It's pretty consistent. If you check out something from a Gentoo-official repo, it's going to have been created by humans without the use of LLM tooling. LLM tooling is used for the kernel, systemd, and a litany of other packages -- trying to run a "non-LLM OS" is more like a fork of the whole ecosystem than a distribution.
I can appreciate the concept that Gentoo is placing a high value on human curation. I used to be firmly against our anti-LLM policy, but honestly it's a pretty strong differentiator from other distributions -- and I'm getting more and more sick of AI tech in general.
This workaround only applies to kernels with the impacted code compiled as a module. RHEL, Fedora, and Gentoo (we use a modified Fedora config) all are configured to build this in directly. Without a patch or config change (as Sam from Gentoo was alluding to), those distributions remain vulnerable.
These categories of vulnerability are not new: https://dgl.cx/2023/09/ansi-terminal-security -- any time you take any untrusted data and do literally anything with it, you're at risk.
I used this for a while. It doesn't display HTML emails just fine. It only supports a subset of stuff which -- as a geek is awesome because it protects me -- but would be hideous to give to a normal user. Literally less than half of my emails were readable.
There are over 600 different people contributing to OpenStack in a given six-month release cycle. Approximately 60% of total code by commit count is from Red Hat employees. I'm one of the 600 that don't work at Red Hat, and there are a lot of us.
You should get a sense of the scale of a project before summarily declaring that it has a single point of failure.
This is true, sadly -- but the documentation exists and community is friendly to those who wanna build those skills. It's extremely difficult to build something the size of OpenStack without making it so configurable that operating it needs a decoder ring. I'm doing everything I can in Ironic to make it more friendly and flexible out of the box, but it's a difficult problem to solve.
I always tell people: OpenStack can do almost anything you want... if you can configure it to do so :).
There's a reason I point out the longevity of OpenStack. As a project, it has significant corporate sponsorship and policies to ensure that one entity can't take over control of it. For instance; the OpenStack Technical Committee is never permitted to have a majority membership made up of a single entity's employees. This means that even though Red Hat, at this stage in it's development, has a majority of contribution, the project itself can never be taken over by a single entity.
People find project governance, and particularly "corporate" involvement in open source to be distasteful -- but in my experience, and OpenStack is a winning example of this -- setting up good boundaries to let companies work together has proven to be sustainable.
I'm saying not that OpenStack can replace LocalStack, but instead that LocalStack, by building a project on top of proprietary APIs, set themselves up to fail.
More reason to run your infrastructure using open source software in your own datacenter. OpenStack has been around for closing in on two decades, running clouds and being mostly governance-drama-free.
It's not surprising that a proprietary ecosystem built on open source software locked up behind a gate doesn't make a worthwhile ecosystem for building open source tooling against.
The only reason I run android over iOS is the freedom to install things I want on it. A waiting period is unacceptable as Android has proven that it can't be trusted not to tighten the grip further.
I had the same thought, as an OpenStack developer as well (TBH I don't remember if my username here identifies me or not). Yeah, we can apply as an exceptional case, but realistically us being excluded shows the criteria is very much directed towards "github style" open source.
I used to go to a members-only bar in Apex, NC (in NC, at least at the time, if >50% of your sales was alcohol, you had to be a "club"). The last time I ever went there was when someone called the bartender and "reported" a DUI checkpoint down the road and they announced it in the bar.
Why do some folks think it's OK to put other people at risk to this level?
Hard agree. I have their doorbell and some of the wifi light fixtures (that go into mains power). They integrate great with home assistant and record locally.
Thanks for posting this! It's been a nice first year as a Gentoo developer. Everyone has been kind and helpful to me as I've been figuring things out.
I want to highlight something: Gentoo's developer onboarding system is EXCELLENT. Starting as an active member of the general community, you talk an existing developer into being your mentor and fill out an open book test ( https://projects.gentoo.org/comrel/recruiters/quizzes/ebuild... ) which later is graded/corrected in a couple of meetings which I'd equate to the "job interview". I wish more open source projects (including my own) had such well-documented, straightforward processes to gain commit access. I appreciated the process of doing the quiz as it helped me close gaps in my knowledge.
With Red Hat, Anaconda is the installer.
With Ubuntu, ubiquity.
etc ...
With Gentoo -- YOU are the installer. This means you have to be ready to perform -- more or less manually -- many of the tasks automated in other distributions. I sorta see this as the same as a tutorial level in a video game: you learn how to read and follow the wiki which is essentially the key to success in Gentoo.
Gentoo is often at the forefront of identifying and helping resolve integration issues between different software projects, particularly when it comes to compiler tech (e.g. fixing packages so they can be built properly with LTO, or with LLVM as well as GCC) or other backend-detail-minutia which makes the whole system better without always being visible to the end user.