Post

Russ Cox
@swtch.com

“There’s a tidal wave coming. You can see it. We can all see it. Are you going to lay down and die, or are you going to do something about it?” Be ready to patch your systems, repeatedly, for at least the next 12 months.

This post is unavailable.

16 reposts52 likes

Josh Bleecher Snyder
@commaok.xyz

As Brad never tires of pointing out, the cost of productivity is bugs. This is not a case in which you acted negligently or maliciously; I politely decline the apology.

Caleb Spare
@cespare.bsky.social

Oof, does this mean I've got to get my colleagues to upgrade their Go installs? Once we got to Go 1.21, we stopped ever upgrading because of automatic toolchain selection.

Russ Cox
@swtch.com

That said, if they don’t set GOPROXY to sketchy other values and don’t worry about TLS MITM attacks generally and trust Google to run proxy.golang.org honestly, then they are still okay.

Russ Cox
@swtch.com

The GitHub remote execution bug is fine and all, but the bigger story is the LLM (with IDA) quickly decompiling GH's binaries to enable the analysis. A lot of companies shipping "closed" binaries are going to learn the hard way that they might as well be shipping source. www.wiz.io/blog/github-...

Klaus Post
@klauspost.com

Yes, OSS is seeing the flood right now because it is low-hanging. But OSS has prepared for it for decades. The "binary distributed" flood will be SO much worse. Don't want to think about device drivers, but just winword.exe seems a big enough target.

Jeremy Lewi
@jeremy.lewi.us

This seems like an opportunity to make OSS more sustainable. The value of patched upstream just increased dramatically; at the same time that tech is doing layoffs. I think core maintainers should take a page from all the licensing shenanigans of OpenCore Cos and figure out how to get paid.