Aggregator

Ancient Slashdot reader alanw shares a post from the OSS Security mailing list, where sysadmin Jan Schaumann wonders what to do after the Linux kernel cranked out 432 CVEs in a little over 24 hours: "I understand the position that CVEs were always a flawed way to track or prioritize security changes... But this onslaught really shows it's not feasible to attempt to prioritize individual kernel changes. I'm not sure what to do here going forward." The Register reports: The nixCraft team speculated on social media that AI bug reports are a likely reason for all those kernel CVEs, which wouldn't be without precedent - Linus Torvalds himself said in May that the Linux kernel security mailing list had become "almost entirely unmanageable" due to AI-assisted bug hunting. Nonetheless, Torvalds has described AI as a useful tool for Linux development while still noting it can be a drag for maintainers, both from a workload standpoint and the fact "it keeps finding embarrassing bugs." [...] Unfortunately for Linux sysadmins, the position in which they find themselves in this current mess isn't one that's readily solved. CVEs might be a messy way to track and prioritize security updates, especially when hundreds of them are published over a short period, but without something better, it falls to IT and security teams to determine which vulnerabilities affect their systems and which kernel updates they need to deploy. Senior kernel maintainer Greg Kroah-Hartman replied to Jan's post, pushing back on the idea that the kernel's CVE volume is uniquely unmanageable. The kernel isn't special, he argues -- companies everywhere are finally realizing they need to re-evaluate how they update all of their systems and devices, something that's traditionally been "woefully ignored." On the "just always update" approach, Greg says that's precisely what the kernel community endorses: "This is what the kernel developer community recommends and supports. If you want support from us, do this." Can't manage it yourself? Pay a company for support, or "just use Debian or Yocto as their security practices are amazing." He points to Android as proof the approach scales, calling it "the largest deployment of software in the world" -- billions of devices kept updated "with one very-overworked developer guiding it all." As for reviewing every CVE individually, he notes this can be largely automated by intersecting the files a CVE touches with the files you actually build, which typically trims the relevant set "down to about 10% of the overall total" -- the approach enterprise distros already take for their customers. Panic-mode selective patching gets a blunt "Good luck with that!" -- regulations like the EU's Cyber Resilience Act are set to legislate that habit away ("rightfully so," in his view), and "your insurance company might wish to have a talk with you as well." Greg also warns the flood isn't over: "The number of llm-found issues is only on the rise right now, it's going to be a very long 18 months at the least to dig ourselves out of this mess, and people had BETTER be updating their systems all along the way if they expect to be secure in any way." As for the 432-CVE burst itself, he explains it was simply him catching up on a weeks-old, publicly visible review queue over the weekend -- delayed by "a perfect storm of 6 weeks straight of conferences and vacations" -- so it shouldn't have come as a surprise to anyone watching the public git repo.

Read more of this story at Slashdot.

Tragic child star Kaylee Hottle's cause of death has been revealed - shortly after harrowing new photos emerged of the aftermath of her fatal car crash on Tuesday.

The excavation team in Tuam, County Galway, which began its painstaking work in July last year, has recovered a total of 99 bodies.

Darts star Cameron Menzies was helped off stage after falling unwell during the World Matchplay Darts.

The content creator had reportedly been undergoing cosmetic surgery on Tuesday morning when she suffered complications.

Paula Budin, 72, a former elementary school teacher, was struck and killed by a pole in 2024 while walking on a high school track.

When pondering the functions of a cone, there are many: roadworks, football drills, illuminating pathways. To play with is typically not one of them - especially when it ends up on your head.

Jade Thirlwall and her ex-boyfriend Jordan Stephens are said to have started having issues 'a few months ago' and started having frank relationship discussions.

ScreenWall's creator tells El Reg he doesn't want those obsolete devices going to waste

Prince Abdullah bin Fahad bin Abdullah bin Abdulaziz bin Jalawi al Saud, 29, was discovered fully clothed on the bathroom floor of his £600-a-night room at the Marriott Hotel in Kensington.

Apple is reportedly launching a Klarna financing deal that will let U.S. customers spread the cost of devices over up to three years, pushing the company closer to a hardware-as-a-service model. "The only thing you don't get under the new arrangement is AppleCare, for which you'll allegedly need to pay extra," notes Computerworld. From the report: The introduction of the scheme gives consumers a way to purchase the company's popular high-end devices when they are introduced -- no doubt,at higher cost -- this fall. [...] A combination of changed customer habits and external threat means the stars are now aligned for hardware-as-a-service models. "Reframing a device as a low monthly payment protects that [upgrade] cadence and allows Apple to start marketing their products as device-as-a-service to consumers, which no other vendor was ever able to do," [IDC analyst Francisco Jeronimo] wrote to me. There is a one-more-thing aspect to this: the products are effectively being leased, a new approach that will give Apple a stronger grip on EOL devices, helping it grab more of them for refurbishment, resale, and recycling. Over time, this will give the company a much stronger grip on the lucrative second-user market that exists around Apple equipment, even while for almost every consumer product we find the life we want is something we can rent, but probably can't afford to own. The other solid reason to take a partnership approach is risk management. Apple had intended to develop its own buy-now, pay-later scheme via Apple Pay Later, but abandoned that plan as it became riskier with rising bank rates. "Also, by backing the program with Klarna rather than reviving the in-house subscription plan it shelved in 2024, Apple captures the demand upside without taking the credit risk onto its own balance sheet," Jeronimo said. "Apple Upgrade lands at precisely the moment Apple needs it," Jeronimo wrote in a note seen by Computerworld. "Having just pushed Mac and iPad prices up on the back of the memory shortage, with iPhone increases widely expected in September -- as well as the new iPhone foldable expected at $2,500 -- Apple's real risk is that rising prices even further can impact the upgrade cycle."

Read more of this story at Slashdot.

Daily Mail Sport expect Eckert, who has seven days to respond, not to contest the charge after accepting culpability while openly cooperating with the FA's thorough interview process.

Lissie Harper said the support she received from politicians in the wake of her husband's death felt 'forgotten' after it emerged two of her husband PC Andrew Harper's killers may be released from jail.

As Trump dismantles the US-led world order, what the rest of the world really needs is sovereign apps and datacenters, argues 'enshittification' coiner

The network first introduced formal aftercare policies in 2019 following the tragic deaths of past contestants Sophie Gradon and Mike Thalassitis.

Nicolas Maduro, 63, and his wife, Cilia Flores, 69, appeared before a judge at the federal court in Manhattan on Wednesday in their drug trafficking case.

Ryley Hutson, 16, was pronounced dead at the scene in Bramcote, Nottinghamshire after an incident involving an electric bike and two cars.

The MP for Walthamstow posted a video with the caption: 'Have you lost a parrot in Walthamstow? Please share!', commenting that the bird was 'too big to be a parakeet'.

Christopher and Kayleigh Coll were found dead in their campervan having succumbed to fumes released by the gas heater which they switched on before bed in chilly October temperatures.