Posts
437
Following
100
Followers
4695
@wdormann @joshbressers @Viss I love it how people think that "coordination of vulnerabilities" is actually something that can be done these days. Think of just who uses the software in question, and who should, and should not, be on such a list to get a "early disclosure notification".

As I have said for quite some time now, all early-disclosure lists are leaks, otherwise why would your government allow them to be in existence?

Software, and specifically open source software, runs the world. So should the whole world be on that notification list? :)
3
5
16
@claudex @icing @joshbressers @vathpela @haliphax That's what we do in the kernel today, it's a pretty straight mapping between the two.
0
0
1
@warthog9 @argv_minus_one There should be fixes out for "everyone", that is what I got working yesterday morning.

And yes, this is on the reporter, there's nothing the kernel security team, or kernel CNA can do differently here, sorry.
0
0
3
@argv_minus_one @jeroen @warthog9 How is this "too low", did the CVSS attributes get written wrong here? If so, please let us know and we will be glad to fix and update the record.
0
0
0
@warthog9 @argv_minus_one Heck, this was even one of the very few CVE entries that we actually scored, giving it a 7.8 on the CVSS scale. We rarely score these things, but when we do, perhaps people should actually pay attention?

Makes me wonder why we even do this sometimes...

{sigh}
1
0
2

@warthog9 @argv_minus_one

I’d argue this not having a broader security push before the public release happened, is a pretty serious failure on someone’s part.

And who is that “someone”? We fix bugs like this in the kernel on a daily basis. If people have not learned to constantly upgrade to stay ahead of this, then why even assign these 10 CVEs a day in the first place? :)

1
0
2
@jeroen Don't trust the Mhz numbers, when the system is overloaded like that, it's hard to report what is actually happening. The load average is over 2000 so it's amazing anything is being reported properly.
0
0
4
repeated

Once again, my professional recommendation in response to the latest Linux kernel vulnerability in the news is that you should gather up all your electronic devices, cast them into the sea, and retreat to the woods.

Each night, gather your children and tell them tales of the Before Times when the hubris of humanity grew so large that we made idols of sand and spoke to them as equals. Remind them that the sand, of course, did not speak or think, but we imagined it could, and let it guide us to folly.

Should a stranger ever come to your village with a glowing rectangle, encourage the youth to beat them with sticks.

3
25
0
My build system right now, as it's one of "those" mornings....
5
7
39
repeated

I was explaining how we built with buildstream and bootc to a coworker and he goes.

"So you made Gentoo but cloud native."

And now I am never going to shut about it lol.

1
2
1
@qualcuno I don't remember, sorry. We got it as a gift many years ago.
0
0
0
@nklsdev As stated above, all of them!
0
0
2
As people keep guessing what/who `gkh_clanker_t1000` is: https://lore.kernel.org/r/20260424054143.087847e1617a84df8b501313@linux-foundation.org

here it is after I cleaned up some of the horrid cable mess that had grown up around it.
4
18
63
repeated

We now require proof of work before you can submit a security report.

Like mowing @bagder 's lawn or washing his car.😌

2
7
1
@qwertviop @AdrianVovk Thanks, found it, but no, nothing, all seems sane on the system. Oh well, KDE it is until I wipe this box...
0
0
0
@lesto Yes to the first, and for the second "you can always change the code to adapt over time". Make it work now, don't worry too much about the future as you don't know what it will hold.
0
0
0
@qwertviop @AdrianVovk there is no `paccheck` as part of `pacman-contrib` :(
1
0
0
Show older