GNU social JP
  • FAQ
  • Login
GNU social JPは日本のGNU socialサーバーです。
Usage/ToS/admin/test/Pleroma FE

  • Public

    • Public
    • Network
    • Groups
    • Featured
    • Popular
    • People

Notices by Greg K-H (gregkh@social.kernel.org)

  1. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Monday, 04-May-2026 02:54:54 JST Greg K-H Greg K-H
    in reply to
    • Viss
    • Josh Bressers
    • Will Dormann
    @wdormann @joshbressers @Viss I love it how people think that "coordination of vulnerabilities" is actually something that can be done these days. Think of just who uses the software in question, and who should, and should not, be on such a list to get a "early disclosure notification".

    As I have said for quite some time now, all early-disclosure lists are leaks, otherwise why would your government allow them to be in existence?

    Software, and specifically open source software, runs the world. So should the whole world be on that notification list? :)
    In conversation about 5 months ago from social.kernel.org permalink
  2. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Saturday, 28-Mar-2026 02:48:57 JST Greg K-H Greg K-H
    in reply to
    • hanno
    @hanno It is real, see my interview in the Register today about this very problem: https://www.theregister.com/2026/03/26/greg_kroahhartman_ai_kernel/
    In conversation about 7 months ago from social.kernel.org permalink

    Attachments

    1. Domain not in remote thumbnail source whitelist: regmedia.co.uk
      Linux kernel czar says AI bug reports aren't slop anymore
      Interview: Greg Kroah-Hartman can't explain the inflection point, but it's not slowing down or going away
  3. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Tuesday, 10-Feb-2026 07:02:32 JST Greg K-H Greg K-H
    in reply to
    • Greg K-H
    Curiosity got the best of me, and I clicked on the links and this just looks like an OpenAI "sales funnel", which is pretty hilarious when you consider the target was open source security teams, none of which could ever fill out these types of forms without flat out lying.
    In conversation about 8 months ago from social.kernel.org permalink

    Attachments


    1. https://media.social.kernel.org/media/f7f1abceeee80be2c20f2cc9c7627bcfaabf0cd7d633943e8398eda9b01c928c.png

    2. https://media.social.kernel.org/media/7fce90303bcec67754efdbbde3311f5ec0aac638079e73574bcd53b1850b1b72.png

    3. https://media.social.kernel.org/media/8e039ceb12737a0bbcf847b9750c843ac69bad208a4e2004499d798746f609e8.png

    4. https://media.social.kernel.org/media/5141ce257a441147e7b26ae6ca74ab6308c9cc97f4334d4852ffd6a40b112a05.png
  4. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Tuesday, 10-Feb-2026 07:01:56 JST Greg K-H Greg K-H
    Looks like the AI companies have finally run out of money as they are asking various open source projects to test their closed source products for them for free. What could go wrong with giving access to an unknown tool to private code repos?

    If I didn't know better, I would think this is an elaborate phishing scam, or they have run out of data to scrape and need more training material.

    Gotta admire their brazenness...
    In conversation about 8 months ago from social.kernel.org permalink

    Attachments


    1. https://media.social.kernel.org/media/84807b046eac8f56458134f8cb702bb885ab16f63dcba00cc758701a35e79ac7.jpg
  5. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Friday, 30-Jan-2026 18:28:10 JST Greg K-H Greg K-H
    Prediction for the potential future:

    When the AI coding agent companies are just about to run out of money, down to their last few % raised as none of their customers are actually paying the real cost required to run these services, they pivot and take all of the uploaded code that was willingly sent to them, turn it into thousands of products / services to sell / rent, disconnect the public api endpoints leaving their old customers helpless as they no longer remember how to program "in the raw" and can not understand their own codebases, and compete directly against them putting their own customers all out of business which finally results in a positive income stream and "validation" of the coding agent companies previously over-hyped business valuations.

    "But copyright law will prevent this!" you say...
    In conversation about 9 months ago from social.kernel.org permalink
  6. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Thursday, 18-Dec-2025 05:26:01 JST Greg K-H Greg K-H
    Rust is is not a "silver bullet" that can solve all security problems, but it sure helps out a lot and will cut out huge swatches of Linux kernel vulnerabilities as it gets used more widely in our codebase.

    That being said, we just assigned our first CVE for some Rust code in the kernel: https://lore.kernel.org/all/2025121614-CVE-2025-68260-558d@gregkh/ where the offending issue just causes a crash, not the ability to take advantage of the memory corruption, a much better thing overall.

