Ask HN: What in the world is taking Ubuntu so long? (undefined)
33 points by linsomniac an hour ago
Ubuntu has CVE-2026-98432 marked as a 9.8, but yet it's coming up on a week with no update to fix it. It's still marked as "work in progress" (though at least now they've listed a mitigation):
https://ubuntu.com/security/CVE-2026-98432
I've had mitigations in place for a week, but this response is really shaking my confidence in Ubuntu. I'm just trying to understand what is going on with Ubuntu. Do they have too many kernels (that page is loooong), do they not have enough automation in the build/test pipeline, are their engineers overwhelmed?
We are moving into a world where there are going to be vastly more security issues; if you can't keep up now, where are you going to be in the next 6 months?
For a long time keeping on top of OS updates has been a huge part of keeping the attackers at bay. However, the world is changing.
AnotherGoodName 13 minutes ago
It's Canonical. The company that literally asks for high school grades and a multi-page essay on any job application and will pass if you're not in the 99th percentile of year 9 maths even while requiring many years experience (which means you probably don't even know what your year 9 maths scores were). All the while they pay a fraction of any other Bay Area tech company.
What i just described isn't a joke or an exaggeration either. It's literally part of the application process and you can look this up.
Anyway they are quite simply hopelessly mismanaged and no one should be touching Canonical products at this point.
hmokiguess 7 minutes ago
Can you share the backstory behind your gripe, this comment feels oddly specific to what appears unrelated to someone outside who doesn't know what you know. Makes me think there's some personal and deeper roots behind it
pluc 4 minutes ago
It's pretty straightforward, go have a look at their careers site and application form. What parent is saying I believe is that they're leaving a lot of talent on the table because of questionable hiring practices; talent that would help proactively (or at least reactively) mitigate things like this.
adsfasf 26 minutes ago
Aren't the patches out since a day?
guyisit 23 minutes ago
Holy crap, they are showing in apt… why in the world wouldn’t they update the dang CVE page?!
I agree though, this took too long.
slekker a minute ago
Likely needs a human from another department to press a button, and they have not "synced" with the team publishing the patch.
infamouscow 8 minutes ago
This is a problem with LTS distro kernels in general. You're trading the feeling of stability at the kernel level for security updates.