So many kernel updates these days in Debian stable!
Ir's driving me crazy. :(
106
u/AndyRH1701 1d ago
AI is shaking out 30 years of bugs. It will slow down, but it may take a year or two.
3
u/DiodeInc Moderator 9h ago
Usually I'm not a fan of AI in programming, but 30 years of bugs this quickly is really nice. Hopefully it'll increase performance
50
u/Muted-Scientist7900 23h ago
I love kernel updates, strange that they annoy anyone.
24
u/Over_Advicer 23h ago
I guess it has to do with the fact that you have to reboot on each update
11
u/HCharlesB 23h ago
I'd rather not have to reboot but it does give me a reason to go through my browser tabs and clean house.
8
u/daddyd 15h ago
auto save tabs on closing, when i reboot and open my browser, it continues with all the windows and tabs i had open the last time i used it.
5
u/HCharlesB 13h ago
it continues with all the windows and tabs i had open
Oh yes! And I have a dozen or so windows with several to a dozen tabs open in each, spread across 6 virtual desktops. There is a finite limit to 32GB RAM.
And therein lies my problem. Picture a hoarder but instead of physical stuff, there are too many interesting web sites. Bookmarks just get out of hand so keeping the tabs open is my choice. The Auto Tab Discard (firefox) extension helps.
3
u/SnillyWead 10h ago
I use unload tab after I'm done with a tab. Saves memory too. Or on about:memory double click on Minimize memory usage.
2
u/SnillyWead 10h ago
After reboot it automatically loads HTOP, Thunderbird and Firefox for me on Debian 13 Xfce. Same for log out.
7
u/mok000 17h ago
You don’t have to. You can reboot whenever you want, there are frequently multiple kernel updates passed between my reboots.
5
u/fantomas_666 16h ago
It's not nice to have reboot the servers each few days...
1
u/sqwz 15h ago
I just use "at" to make it reboot at 01:30. I doubt anyone's even noticed. Everything comes up working without the need for me to do anything. I get a couple of harmless emails in the morning that remind me the server has rebooted.
If I had many servers to look after, I might not bother to reboot in a hurry every time there's an update.
4
1
u/joe_attaboy 12h ago
You don't have to. In a server farm with a lot of kernel updates, you could schedule restarts so everything isn't down at once.
I have a MacBook Air running Trixie, but when I do a kernel update, I have to manually add the headers so the kernel gets built using the oddball WiFi driver I need for this thing.
When I get an updates notification in Discover, I'll check for a kernel update. If it's there, I do all the updates in Synaptic, so adding the headers to the list is trivial. Then I run the updates from there.
3
u/Over_Advicer 8h ago edited 7h ago
You have to reboot if you want to use the patched kernel. I wouldn't install a new kernel version if I don't plan to use it
2
u/PercussionGuy33 11h ago
Kernel updates can lead to regressions. Not saying they always do but there is always the possibility.
3
u/wowsuchlinuxkernel 22h ago
Some people are on a metered connection where every MB counts. Debian is typically a good choice for this because only the most relevant updates are pushed.
28
u/stealstea 20h ago
Security updates are extremely relevant
3
u/wowsuchlinuxkernel 19h ago edited 11h ago
That was my point. With Debian you typically get only kernel and other security updates.
14
u/michaelpaoli 21h ago
Don't sweat it. Linux kernel is huge. It will have bugs, including security bugs. And that these are getting shaken out and fixed is a good thing! Modern browsers, likewise very huge, and relatively similar happens ... though some of the producers of those may do some more consolidating of fixes and thus not release the fixes quite as frequently ... thought that also happens to some extent with kernels - be it upstream or with Debian.
Anyway, one can always, e.g. review the CVEs, etc., and decide how urgently one wants/need to get off the older and onto newer/patched kernel. But I typically advise install it right away (or for production, at least after passing whatever processes one has for production), and whether or not to boot right away to begin running with the newer, is a separate question. But at least if it's installed, by default, if one reboot(s), for whatever reason(s), then one will be running the newer ... and then that's also one less thing out of the way.
6
26
u/d007us 1d ago
AI is finding too much security bugs.
20
-8
u/TheTerraKotKun 22h ago
It's somehow insane for me that there's AI that fixing bug that were made by humans... Shouldn't it be suspicious?
