or maybe, just maybe, entertain for a second that upstream (linux kernel) shipped the original patch commit on October 1st with rollout to mainline on October 9th and disclosure on October 15th.
People with affected systems have been waiting ever since for canonical to ship ... something, anything. Or maybe communicate the blockers. Crickets, though.
It gets all the more egregious if you're a paying customer for Ubuntu Pro (which thank god, our company is not).
It is absolutely taking the proberbial piss when you put it into context of their bold shiny new ambitions posted on September 23rd on their official blog (https://canonical.com/blog/accelerating-delivery-of-cve-fixe...) ... failing every single listed requirement in that announcement, now 14+ days, after initial CVE disclosure.
No need for a tin-foil hat here at all. Ubuntu has a large installbase. Part of which hosts servers. And if I had to take a wild guess that userbase is about to shrink dramatically going forward.
People panicked about the issue can either apply a quick IPTables mitigation or install the kernel Ubuntu hasn't released to production yet. It's annoying that Canonical is late, but it's not the end of the world either.
Unlike Arch or even Debian, Canonical has dozens of kernels to test and verify. The downside of supporting your software for ten years across multiple chipsets and even offering in-between kernel updates is that you need to test and maintain a shitload of kernels. Testing all of those takes time.
I hope they do a write-up about what went wrong here but all the big companies were weeks late to the party. My guess is that some of the patches were causing issues when backported, or Red Hat would've released updates much sooner as well.
What do you mean? I can post whatever I want on Reddit and I can make it have as many upvotes as I need. They basically make bot farms undetectable, by hiding histories and automatic username selection. Literally nothing should be considered truth with Reddit as its only source
> Literally nothing should be considered truth with Reddit as its only source
Don’t get me wrong: I completely agree that Reddit should not be the only source, and go further that nothing should be assumed to be true based on Reddit signals (such as upvotes and comments). This is why I carefully chose my words: these can be strong signals of truth.
I think it’s also worth parsing out that I don’t think this is valid across all subreddits.
I'm not a lawyer, but it feels like you should consult one. If you have the legal information of this person and they have possession of your activation locked phone, sounds like you could at least sue him civilly or in small claims court for the value of it, if the DA won't do anything
reply