this post was submitted on 30 Apr 2026
215 points (98.2% liked)

Selfhosted

58862 readers
1198 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

  7. No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] thesmokingman@programming.dev 15 points 8 hours ago (2 children)

The only guaranteed fix is in the kernel. You’ll want to check your distro for the CVE. The disclosers very happily bring up all the distros affected but do not seem to have reached out to any of them to also patch. The CVE itself is still waiting for NVD analysis beyond its base score.

I’m not actively saying they did anything wrong but I am saying they’re blowing smoke about responsible disclosure.

[–] Danitos@reddthat.com 5 points 5 hours ago

They sell a vulnerability discovery program. IMO, they did this dubious responsable disclousure to get the extra marketing.

[–] ozymandias117@lemmy.world 9 points 7 hours ago

Yeah... It seems like they only reached out to the kernel, and not to any distros...

They also disclosed after 37 days rather than the more standard 90 days for everyone to patch