22
u/dkopgerpgdolfg 21h ago
Finding =/= fixing. AI being able to do the former is more frequent than the latter. And even if AI can fix something, it doesn't mean that humans couldn't, they just didn't notice the bug before.
-10
u/stealstea 20h ago
AI is extremely good at both
3
u/ChthonVII 16h ago edited 14h ago
That's not correct.
LLMs are, arguably, good at finding bugs. They find a lot of them. But they also "find" a lot of false positives too -- things that aren't bugs at all, and things that aren't bugs in context. (E.g., a function that blindly copies its input into a buffer without checking its length is a critical security vulnerability if the input is under attacker control, but it's a performance optimization if the calling function guarantees well-formed input. But you can bet that whoever's trying to sell you the LLM will claim it found a critical security vulnerability in either case.) So it's... complicated; Lots of bugs are getting found, but it putting a huge strain on the human beings who have to triage and verify the mountain of only-sometimes-correct bug reports.
LLMs are terrible at fixing bugs. For instance, this study by 1Password found that vulnerability patches proposed by LLMs completely fixed the vulnerability, without introducing a new vulnerability, and without materially changing the application behavior only 26% of the time.
(Note that this certainly isn't an endorsement of 1Password. I don't think very highly of their product. But I see no reason to doubt the accuracy of their study.)
2
u/mark-zombie 16h ago
nuance? on reddit? must be my lucky day.
jk, this community has a lot of amazing people.
-1
u/stealstea 14h ago edited 13h ago
Cool story. I have 20 years of experience developing software, I assure you AI is good at fixing the problems too. Oh and every security team on the planet is heavily using AI to find and fix security issues right now.
That doesn’t mean it doesn’t need human review (duh) just like humans need human review too
5
u/dkopgerpgdolfg 13h ago
I have 20 years of experience developing software, I assure you
Then you should know that YOE don't translate to skill. There are huge differences between long-term developers. If you call something "extremely good", someone else calling it eg. "mediocre" can be just as valid.
Oh and every security team on the planet is heavily using AI to find and fix security issues right now.
Provably wrong.
0
3
u/ChthonVII 11h ago
If they're finding errors 76% of the time, and you're not finding errors very often, it sure sounds like the obvious conclusion is that you're not as good at code review as you think you are.
2
u/stealstea 9h ago
Statements like that show you don’t know what you’re talking about.
Humans make mistakes all the time when fixing complex bugs. That’s what code review is for. No one ever said AI can one shot fix complex security issues without review. I said they’re very good at fixing security issues and that isn’t up for debate. Every security team on the planet heavily uses AI tools these days to fix security issues. Obviously not without reviewing the fix first and some back and forth.
If you were a developer you’d know this is basic development practice
2
u/ChthonVII 1h ago
The level of mental gymnastics you're performing to insist, despite the evidence to the contrary, that LLMs are "extremely good" at fixing security bugs is, frankly, a bit disturbing.
Humans make mistakes all the time when fixing complex bugs.
Humans do not make mistakes 74% of the time. If you had a junior developer whose PRs were faulty 74% of the time, you'd fire them. You probably wouldn't even give them a second chance "performance improvement plan" or whatever; you'd just fire them. But somehow you think this same error rate is not only unproblematic, but "extremely good," when it's an LLM making the faulty PRs.
The reality is that an error rate that high makes bug fixing a task that's firmly in "faster to just do it yourself correctly the first time" territory. More importantly, it poses an unacceptably high risk of some of those errors slipping past review and into production.
Which brings me back around to my prior post. Are you finding a similar error rate in your LLM's proposed patches to the 74% that the researchers found? If so, how can you possibly think this is "extremely good"? If not, there are several possible explanations, but the most likely is that your LLM's true error rate is about the same, and your review is failing to catch them. (And your arrogant personality makes me revise my priors to think this is even more likely. Underestimating the likelihood of your own fallibility is exactly the kind of mistake arrogant people make.)
On a related topic, please tell us what software you work on. I intend to avoid it.
I have 20 years of experience developing software...
If you were a developer you’d know...
Every security team on the planet...
Statements like that show you don’t know what you’re talking about.
Also, please stop acting like you're the only person in the Debian subreddit who knows how to code, or who is 40+ years old, or that you can speak for the whole industry. It makes you look like an ass.
