「 The vulnerability was introduced in April 2021 with the release of glibc 2.34. The flaw is a buffer overflow weakness in the glibc's ld.so dynamic loader, a crucial component responsible for preparing and executing programs on Linux systems. The vulnerability is triggered when processing the GLIBC_TUNABLES environment variable, making it a significant threat to system integrity and security 」
Did you know that you can install #glibc packages on #termux now?, Thanks to maintainer Maxython https://github.com/maxython you may now install pacman and install glibc apps from the gpkg repo!
There is a new vulnerability affecting Linux users. specifically, "Loony Tunables" affects Glibc and is vulnerable to LOCAL attacks only. Patches are already rolling out.
This week’s news about the "Looney Tunes flaw" highlighted a condition which can allow a local user to access root privileges from the command line. Part of the RL Security team's task is to have mitigation strategies ready for such cases - reporting vulnerabilities and suggesting fixes upstream, and also writing our own extra packages.
A severe vulnerability, CVE-2023-4911, has been discovered in the GNU C Library (glibc), affecting various Linux distributions, including Fedora, Ubuntu, Debian, Red Hat Enterprise Linux (RHEL), and Red Hat Virtualization. The vulnerability allows a local attacker to elevate limited local privileges to full root when launching binaries with SUID permission. While it has been fixed in upstream glibc, many downstream systems require updates to address the issue. Cybersecurity firm Qualys, which identified the vulnerability, warns that it poses a significant threat due to its ubiquity in Linux environments and ease of exploitation.
If #Glibc wasn't a piece of shit that knowingly and willingly bricks #Userspace all the time #Docker would neither have a right to exist nor legitimate reason to be used.
I hope #Linux will migrate to #musl sooner than later...
Were this not the case we'd have either #Juju or jist basic scripts (see #Zulip's Installer) that does setup all the stuff...
Docker is just an ugly workaround re: #Linux using that shit, and the sad part is that it's a legitimate issue, otherwise it would not exist to vegin with!!!
espechally since "#Glibc breaking shit" really pisses off folks and #musl being a much slimmer and sleeker alternative to it that doesn't constantly brick code with minor updates...
Among other things like strlcpy & strlcat (I know, right?), it includes many fixes and improvements in the #Hurd port, and a brand new x86_64-gnu (aka 64-bit Hurd) port!
Ich lese ja via nitter.net bei einigen ausgewählten Accounts immer noch beim X vorbei, und inzwischen bin ich regelmäßig irritiert über so selbstverständliche Dinge, die sie dort nicht haben, wie z.B. >400 Zeichen und einen Edit-Button.
Diese Selbst-Antworten, die nötig sind, um ein Wort oder einen einzigen Buchstaben zu korrigieren, ganz, ganz furchtbar.
Und dann weißt du, dass die nichtmal die Beiträge von Leuten sehen, denen sie folgen, wenn der Algorithmus das anders entscheidet.
@viel_zu_negativ ...die größten Painpoints ist eher die #Glibc und andere #GNU-Schrott welcher konsequent mit minimalsten Updates nativss bricked, weshalb ich hoffe dass auf #musl oder andere #c-libs umgdstellt wird.
Ansonsten funzt #Wine ganz gut - es bräuchte natürlich Feinschliff vgl. #Proton / #DXVK-Integration in #Steam.
#Glibc is the major preventor of #Linux becoming the norm since #GNU literally brick shit with minor updates, and the #FSF outright ignores the the fact that #CCSS exist and not everything is #FLOSS and that people should not have to recompile their stuff!
Otherwise everything that has been touched or associated with #RMS / #Stallman is tainted and him being reinstated will continue to damage #FreeSoftware for years to come.
@bitpirate@gamingonlinux I mean don't get me wrong, it really shines in compatibility as @fuchsiii has shown me several times: Even ancient #Windows games will run better than under Windows...
But personally I think that #Proton / #Wine / #DXVK should be transitional mechanisms and not be turned into a perpetual crutch...
@lunaa@yura@torvalds because as much as we all want our favorite #FLOSS to run first, there will always be some #CCSS that can't be replaced.
That's why #Proton (#Wine + #DXVK) are seen as "necessary" (not even evil at all) mechanisms so people can even do basic #Gaming on #Linux, because #glibc prevents people from playing old #native Linux games that ain't FLOSS'd!
It's such a shame when cool projects are maintained by bigots.
I wanted to give Hyprland a try, since I love the (technical) direction it's going. Sadly, the maintainers are transphobic and will treat you like garbage if you are a trans person. @orowith2os, a great friend of mine, shared some screenshots about the bigotry on the Discord server that made me reconsider my decision.