    Note the other 159 kernel CVEs issued today for fixes in the C portion of the codebase, so as always, everyone should be upgrading to newer kernels to remain secure overall.
    In conversation about 10 months ago from social.kernel.org permalink

    Attachments

    1. No result found on File_thumbnail lookup.
      CVE-2025-68260: rust_binder: fix race condition on death_list - Greg Kroah-Hartman
  7. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Tuesday, 09-Dec-2025 13:53:32 JST Greg K-H Greg K-H
    Starting to write up a series of articles about the Linux kernel CVE work that has happened in the past 2 years, starting with some "back to basics" information about how Linux kernels are numbered as many people/companies really don't know how we do this, and it matters a lot in tracking bugfixes and how to determine "vulnerable" and "fixed" kernel releases:
    http://www.kroah.com/log/blog/2025/12/08/linux-cves-more-than-you-ever-wanted-to-know/
    and
    http://www.kroah.com/log/blog/2025/12/09/linux-kernel-version-numbers/
    In conversation about 10 months ago from social.kernel.org permalink

    Attachments

    1. Domain not in remote thumbnail source whitelist: www.kroah.com
      Linux CVEs, more than you ever wanted to know
      from Greg K-H
      It’s been almost 2 full years since Linux became a CNA (Certificate Numbering Authority) which meant that we (i.e. the kernel.org community) are now responsible for issuing all CVEs for the Linux kernel. During this time, we’ve become one of the largest creators of CVEs by quantity, going from nothing to number 3 in 2024 to number 1 in 2025. Naturally, this has caused some questions about how we are both doing all of this work, and how people can keep track of it.
    2. Domain not in remote thumbnail source whitelist: www.kroah.com
      Linux kernel version numbers
      from Greg K-H
      Despite having a stable release model and cadence since December 2003, Linux kernel version numbers seem to baffle and confuse those that run across them, causing numerous groups to mistakenly make versioning statements that are flat out false. So let’s go into how this all works in detail.
  8. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Wednesday, 03-Dec-2025 22:01:37 JST Greg K-H Greg K-H
    The last 5.4.y kernel release has now happened: https://lore.kernel.org/all/2025120319-blip-grime-93e8@gregkh/

    Please don't use this branch anymore, it's really old, and pretty obsolete, and has over 1500 unfixed CVEs in it:
    https://lore.kernel.org/all/2025120358-skating-outage-7c61@gregkh/

    And if you are stuck with that kernel version for some reason, go ask your vendor to fix those 1500+ CVEs, otherwise you are paying for support that doesn't actually do anything for you...
    In conversation about 10 months ago from social.kernel.org permalink

    Attachments

    1. No result found on File_thumbnail lookup.
      Linux 5.4.302 - Greg Kroah-Hartman
    2. No result found on File_thumbnail lookup.
      Re: Linux 5.4.302 - Greg Kroah-Hartman
  9. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Monday, 01-Dec-2025 20:21:55 JST Greg K-H Greg K-H
    As pointed out on an irc channel, yet another example of kernel developers having to do crazy things to paper over hardware bugs: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f076ef44a44d02ed91543f820c14c2c7dff53716
    In conversation about 11 months ago from social.kernel.org permalink

    Attachments

    1. Domain not in remote thumbnail source whitelist: git.kernel.org
      rtc: rk808: Compensate for Rockchip calendar deviation on November 31st - kernel/git/torvalds/linux.git - Linux kernel source tree
  10. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Sunday, 09-Nov-2025 10:44:11 JST Greg K-H Greg K-H
    As seen in the Seoul Lablup office (https://www.lablup.com/) when visiting the other day right before the OSS Korea conference. Many thanks to them for the good conversations, and food and beer!
    In conversation about a year ago from social.kernel.org permalink

    Attachments


    1. https://media.social.kernel.org/media/a3407eeb5c895d1c5cd2021b1cc8588df964d85779c1efbf7fcbd4dd79fd7e64.jpg
    2. Domain not in remote thumbnail source whitelist: cdn.lablup.com
      Lablup Home Page
      from Lablup Inc.
      Lablup Inc.: Make AI Accessible
  11. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Thursday, 02-Oct-2025 18:45:50 JST Greg K-H Greg K-H
    in reply to
    • Natanael Copa
    @ncopa You do NOT want to see the kcbench results for the riscv system I have here, it's so sad it's not even funny. So sad I haven't even powered it on in a few months, it's pretty much useless :(
    In conversation about a year ago from social.kernel.org permalink
  12. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Thursday, 02-Oct-2025 06:15:42 JST Greg K-H Greg K-H
    Benchmarking the different machines in my office with the wonderful kcbench: http://www.kroah.com/log/blog/2025/10/01/the-only-benchmark-that-matters-is.../
    In conversation about a year ago from social.kernel.org permalink

    Attachments

    1. Domain not in remote thumbnail source whitelist: www.kroah.com
      The only benchmark that matters is...
      from Greg K-H
      …the one that emulates your real workload. And for me (and probably many of you reading this), that would be “build a kernel as fast as possible.” And for that, I recommend the simple kcbench. I kcbench mentioned it a few years ago, when writing about a new workstation that Level One Techs set up for me, and I’ve been using that as my primary workstation ever since (just over 5 years!).
  13. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Thursday, 11-Sep-2025 14:10:05 JST Greg K-H Greg K-H
    in reply to
    • daniel:// stenberg://
    • Matt "msw" Wilson
    • Jacques Chester
    @msw @jacques @bagder I have no problem adding additional data like "This config option means you will not be vulnerable" to our records today, if people want to submit that information to us. We take patches and additions to the kernel cve.org records on a weekly basis from vendors that work to narrow down affected kernel ranges and add additional references.

