in the wake of Blenderβs unfortunate, βdropping a banana peel on the ground and slipping on itβ-type post a few days ago, i feel like it should be noted that they did, in fact, post a response today where they apologized and announced policy changes and open discussions that i think pretty reasonably address the problems. thank you, blender.
https://www.blender.org/news/upcoming-blender-development-fund-and-ai-policies/
tell someone that they're cool, what happens next may surprise you
The recent announcement about Anthropic joining the Blender Development Fund as a Corporate Patron member has raised concerns from the community around how we engage with AI topics.
This is how we plan to address the issue: https://www.blender.org/news/upcoming-blender-development-fund-and-ai-policies/
RE: https://fedi.lwn.net/@lwn/116483835313862451
Seth was the leader of the GNOME Usability project, which led to the creation of the human interface guidelines; the words might have changed over 25 years, but he's one of the people that made the Linux desktop, and we're still walking in his footsteps.
This is epic, first time camera is working in #Waydroid π€© Thanks to @supechicken and the WayDroid-ATV project!
What went wrong with this case?
Theori appear to have only contacted the linux kernel devs with the vulnerability, as opposed to going the usual CVD route that includes all of the major Linux distros.
Why is this a problem? Since the linux kernel became a CNA, there has been a flood of CVEs for the Linux kernel. The Linux kernel devs' arguments is that any given kernel flaw could presumably be leveraged to behave as a vulnerability, and it's not worth their time to determine "vulnerability" or "not a vulnerability". Everything gets a CVE.
Now the case with copy.fail? It was indeed reported to the kernel devs. And it got a CVE. A single CVE buried in flood of all of the Linux kernel CVEs.
And it appears that every distro on the planet was blindsided by this proven-exploitable vulnerability because they were not given any warning. Or even any suggestion to pick this single CVE out of the sea of Linux kernel CVEs as worth cherry picking.
Much to the chagrin of the Linux devs, RHEL doesn't use up-to-date Linux kernels. They cherry pick CVEs to backport to their chosen kernel version. (e.g. the latest and greates RHEL 10.1 uses 6.12.0, which was released November 17 2024). And in this world where bad actors like Theori don't involve vendors in vulnerability coordination, and just about every Linux kernel bug gets a CVE, this workflow fails. Hard.
Good times...