Post gains traction on Hacker News, developer community responds
1 Nov 2 · 6d ago · 2 articles · 2 posts · 20 comments · 3 sources · development 1 of 1
The critique reaches the HN front page with over 300 points and 127 comments. Multiple developers report confidence loss in Ubuntu, consideration of alternatives like Rocky Linux, and frustration that a company selling security subscriptions lags volunteer-maintained distributions.
“I'm moving all my servers off Ubuntu. I've completely lost trust in it.”
chalmovskychalmovsky Developer and Ubuntu userCanonical Ubuntu maintainer and commercial Linux vendorAnthropic AI research companyDebian Volunteer-maintained Linux distribution
The whole story articlespostscomments the bright band is this development · numbered dots are the others · click one to jump
What was reported 1 claim about this development
-
2 outlets WTF Ubuntu?
first by HN Best, 6d ago · also HN Frontpage
What people said 24 voices · best of 49 · verbatim
-
N
WTF Ubuntu? https:// chalmovsky.com/posts/wtf-ubuntu In case you missed it: CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code. It's been there since 2016, so virtually every Linux server on the planet has it, and it can be hit remotely. Anthropic says it built a working exploit that gets root on a server. A total takeover…
-
The more I look at this the angrier I get. This is a CVE that Anthropic claims can get a Remote Code Execution on vulnerable systems, which includes default Ubuntu installs running any sort of Go server like Caddy. Bad enough that I shut down my personal website and self-hosted tools (sorry for any typos, my grammar checker is also down).And this…
-
Worse yet, the Ubuntu security incident page[0] lists "Ubuntu Priority: High" (as opposed to Critical, which would trigger an out-of-schedule patch). There's a "Why this priority?" link that simply says:> Why is this CVE high priority?> See ubuntu cvss scoreThat's it, we don't even get a period on this TBD of a sentence. It's followed by a generic…
-
I think this is more of a communications failure than anything. My understanding (happy to be corrected) is:1. That for this to be a DOS type exploit, the attacker needs to exploit a race condition over network, which is an incredibly unlikely event that one can't really force.2. For it to be a root exploit they need to craft the IP options with a…
-
I don't think this is fair. They don't do a good job of pointing you at their rationale which is in their security score here[0]. I ultimately had to have claude translate the kernelese in to something my small brain could understand but this is a bug that could crash your system but is unlikely to expose your confidential system data to attackers…
-
To be fair: while critical (9.8) it has an EPSS score of <1% (probability of it being actually used). According to [1], [2], and others, at worst the issue results in a kernel crash or a denial of service. I read the post by Anthropic too, but something just doesn't reconcile there between everyone saying its a DoS, and Anthropic alone claiming…
-
I think it's just brand, ubuntu was what I knew from using it as a personal desktop and then it's the default/most obvious option for a lot of providers, I think even 10+ years ago AWS EC2 defaulted to it above Debian, digital ocean too I think?I don't remember why exactly but it was definitely just 'linux VPS = Ubuntu' for a long time. I think…
-
I'll add that they were a day or two late to patch the brotli issue, other than Ubuntu Pro LTS, which was still "under consideration" or whatever they called it, for another few days to a week. https://ubuntu.com/security/CVE-2026-111497 Now it says it's fixed, but on my old server I'm still not getting the updates for whatever reason (maybe I…
-
Hi all, representing Canonical's product team here. We have fixes available for Ubuntu 22.04 LTS and newer in the -proposed pocket which are being tested for stability. These can be applied by users and we published a blog with the details. We sincerely appreciate the feedback and will follow up as soon as we can with more information
-
The traditional answer is that Debian is a bit slower-moving in both the Linux kernel and userland, so people who want current versions of popular software often find that they have to do some extra work in Debian.A gradually increasing number of popular userland applications have been publishing their own apt repositories however so this is less…
-
Yeah, their lack of a satisfactory response is the final nail in their coffin. This incident escalates my consulting advice about Ubuntu from “not recommended” to “switch immediately”.Some of my clients may be surprised by this change, as I once advocated for Ubuntu as a good choice for a development and deployment platform. While that has not…
-
It’s not a good look that Ubuntu is taking its time with this patch even for paying customers, but I do have to question how widely exploitable this is. If your site is mission-critical, it most likely has a load balancer or reverse-proxy in front of it that’s probably already filtering it out. Companies like AWS have already confirmed that their…
-
For the record, the kernels with the fixes are in the "proposed" repos for each LTS release:* https://launchpad.net/ubuntu/+source/linuxYou can pull them down with a "-t" added to your apt-get (but will not appear by default).26LTS had the new kernel go to the updates/security repos on October 28.
-
Well, I did it. This was the straw that broke the camel’s back: I have moved over to Rocky Linux. I am more a RedHat user, and Ubuntu never felt really comfortable for me. I don’t like having to do incremental upgrades every two years or so; I would rather do a single big upgrade about once every 7-8 years and have a rock solid development…
-
The fact that Ubuntu (still) hasn't patched this (despite the fact that I'm pretty sure Opus 5.5 could figure it out in a few minutes) is pathetic. And it's very annoying for me because I have two servers that I need to consider migrating off of it now because Ubuntu clearly doesn't care all that much about security vulnerabilities like this. Get…
-
How about WTF linux?The TCP/IP stack has one of the most stable requirements bases of any component -- modern PCs can communicate with decades-old software and hardware, and the composition of layers design means the code can be easily tested, and is a great candidate for analysis via formal methods. And once you have a formally verified…
-
We were using ZFS in prod a few years ago, and there was a one-line patch to fix data loss issues.It took Ubuntu something like 6 months to “backport” it. I’m not at all surprised they are taking forever to patch a severity 11 wormable exploit.Mildly disappointed, but not surprised. Anyway, the ZFS thing (and, before that, widespread…
-
It’s okay to have criticism, but at least be constructive about it. This “I demand to speak to the manager” energy should be kept out of open source.The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.Just a title…
-
" Anthropic says it built a working exploit that gets root on a server. A total takeover."From the linked Ubuntu CVE page" Vulnerable system - Confidentiality impact LowVulnerable system - Integrity impact LowVulnerable system - Availability impact High" suggesting it's more of a denial of service. So which is it, there are dozens of kernel CVEs…
-
I knew what this is about before clicking the link. While trying to find remediations for vulnerable systems I was also looking for any kind of "official" statement on literally WTF is going on here from the Ubuntu side, but I haven't been able to find one yet. I guess it has to go through the "hacker news puts enough attention on it for someone…
-
E.g. Ubuntu 22.04 Linux kernel 5.15.0-203.213 was published in Canonical's proposed kernel PPA on October 26, 2026. So just enable Canonical's proposed repository, use APT pinning to prevent automatic installation of untested packages and install the patched kernel. I agree that they need to get quicker at pushing these updates into stable, but…
-
> I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`, this is now the kick I needed to move to a different distro.To be clear, Ubuntu Pro doesn't have the fix yet either.
-
For people who absolutely need to run 16.04, 18.04 and 20.04 without any further subscription, I recommend installing the signed kernel from 22.04 (as of right now only available in the -proposed repo). Worked fine for some 16.04 examplary machines I had around that are stuck and bumps the kernel to 5.15 (soon EOL, but maintained by ... canonical…
-
Here is Ubuntu’s webpage on this vulnerability:https://ubuntu.com/security/CVE-2026-98432It’s still, over a week after disclosure and patches, unpatched in Ubuntu.As for me, a part of me wants to move over to Rocky Linux 10.
All 1 developments of Ubuntu delays critical Linux kernel patch while competitors… →
Hacker NewsNewswiresMastodonLobsters