathan Corbet
corbet
@sackofbones @Netzblockierer @torvalds @mhoye Perhaps consider trusting a project (and its leader) that have delivered increasingly capable kernels and a strong development community for 35 years?
I am not thrilled (to put it lightly) about this rush to LLMs, but I don't think that this sort of attitude makes things better.
I am not thrilled (to put it lightly) about this rush to LLMs, but I don't think that this sort of attitude makes things better.
1
0
2
Jonathan Corbet
corbet
"No text that is AI-generated may be published in our magazine. No AI-generated art may be used as a Current Affairs illustration. When you read Current Affairs, you are going to be reading the thoughts of a human, and seeing the results of human artistry."
https://www.currentaffairs.org/news/why-were-banning-ai
Nice to see, even if they partake in the — wait for it — vilification of em-dashes ...
https://www.currentaffairs.org/news/why-were-banning-ai
Nice to see, even if they partake in the — wait for it — vilification of em-dashes ...
0
27
45
Jonathan Corbet
corbet
@srtcd424 @mhoye @gvwilson There is *one* Rust developer who left after some frustrating experiences. We were sad to lose him. Meanwhile Rust is going from strength to strength in the kernel.
If you look at my Kernel Recipes talk last month, you'll see that, among many other things, I said that the LLM onslaught was likely to cost us developers who don't want to deal with it. To a lesser extent, the advent of Rust may have the same effect. It is not desirable, but I'm not sure what you do about it.
Those who know me know that I am not a big LLM fan. I don't like what they are doing to our community, I fear for the long-term maintainability of a kernel filled with code that its authors don't understand, I detest the time I have had to put into defending LWN against scraper DDoS attacks, I am terrified by the prospect of making our free-software project dependent on proprietary tools owned and developed by psycopaths, I don't believe we can afford the environmental costs, and so on. But the community has to respond to all of this somehow; we're all still trying to figure out what that is.
If you look at my Kernel Recipes talk last month, you'll see that, among many other things, I said that the LLM onslaught was likely to cost us developers who don't want to deal with it. To a lesser extent, the advent of Rust may have the same effect. It is not desirable, but I'm not sure what you do about it.
Those who know me know that I am not a big LLM fan. I don't like what they are doing to our community, I fear for the long-term maintainability of a kernel filled with code that its authors don't understand, I detest the time I have had to put into defending LWN against scraper DDoS attacks, I am terrified by the prospect of making our free-software project dependent on proprietary tools owned and developed by psycopaths, I don't believe we can afford the environmental costs, and so on. But the community has to respond to all of this somehow; we're all still trying to figure out what that is.
2
1
7
Jonathan Corbet
corbet
@mhoye @gvwilson The kernel community is more than mildly interested in alternatives. When you have literally thousands of people showing up throwing slop at you, what do you do to retain your sanity and the quality of your code base? Nobody wants to turn away developers who want to actually learn the kernel and be part of the community, but identifying those people takes time and resources that simply aren't there.
1
1
4
Jonathan Corbet
corbet
@cks I have not quantified it; perhaps I should. There are definitely new developers who show up with a new driver once a company decides to upstream it; I would guess there's a handful of them each cycle, just based on MAINTAINERS file changes.
As for the rest, a lot of changes are obviously focused on drivers just because that's a huge part of the kernel. But one thing that really characterizes the flood of new contributors is that they make changes all over the kernel. You'll see a previously unknown identity changing drivers, security modules, core networking code, and more, all in a single development cycle.
Essentially, if you're not concerned about really understanding the code you're working with, you can work all over, and a lot of the LLM-driven new contributors are doing exactly that.
As for the rest, a lot of changes are obviously focused on drivers just because that's a huge part of the kernel. But one thing that really characterizes the flood of new contributors is that they make changes all over the kernel. You'll see a previously unknown identity changing drivers, security modules, core networking code, and more, all in a single development cycle.
Essentially, if you're not concerned about really understanding the code you're working with, you can work all over, and a lot of the LLM-driven new contributors are doing exactly that.
1
1
1
Jonathan Corbet
corbet
The updated version of my plot of first-time contributors per kernel release. It seems this trend is not slowing down anytime soon. I wish I felt better about all of the stuff these folks are putting into the kernel...
3
17
27
Jonathan Corbet
corbet
Debian issued a security advisory stating that "several vulnerabilities have been discovered in the Linux kernel:
https://lwn.net/Articles/1097401/
Here, evidently, "several vulnerabilities" means "1,313 CVE numbers".
https://lwn.net/Articles/1097401/
Here, evidently, "several vulnerabilities" means "1,313 CVE numbers".
10
49
53
Jonathan Corbet
corbet
I conclude that it is a bad sign when your airline sends you a cheery note asking if you have any data from Air Tags and the like that might give them a clue as to where your suitcase is.
3
11
42
Jonathan Corbet
repeated
repeated
Kernel Recipes
KernelRecipes@fosstodon.org(1/2) The dust has settled, the coffee cups are washed, but the good vibes are here to stay:
All the talk videos are online : https://www.youtube.com/playlist?list=PLEVVgAZOU9P8
The slides, with more landing over the next few days (some speakers are still polishing 😉) - check the schedule to catch it : https://kernel-recipes.org/en/2026/schedule/
The drawings from our amazing attendees (https://kernel-recipes.org/en/2026/attendees-sketches/) and speakers (https://kernel-recipes.org/en/2026/speakers-sketches/)
Tons of photos: https://kernel-recipes.org/en/2026/2026-speakers-on-stage/ and https://kernel-recipes.org/en/2026/in-the-room/
1
11
1
Jonathan Corbet
corbet
@ljs @monsieuricon Anybody can put together a documentation patch :)
What may also happen is that said text will be kept around and posted when the process starts next year.
What may also happen is that said text will be kept around and posted when the process starts next year.
1
0
0