Reporting bugs before Ubuntu releases has never worked for me. They always land a bunch of major changes after the supposed "freeze" then they ignore all feedback because of the freeze. It's infuriating.
yeah, this is a bug. And yes, it should be fixed. But I don't think it will affect many users, I mean who has a 32000 -evels deep directory on their system?
Wow! Memory safety and such... Reminds me when a friend of mine wrote in IRC long time ago: "Hmm, tail just segfaulted." When I asked "Are you on Hurd?" he just replied "Yes."
You can use coreutils-from-gnu instead uutils. However since 26.04 build-essential depends on coreutils-from-uutils, it cannot be upgraded while coreutils-from-gnu is installed.
But it's clear that Ubuntu will remove coreutils, genuine sudo and other tools from the future versions. It's the direction, it's ideological and thus nor merit nor our feedback will change anything here.
You can use equivs to create a dummy coreutils-from-uutils package, as mentioned in the responses to that report.
It is frustrating that Canonical has no interest in fixing it, though. It makes it hard to take their claims seriously that you can still use GNU coreutils if you want.
So what is the way forward for Linux to have sandboxi g as strong as Android? Appimage everything? I know it's possible now hacking together things, but I mean by default and integrated.
Has the code quality in that repo gotten to a good point then? I haven't followed it much, but last I looked[1] (which was a few years ago) almost every tool I looked at in detail had pretty bad performance or correctness issues.
I’m a huge proponent of Rust and generally lean a lot closer to the RIIR mentality than most, but this effort seems to be such a waste of effort and resources.
There have been a dozen CVEs reported against all of coreutils in the past twenty years. The most recent audit of uutils-coreutils turned up forty-four CVEs.
By all appearances they’re replacing battle-tested and fundamental tooling which hasn’t been a problem with extremely amateurish Rust. The threading highlighted in the linked post above seems pretty egregious.
Neither. They basically see Rust as the future. They want to be able to attract young contributors and to hire young employees who are excited about Rust and who want the safety features. Bear in mind, the average age of the Linux developer is increasing. They also see technical benefits in Rust. And they are increasing test coverage of both the Rust tools and the tools written in C, IIRC.
Hmm, this doesn’t make sense. You simply don’t replace utilities with many decades of maturity and that “just work” with something that is not as mature. It will open all users of the distro to all sorts of subtle and not so subtle bugs. I for one don’t want to find myself staring at a mysterious segfault when I want to build the latest version of nodejs or flash a microcontroller. It’s such a pity; I have used Ubuntu for close to 23 years.
Ubuntu started out with a slogan claiming "linux for human beings", and it kept that reputation for well over a decade, with a heavy focus on the desktop.
You can split hairs however you want, but this created a legacy, and is why Ubuntu is still one of the top recommended distributions for beginners.
FWIW, Canonical did not reach out to any of us who maintain GNU coreutils before, after, or during the transition. Had we known, we could have easily warned them about the incompatibilities.
> Ubuntu devs have been nothing but good FOSS citizens
They have forced systemd despite feedback and genuine concerns.
They have forced fake sudo and uutils the same way.
So, ideology over merit. That doesn't mean that all of the Ubuntu devs are this way, but this means that the company is consistent in its ways to hurt Linux.
There have been twelve CVEs reported against coreutils in the past twenty years.
There were forty-four against this project in just the last audit.
I am all for RIIR in cases where it makes sense. This does not even remotely appear to be one of them. By all appearances the quality of the code is extremely amateurish at best. coreutils has not been a significant source of vulnerabilities in the past, and they’re replacing it with code written by amateurs that performs worse and already has a worse security track record.
I really don't understand why Canonical rushes this. If 'rm' can't remove all possible directory entries, that is a big issue:
Rush? This is an interim release (95% or so only tracks LTS's) that is not even out yet... Go file a bug reports if you have some time.
I did, and the original dev of the component fixed it within a few days. It was straightforward, a backwards reading of a spec, reordered.
The fix is still sitting unmerged many months later.
This surprised me since I thought the project was in heavy bugfix/compat mode. I won’t touch it until I see some velocity on open bugs.
1 reply →
I have. It has been an open bug upstream for years as well.
1 reply →
My experience is that filing bug reports to ubuntu is a complete waste of time. Not sure if it's different for paying users.
Reporting bugs before Ubuntu releases has never worked for me. They always land a bunch of major changes after the supposed "freeze" then they ignore all feedback because of the freeze. It's infuriating.
2 replies →
Let them first fix Snap.
There is no reason for anyone on any distro to use snap.
It will die so just leave it alone.
They need to kill snap ...
5 replies →
yeah, this is a bug. And yes, it should be fixed. But I don't think it will affect many users, I mean who has a 32000 -evels deep directory on their system?
What programmer or programming language can't iterate a loop more than 32000 times?!
18 replies →
That way of thinking just means it'll never be fixed
8 replies →
I mean, that should work... but you can see why that would be considered low priority right?
Wow! Memory safety and such... Reminds me when a friend of mine wrote in IRC long time ago: "Hmm, tail just segfaulted." When I asked "Are you on Hurd?" he just replied "Yes."
I was bummed when I came across this: https://github.com/trifectatechfoundation/sudo-rs/issues/129...
Can’t wait for the whole Rust rewrite of Linux!
You can use coreutils-from-gnu instead uutils. However since 26.04 build-essential depends on coreutils-from-uutils, it cannot be upgraded while coreutils-from-gnu is installed.
https://bugs.launchpad.net/ubuntu/+source/build-essential/+b...
