Top
Best
New

Posted by chalmovsky 10 hours ago

WTF Ubuntu?(chalmovsky.com)
1267 points | 574 commentspage 7
rs_rs_rs_rs_rs 9 hours ago|
The "WTF" is unwaranted, it's really not that easy to write a weaponized exploit for a bug like that one.

I am a bit surprised by the panic...

newsoftheday 8 hours ago||
I'm not too surprised, it feels more like a way to help promote Anthropic than what it tries to appear to be.
robotuprising 7 hours ago||
It's really not that easy - for a human - to write a weaponized exploit for a bug like that one.
rs_rs_rs_rs_rs 5 hours ago||
No, I'm pretty sure AI too can't write an exploit for this, forget it about a reliable one.
worthless-trash 9 hours ago||
Its only the media / publicity that drives this one, there were worse within the last year that nobody seems to care about.
superkuh 9 hours ago|
That is with the implicit assumption that the mptcp exploit of this ipv4 tcp bug is the only exploit that will be found. I don't think that assumption will hold true.
worthless-trash 9 hours ago||
There were other fragmentation flaws that were equally as bad as this, I wrote the reproducer.

IIRC it had minimal HN discussion.

jongjong 3 hours ago||
Maybe they got a bribe from some intelligence agency to leave it open a little longer.
nottorp 9 hours ago||
> Anthropic says it built a working exploit that gets root on a server. A total takeover.

No offense but Anthropic says that every time.

saidnooneever 4 hours ago||
maybe once it comes out you will need to pay them to get the patch xD

I suppose this kind of stuff is why you will find some places who roll Debian in prod but almost never find Ubuntu?

on laptops etc. its less impwct because (i think) most people are sensible enough not to have all kinds of listeners open all the time?/(right guys??? ...RIGHT GUYS???)

dont forget it can also be used as LPE if its a local host listener. and LLMs can bake u a nice exploit for it too.

Go Debian or perhaps consider freeBSD or OpenBSD if your workloads permit. they are more feasible, and sensible by the day, not just trying to poop on Linux, its simply much more targeted for now, and because it moves faster, and thus is bigger, it will have more holes.

a lot of ball dropping all around lately in lots of incidents and CVE. stay safe out there!

thatonehack 7 hours ago||
I’ve always hated Ubuntu. I simply don’t understand the pitch as to why someone would use Ubuntu over just good ol fashion Debian. Better yet: FreeBSD.
runjake 9 hours ago||
I have the same general feelings, but then I recall my years as an OSS developer and being abused by people who contributed absolutely nothing to my projects. Not money, not code, not documentation, not even grammar corrections. I'm sure anyone who's been involved with reasonably popular OSS can relate.

I am not contributing to Ubuntu in any way, and that puts it into perspective.

(I still directly contribute to OSS and release OSS projects, but absolutely refuse to engage with the least bit of hostility. Any of that is an insta-block.)

Edit: Whoah the downvotes and comments. I'm not saying that Ubuntu is doing well here. I'm trying to point out that a a vast percentage of the complainers are not paying customers, and maybe if they did pay, Ubuntu would have more incentive and resources to work more quickly.

yjftsjthsd-h 8 hours ago||
People are paying money for Ubuntu, though. I suppose if only the free versions were unpatched we could consider the ethics and merits of who is allowed to complain about what, but when the paying customers are also being left out in the cold I don't think your argument has much merit.
runjake 8 hours ago||
Sure, and those people have a right to complain.

But, imagine if the complaint vs paid ratio were more equal.

Right now, the ratio is massively skewed towards complainers vs paid. (>99.9% I'd guess)

pezgordo 8 hours ago||
I guess yes on internet, enterprise customers just call their account managers rather than write a blog.
basilikum 8 hours ago||
Ubuntu is a for profit product by a commercial company, Canonical.
runjake 8 hours ago||
Most of it's user base are non-paying "free tier" customers.
sufficientsoup 7 hours ago|||
Their product is their product. It's not as if they should deprive their paying customers of a fix to spite the non-paying.
basilikum 7 hours ago|||
How is that relevant?
q2dg 9 hours ago||
Why use Debían when you can use Rocky or Alma?
ethin 6 hours ago||
The fact that Ubuntu (still) hasn't patched this (despite the fact that I'm pretty sure Opus 5.5 could figure it out in a few minutes) is pathetic. And it's very annoying for me because I have two servers that I need to consider migrating off of it now because Ubuntu clearly doesn't care all that much about security vulnerabilities like this. Get your shit together, Canonical. We all know you can do way, way better than this.
baggy_trough 6 hours ago|
Debian is already on 6.12.115, the stable kernel from 3 days ago. Who knows what horrors were fixed?
More comments...