iirc the Linux kernel dropped support for pre-Pentium x86 in the last few years, so any distro with 486 support now would be using an unmaintained kernel.

I think if you want a maintained operating system for your 486 today, NetBSD is probably the thing to run.

AUR is bad, actually

But why rewrite programs that existed for decades and have proven their stability and safety? Rewriting them to Rust won’t make them safer, it will just introduce the kind of issues original versions have got fixed long ago.

Of course rewriting them will introduce some new issues, but it will also eliminate classes of bugs from which there are definitely still a great many in old “stable” C code (bugs which are now being discovered and will presumably continue to be discovered at a much faster pace due to LLMs).

The whole project is about abolishing GPL. And Rust is just an excuse.

I don’t think it is just an excuse; I believe that improving security is also a goal… but removing GPL code is clearly also part of their motivation :(

No, it is not a good time. A project like Ubuntu should now be in freeze as they had about 3 months before release

This bug was reported (and resolved by rolling back to the GNU coreutils version of cp) on June 30, a little over 15 weeks prior to the scheduled release date.

Which distros have a feature freeze that far in advance?

Ubuntu hasn’t even scheduled theirs for this release yet; if you edit that url to look at previous releases’ schedules you can see their feature freeze and debian import freezes are typically about 2 months prior to release. (See here for descriptions of all of the different types of freezes…)

What an absolute shitshow

I’d say the month of June is actually a good time to be breaking and fixing things in a release that is due to come out in (checks notes) October.

As others have said it is a huge amount of work to maintain a fork of such a complicated piece of software.

Especially around security: web browsers constantly process potentially-malicious data, which gives them a large attack surface. Every browser regularly has new vulnerabilities discovered which must be fixed. Hard forking a browser means that, even ignoring any bugs in the new code the fork has added, every time a bug is discovered and fixed in the code they forked from someone needs to analyze the upstream’s fix and port it to the fork. The more they diverge, the more work this is. Failing to do this work lets any malicious website exploit the bugs and install malware on users’ computers.

One shot rewriting the whole test suite

tridge’s blog post makes it clear that this was not “one-shotted” at all.

You should read the whole thread

I regret reading it; I’ll assume in good faith that it wasn’t LLM generated but it is ironically as confidently wrong as if it were.

It almost (and should have) lost me when it started by quote-agreeing with someone else saying “rsync was basically done until the maintainer discovered vibecoding” - no, pay attention, it was not “basically done”, there were/are a mountain of CVEs!

But then this got my interest:

This does not “translate tests into pytest” or a unit testing framework, it writes its own testing framework where tests are whole python scripts that redefine basic test functions in every script. Surely there would be a single way to “run rsync and get the results” - nope, well, there is, but then every test file will randomly redefine its own _run_and_capture function.

tridge says he has used pytest on other projects and had good reasons not to use it here; I’m inclined to believe him.

But the notion of every test defining its own way to invoke rsync sounded like a valid criticism, and an easy one to verify, so I checked: It turns out that there is in fact a common run_rsync function which is used by the majority of the tests. One test defines its own _run_and_capture function (which differs in that it writes the output to a file, for reasons I didn’t investigate), and it looks like a few others invoke rsync other ways, but the majority of them use the common function.

So, that rambling thread’s sole concrete criticism of rsync’s new python tests turns out to be false.

get ready for high-speed public transportation with US-American characteristics

that kernel release (which most distros have still not shipped yet) fixes only one of the two vulnerabilities (CVE-2026-43284); afaik even upstream still doesn’t have a patch for the second one (CVE-2026-43500) at this time.

(for people relying on Linux privilege separation, here are mitigation instructions.)

Are there tradeoffs?

there are many, and the README lists far more now than it did 10 days ago when I first posted this.

it’s for devices which Graphene doesn’t support

You mean GrapheneOS? Or is GraphiteOS a different OS I’ve not heard of?

two years later: GraphiteOS is now a thing that exists https://github.com/cawilliamson/treble_graphiteos

cc @InternetCitizen2@lemmy.world

unfortunately, like its predecessor (Nokia’s Maemo/Meego), Jolla’s SailfishOS has never been (and has never had plans to be) fully free/libre open source software.

many components of it are freely licensed, but not nearly enough to constitute an actual mobile operating system you can use.

(well actually) you forgot Poland