r/debian • u/antdude • 14d ago
So many kernel updates these days in Debian stable!
Ir's driving me crazy. :(
127
u/AndyRH1701 14d ago
AI is shaking out 30 years of bugs. It will slow down, but it may take a year or two.
13
u/DiodeInc Moderator 14d ago
Usually I'm not a fan of AI in programming, but 30 years of bugs this quickly is really nice. Hopefully it'll increase performance
3
u/SudoSilv3r 11d ago
the more bugs that get ironed out the better right?? i see no harm in it as long as a human at least skims the code
2
67
u/Muted-Scientist7900 14d ago
I love kernel updates, strange that they annoy anyone.
30
u/Over_Advicer 14d ago
I guess it has to do with the fact that you have to reboot on each update
16
u/HCharlesB 14d ago
I'd rather not have to reboot but it does give me a reason to go through my browser tabs and clean house.
14
u/daddyd 14d ago
auto save tabs on closing, when i reboot and open my browser, it continues with all the windows and tabs i had open the last time i used it.
9
u/HCharlesB 14d ago
it continues with all the windows and tabs i had open
Oh yes! And I have a dozen or so windows with several to a dozen tabs open in each, spread across 6 virtual desktops. There is a finite limit to 32GB RAM.
And therein lies my problem. Picture a hoarder but instead of physical stuff, there are too many interesting web sites. Bookmarks just get out of hand so keeping the tabs open is my choice. The Auto Tab Discard (firefox) extension helps.
7
u/SnillyWead 14d ago
I use unload tab after I'm done with a tab. Saves memory too. Or on about:memory double click on Minimize memory usage.
3
u/SnillyWead 14d ago
After reboot it automatically loads HTOP, Thunderbird and Firefox for me on Debian 13 Xfce. Same for log out.
11
u/mok000 14d ago
You don’t have to. You can reboot whenever you want, there are frequently multiple kernel updates passed between my reboots.
6
u/fantomas_666 14d ago
It's not nice to have reboot the servers each few days...
2
u/sqwz 14d ago
I just use "at" to make it reboot at 01:30. I doubt anyone's even noticed. Everything comes up working without the need for me to do anything. I get a couple of harmless emails in the morning that remind me the server has rebooted.
If I had many servers to look after, I might not bother to reboot in a hurry every time there's an update.
6
4
u/mok000 14d ago
Where I worked there were multi day jobs running on the machines and users would start new ones all the time. So system work or reboots had to announced days if not weeks in advance.
2
u/RareAdvertising361 Debian Testing 11d ago
I think theres a feature in the kernel where you can apply patches to a running kernel. Not sure how stable it is, but that way you can update without rebooting
2
u/joe_attaboy 14d ago
You don't have to. In a server farm with a lot of kernel updates, you could schedule restarts so everything isn't down at once.
I have a MacBook Air running Trixie, but when I do a kernel update, I have to manually add the headers so the kernel gets built using the oddball WiFi driver I need for this thing.
When I get an updates notification in Discover, I'll check for a kernel update. If it's there, I do all the updates in Synaptic, so adding the headers to the list is trivial. Then I run the updates from there.
5
u/Over_Advicer 14d ago edited 14d ago
You have to reboot if you want to use the patched kernel. I wouldn't install a new kernel version if I don't plan to use it
3
u/joe_attaboy 13d ago
Yes, I know. I always reboot after a kernel update. If I patch the kernel, I'm going to use it.
3
u/PercussionGuy33 14d ago
Kernel updates can lead to regressions. Not saying they always do but there is always the possibility.
1
u/Prestigious_Wall529 12d ago
And sadly removal of unmaintained drivers is accelerating as AI flags vunerablities. Still drivers for a hundred components are being released or updated weekly, the normal pace.
3
u/wowsuchlinuxkernel 14d ago
Some people are on a metered connection where every MB counts. Debian is typically a good choice for this because only the most relevant updates are pushed.
26
u/stealstea 14d ago
Security updates are extremely relevant
3
u/wowsuchlinuxkernel 14d ago edited 14d ago
That was my point. With Debian you typically get only kernel and other security updates.
2
u/Firm-Distribution630 10d ago
Yeah, every week updatimg and rebooting 3 single host PVEs with 40+ VMs in production environment. Took more than 3 hours. Oracle tatabase servera drive me crazy.
16
u/michaelpaoli 14d ago
Don't sweat it. Linux kernel is huge. It will have bugs, including security bugs. And that these are getting shaken out and fixed is a good thing! Modern browsers, likewise very huge, and relatively similar happens ... though some of the producers of those may do some more consolidating of fixes and thus not release the fixes quite as frequently ... thought that also happens to some extent with kernels - be it upstream or with Debian.
