Ask HN: What in the world is taking Ubuntu so long?

46•linsomniac•1h ago

Ubuntu has CVE-2026-98432 marked as a 9.8, but yet it's coming up on a week with no update to fix it. It's still marked as "work in progress" (though at least now they've listed a mitigation):

https://ubuntu.com/security/CVE-2026-98432

I've had mitigations in place for a week, but this response is really shaking my confidence in Ubuntu. I'm just trying to understand what is going on with Ubuntu. Do they have too many kernels (that page is loooong), do they not have enough automation in the build/test pipeline, are their engineers overwhelmed?

We are moving into a world where there are going to be vastly more security issues; if you can't keep up now, where are you going to be in the next 6 months?

For a long time keeping on top of OS updates has been a huge part of keeping the attackers at bay. However, the world is changing.

Comments

adsfasf•44m ago

Aren't the patches out since a day?

guyisit•41m ago

Holy crap, they are showing in apt… why in the world wouldn’t they update the dang CVE page?!

I agree though, this took too long.

slekker•19m ago

Likely needs a human from another department to press a button, and they have not "synced" with the team publishing the patch.

AnotherGoodName•31m ago

It's Canonical. The company that literally asks for high school grades and a multi-page essay on any job application and will pass if you're not in the 99th percentile of year 9 maths even while requiring many years experience (which means you probably don't even know what your year 9 maths scores were). All the while they pay a fraction of any other Bay Area tech company.

What i just described isn't a joke or an exaggeration either. It's literally part of the application process and you can look this up.

Anyway they are quite simply hopelessly mismanaged and no one should be touching Canonical products at this point.

hmokiguess•25m ago

Can you share the backstory behind your gripe, this comment feels oddly specific to what appears unrelated to someone outside who doesn't know what you know. Makes me think there's some personal and deeper roots behind it

EDIT: I'm shocked.

pluc•22m ago

It's pretty straightforward, go have a look at their careers site and application form. What parent is saying I believe is that they're leaving a lot of talent on the table because of questionable hiring practices; talent that would help proactively (or at least reactively) mitigate things like this.

AnotherGoodName•18m ago

Look it up so it isn't just coming from me. It's a quick Google "Canonical hiring process" and there's no shortage of wait wtf was that type of posts on this. You can also go on their website and try to apply for any job just to be further shocked.

They ask for; A massive multi-choice questionaire. A massive free form list of questions. An ask for an essay. Grades from High school through to University. That's to start the process of many rounds of interviews followed by finally an interview with Mark Shuttleworth himself who's known to say no on vibes.

Personally i applied for a senior management role after ~30years working at multiple other very large and well known companies. The pay at canonical was literally 1/5th but i was curious. I was honest about my high school scores and immediately given a thanks for your time but we will pass dialog on their website after stating maths scores in year 9. I'm not even fucking kidding. Obviously i was gobsmacked. It was a blessing to get knocked back that early all things considered.

Not my post but has more detail and matches what i saw. Be amazed at the insanity in the leadership at Canonical that allows for this; https://www.reddit.com/r/recruitinghell/comments/15kj845/can...

We're talking put him in a straightjacket loony tunes type of shit when it comes to Shuttleworth. You can also look up various personal interactions. It's utterly fucking insane.

infamouscow•26m ago

This is a problem with LTS distro kernels in general. You're trading the feeling of stability at the kernel level for security updates.

chrisvalleybay•16m ago

There has been a workaround available since nov 2: https://ubuntu.com/blog/fixes-available-in-proposed-pocket-f...

InsidiousWombat•7m ago

The fix is to install Debian

Deus Ex

Gemini Omni 1.2 Flash

Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

FAA Begins Retiring Decades Old Floppy Disks from Air Traffic Control

Blender's UI and Runtime: Much Faster Than GPUI

Claude Code sends your email address to websites

Zero Hour: Telling time was a matter of survival and strategy during WWI (2014)

sshole

Living beyond the limits of survival: wood ants trapped in a gigantic pitfall (2016)

Kugelblitz – Mac-Native Google Earth Alternative

We've built an open-source feature flag server for 11 years

Multiplayer tanks that demolish real buildings from OpenStreetMap

MS Paint Remote Code Execution Vulnerability

Mbodi AI (YC P25) Is Hiring Research and Robotic Engineers

University libraries are being swarmed by AI bots, putting public access at risk

Ask HN: What in the world is taking Ubuntu so long?

From Linux to Wikipedia: How Volunteers Build the Internet

Lippitt-Knoster in Practice (Field Notes for Managing Complex Projects)

RIP Cybertruck. You Were Unloved, Unwanted, and Utterly Absurd

Pwn.college

Show HN: Agentic Identity Broker, OAuth Delegation for AI Agents

Where Each U.S. State Gets Its Tax Revenue From

AI for scientific discovery: How researchers use Claude

Hardcoded credentials and other issues in Tata Motors App

Chomsky and the Two Cultures of Statistical Learning (2011)

Britain to make salary disclosure in job ads mandatory

The Hackintosh Reborn

Nvidia Kubernetes Engine (NVKE)

Inkling 2 Small

Window Sweaters

Ask HN: What in the world is taking Ubuntu so long?

Comments

Deus Ex

Gemini Omni 1.2 Flash

Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

FAA Begins Retiring Decades Old Floppy Disks from Air Traffic Control

Blender's UI and Runtime: Much Faster Than GPUI

Claude Code sends your email address to websites

Zero Hour: Telling time was a matter of survival and strategy during WWI (2014)

sshole

Living beyond the limits of survival: wood ants trapped in a gigantic pitfall (2016)

Kugelblitz – Mac-Native Google Earth Alternative

We've built an open-source feature flag server for 11 years

Multiplayer tanks that demolish real buildings from OpenStreetMap

MS Paint Remote Code Execution Vulnerability

Mbodi AI (YC P25) Is Hiring Research and Robotic Engineers

University libraries are being swarmed by AI bots, putting public access at risk

Ask HN: What in the world is taking Ubuntu so long?

From Linux to Wikipedia: How Volunteers Build the Internet

Lippitt-Knoster in Practice (Field Notes for Managing Complex Projects)

RIP Cybertruck. You Were Unloved, Unwanted, and Utterly Absurd

Pwn.college

Show HN: Agentic Identity Broker, OAuth Delegation for AI Agents

Where Each U.S. State Gets Its Tax Revenue From

AI for scientific discovery: How researchers use Claude

Hardcoded credentials and other issues in Tata Motors App

Chomsky and the Two Cultures of Statistical Learning (2011)

Britain to make salary disclosure in job ads mandatory

The Hackintosh Reborn

Nvidia Kubernetes Engine (NVKE)

Inkling 2 Small

Window Sweaters