For now you can list dependent packages manually in apt-get install: https://packages.ubuntu.com/resolute/build-essential
But it's clear that Ubuntu will remove coreutils, genuine sudo and other tools from the future versions. It's the direction, it's ideological and thus nor merit nor our feedback will change anything here.
> genuine sudo
That made me curious, it sounds related to this:
Ubuntu 26.04 Ends 46 Years of Silent sudo Passwords - 5 months ago (413 comments)
https://news.ycombinator.com/item?id=47464134
2 replies →
You can use equivs to create a dummy coreutils-from-uutils package, as mentioned in the responses to that report.
It is frustrating that Canonical has no interest in fixing it, though. It makes it hard to take their claims seriously that you can still use GNU coreutils if you want.
So what is the way forward for Linux to have sandboxi g as strong as Android? Appimage everything? I know it's possible now hacking together things, but I mean by default and integrated.
Has the code quality in that repo gotten to a good point then? I haven't followed it much, but last I looked[1] (which was a few years ago) almost every tool I looked at in detail had pretty bad performance or correctness issues.
[1] https://jackson.dev/post/rust-coreutils-dd/
> last I looked[1] (which was a few years ago)
You weren't kidding: it was exactly 4 years ago ("September 13, 2022").
The reason for existence of uutils is ideological, not technical. Thus code quality is of no use for the objective.
I’m a huge proponent of Rust and generally lean a lot closer to the RIIR mentality than most, but this effort seems to be such a waste of effort and resources.
There have been a dozen CVEs reported against all of coreutils in the past twenty years. The most recent audit of uutils-coreutils turned up forty-four CVEs.
By all appearances they’re replacing battle-tested and fundamental tooling which hasn’t been a problem with extremely amateurish Rust. The threading highlighted in the linked post above seems pretty egregious.
1 reply →
I bet you don't know the reason for existence
Everything online reminds of when Ubuntu switched to dash for init scripts or something. Good times.
Was there something wrong with how they are currently written or do they just want the badge that says they converted to Rust?
Neither. They basically see Rust as the future. They want to be able to attract young contributors and to hire young employees who are excited about Rust and who want the safety features. Bear in mind, the average age of the Linux developer is increasing. They also see technical benefits in Rust. And they are increasing test coverage of both the Rust tools and the tools written in C, IIRC.
My source is this interview with the VP of Engineering at Canonical on this topic: https://corrode.dev/podcast/s05e05-canonical/
License. GNU is copyleft and the new thing is permissive.
We might see a fracture open slowly. For me, even AGPL is not enough
Once they have a more permissive license, cui bono?
1 reply →
Hmm, this doesn’t make sense. You simply don’t replace utilities with many decades of maturity and that “just work” with something that is not as mature. It will open all users of the distro to all sorts of subtle and not so subtle bugs. I for one don’t want to find myself staring at a mysterious segfault when I want to build the latest version of nodejs or flash a microcontroller. It’s such a pity; I have used Ubuntu for close to 23 years.
then install the other tool. no one is holding a gun to your head. it isn't windows.
Like how one can easily not use snap on Ubuntu? /s
1 reply →
[flagged]
[flagged]
Ubuntu started out with a slogan claiming "linux for human beings", and it kept that reputation for well over a decade, with a heavy focus on the desktop.
You can split hairs however you want, but this created a legacy, and is why Ubuntu is still one of the top recommended distributions for beginners.
Cool aspirations but I don't think it has significant enterprise deployments compared to RHEL or SLES.
It looks like they have a few paying customers: https://technologychecker.io/technology/ubuntu
And they are slightly behind RHEL: https://commandlinux.com/statistics/linux-server-market-shar...
[flagged]
[flagged]
[flagged]
Legacy is a bit harsh...
FWIW, Canonical did not reach out to any of us who maintain GNU coreutils before, after, or during the transition. Had we known, we could have easily warned them about the incompatibilities.
1 reply →
> Ubuntu devs have been nothing but good FOSS citizens
They have forced systemd despite feedback and genuine concerns.
They have forced fake sudo and uutils the same way.
So, ideology over merit. That doesn't mean that all of the Ubuntu devs are this way, but this means that the company is consistent in its ways to hurt Linux.
1 reply →
> Ubuntu devs has been nothing good FOSS
Did you mean nothing "but" good?
2 replies →
The account you’re replying to has 8 karma across 13 comments in the last 11 years.
The other comments are about as good as the one you replied to.
Probably true, but the direction Linux is going these days is concerning
It's important to remember that this is a story about Ubuntu, and not Linux, and they are two very different projects with different motivations.
2 replies →
Care to elaborate?
15 replies →
[flagged]
I went upstream and started using Debian instead. Don't listen to the haters: it updates at about the same frequency as Ubuntu LTS.
Or just use Arch, and skip the pointless hype squad
Funny .. Arch started growing on me.
Or Pop!_OS that does not vibe slop their distro.
you are being sarcastic right?
[flagged]
The project was started long before LLMs existed.
[flagged]
There have been twelve CVEs reported against coreutils in the past twenty years.
There were forty-four against this project in just the last audit.
I am all for RIIR in cases where it makes sense. This does not even remotely appear to be one of them. By all appearances the quality of the code is extremely amateurish at best. coreutils has not been a significant source of vulnerabilities in the past, and they’re replacing it with code written by amateurs that performs worse and already has a worse security track record.
> There were forty-four against this project in just the last audit.
Was there an audit against coreutils? If not, it's not really apple-to-apple comparison.
3 replies →
From the company that distributed Amazon spyware (https://www.fsf.org/blogs/rms/ubuntu-spyware-what-to-do) and now turns Debian into Slopian. No thanks.