4 comments

  • ptx1 hour ago
    Better to follow the link to the technical details and just read those: <a href="https:&#x2F;&#x2F;cdn2.qualys.com&#x2F;advisory&#x2F;2026&#x2F;03&#x2F;17&#x2F;snap-confine-systemd-tmpfiles.txt" rel="nofollow">https:&#x2F;&#x2F;cdn2.qualys.com&#x2F;advisory&#x2F;2026&#x2F;03&#x2F;17&#x2F;snap-confine-sys...</a><p>The article linked in the submission is more verbose but less clear and half of it is an advertisement for their product.
  • rglover13 minutes ago
    Semi-related: does anybody know of a reliable API that announces CVEs as they&#x27;re published?
  • ifh-hn1 hour ago
    I wonder if, and this is just speculating not trying to start an arguement, if this sort of thing could have happened in the simpler pre-snap, pre-systemd systems? More to the point is this a cause of using more complicated software?
    • dogleash1 hour ago
      Permission and timing gotchas in &#x2F;tmp predate snap and systemd. It&#x27;s why things like `mkstemp` exist.<p>I remember cron jobs that did what systemd-tmpfiles-clean does before it existed. All unix daemons using &#x2F;tmp run the risk of misusing &#x2F;tmp. I don&#x27;t know snap well enough to say anything about it makes it uniquely more susceptible to that.
      • SoftTalker34 minutes ago
        The mistake seems to be using a predictable path (&#x2F;tmp&#x2F;.snap) in a publicly-writable directory.
  • cyberpunk1 hour ago
    [flagged]
    • dgxyz31 minutes ago
      Rewrite tools in new language, get new exciting bugs!
    • delamon1 hour ago
      Rust cannot help you if race condition crosses API boundary. No matter what language you use, you have to think about system as a whole. Failure to do that results in bugs like this
      • bangaladore1 hour ago
        The bigger problem here is it seems like the rust utilities were rushed to be released without extensive testing or security analysis because <i>simply because they are written in rust</i>. And this isn&#x27;t the first serious flaw because of that.<p>Doesn&#x27;t surprise me coming from Canonical though.<p>At least that&#x27;s the vibe I&#x27;m getting from [1] and definitely [2]<p>[1] <a href="https:&#x2F;&#x2F;cdn2.qualys.com&#x2F;advisory&#x2F;2026&#x2F;03&#x2F;17&#x2F;snap-confine-systemd-tmpfiles.txt" rel="nofollow">https:&#x2F;&#x2F;cdn2.qualys.com&#x2F;advisory&#x2F;2026&#x2F;03&#x2F;17&#x2F;snap-confine-sys...</a> [2] <a href="https:&#x2F;&#x2F;bugs.launchpad.net&#x2F;ubuntu&#x2F;+source&#x2F;rust-coreutils&#x2F;+bug&#x2F;2111815" rel="nofollow">https:&#x2F;&#x2F;bugs.launchpad.net&#x2F;ubuntu&#x2F;+source&#x2F;rust-coreutils&#x2F;+bu...</a>
        • yjftsjthsd-h46 minutes ago
          The best discussion I can find for the official reasons for switching is <a href="https:&#x2F;&#x2F;discourse.ubuntu.com&#x2F;t&#x2F;carefully-but-purposefully-oxidising-ubuntu&#x2F;56995" rel="nofollow">https:&#x2F;&#x2F;discourse.ubuntu.com&#x2F;t&#x2F;carefully-but-purposefully-ox...</a> -<p>&gt; But… why?<p>&gt; Performance is a frequently cited rationale for “Rewrite it in Rust” projects. While performance is high on my list of priorities, it’s not the primary driver behind this change. These utilities are at the heart of the distribution - and it’s the enhanced resilience and safety that is more easily achieved with Rust ports that are most attractive to me.<p>&gt; The Rust language, its type system and its borrow checker (and its community!) work together to encourage developers to write safe, sound, resilient software. With added safety comes an increase in security guarantees, and with an increase in security comes an increase in overall resilience of the system - and where better to start than with the foundational tools that build the distribution?<p>So yes, it sounds like the primary official reason is &quot;enhanced resilience and safety&quot;. Given that, I would be interested in seeing the number of security problems in each implementation over time. GNU coreutils <i>does</i> have problems from time to time, but... <a href="https:&#x2F;&#x2F;app.opencve.io&#x2F;cve&#x2F;?product=coreutils&amp;vendor=gnu" rel="nofollow">https:&#x2F;&#x2F;app.opencve.io&#x2F;cve&#x2F;?product=coreutils&amp;vendor=gnu</a> only seems to list 10 CVEs since 2005. Unfortunately I can&#x27;t find an equivalent for uutils, but just from news coverage I&#x27;m pretty sure they have a worse track record thus far.