Head to https://squarespace.com/thelinuxexperiment to save 10% off your first purchase of a website or domain using code thelinuxexperiment Grab a brand new laptop or desktop running Linux: https:/...
I don’t know if a fork is needed with a new org surrounding it that focuses 100% on the kernel, or if something else has to happen, but the Linux foundation wasting money on shit like AI and endorsing Chromium sounds an awful lot like Mozilla. Mozilla lost its way a long time ago and the Linux Foundation might be going the same way too.
I agree the Linux kernel is just fine. But that’s only because despite the security risks of C, there’s no viable alternative kernel.
But development doesn’t stand still, so either Linux catches up, or gets replaced when a viable alternative arrives. Thankfully Linus sees the problem, so they’re working to make the kernel viable a while longer, but I also agree with the person you replied to that this work could definitely use a bit more help.
There are no security risks with C when you write good code. The reason we are seeing a lot of security vulnerabilities is because prior to about 10 years ago security wasn’t considered that important.
I’m not saying Rust is bad. (It is generally good) The thing to remember is that Rust also can have security issues. What we need is skilled programmers who understand security.
Sorry, but this mindset is hurting both Linux and security in general.
The reason we are seeing a lot of security vulnerabilities is because prior to about 10 years ago security wasn’t considered that important.
This is frankly quite obviously false. Microsoft started taking security more seriously around the release of Windows 2000. Are you saying the Linux kernel developers took another 15 years to realize security is important?
Security research shows that new code is more prone to common vulnerabilities than old code is. While old code may have been designed with weak (or no) security considerations, those are well-mitigated by now. On the contrary, new code still regularly contains exploitable memory safety issues that slip by review.
What we need is skilled programmers who understand security.
We have skilled programmers who understand security. Those also understand that we need more than that.
Continuing to use C doesn’t merely require skilled programmers, it requires programmers that never make any mistake ever. That’s an infeasible standard for any human to uphold, hence why C is considered a risk.
@arendjr@possiblylinux127 eh, in reality, The reason we are seeing a lot of security vulnerabilities is because:
A: it is the most used OS in the world, hackers & pirates… have 100 reasons to pirate winlol, for example imagine having 1 B$ worth of games on your storage drive, everyone would be killing to even have a sniff
B: it gives the feeling of the thrill of challenge when you decide to tweak, because it is close-sourced so it by default enables a few tweaks, all can be corrected
I had a look at NetBSD and FreeBSD: I don’t think they are in a better position than linux honestly. NetBSD still uses CVS and mailinglists for contributing.
An addition or change to the existing source code is a somewhat trickier affair and depends a lot on how far out of date you are with the current state of FreeBSD development.
Both might be even be worse than linux in terms of ease of contributions…
Fuck dude, we need an alternative to the Linux Foundation that actually focuses on Linux itself, not every single project that somehow runs on Linux. The linux kernel is a pain to join as a newbie, it’s underfunded (2% of all the Linux Foundation’s funding goes to the Linux kernel), the development cycle and tooling is outdated, the major language © is a security risk, the maintainers are turning old and gray which brings with it the typical resistance against change, and so many other things.
I don’t know if a fork is needed with a new org surrounding it that focuses 100% on the kernel, or if something else has to happen, but the Linux foundation wasting money on shit like AI and endorsing Chromium sounds an awful lot like Mozilla. Mozilla lost its way a long time ago and the Linux Foundation might be going the same way too.
Anti Commercial-AI license
The Linux kernel is just fine. C is in fact not a “security risk” and the tooling works fine for what it is.
I agree the Linux kernel is just fine. But that’s only because despite the security risks of C, there’s no viable alternative kernel.
But development doesn’t stand still, so either Linux catches up, or gets replaced when a viable alternative arrives. Thankfully Linus sees the problem, so they’re working to make the kernel viable a while longer, but I also agree with the person you replied to that this work could definitely use a bit more help.
There are no security risks with C when you write good code. The reason we are seeing a lot of security vulnerabilities is because prior to about 10 years ago security wasn’t considered that important.
I’m not saying Rust is bad. (It is generally good) The thing to remember is that Rust also can have security issues. What we need is skilled programmers who understand security.
Sorry, but this mindset is hurting both Linux and security in general.
This is frankly quite obviously false. Microsoft started taking security more seriously around the release of Windows 2000. Are you saying the Linux kernel developers took another 15 years to realize security is important?
Security research shows that new code is more prone to common vulnerabilities than old code is. While old code may have been designed with weak (or no) security considerations, those are well-mitigated by now. On the contrary, new code still regularly contains exploitable memory safety issues that slip by review.
We have skilled programmers who understand security. Those also understand that we need more than that.
Continuing to use C doesn’t merely require skilled programmers, it requires programmers that never make any mistake ever. That’s an infeasible standard for any human to uphold, hence why C is considered a risk.
@arendjr @possiblylinux127 eh, in reality, The reason we are seeing a lot of security vulnerabilities is because:
A: it is the most used OS in the world, hackers & pirates… have 100 reasons to pirate winlol, for example imagine having 1 B$ worth of games on your storage drive, everyone would be killing to even have a sniff
B: it gives the feeling of the thrill of challenge when you decide to tweak, because it is close-sourced so it by default enables a few tweaks, all can be corrected
The corporitization of linux continues. I jumped to BSD. Just linux at work now.
Is BSD moving to Rust and can one contribute with something else than a mailing list?
Anti Commercial-AI license
Good questions. I don’t know, but it’s unlikely that Rust will be included in the base system anytime soon. It is of course available as a package.
I had a look at NetBSD and FreeBSD: I don’t think they are in a better position than linux honestly. NetBSD still uses CVS and mailinglists for contributing.
NetBSD even starts with this
Both might be even be worse than linux in terms of ease of contributions…
Anti Commercial-AI license
Can’t argue with that.