Same.

I wish I had seen this before pulling all that Cat-6a.

After reading that amazing title, I skimmed the whole article several times looking for the part about DNA existing outside the cells.

Initializing the http client is one of the very first things this text editor does in "app.run()": https://github.com/zed-industries/zed/blob/a7c9c24f40d7e9169... Line 497 suggests it fails without it.

There are hundreds of references to http requests in the source tree, though most seem associated with calling particular AI model providers.

This looks to be the telemetry struct: https://github.com/zed-industries/zed/blob/a7c9c24f40d7e9169...

It appears to crawl your worktrees collecting an inventory of the types of projects you have and is interested in certain named files specificaly: https://github.com/zed-industries/zed/blob/a7c9c24f40d7e9169...

Yeah, screw that.

I am literally shopping for a new editor. A once-a-decade thing for me. I want something that can effectively sandbox local models for code gen.

So I was looking at Zed yesterday. Cloned the repo. Then I noticed they were funded by our favorite VCs.

Between this and CVE-2026-31431 ("Copy Fail"), it seems like I dodged a bullet.

What I do is to have two things, a simple editor, I use helix for normal editing. And in a second terminal a docker container solution where I put opencode or claude in https://git.jeena.net/jeena/agent-container

I think that's why fork "Gram" exists. It strips all the weird parts and leaves just the editor.

By sandbox you mean limit to certain files, certain actions, or both?

I've been wanting to look into better emacs integration for agents. Imagine an agent making direct elisp function calls, or using macros... One could limit which functions are allowed to run similar to how cli harnesses work, but plug straight into LSP and etc.

"The starting insight — that splice() hands page-cache pages into the crypto subsystem and that scatterlist page provenance might be an under-explored bug class — came from human research by Taeyang Lee at Xint. From there, Xint Code scaled the audit across the entire crypto/ subsystem in roughly an hour. Copy Fail was the highest-severity finding in the run."

So, if anything, this might argue against the presence of huge quantities of high-severity bugs in this part of the Linux kernel (that could be found by "Xint Code"-class scanning systems).

There's a claim upthread that a straightforward variation works against /etc/passwd.

You can also just use this to patch libc and turn close() into close-but-also-give-me-a-root-shell().

No it hasn't.

Ubuntu before 26.04 LTS (released a week ago) are currently listed as vulnerable.

Debian other than forky and sid are currently listed as vulnerable.

This is a disgrace.

Disclosure timeline

    2026-03-23Reported to Linux kernel security team
    2026-03-24Initial acknowledgment
    2026-03-25Patches proposed and reviewed
    2026-04-01Patch committed to mainline
    2026-04-22CVE-2026-31431 assigned
    2026-04-29Public disclosure (https://copy.fail/)

kernel 6.19.14-arch1-1, the kernel in question from the parent comment, has been patched.

The lesson here being... compile your own kernel from git sources every few days?

Give up entirely on non-virtualized container security?

This is not sarcasm. I'd finally given in and started learning about docker/podman-style OCI containerization last week.

in this specific case, they offer an alternative mitigation if your chosen distro has not updated yet:

For immediate mitigation, block AF_ALG socket creation via seccomp or blacklist the algif_aead module:

    echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf
    rmmod algif_aead 2>/dev/null

Thanks!

I'd do 'umask 133' in front of the echo out of paranoia.

Out of curiosity, was the asterisk after '2>/dev/null' intentional? I had not seen that idiom before.

the asterisk is my oops, trying to format the comment in italics to differentiate my comment from the text provided by the author. sorry for the confusion

And I would do chattr +i disable-algif.conf

are you sure containerization would be more secure? this is also a rootless podman escape. the lesson here is to not give random people shell access to your systems.

I mean, most Kernel version literally got the patch 2026.04.30, so just today.

I don't know about LLMs, but I tried an Intel card when Ubuntu Wayland couldn't initialize a 2 year old Nvidia. It just works.

That is just Linux and politics. Linux wants to force vendors to open source theirs, Intel plays along, Nvidia as the market lead does not, so you have to use their proprietary one, which most distros do not ship by default.

Interesting. I had read that Intel's Linux drivers were far behind their Windows versions. I haven't checked in a few months though.

That is compatible with what the comment you are replying: you don't need much to beat nVidia open drivers for linux. Intel linux drivers might be behind their Windows drivers, still ahead of nVidia's.

nVidia has zero incentives to play open for linux, they release the binary blobs, next to zero docs and support, and you deal with it. The last nVidia card I bought was 20 years ago, and it was so bad for linux (low perf and freezes for the open drivers, manual re-install hell and pray on each kernel update for the binaries) that I switched to ATI. Since then, ATI or Intel always were decent with zero headaches.

The X Window developers were mostly just making it up as they went along. Practically no one expects mouse buttons to work like that.

Unix workstations had mice with 3 buttons. The Mac had only one. Windows, Amiga, Atari had two. The Unix developers had choice that others didn't have. They came up with a use that existed forever. Now someone decided to remove the default for no apparent reason. It's like the Android product managers continuing to change the color, size and gesture to answer a phone call: every release, the first call is an exercise in managing frustration.

The number of graphical Unix workstation users during at the time of widespread adoption of Windows and Mac was utterly insignificant.

You cannot compare it to Android.

I absolutely love that these are all available online.

But it does call into question my decision to haul 100's of kg of these things around every time I moved residence over the last 40+ years.

I am sure it doesn't. For one thing, it is much quicker to leaf through the physical copy than to browse the PDF.