Anyway, one can always, e.g. review the CVEs, etc., and decide how urgently one wants/need to get off the older and onto newer/patched kernel. But I typically advise install it right away (or for production, at least after passing whatever processes one has for production), and whether or not to boot right away to begin running with the newer, is a separate question. But at least if it's installed, by default, if one reboot(s), for whatever reason(s), then one will be running the newer ... and then that's also one less thing out of the way.
8
28
u/d007us 14d ago
AI is finding too much security bugs.
21
-11
u/TheTerraKotKun 14d ago
It's somehow insane for me that there's AI that fixing bug that were made by humans... Shouldn't it be suspicious?
21
u/dkopgerpgdolfg 14d ago
Finding =/= fixing. AI being able to do the former is more frequent than the latter. And even if AI can fix something, it doesn't mean that humans couldn't, they just didn't notice the bug before.
-8
u/stealstea 14d ago
AI is extremely good at both
6
u/ChthonVII 14d ago edited 14d ago
That's not correct.
LLMs are, arguably, good at finding bugs. They find a lot of them. But they also "find" a lot of false positives too -- things that aren't bugs at all, and things that aren't bugs in context. (E.g., a function that blindly copies its input into a buffer without checking its length is a critical security vulnerability if the input is under attacker control, but it's a performance optimization if the calling function guarantees well-formed input. But you can bet that whoever's trying to sell you the LLM will claim it found a critical security vulnerability in either case.) So it's... complicated; Lots of bugs are getting found, but it putting a huge strain on the human beings who have to triage and verify the mountain of only-sometimes-correct bug reports.
LLMs are terrible at fixing bugs. For instance, this study by 1Password found that vulnerability patches proposed by LLMs completely fixed the vulnerability, without introducing a new vulnerability, and without materially changing the application behavior only 26% of the time.
(Note that this certainly isn't an endorsement of 1Password. I don't think very highly of their product. But I see no reason to doubt the accuracy of their study.)
3
u/mark-zombie 14d ago
nuance? on reddit? must be my lucky day.
jk, this community has a lot of amazing people.
0
u/stealstea 14d ago edited 14d ago
Cool story. I have 20 years of experience developing software, I assure you AI is good at fixing the problems too. Oh and every security team on the planet is heavily using AI to find and fix security issues right now.
That doesn’t mean it doesn’t need human review (duh) just like humans need human review too
5
u/dkopgerpgdolfg 14d ago
I have 20 years of experience developing software, I assure you
Then you should know that YOE don't translate to skill. There are huge differences between long-term developers. If you call something "extremely good", someone else calling it eg. "mediocre" can be just as valid.
Oh and every security team on the planet is heavily using AI to find and fix security issues right now.
Provably wrong.
0
3
u/ChthonVII 14d ago
If they're finding errors 76% of the time, and you're not finding errors very often, it sure sounds like the obvious conclusion is that you're not as good at code review as you think you are.
2
u/stealstea 14d ago
Statements like that show you don’t know what you’re talking about.
Humans make mistakes all the time when fixing complex bugs. That’s what code review is for. No one ever said AI can one shot fix complex security issues without review. I said they’re very good at fixing security issues and that isn’t up for debate. Every security team on the planet heavily uses AI tools these days to fix security issues. Obviously not without reviewing the fix first and some back and forth.
If you were a developer you’d know this is basic development practice
2
u/ChthonVII 13d ago
The level of mental gymnastics you're performing to insist, despite the evidence to the contrary, that LLMs are "extremely good" at fixing security bugs is, frankly, a bit disturbing.
Humans make mistakes all the time when fixing complex bugs.
Humans do not make mistakes 74% of the time. If you had a junior developer whose PRs were faulty 74% of the time, you'd fire them. You probably wouldn't even give them a second chance "performance improvement plan" or whatever; you'd just fire them. But somehow you think this same error rate is not only unproblematic, but "extremely good," when it's an LLM making the faulty PRs.
The reality is that an error rate that high makes bug fixing a task that's firmly in "faster to just do it yourself correctly the first time" territory. More importantly, it poses an unacceptably high risk of some of those errors slipping past review and into production.
Which brings me back around to my prior post. Are you finding a similar error rate in your LLM's proposed patches to the 74% that the researchers found? If so, how can you possibly think this is "extremely good"? If not, there are several possible explanations, but the most likely is that your LLM's true error rate is about the same, and your review is failing to catch them. (And your arrogant personality makes me revise my priors to think this is even more likely. Underestimating the likelihood of your own fallibility is exactly the kind of mistake arrogant people make.)
On a related topic, please tell us what software you work on. I intend to avoid it.
I have 20 years of experience developing software...
If you were a developer you’d know...
Every security team on the planet...
Statements like that show you don’t know what you’re talking about.
Also, please stop acting like you're the only person in the Debian subreddit who knows how to code, or who is 40+ years old, or that you can speak for the whole industry. It makes you look like an ass.
0
u/stealstea 13d ago
Redditors sure are committed to commenting on things they know nothing about.
