Earlier quoted context omitted.
How so?
[deleted]
[deleted]
Maybe you shouldn't install new software for a bit
21–30 of 497 posts
Re: Maybe you shouldn't install new software for a bit
#22There's already an okay solution to supply-chain attacks against dependency managers like npm, PyPI, and Cargo: set them to only install package versions that are more than a few days old. The recent high-profile attacks were all caught and rolled back within a day, so doing this would have let you safely avoid the attacks. It really should be the default behavior. Let self-selected beta testers and security scanner…
More a case for something like this from Show HN three months ago
https://github.com/artifact-keeper
An artifact manager. Only get what you approve. So you can get fast updates when needed and consistently known stable when you need it. Does need a little config override - easy work.
I had my own janky tooling for something like it. This is a good project.
Re: Maybe you shouldn't install new software for a bit
#23Re: Maybe you shouldn't install new software for a bit
#24Fedora upgrades have usually been great, but I jumped the gun on Fedora 44. Sound completely dead with no Pipewire service available. ALSA not responding. Firefox dies immediately if I open a new tab or right click anywhere on the browser itself (inlcuding nightly builds). QEMU refuses to load. Maybe something got completely f'd in the upgrade process.. I never had an issue before having upgraded from Fedora 38 all t…
I have had none of those issues on Fedora 44, FWIW.
Re: Maybe you shouldn't install new software for a bit
#25I do a bit wonder what happens as standard practice becomes to lag more and more and more. Who is there left that's looking, that'd finding out?
Re: Maybe you shouldn't install new software for a bit
#26Earlier quoted context omitted.
The dirty frag repo says: > Because the responsible disclosure schedule and the embargo have been broken, no patch exists for any distribution. I had to do a double take reading that. It’s written something happened and prevented them from following a schedule but seemingly they chose to release the information. I hope I’m missing something where it was forcibly disclosed elsewhere. Edit: Moments later I refreshed th…
> Due to external factors, the embargo has been broken, so no patch exists for any distribution. Very odd wording. I assume there’s an interesting/upsetting story here that will come out soon.
Re: Maybe you shouldn't install new software for a bit
#27Fedora upgrades have usually been great, but I jumped the gun on Fedora 44. Sound completely dead with no Pipewire service available. ALSA not responding. Firefox dies immediately if I open a new tab or right click anywhere on the browser itself (inlcuding nightly builds). QEMU refuses to load. Maybe something got completely f'd in the upgrade process.. I never had an issue before having upgraded from Fedora 38 all t…
I had a day 1 crashloop with KWin on the 2nd desktop, but on day 2 some package update fixed it. Honestly it isn't the first time Fedora upgrades have messed something up for me either but I do think it's more stable than the average Ubuntu release, not that I've upgraded ubuntu in like 5 yrs.
Re: Maybe you shouldn't install new software for a bit
#28For the newer players who have gotten into continuous integration and containerized builds, consider checking on your systems to be sure you're not pulling 'latest' across a bunch of packages with every build.
We set up our base containers with all the external dependencies already in them and then only update those explicitly when we decide it's time.
This means we might be a bit behind the bleeding edge, but we're also taking on a lot less risk with random supply chain vulns getting instant global distribution.
Re: Maybe you shouldn't install new software for a bit
#29For the newer players who have gotten into continuous integration and containerized builds, consider checking on your systems to be sure you're not pulling 'latest' across a bunch of packages with every build. We set up our base containers with all the external dependencies already in them and then only update those explicitly when we decide it's time. This means we might be a bit behind the bleeding edge, but we're…
You'll also find your CI build times and flakey failures can be cut down massively by doing this.
Re: Maybe you shouldn't install new software for a bit
#30Alternatively, switch to an operating system like FreeBSD which doesn't take a YOLO approach to security. Security fixes don't just get tossed into the FreeBSD kernel without coordination; they go through the FreeBSD security team and we have binary updates (via FreeBSD Update, and via pkgbase for 15.0-RELEASE) published within a couple minutes of the patches hitting the src tree. (Roughly speaking, a few seconds for…
Also funny they never show Debian in those tests/videos.
Debian is probably the best of all the Linuxes, but still suffers from split-brain: If patches are sent upstream first, Debian can't start digesting them until they're already public.
With FreeBSD there's never any question of "who should this get reported to".