Haelwenn /элвэн/ Apr 2

https://bugs.gentoo.org/971885 "app-editors/vim: Multiple High risk vulnerabilities in the past few days"

Pfahaha, makes me wonder if it's related to the vibe-code stuff it got in there lately.

971885 – app-editors/vim: Multiple High risk vulnerabilities in the past few days

Show threadsamApr 2

@lanodan I don't use vim so not for me to do really, but I'm just waiting for someone to package one of these "boring forks".

From what I saw, at least some of these vulnerabilities (not sure if it's the ones in this bug but wrt the ones going around recently), they got introduced pretty recently and couldn't be repro'd on say Debian stable, so any fork would likely be okay if it's from a little while ago..

Show threadHaelwenn /элвэн/ Apr 2
@thesamesam Well I don't use it either (I use app-editors/vis) so it's kind of me being on the peanut gallery, otherwise pretty sure I probably would have packaged one of those boring forks already.
Show threadsamApr 2
@lanodan Had a feeling. I feel like editors are one of those where you need someone who actually daily drives it to be sensitive to the various things that can go wrong, tweaked upstream defaults, blah blah
Show threadmid_kidApr 2
@thesamesam @lanodan I am a heavy user of vim, but have never poked much at its internals (or bothered learning vimscript) so I've yet to notice any of this ensloppification.
Looking around, it seems that too much of the software I rely on has started using AI overnight, making it unavoidable. Drew even has a blog post on replacing rsync with tar due to this, something I really don't see being anywhere near equivalent.
As someone who consistently fights losing fights, this doesn't seem worth it.
Show threadsamApr 2
@mid_kid @lanodan You're entitled to your nihilism but for me, it's resisting it, or not doing this at all anymore.
Show threadmid_kid

@thesamesam @lanodan FWIW, it does make me happy to see people fighting the fights I'm too tired to engage :)

Is there any big plans for gentoo regarding this? Will the project switch to non-AI alternatives where possible?

Apr 2 at 4:35pmWeb
Show threadsamApr 2

@mid_kid @lanodan See the discussion at https://public-inbox.gentoo.org/gentoo-dev/[email protected]/

I don't think we have a clear plan or rule yet, though e.g. a bunch of Perl modules have newer versions masked because they're now nearly "autonomously developed", some Python libraries are in package.deprecated or last-rited, ...

[gentoo-dev] Dealing with (potential) slop packages - Michał Górny

Show threadHaelwenn /элвэн/ Apr 2
@thesamesam @mid_kid Ah yeah, that thread, I gave up on reading it all after like ~6 emails due to the length, I'm fine with leaving it to ones involved in it.
Show threadsamApr 2

@lanodan @mid_kid I did try to focus on practical technical measures and I think I killed the conversation, but nobody has complained (and several have supported) what we've done with Perl.

One of those things where sometimes having the discussion is useful in that there's no clear wrong (or right) answer, so you have some licence to go ahead.