The recent announcement about Anthropic joining the Blender Development Fund as a Corporate Patron member has raised concerns from the community around how we engage with AI topics.

This is how we plan to address the issue: https://www.blender.org/news/upcoming-blender-development-fund-and-ai-policies/

#b3d #DevFund

RE: https://fedi.lwn.net/@lwn/116483835313862451

Seth was the leader of the GNOME Usability project, which led to the creation of the human interface guidelines; the words might have changed over 25 years, but he's one of the people that made the Linux desktop, and we're still walking in his footsteps.

This is epic, first time camera is working in #Waydroid 🤩 Thanks to @supechicken and the WayDroid-ATV project!

#LinuxMobile #NixOS #postmarketOS

@eloy @alexanderkjall @noisytoot but oh boy the coding style is much worse than literal amlogic kernel BSP

@eloy @noisytoot @alexanderkjall The only reason I can think of to use this for marketing is .. yeah, what you said, and maybe also "hey our AI is so good!!!"

@noisytoot @alexanderkjall it's not like you'll be running the exploit on some microcontroller with 16K of SRAM

@noisytoot @alexanderkjall it's just not serious

@noisytoot @alexanderkjall it's also obfuscated IMO. Why need to zlib.decompress ? Can't you give us the data itself without compression?
A bunch of variables also have quite meaningless names. It really does scream a lot like obfuscation.

What went wrong with this case?

Theori appear to have only contacted the linux kernel devs with the vulnerability, as opposed to going the usual CVD route that includes all of the major Linux distros.

Why is this a problem? Since the linux kernel became a CNA, there has been a flood of CVEs for the Linux kernel. The Linux kernel devs' arguments is that any given kernel flaw could presumably be leveraged to behave as a vulnerability, and it's not worth their time to determine "vulnerability" or "not a vulnerability". Everything gets a CVE.

Now the case with copy.fail? It was indeed reported to the kernel devs. And it got a CVE. A single CVE buried in flood of all of the Linux kernel CVEs.

And it appears that every distro on the planet was blindsided by this proven-exploitable vulnerability because they were not given any warning. Or even any suggestion to pick this single CVE out of the sea of Linux kernel CVEs as worth cherry picking.

Much to the chagrin of the Linux devs, RHEL doesn't use up-to-date Linux kernels. They cherry pick CVEs to backport to their chosen kernel version. (e.g. the latest and greates RHEL 10.1 uses 6.12.0, which was released November 17 2024). And in this world where bad actors like Theori don't involve vendors in vulnerability coordination, and just about every Linux kernel bug gets a CVE, this workflow fails. Hard.

Good times...

@jn overall it all feels not serious at all to me. Yes, the vuln is real. But not only did they not notify any mainstream linux distro, but they have the audacity to say these distros that haven't been notified, actually have the vuln patched already which is false.

That combined with "hey our AI solution detected this based on human analysis!!" .. ugh

@jn it's all AI generated, so yes of course there's lots of immature marketing...

"jn[?] this disclosure" :P

@mntmn I've daily driven a Linux phone before, and I continue to daily drive a (muuuuch less powerful, armv7) tablet with pmOS on it. My main gripes on pmOS right now (which I and obviously everyone else hope will be fixed) is the overall reliability of things like calls and audio.

Other than that, I think it's becoming what Android used to be in 2012 to me. I feel pmOS is slowly becoming what Android used to be in 2012, a pretty good phone/etc OS with a huge and growing hacker community.

Anyone saying "Scientists don't want you to know this fact" has never met a scientist.

Scientists are famous oversharers.

@CyReVolt Yes, but it'd be easier to know if it wasn't all obfuscated.

Dear #gitlab a Work Item is not something I want to be concerned with in #FreeSoftware stuff I do in my free time. Can't we have names that are more motivating like "Puzzles to solve"?

@alexanderkjall they also had time to obfuscate their exploit.

@simonzerafa @alexanderkjall How do distros know that there is a vulnerability in the wild?

Today I have spent way too much time handling the https://copy.fail situation #copyfail

The persons who discovered it didn't notify the distribution security list, so no patched kernels was available for people to install when they released it.

But they did have time to write an exploit, and thought it was a good idea to distribute that on day one, before vendors had time to provide patches.

I'm not very impressed with xint.io, I guess it's the marketing department that runs the show.

@CyReVolt What's the point? You're not going to run this in an embedded environment with only 64K of SRAM available?