warthog9

@corbet@social.kernel.org @lwn@fedi.lwn.net if you need more capacity, give a shout, I've a bit i can throw to the cause if you need it

@funkylab@mastodon.social It feels epicly sus that I tripped over it 6 months on only because Paypal was complaining they couldn't send me an e-mail. I also can't replicate it so something is very off somewhere, and I'm not convinced it's on my side.

@gregkh@social.kernel.org @argv_minus_one@mastodon.sdf.org won't disagree in the slightest on that front, and I'm not laying my grumbles at the kernel communities feet here. The kernel security team did it's job, there's a fix, no issue there. Where I'm grumbling is it looks like the public disclosure happened before the distros were aware, and in such a way that there was even a chance at a fix out for people to actually update to. While I would love to have folks be able to go, compile their own kernel and get to mainline to pick up the fix, the reality in a lot of deployments means you can't, even in some of the deployments I've got to handle these days we can't just because of other driver mess issues (that's a whole different can of worms worthy of much void screaming, but I'm not going to do that here right now). Debian and Ubuntu look like they have a minor up side they left the code as modules, reject loading the modules and you can steer clear of this right now. EL / Fedora, look like they picked the option to compile it straight in and are kinda up a creek right now. Fedora will likely be sorted quite shortly, but that's because they track mainline a lot closer. EL, only good option there is to flip to elrepo and go mainline there assuming you don't have other messes to deal with. Mostly the grumble is laid at the feet of the finder wanting to publicize it seemingly as quickly as they did, some of the distros for dragging their feet and/or ignoring these things the way they tend to, and for at least not vaguely giving the distros a chance to go "ohhh poop", and have fixes in place once it was public (again that's more laid back at the publicized situation vs. not). Right now there's a lot of scramble for a bunch of folks, and not a lot of ways to get to a fix, and that's where I'm grumbling from (though I haven't had enough coffee / tea yet this morning to go find how far that's moved overnight, so bear with me if they've all miraculously pulled a fast one and everyone has a fix out for everyone)

@ehashman@cloudisland.nz twitch

@ehashman@cloudisland.nz pretty bad, and disclosure looks like it sucked so we aren't far from calling it a 0-day

@argv_minus_one@mastodon.sdf.org nevermind, I need to go remind myself why I don't drink: root@erebor:/var/log# modinfo algif_aead name: algif_aead filename: (builtin) description: AEAD kernel crypto API user space interface author: Stephan Mueller license: GPL file: crypto/algif_aead root@erebor:/var/log#

@argv_minus_one@mastodon.sdf.org I was just commenting something similar that the advisory seems to be wackadoodle in another venue. I'd argue this not having a broader security push before the public release happened, is a pretty serious failure on someone's part. I'm back-tracking if ELs are even at risk, because I can't find the module but I haven't confirmed if it's just compiled in and not a module now 😕 (I've seen notes they are, I just want to confirm before I just table flip and move to elrepo's mainline kernels to get around this)

@mwl@io.mwl.io I feel this in my bones

@CursedSilicon@social.restless.systems @kwf@social.afront.org that would be on you, we won't get involved till they've got their house back in order and capable of dealing with what we need.

@kwf@social.afront.org @CursedSilicon@social.restless.systems at the end of the day we are volunteering our time and energy. There's a threshold for what we can/want to fix, and what we can't. Specific to Gentoo we reached out, tried, it didn't work as it's not a good fit for the model we are running and how they are/aren't working.

@CursedSilicon@social.restless.systems @kwf@social.afront.org several entities, Ziply being one, there's a new one run by another entity within the past week too

@CursedSilicon@social.restless.systems @kwf@social.afront.org it's one of the bigger faster ones. I'm not sad about my connectivity to it 😜

@CursedSilicon@social.restless.systems @kwf@social.afront.org Gentoo fell into the FAQ: http://mirrors.fcix.net/faq/