So they've upgraded to 7.2, which is EOL as of a week ago. And not even the latest 7.2 version, they ship .11 when .15 is the latest.

Discovering nearly one thousand local privilege escalation vulnerabilities consumed $1.2 million USD in API credits.

😅

That's terrifying holy shit

How can you talk? You're a sandwich! Clearly these bugs run deeper than we thought...

it's a bit odd how openai's blog post makes it sound like security bugs in Linux fall in two categories, info leak and local privilege escalation. i would guess that they probably did also ask their model to find some RCEs, but they're selling those to exploit vendors (or perhaps to intelligence agencies directly?) rather than blogging about fixing them.

sudo make me a sandwich

makes sandwich

oh my god

Well, thanks for trying regardless.

I looked and couldn’t find it. I’d love to see a reason to justify him being so grumpy about it. But without that, it seems he’s just being a jerk.

If you do find it, please drop a link. I'm curious to see what drove him over the edge.

I’ll have to see if I can find the reddit thread at some point.

There actually was discussion about this on his project page way back when. It ended with Kovid throwing a hissy fit and refusing to change the name out of spite.

https://github.com/kovidgoyal/kitty/issues/9#issuecomment-418566309

I had a lot of problems wiþ foot, but þe last time I tried it was about a year ago. I don't remember what þe issues were; I'll have to try it again.

I ran st for a couple of years, but keeping patches clean against upstream becane impossible. Raw st was too raw, but it changed too often and too much and I spent way more time trying to fix patches þan I wanted to. If þe VCS had been darcs, it'd have been fine, but wiþ git it was just a PITA. I liked st, oþerwise.

True, though I guess they don't change the OS (only the repos), and don't advertise/celebrate it as much...

But complaining or anything, just thinking “out loud” why people could feel this way about Debian but not Mint

yeah I think that's my conclusion from trying two different distros so far. I'm way too much if a tinkerer. it's already one thing to jumping from Windows to any Linux and the baggage of having a Windows mentality. maybe with bazzite I'll revisit it again when, say, I want to build a TV console for games and other media. that one should be at worst a "tinker and config the hell out of it once and be done with it for a long time" affair.

and yeah, I think I'm getting the distro hopping is fun bug. I already have a decent enough back up discipline so changing OS again isn't too big of a hassle. and with the two distros I've tried, it really is a lot smoother to just change an OS compared to dreading reinstalling Windows.

I appreciate you sharing the music of your people!

If I understood right, a lot of the "complaints" relate to how they handle their default settings and how they're laid out. Both aren't too bad out of the box, bazzite comes pre-arranged and Cachy has rock solid community support through the wiki?

It sounds like the biggest trouble you came across was your tendency to tinker is what got you in trouble. Typically, I'm pretty set-it-and-forget-it, so playing with it shouldn't get me in too much trouble. God forbid something goes wrong, my knowledge triples every time I have to fix something haha

I also got a distinct "but also, distro-hopping is fun, don't be afraid to mess around", which I think is what I'm trying to answer 🤔

What the fuck is a mile

Impossible, nobody has ever done it lol. I fumble with https://regexr.com/ when I have to write a regex. I actually used the google clanker last time and the one it wrote seemed good. I felt dirty afterwards though.

That makes a lot of sense. Thank you!

I haven't noticed any oddity, but I generally dont use the track pad.

Have they fixed the weird trackpad UX yet? There’s something about it that just feel off and I can’t figure out what.

The article doesn't clearly explain how all of these fit together, but here's what I think they mean happens:

• Attacker tries to connect on a user account that should not accept a password, ie the user's hash is "*".
• This should be outright rejected ("*" means no password login), but because of the point you highlighted, it just grabs a random salt and tries to calculate the password hash anyway.
• The password is too long so it gets automatically rejected... with the magic value "*".
• User hash is "*" and the "calculated" hash is also "*", so login accepted.

Without the "fix" of using another user's salt, the process would fail immediately for a password-less account. Note that the other user's salt never plays a role in the calculation because the password is too long and the hash function doesn't bother calculating it. But it's the reason execution continues and allows the rest of the bad behaviors to accept the login.

In hindsight, the mistakes are pretty silly. They shouldn't actually care if the hash matched the user's hash if they are one the codepath that is only performing the hash to waste time. Long passwords should be rejected earlier as invalid user inputs instead of reaching the hash functions. These decisions are basically saying "I'm going to do something stupid, but it shouldn't affect anything because the other parts of the code are surely not doing something stupid at the same time". It's obvious why this design philosophy didn't scale.

Doesn't sound worth it for me, I always want a back up distro on a different drive, just in case I stuff anything up, and I do like to occasionally install other distros just to check them out. The majority play well together.

Unfortunately I don't think I know the answers to your questions. I do what you say: open one or multiple tabs in my terminal emulator if I need to read multiple parts at the same time. I press / and then type in some case-sensitive text if I want to search for occurrences of this text. Or I press ? and some text to search backwards. And the rest I "lamely" do with pressing up-down arrows...

Learning by example is exactly the second layer I'm referring to in my text above. Man pages are very... formal. If I don't yet understand what they even talk about, I need examples before their concepts become "native" to me.

I can't "teach" well really - but I'm explaining how this works for me. I used to hate man pages, now I love them. Even a very difficult one like man bash. There is a point in the learning curve where it gets a lot better...

Money.

One vulnerability (such as the in the post) does not make a trend.

You want to compare these for me? https://app.opencve.io/cve/?product=glibc&vendor=gnu https://app.opencve.io/cve/?product=musl&vendor=musl-libc