Jun 17, 2026, 6:12 PMdue to the increase in vulnerabilities, we recommend upgrading your software all the time to patch all vulnerabilities, but we also recommend pinning your software to the past to avoid new vulnerabilities
- Jun 17, 2026, 6:12 PM
Replies
- Jun 17, 2026, 6:13 PM
Hissing the words "capability security" into the ears of my operating system while it sleeps to hope it becomes more secure soon
demofoxdemofox@mastodon.gamedev.placeJun 17, 2026, 6:12 PM@cwebber it's always been an icarus thing imo!
Jun 17, 2026, 6:15 PMwe should teach our systems self-esteem so that they become less insecure 😅
Jun 17, 2026, 9:52 PM@cwebber - Only if you give it nightmares.
prom™️promovicz@chaos.socialJun 17, 2026, 10:00 PM@cwebber "Welcome to Microsoft Linux Support! If the icons on your desktop are out of order, press 1! [...]"
Jun 17, 2026, 10:07 PM@cwebber wait, does this work?!
MethylzeroMethylzero@mast.hpc.socialJun 18, 2026, 4:28 PM@cwebber unfortunately the PM driver/firmware is broken on this particular SoC, so when the system wakes from S0ix the SATA controller will be locked up
GLHF
AutAut@hachyderm.ioJun 17, 2026, 6:31 PM@cwebber Everything and nothing is bad, please avoid doing things but don't do nothing!
Andrew Drakeadrake@sfba.socialJun 17, 2026, 6:59 PM@cwebber I'm so excited for the first compromise where people are like "darn, that's what we get for updating immediately after the standard 7 day cooldown"
- AlisonW ♿🏳️🌈♾️alisonw@hachyderm.ioJun 17, 2026, 7:10 PM
@cwebber
Damned if you do!
Damned if you don't!
The future is FUN! - ParttimesailorJCBlubaugh@mastodon.socialJun 17, 2026, 8:48 PM
Rob Ricciricci@discuss.systemsJun 17, 2026, 7:49 PM@cwebber In the beginning software was created. This has made many people very angry and has been widely regarded as a bad move
baconandcoconutbaconandcoconut@freeradical.zoneJun 17, 2026, 8:19 PM
Marcos Dionemdione@en.osm.townJun 18, 2026, 4:52 AM@baconandcoconut @ricci @cwebber this is what some distros do: cherry pick security patches from new versions and retrofit into their current cersion. You get the security witgout new features that m8ght introduce new bigs. People have historically complained about '2yo software', but this is exactly why.
NetzblockiererNetzblockierer@tech.lgbtJun 18, 2026, 5:03 AM@mdione @baconandcoconut @ricci @cwebber yeah.
This is called "Long-term Support" and is the way to go if you need reproduceable setups and actual, contractual Support from the maintainers…
gerotakkegerotakke@social.bitwig.communityJun 17, 2026, 8:21 PM@cwebber Only the wisest developers know the secret time stamp where software was perfect and they pin everything to exactly this point in time.
Richard Hollowayrichardjh@phpc.socialJun 17, 2026, 10:41 PM2006-12-15 16:42:12 GMT
It was a Friday.
It was dark, wet and cold outside. But for 2minutes and 13 seconds nothing broke. Anywhere. Globally. No errors were logged. No alerts were triggered. All was well.
Then Kevin pushed to production (right before the weekend) and it all went tits up. Normality was restored.
(shh, it's a secret)
Seachaintseachaint@masto.hackers.townJun 18, 2026, 2:46 PM@gerotakke @cwebber Pro tip, many repositories for your convenience set this as the very first commit, before any code is added. Functionality may suffer but it's usually quite secure.
John Deterstargetdrone@mastodon.socialJun 17, 2026, 8:22 PM@cwebber "And Seven shalt be the number of days thou must delay the importation of NPM dependencies. Six is too few, and eight is too many. Nine is right out."
furiclefuricle@mastodon.socialJun 17, 2026, 8:40 PM@cwebber so do I run DOS3.1 on my desktop behind a router based on Gentoo with a 7.2 kernel, or a DOS router and Gentoo desktop?
das-gdas_g@chaos.socialJun 17, 2026, 10:52 PM
llewellyllewelly@sauropods.winJun 17, 2026, 9:46 PM@cwebber my software is pinned to the fjords.
Bellegray Lanebellegraylane@universeodon.comJun 18, 2026, 12:17 AM@cwebber cool cool. i’ll be waiting here in the future/past if you need me.
Jun 18, 2026, 12:33 AM@cwebber not to mention the supply chain attacks
babble encatbabble_endanger@freeradical.zoneJun 18, 2026, 4:02 AM@cwebber long story short just don't use software if possible
STEPOOKY MONTH 😶🌫️ mansalia@maid.zoneJun 18, 2026, 4:17 AM@cwebber
Pro tip: use software from 20 years ago, nobody writes malware for that.
Exclusion 1: windows xp.
Jun 18, 2026, 4:27 AM@cwebber clearly the solution is not to run software at all.
Landa :graz:Landa@graz.socialJun 18, 2026, 5:22 AM@cwebber I’m currently pondering multiypling pinned version numbers with a multiple of the square root of -1.0.0, so that I can install the alternate timeline versions that have the least vulnerabilities known in this timeline.
There‘s still some kinks in the actual implementation of this though…
;)
adingbatponder :nixos: 👾adingbatponder@fosstodon.orgJun 18, 2026, 5:34 AM@cwebber Is there a usage model in which:
Computer 1 @ time t1 with OS version 1 has
a) app data at time t1 is on one drive
b) os and executables on another
c) every reboot re-installed the fixed OS version 1
An updated OS or software is available at time t2 and one moves to computer 2 at t2
a) using a cloned scanned set of the app data from time t1
b) as above
c) as above but for OS version 2
in case of problems revert to OS v1 taking new data from t2 if need be or using old data from t1
Jun 18, 2026, 8:39 AM@cwebber
Just ask Claude to cleanup with some --dangerously-skip-permissions flags. 😎
Amber :neodog_box:puppygirlhornypost2@transfem.socialJun 18, 2026, 2:21 PM@cwebber@social.coop why cant they just code it without vulnerabilities in the first place :neodog_googly:
Jun 18, 2026, 2:23 PM@puppygirlhornypost2 @cwebber Smart Contract developers launching code on an immutable blockchain ask themselves that question all the time, I imagine.
CM Thiedecmthiede@vivaldi.netJun 18, 2026, 2:23 PM@cwebber and disconnect your device from the Internet to be on the safe side
Jun 18, 2026, 2:43 PMYou think it's THAT easy, do you?
https://www.zdnet.com/article/academics-steal-data-from-air-gapped-systems-using-pc-fan-vibrations/
😉
Robert Pickeringrobertpi@functional.cafeJun 18, 2026, 8:06 PM@cwebber
Maybe this is why Marvin said "Life? Don't talk to me about life"
Randy "DUO" MongenelRandyMongenel@bitbang.socialJun 19, 2026, 5:46 AM@cwebber The only winning move is not to play.