Soviet Pigeon

Sounds like a discussion about if someone likes apples or pears

It’s the misleading exclamation mark. If I see this picture, my impression is that kitty works only with issues on Linux

Of course. I’m not happy about many things, but that doesn’t give me the right to harass somebody.

They are not being harassed, but are being shown in this way that their intentions and behavior are more than just shit

Pointing out something politely is very different from jumping on a bandwagon and spamming an issue, or creating meme issues and meme pull requests. We should be better than that.

Is that really what we want? Anything slightly popular making a misstep to be hounded by an online mob?

This is not a misstep. They just don’t want to hire developers for Winamp and rather try to outsource the work to others for no cost. And then they call it copyleft while forbidding anyone to do anything else with the source code except sending them pull requests. That’s disrespectful, rude and simply shameless. This is fully calculated, not a misstep. If it was just a misstep, then I would agree with you about these meme pull requests and so on. Saying this, I absolutely understand why the receive such “feedback”.

This whole thing sounds more like a way to get some pull requests to fix their product for free. That’s not open source. The source code is simply available, that’s all. In the first run they even prohibited to fork it (!!!) while it is necessary to work on this project. They may fixed it, but you are still not allowed to do anything with it, only provide free work. Of course people are not happy with it.

They should delete this repo and change their license if they want contributors for free. Or just hire programmers for money.

Every bugfix is a CVE. Even if it is maybe not a security problem in first place, but it might be one in the kernel context, so everything is a CVE. Also other CVEs from other applications, open source or not, doesn’t have to mean that much. You have to see those database quite critical. Especially if you need very esoteric, almost magical methods to exploit.

When the people of the Linux Kernel started flooding them, because every bug is a security problem, those Database providers were and are very happy. It makes good money, those data is seller from other providers to companies. And now you really have to use their service, because the kernel have soooooooo many security problems! It is not like developers or security teams are happy about this shit. But if the senior leaders insist on use those CVEs, you don’t have any choice. And it is not that unusual, that it is not needed to address them.

The Linux Kernel can provide and provides more security when you use them. It is the decision of the distribution if they want to enable selinux or apparmor, enable kernel options, which make your system more hardened with memory encryption, page poison or kernel lock down and and and. Since this is only the kernel, the userland can provide more features, which some distributions also enables.

The way you can elevate applications and define special rights for the usage of devices or OS functions, is incomparable to standard Windows. Would only user, group and rwx exist, they wouldn’t be any lxc, podman, docker or whatever today. Windows does not the same now. Windows does it different and can’t do some things regarding elevation of rights and their restriction by design.

Linux Kernel provides more security techniques than Windows indeed, but they need to be used. To point out CVEs is kind of stupid. The Linux kernel never commited any entries to the CVE database for years, they started since February 2024 doing so, because they gave up on their opposition. They warned, if they do this now, the databases will get flooded with CVEs. Because in the kernel context, every bug counts as a security problem, if you look at it from the right perspective. This is a difference to Windows CVEs.

Of course this is great for those CVEs database providers because they now can sell their stuff happily.

What you need are not CVE entries for the Linux Kernel, but the latest supported Linux Kernel installed.

And srsly: Antivirus is snake oil. Using software with Administrator rights in Windows or even Linux, which parses every file, is fucking dangerous. It is usable on a mailserver, where the antivirus process is containerised or virtualized.

And what is the point with firewalls I read here? The most distros have firewalls enabled. When were they not there? Iptables was always there and I had to configure it, so I could allow or disallow incoming traffic. I almost never had to install it manually.

Edit:

Regarding CVEs, here the what Linux CNA tells:

Note, due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team.

Source

Any bugfix is a CVE

I did it few times between 2008 and 2010 when I was way younger. Idk how I did it, but after two times I was used to it and learned also a lot. Today I don’t have the nerves to install arch without archinstall or anarchy. The wiki helped me a lot. The wiki gives an excellent guide to install arch and to set up everything you need. It is well written enough, that no deep Linux knowledge is needed

The archlinux wiki is great for everything. I used it when I had Fedora, Debian or sometimes if I used OpenBSD.

To fully grasp how containers actually work, you should read the Linux kernel documentation on namespaces and permission control via capabilities.

Hmm, I thought the aspect of demystification would also include a brief explanation on, how namespaces and capabilities work.

It’s not security debt, it’s just general technical debt.

I would also say, that this is just technical debt. I also fully understand, that there are things like breaking changes. I remember clearly when we used asyncore in the past for Python at work and then it became deprecated. It was still possible to use it for a long time, but a change was needed. Such breaking changes caused work and are not nice. Especially if it is a big software.

On the other side, I am not happy if I buy software or hardware, which has probably insecure dependencies. I understand the developers, I am also one, and I know that many things are not under their control. I am also not blaming them. But it is a no-go if something new is sold with 10-year-old OpenSSH Server, 15-year-old curl or other things.

But I am not taking exotic vulnerabilities that seriously. Like, if you need specific constellations, so this is somehow hackable.