The number of reported security vulnerabilities has gone up drastically. And so has the frequency, number, and volume of security patches. Which also makes the gap between fully supported distributions and ones with only partial security support larger. (Not every distribution provides full security upddates for the full announced life time of a release.)
How are you folks reacting to this?
You must log in or register to comment.
I think its a good sign, because it means the Kernel gets more secure. And it also means there is not just slop produced with Ai, if people know what they are doing off course. Any of these CVEs not found could have been abused by anyone else.
Edit: I was thinking and speaking of the Linux Kernel itself, but this applies to any other important code or service too.
The number of reported security vulnerabilities has gone up drastically.
I think of the number of FOUND security vulnerabilities has gone up drastically.
Fantastic! When we knew this was coming, the company finally prioritized several of my initiatives about getting up to date. More recent CVEs helped me prioritize a smoother path to updates
😂 I am somewhat envious! My company still uses flourescent lamps… and part the stack is from the same time.
Patch.
I already had automatic updates, so now it’s just a lot of rebooting.
Cutting down external services to 0. SQL, Wiki, SVN, CalDAV, etc. All shut down.
Its important to remember that the vulnerabilities always existed, we just know about them now. We have no idea how many of them were being quietly exploited before now.
There is no point being mad at AI for the avalanche of CVEs, if anything we should be mad ourselves for not prioritising security review of the code. Many of these issues probably could have been found before AI if we as an industry were willing to spend the resources doing the audits. But we werent willing, and now we have to pay for our sins.
you should listen to GKH’s review of the recent dumps of “CVEs” because you clearly don’t know what you’re talking about
Care to summarise?
https://m.youtube.com/watch?v=_MwMLPmMccs
I’m halfway through this, I assume that its what you mean? Nothing there so far invalidates what I said. 25% bad reports means 75% good reports.
Edit: I finished it, and nothing he says invalidates what I wrote.
I think it’s great. Amount of bugs is finite. It will stop and we will be better off for it.
Amount of bugs is finite.
Resources are also finite. You can’t proof the absence of bugs, you can only proof the existence of it.
Did you know, there are more ways to arrange a deck of cards than there are atoms on Earth. A standard deck has only 52 cards. Now imagine how many possibilities are there to have bugs in a code like the Linux Kernel. Just because something is finite does not mean we will ever reach that point.
You can absolutely prove the absence of bugs via formal verification.
The card example does not really make sense because the kernel is not a random set of syntax and bugs do not happen randomly. They usually happen because a dev overlooked a use after free or buffer overflow. Well we now have software really good at finding these things, as well as system languages that cannot have these bugs.
If bugs are closed faster than they are opened, the total amount goes down. For orientation: around 25% of all CVEs ever published were published this year. That means around 6x more bugs were fixed this year than in the other years. I don’t think the kennel gained that amount of additional bugs.
You can absolutely prove the absence of bugs via formal verification.
You can’t have a formal verification for an open ended system like the Linux Kernel. You can only have that with extremely narrow defined functions that only operate mathematical and the input and output are 100% deterministic. Someone has to make the test cases, and to my knowledge its not possible to do this with complex systems like the Linux Kernel.
The card example does not really make sense because the kernel is not a random set of syntax and bugs do not happen randomly.
It makes sense, because it proofs my point that a finite number is irrelevant if its that big. The randomness of it is absolutely not the point, its the sheer amount of possibilities.
Well we now have software really good at finding these things, as well as system languages that cannot have these bugs.
No software can test a complex system like this in its entirety to make sure there are no bugs. Those software itself need to be perfect themselves too. Therefore you introduce enormous complexity in solving bugs, which itself can have bugs.
If bugs are closed faster than they are opened, the total amount goes down.
I wasn’t arguing against that. I am arguing that a finite number of bugs is not a good argument to have none in the future. Because of the sheer amount of possibilities, and also because we cannot proof that Linux Kernel is perfect without any bugs. It is impossible.
Even if we assume every patch to an existing bug is perfect and doesn’t cause other issues somewhere else.
This still only applies if the kernel stays static/not adding features or support for new hardware.
This is pretty much where I am with it. I see this as our transition phase towards more memory safe languages and tighter code
Amount of bugs is finite
Not really, no.
🎵 99 little bugs in the code, 99 little bugs, you take one down, patch it around, 102 little bugs in the code 🎵
Put everything behind VPNs and migrate services from Docker to VMs
Even the VPN hosts and OS full of CVEs
Yeah but then like those VPNs should put their hosts also behind a VPN
VPNs all the way down
This is a good thing for Open Source Software. Yes, there’s a lot of vulnerabilities discovered, but in time, most, if not all of them will be patched. Closed Source Software on the other hand will always have the sword of Damocles hanging over their head, as it will be uncertain if they’re fully patched…
I’ve certainly been remembering to update everytime I’m on my PC now.
It made me automate the process of updating that junk heap I call a homelab: the OS, the flatpaks, the docker images.
But then you don’t get the satisfaction of feeling like an admin.
I’ve also been keeping my unplugged most the time now even though I haven’t opened up any ports or made an attempt to set up a way to communicate with my servers services outside of lan.
I was just getting it finished for all the stuff I need locally and everything else involves talking to the scary outside world and I think I’ll wait on that for a little. I just finished my esphome display too which now can only tell me the temp, without the server.
I figure maybe in a few months to six months a lot of the security flaws in most things should of been addressed and I can probably bring my shit box to its full potential. I have a real GPU in mine I haven’t even got to really use besides testing llms and image gen, or trying out frigate ai features with my cat.
I just keep updating and patching, same as before. For big ones, like php2shell (before it was determined that it required a very specific setup), I check for signs of intrusion. But that’s still relatively rare. Just update.
Happy to have outsourced and paying professionals to do this and not me in my spare time.
It’ll be an annoying couple of years, and most bugs are nowhere near as serious as they are hyped up to be. Plan for more data breaches than usual though, not everyone is going to have sufficient layers of protection.
It’s good that they’re finding these bugs and fixing them. The only thing I feel that I personally can do is to update as much as possible, and to reduce attack surface if possible.