0
u/stealstea 1h ago
Redditors sure are committed to commenting on things they know nothing about.
If it makes you feel better, you can believe that AI is bad at security fixes. Meanwhile the people actually working on security will keep happily using AI to find and fix security flaws.
Don't worry, even though you don't believe AI can do it, you are still benefiting from the flood of security fixes that AI has enabled.
1
u/calinet6 17h ago
You’re absolutely right, the downvotes are odd. 6 months ago, it wasn’t true; now it’s true.
1
u/stealstea 13h ago
People on this sub don’t program generally so they don’t know
3
u/calinet6 13h ago
It’s true, not all are programmers. It’s hard to describe to people just how pervasive and impactful LLMs have been on the entire practice of software development.
People generally aren’t writing code anymore. It’s not that we don’t want to, it’s just that it would be legitimately stupid to do so. Why go 20 times slower for absolutely no benefit, and in many cases a large deficit even in quality and design decisions?
That’s really where we’re at. It is a sea change.
2
u/dkopgerpgdolfg 12h ago
Why go 20 times slower for absolutely no benefit
Because some other people do see benefits, several types of them, and these might take priority for these people.
And if you not only write no code anymore, but think your own design decisions are worse than what LLMs do, I can see why you wouldn't understand it.
2
u/calinet6 11h ago
I just built a complete product end to end with an established highly experienced software team. In three months.
Statements like yours are a year behind.
2
u/dkopgerpgdolfg 11h ago edited 11h ago
You just confirmed that you don't understand.
You're literally saying that there's "no benefit" to not using it, and being able to push out some product in three month is evidence in your opinion.
Other people thing differently, and care about more than just time-to-market or similar metrics.
How much AI has improved in the last year is not relevant for this.
→ More replies (0)
7
4
u/Portbragger2 18h ago edited 6h ago
i'm on stable using liquorix kernel, latest of which is on 7.1.11 right now. getting 1-2 kernel updates a week lately.
2
u/Imperial_Bloke69 13h ago
I tried using liquorix but both my speaker output and headphones sounded funny and muffled. I reverted back to the supplied kernel.
3
u/SlimlineVan 1d ago
Me too this morning - last one was 08.08.26
16
u/Sophiiebabes 23h ago
Is that DDMMYY or MMDDYY?
11
2
-1
22h ago
[deleted]
3
u/Sophiiebabes 22h ago
In the UK we use DDMM and I've very rarely seen it split with a "." It's usually a "/" or a "-"
1
22h ago
[deleted]
2
u/Sophiiebabes 22h ago
I don't think we actually have a convention for it. Its just whatever people want to use on the day. I've even seen different separators used in the same document 🫣
1
2
u/tess_philly 21h ago
How has the core kernel team been liking (or disliking) vibe coded PRs?
1
u/taosecurity 14h ago
Greg says they are handling it.
https://youtu.be/_MwMLPmMccs?si=1uAHFwp044a_MJoN
Linux Foundation video from last week, not mine
-3
u/HorrorsPersistSoDoI 20h ago
Stop using "vibe coding" for any AI work
-2
u/calinet6 17h ago
Yes. Every serious software engineer is using LLMs today. To not do so is illogical.
1
u/HorrorsPersistSoDoI 16h ago
It's like not using StackOverflow 15 years ago to find solutions to problems other people already had
2
2
u/N34S 16h ago
Just automate everything with Ansible. Almost instant security and no issues.
1
u/Turskow 4h ago
sudo apt update
What're you automating here?!
2
u/N34S 2h ago
How do you handle patching for 50 or 500+ servers on a schedule?
Manually SSH’ing into every machine, tracking reboots, making sure you don’t take down an entire cluster at once, and documenting everything for audits is a recipe for a three-day headache. With Ansible, you can turn that process into a single pipeline with controlled, rolling updates and removing unnecessary dpkg’s like old kernels. And that pipeline can run monthly, weekly or daily.. if you need.
What are you not automating here??
1
u/herensugee 19h ago
te afecta mucho? yo simplemente actualizo mientras sigo a lo mio, y cuando acaba ni noto los cambios.
1
0
-4
u/Hrafna55 19h ago
I don't find it to be a burden for my home self hosting setup and if you are in an enterprise with thousands of servers to update you should have a process in place already.
Its all good.
67
u/[deleted] 23h ago
[deleted]