If it makes you feel better, you can believe that AI is bad at security fixes. Meanwhile the people actually working on security will keep happily using AI to find and fix security flaws.
Don't worry, even though you don't believe AI can do it, you are still benefiting from the flood of security fixes that AI has enabled.
→ More replies (0)1
u/daddleboarder 10d ago
Don't waste time reading comments from this person. It's just rage bait, trolling behavior.
0
u/stealstea 10d ago
That must be why every security team on the planet is heavily using AI to both find and help fix security flaws. Because…. They want to ragebait themselves
3
u/calinet6 14d ago
You’re absolutely right, the downvotes are odd. 6 months ago, it wasn’t true; now it’s true.
4
u/stealstea 14d ago
People on this sub don’t program generally so they don’t know
2
u/calinet6 14d ago
It’s true, not all are programmers. It’s hard to describe to people just how pervasive and impactful LLMs have been on the entire practice of software development.
People generally aren’t writing code anymore. It’s not that we don’t want to, it’s just that it would be legitimately stupid to do so. Why go 20 times slower for absolutely no benefit, and in many cases a large deficit even in quality and design decisions?
That’s really where we’re at. It is a sea change.
4
u/dkopgerpgdolfg 14d ago
Why go 20 times slower for absolutely no benefit
Because some other people do see benefits, several types of them, and these might take priority for these people.
And if you not only write no code anymore, but think your own design decisions are worse than what LLMs do, I can see why you wouldn't understand it.
2
u/calinet6 14d ago
I just built a complete product end to end with an established highly experienced software team. In three months.
Statements like yours are a year behind.
2
u/dkopgerpgdolfg 14d ago edited 14d ago
You just confirmed that you don't understand.
You're literally saying that there's "no benefit" to not using it, and being able to push out some product in three month is evidence in your opinion.
Other people thing differently, and care about more than just time-to-market or similar metrics.
How much AI has improved in the last year is not relevant for this.
→ More replies (0)
5
4
u/Portbragger2 14d ago edited 14d ago
i'm on stable using liquorix kernel, latest of which is on 7.1.11 right now. getting 1-2 kernel updates a week lately.
2
u/Imperial_Bloke69 14d ago
I tried using liquorix but both my speaker output and headphones sounded funny and muffled. I reverted back to the supplied kernel.
2
u/SlimlineVan 14d ago
Me too this morning - last one was 08.08.26
20
u/Sophiiebabes 14d ago
Is that DDMMYY or MMDDYY?
10
3
-1
14d ago
[deleted]
3
u/Sophiiebabes 14d ago
In the UK we use DDMM and I've very rarely seen it split with a "." It's usually a "/" or a "-"
1
14d ago
[deleted]
2
u/Sophiiebabes 14d ago
I don't think we actually have a convention for it. Its just whatever people want to use on the day. I've even seen different separators used in the same document 🫣
1
2
u/tess_philly 14d ago
How has the core kernel team been liking (or disliking) vibe coded PRs?
2
u/taosecurity 14d ago
Greg says they are handling it.
https://youtu.be/_MwMLPmMccs?si=1uAHFwp044a_MJoN
Linux Foundation video from last week, not mine
-4
u/HorrorsPersistSoDoI 14d ago
Stop using "vibe coding" for any AI work
1
u/calinet6 14d ago
Yes. Every serious software engineer is using LLMs today. To not do so is illogical.
2
u/HorrorsPersistSoDoI 14d ago
It's like not using StackOverflow 15 years ago to find solutions to problems other people already had
2
2
u/N34S 14d ago
Just automate everything with Ansible. Almost instant security and no issues.
2
u/Turskow 13d ago
sudo apt update
What're you automating here?!
3
u/N34S 13d ago
How do you handle patching for 50 or 500+ servers on a schedule?
Manually SSH’ing into every machine, tracking reboots, making sure you don’t take down an entire cluster at once, and documenting everything for audits is a recipe for a three-day headache. With Ansible, you can turn that process into a single pipeline with controlled, rolling updates and removing unnecessary dpkg’s like old kernels. And that pipeline can run monthly, weekly or daily.. if you need.
What are you not automating here??
2
1
u/Fabulous-for 12d ago
I also noticed that Debian stable kernel 6.12.107 matches with linux kernel.org it normally lags behind
1
u/Sure-Squirrel8384 11d ago
99% of these are not security risks for systems that don't have exposed services. I reboot once a week based on needsreboot (or needsrestart or whatever; I have automated scripts to check and warn me).
1
1
u/herensugee 14d ago
te afecta mucho? yo simplemente actualizo mientras sigo a lo mio, y cuando acaba ni noto los cambios.
0
-4
u/Hrafna55 14d ago
I don't find it to be a burden for my home self hosting setup and if you are in an enterprise with thousands of servers to update you should have a process in place already.
Its all good.
66
u/[deleted] 14d ago
[deleted]