Not having the module loaded doesn't mean you're not vulnerable, the kernel loads the module on-demand when it's needed. I tried the exploit on such a system, and it worked.

However, not having the module loaded does mean that in normal operation you don't need the module, so the proposed mitigation of disabling the module is safe in the sense that it won't disrupt anything.

the kernel will autoload modules when they are needed. The fact that the module hasn't been loaded is an indication that the bug may not have been exploited, but it does not mean that you are not vulnerable to it. You need to block the module from loading or remove it entirely to mitigate the issue (which is what the first line of the recommended mitigation states).

> I don't know what exactly can load this module

Well, for one thing, opening an AF_ALG socket, as the exploit does.

rmmod just tells you it's not loaded; you'd have to delete the module to prevent it auto-loading.

> I have checked all the servers (bookworm, bullseye) that I manage, and none of them have the algif_aead module loaded.

But only Trixie (and testing/Sid) are patched (as I type this).

On Bookworm (and Bullseye), you want to add the module to list of blocked modules. It's a one-line change.

I use Thunderbird from the beginning when it was still named Firebird (I switched from Outlook Express). I think that it's a good product because it continues to do the job since more than 20 years. Me too I don't understand the negative comments. It's free (MPL license), it's packaged by Debian. All good. I don't care about Mozilla.

I just check something because my memory as faults... Firebird was the name of Firefox and the mail client was called something like Mozilla mail or something else.

It was originally Minotaur (when the browser was Phoenix), then they were Firebird and Thunderbird, until the browser renamed to avoid a name clash.

I really don't remember (+quick check) Firebird for the email client, do you have source for this?

Predecessor of Firefox was Firebird, and before that it was even called Phoenix.

https://en.wikipedia.org/wiki/Firefox#Name_changes

So it wasn't used before Thunderbird, that was the point of OP and myself. We were talking about the email client(!).

And I was an user of firebird, the database.

No, the email client was never called Firebird, that isn't what I was saying.

Browser: Phoenix -> Firebird -> Firefox Mail client: Minotaur -> Thunderbird

Firebird was the browser's name, after phoenix and before rebranding to firefox.

So it wasn't used before Thunderbird, that was the point of OP and myself. We were talking about the email client(!).

And I was an user of firebird, the database.

Yes that is a confirmation.

Firebird was actually the database whose name they hijacked when they had access to AOL's legal army.

Also K9Mail is now Thunderbird for Android.

They didn't really hijacked anything. Firebird made sense coming from phoenix. It wasn't a good choice considering the database existed before but it wasn't really an hijack in the sense that both are significantly different product that trademarks wouldn't have clashed. It was just annoying when doing web searches (similarly to gemini the google AI product vs the protocol).

It wasn't that simple. I couldn't find Firebird's original position post but this is close enough.

https://www.mozillazine.org/articles/article3097.html

I’ve used it since it was called Netscape Mail. ;-)

like all Big Tech

Except this "big tech" larper is supposedly fully owned by a nonprofit.

Outlook Express

[]->

ridiculous...

Why this entry is in the top 30?

Not ridiculous as long as there are still who need to learn. right? That said, I didn't see that coming

Oh, thank you... I'm not alone... I'm so tired of seeing crappy containers with pseudo service management handled by Dockerfiles, used instead of proper and serious packaging like that of many venerable Linux distributions.

Hi Jarred,

I contributed to Bun one time for SQLite. I've a question about the licensing. Will each contributor continue to retain their copyright, or will a CLA be introduced?

Thanks

With Bun's existing OSS license and contribution model, all contributors retain their copyright and Bun retains the license to use those contributions. An acquisition of this kind cannot change the terms under which prior contributions were made without explicit agreement from all contributors. If Bun did switch to a CLA in the future, just like with any OSS project, that would only impact future contributions made after that CLA went into effect and it depends entirely on the terms established in that hypothetical CLA.

Hello, thank you, but that doesn't answer my question. I'm not asking for a definition, but for information about licensing decisions for the future of Bun.

The atmosphere is amazing. Really good job... continue :-)

Obrigado amigo <3

trump-lang is a totally stable genius programming language made for developers who don’t like to wait, think twice, or read error messages.

Designed with rapid decision-making, alternative logic, and absolutely no regard for international standards — it’s the only language endorsed by billionaires who don’t code.

It is unfortunate. GCC has enabled the compilation of countless lines of source code for nearly 40 years and has served millions of users. Regardless of whether its design is considered good or bad today, GCC has played an essential role and has enabled the emergence of many projects and new compilers. GCC deserves deep respect.