    So we could do what you want today, no changes to anything that cve.org does right now would be needed, just send us a patch! But that was not what was being proposed at all, unfortunately.
    In conversation about a year ago from social.kernel.org permalink

    Attachments

    1. No result found on File_thumbnail lookup.
      cve-website
  14. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Wednesday, 30-Jul-2025 14:26:40 JST Greg K-H Greg K-H
    in reply to
    • Alex
    • Marcin Juszkiewicz 🙃
    @stsquad @hrw Fixing the lack of almost all riscv soc drivers to be upstream so that I can boot a kernel.org release on one of them (i.e. a normal developer can test their changes) would be a good start. Which is one of the things that article says...
    In conversation about a year ago from social.kernel.org permalink

    Attachments

    1. Domain not in remote thumbnail source whitelist: kernel.org
      The Linux Kernel Archives
  15. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Tuesday, 29-Jul-2025 15:50:54 JST Greg K-H Greg K-H
    Looks like the risc-v community is learning from history! Hopefully this results in more upstream development efforts: https://riscv.org/blog/2025/07/risc-v-upstreaming/
    In conversation about a year ago from social.kernel.org permalink

    Attachments

    1. Domain not in remote thumbnail source whitelist: riscv.org
      Full-Fat, Kernel-Ready: Why RISC-V Linux Needs Everyone Upstream – RISC-V International
  16. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Thursday, 24-Jul-2025 16:05:37 JST Greg K-H Greg K-H
    Saving this here to use later. As seen in the comments on yet-another-ai story on Lobsters:

    "How could you claim to have a neutral, informed opinion on LLMs without signing up for a bunch of subscriptions and constantly talking to the liar machine to see if it told a truth today?"
    In conversation about a year ago from social.kernel.org permalink
  17. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Tuesday, 15-Jul-2025 17:58:20 JST Greg K-H Greg K-H
    Days since an "AI found security bug" turned out to be totally false due to the inability of the tool to actually parse C code: 0

    I'm seeing multiple of these type of "reports" per week now for Linux. Why do people think that an LLM can somehow do better than a compiler and also not even test their proposed changes to verify they even do anything?

    {sigh}
    In conversation about a year ago from social.kernel.org permalink
  18. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Friday, 11-Jul-2025 22:29:10 JST Greg K-H Greg K-H
    The second hardest thing in working in an open source developer community is learning who to ignore, be it in patch reviews or other places.

    The hardest thing in working in an open source community is realizing that you are the one that everyone is ignoring.
    In conversation about a year ago from social.kernel.org permalink
  19. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Wednesday, 04-Jun-2025 17:51:31 JST Greg K-H Greg K-H
    My seat name tag for the EU CRA meeting today...
    In conversation Wednesday, 04-Jun-2025 17:51:31 JST from social.kernel.org permalink

    Attachments


    1. https://media.social.kernel.org/media/1cf2ce6ef522658d5cb63bc5f08aea5490eaf1e358ee6e7b42cb290c17dbf3db.jpg
  20. Embed this notice
    Greg K-H (gregkh@social.kernel.org)'s status on Tuesday, 29-Apr-2025 22:06:15 JST Greg K-H Greg K-H
    "Findings by static analyzers in Fedora 43" == "nonsense findings that someone wants someone else to wade through to weed out the obvious false-positives in their broken 'security' tool"

    Someone needs to seriously reconsider this.

    And yes, the tool is obviously broken, I looked at the first 3 "issues" found and just laughed, thinking this was a joke, but it seemed to actually be real, which is sad on so many levels...

    {sigh}
    In conversation Tuesday, 29-Apr-2025 22:06:15 JST from social.kernel.org permalink
  • Before

User actions

    Greg K-H

    Greg K-H

    Tags
    • (None)

    Following 0

      Followers 0

        Groups 0

          Statistics

          User ID
          101452
          Member since
          24 Feb 2023
          Notices
          115
          Daily average
          0

          Feeds

          • Atom
          • Help
          • About
          • FAQ
          • TOS
          • Privacy
          • Source
          • Version
          • Contact

          GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.

          Creative Commons Attribution 3.0 All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.