Manual runtime type classes!
And I thought "stringly typed" couldn't be topped in webshit meme-ry.
Man, webshits are funny 😊
I'm a "developer edition" user (beta channel) running multiple profiles from multiple system users, and the only change I noticed weeks ago was the file picker not opening at all 😬
Fixed by running firefox with dbus-launch. So that was +1 for dbus over systemd in the race to make less shit work expectedly, while killing unix/posix in the process.
Wow! What an observant smart thought.
Well, except for the fact that code conversion doesn't give you the permission to change licenses or remove copyright. And the small matter of fact that both projects mentioned are Canonical projects, where whatever code that is not directly copyrighted by Canonical, is contributed by someone who signed an agreement with this stipulation:
(b) To the maximum extent permitted by the relevant law, You grant to Us a perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable licence under the Copyright covering the Contribution, with the right to sublicense such rights through multiple tiers of sublicensees, to reproduce, modify, display, perform and distribute the Contribution as part of the Material; provided that this license is conditioned upon compliance with Section 2.3.
"Us" being Canonical of course. So they could actually "re-license" the projects right now, without changing a single line of code.
It's always astonishing how condiment in their ignorance people are when it comes to these matters.
You geniuses are getting too predictable with your ignorance.
I literally wrote what's quoted above yesterday replying to someone else.
YSK
okay
There's a new initiative
A single microblogger.
A single patch.
On top of main (read, nightly).
for hard-forking firefox
Forks, hard and soft, always existed.
The hard ones are all half-dead maintenance wise. Not to mention the 10s of thousands of unpatched vulnerabilities, and that's not even counting undiscovered ones in those ancient code bases.
and creating a "base browser"
What is libxul 🤔🙂
You should try properly educating yourself on matters, instead of just taking whatever bullshit random often-clueless if not also malicious e-celebs spout at face value, or wherever you're getting these retarded theories from.
How many layers should I go through?
Here is a few:
Pull requests were designed for open source contributions from untrusted strangers. Applying them to trusted teams is a category error.
wrong
didn't bother reading further
Linux 7.1: Kicinski Called It ‘LLM-pocalypse.’ Then Deleted 138,000 Lines.
The Linux networking maintainer wrote about an ‘LLM-pocalypse’ in the same pull request that deleted 138,000 lines from the kernel.
One hundred thirty-eight thousand lines. One pull request.
“If we want to have a fighting chance of surviving the LLM-pocalypse, this code needs to find a dedicated owner or get deleted.”
Jakub Kicinski, Linux networking maintainer, wrote that in his pull request message. Then he deleted it. All of it. Six entire subsystems. 138,000 lines of networking code that the world switched off years ago but the kernel kept compiling anyway.
On April 26, 2026, Linus Torvalds merged that pull request into Linux 7.1-rc1.
The first time in Linux history that AI-generated bug reports forced the removal of working software. Kicinski made it happen, and Linus approved for rc1 release; it ships to every server, phone, and embedded device running Linux within months. These protocols are permanently removed from the kernel.
What Kicinski Actually Deleted
Over 138,000 lines were erased in a merge window that also brought 12,996 changesets from 2,011 developers, 342 of them first-timers. The explicit motivation for the deletions: AI-generated security bug reports are flooding maintainers with work on code that has no real users left.
The networking subsystem removed ATM (Asynchronous Transfer Mode), AX.25, amateur radio networking, ISDN (Integrated Services Digital Network), Bluetooth CMTP (the bridge protocol between Bluetooth and ISDN), CAIF (Communication CPU to Application CPU Interface), and dozens of old ISA, PCMCIA, and PCI networking drivers.
ATM was already a relic when I was debugging VLAN (Virtual LAN) tagging issues in 2008 at a telecommunications company during my internship. ISDN was the protocol our office PBX (Private Branch Exchange) used before I ripped it out and replaced it with SIP (Session Initiation Protocol) trunks. These protocols didn’t matter anymore, but a decade ago. The code stayed because every maintainer feared breaking a setup they could not see.
Super-human claims require evidence. And asking for that evidence is not an insult.
Nice(!) to see so many people who don't know anything about programming get successfully propagandized into going against something they know nothing about.
Below is a list of CVE's published against original sudo, all within the last 5 years. You may not heard of them, because CVE's against non-Rust projects are not news 🫣
sudo CVE's from within the last 5 years(severity scores are not available/assigned always)
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.
Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read.
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation.
Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
Sudo before 1.9.13 does not escape control characters in log messages.
Sudo before 1.9.13 does not escape control characters in sudoreplay output.
Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
The special comment from @MTK@lemmy.world in this thread deserves some focus:
The Rust hype is funny because it is completely based on the fact that a leading cause of security vulnerabilities for all of these mature and secure projects is memory bugs, which is very true, but it completely fails to see that this is the leading cause because these are really mature projects that have highly skilled developers fixing so much shit.
So you get these new Rust projects that are sometimes made by people that don’t have the same experience as these C/C++ devs, and they are so confident in the memory safety that they forget about the much simpler security issues.
This has all the classics from the collectively manic discourse that has been spreading lately
mature projects
highly skilled developers
Rust projects that are sometimes made by people that don’t have the same experience as these C/C++ devs
C/C++ devs (deserves a separate entry)
they forget about the much simpler security issues.
The only classic missing is "battle tested" which is a crowd favorite these days.
But of course the internet gantry's knowledge about CVE's reported against non-Rust projects, is as good as their understanding of the Rust language itself.
Someone bothering to be minimally informed, even when lacking the technical knowledge to maximize their understanding of the information, would have known that the original "mature" sudo has CVE's published against it all the time. A CRITICAL one was rather recent even. And as it just happens, the ones not (directly) related to memory safety did outnumber the ones that did recently (5 year span). Which ones had higher severity is left as homework for the internet gantry.
The discourse centered around memory safety is itself lacks the knowledge to realize that the overall value proposition of Rust is much bigger than this single aspect, although the breadth of sub-aspects that cover memory safety offered by Rust is itself also under-grasped.
The internet gantry's susceptibility to propaganda and good old FUD done by ignorant and drama mongering "influencers" and "e-celebs" would have been almost concerning, that is if their transient feelings mattered in any way, in the grand scheme of things.
Needless to say, but this is comment is not meant to be disparaging towards Todd C. Miller or any other sudo developer/maintainer. He has a good relationship with sudo-rs developers anyway, not that the internet gantry would know.
Well said by the mainrainer(sic). Should probably have mentioned the reality behind some of the leaders of the mob, who target people like (infamous nazi!) Richard Stallman.
Totally organic! And the foot soldiers are totally mentally (and hormonally) stable!