Not me personally, but with enough social pressure, perhaps these will cease over time. Minority positions become majorities. Policies change. You know, like what happened this past week.
The fact that you’re not joining the call for higher quality content is disheartening.
This vulnerability does not require firecracker. The CVE does not mention firecracker at all.
Ruby is not Rails. The same way Linux KVM is not Firecracker. You cannot paint everything with the same brush. The author chose to make this sensationalist by implying its a firecracker issue. It is not.
You've repeatedly claimed it, but the logic doesn't hold. KVM is a dependency for Firecracker, just like brotli is a dependency for Node. What matters isn't "who's according-to-Hoyle responsible", what matters is "are you exposed to it".
Not for nothing, but it would have been possible for Firecracker to disable the partial checksum feature this vulnerability exploits. If you wanted to push on the argument a bit, you could say that Firecracker ran virtio-net in an aggressive and possibly unsafe configuration. I wouldn't agree, but it's a colorable argument.
Anyway, I think you keep missing my point. It’s the “uncritical” word that is important here. How work is done is often as important as the work itself. Isn’t that what we teach our children and our junior colleagues? What’s more, expectations should be even higher with seniority.
[–] tptacek 1 day ago
[–] otterley 1 day ago
The fact that you’re not joining the call for higher quality content is disheartening.
[–] tptacek 1 day ago
[–] sscaryterry 16 hours ago
[–] tptacek 16 hours ago
[–] sscaryterry 12 hours ago
Ruby is not Rails. The same way Linux KVM is not Firecracker. You cannot paint everything with the same brush. The author chose to make this sensationalist by implying its a firecracker issue. It is not.
I've repeatedly explained this.
[–] tptacek 11 hours ago
Not for nothing, but it would have been possible for Firecracker to disable the partial checksum feature this vulnerability exploits. If you wanted to push on the argument a bit, you could say that Firecracker ran virtio-net in an aggressive and possibly unsafe configuration. I wouldn't agree, but it's a colorable argument.
[–] otterley 8 hours ago
[–] tptacek 8 hours ago
[–] otterley 7 hours ago
https://lore.kernel.org/netdev/20260922030310.8684-2-habte.y...
Anyway, I think you keep missing my point. It’s the “uncritical” word that is important here. How work is done is often as important as the work itself. Isn’t that what we teach our children and our junior colleagues? What’s more, expectations should be even higher with seniority.