Maybe you shouldn't install new software for a bit
1–10 of 497 posts
Re: Maybe you shouldn't install new software for a bit
#2[flagged]
Re: Maybe you shouldn't install new software for a bit
#3Yes, and, for non-personal machines or anything connected to the internet: now is a great time to get good at rolling out patches and new releases quickly.
Re: Maybe you shouldn't install new software for a bit
#4[flagged]
? This is related to a vulnerability that was introduced to the Linux kernel in 2017.
Re: Maybe you shouldn't install new software for a bit
#5Fun fact: You still can't build the vllm container with updated dependencies since llmlite got pwned. Either due to regression bugs, or due to impossible transient dependencies in the dependency tree that are not resolvable. There is just too much slopcode down the line, and too many dependencies relying on pinned outdated (and unpublished) dependencies.
I switched to llama.cpp because of that.
To me it feels more and more that the slopcode world is the opposite philosophy of reproducible builds. It's like the anti methodology of how to work in that regard.
Before, everyone was publishing breaking changes in subminor packages because nobody adhered to any API versioning system standards. Now it's every commit that can break things. That is not an improvement.
Re: Maybe you shouldn't install new software for a bit
#6the lottery of either getting a new supply-chain attack or the fixes from Mythos with every single update
Re: Maybe you shouldn't install new software for a bit
#7It really pisses me off that responsible disclosure timelines are being ignored.
Re: Maybe you shouldn't install new software for a bit
#8It really pisses me off that responsible disclosure timelines are being ignored.
The dirty frag repo says:
> Because the responsible disclosure schedule and the embargo have been broken, no patch exists for any distribution.
I had to do a double take reading that. It’s written something happened and prevented them from following a schedule but seemingly they chose to release the information. I hope I’m missing something where it was forcibly disclosed elsewhere.
Edit: Moments later I refreshed the homepage and saw the announcement. They do claim to have consulted with maintainers
Re: Maybe you shouldn't install new software for a bit
#9[flagged]
What?
Re: Maybe you shouldn't install new software for a bit
#10It really pisses me off that responsible disclosure timelines are being ignored.
if you don't already consider responsible disclosure a quaint idea, you may want to grow warm on it
the idea that it exists at all is more or less a gentleman's agreement in the engineering world anyway