Remote

Tomas Vondra

@tomasv@fosstodon.org

mastodon 4.7.3

bug developer, technical debt contributor

217 Followers

90 Following

9 Posts

Joined November 08, 2022

blog:

https://vondra.me

e-mail:

tomas@vondra.me

github:

https://github.com/tvondra

codeberg:

https://codeberg.org/tvondra

Tomas Vondra @tomasv@fosstodon.org

· 5mo ago

Replying to

@AndresFreundTec @thesamesam @mgorny I think the bigger issue is the strange definition of what "LTS" means, and what people assume it to mean. Because from the descriptions I found, LTS means "actively maintained and provided with security updates" but it seems it means "some security updates, maybe". Which is not great, I guess? FWIW I understand the number of fixed issues is likely overwhelming. But then maybe not having LTS kernels would be better ...

Tomas Vondra @tomasv@fosstodon.org

· 5mo ago

The #Postgres open source project is 30 this year. To mark the occasion, we're preparing a slideshow with photos from the past and present of the project - events, funny and interesting photos. We plan to present it at pgconfd.dev in Vancouver (~1 month from now), and then also publish it on the web.

If you have taken such photos, or if you know where we could find them, we'd like to know! Feel free to ping me here, shoot me an e-mail, or something.

#Postgres #PostgreSQL #pgconfdev

fosstodon.org

Tomas Vondra @tomasv@fosstodon.org

· 5mo ago

Replying to

@thesamesam @AndresFreundTec @mgorny That's fair, I guess. Still, what fraction of the fixes has that? Likely a minority, I'd guess? In that case, wouldn't it be more prudent to assume one of the other issues is bad enough to upgrade?

Tomas Vondra @tomasv@fosstodon.org

· 30mo ago

Replying to

@AndresFreundTec OMG, I read that report earlier today and completely missed it's from you. Something tells me this is not the only backdoor that person injected into seemingly boring packages ... fun fun fun.

Tomas Vondra @tomasv@fosstodon.org

· 5mo ago

Replying to

@aho@ioc.exchange @lwn@fedi.lwn.net I don't think so, or at least I'm not aware of a fix. But I also think the workload showing the regression is extremely artificial, and you'll not see the regression for anything remotely realistic.

Tomas Vondra @tomasv@fosstodon.org

· 5mo ago

Replying to

@AndresFreundTec @thesamesam @mgorny True, but I'm afraid it's not practical. Someone needs to make those assessments, it's hard to determine the impact, and it's likely very time consuming. Even before the current onslaught of reports. I'd imagine this is why NIST recently gave up on enriching the CVEs.

Tomas Vondra @tomasv@fosstodon.org

· 6mo ago

Replying to

@ascherbaum @alex Yeah. I wonder what packages are being used?

Tomas Vondra @tomasv@fosstodon.org

· 6mo ago

Replying to

@db_geek @alex No, dump/restore is not required. pg_upgrade exists for a long time.