You might want to stop running atop

Re:You might want to stop running atop by emmelaich on Tuesday March 25, 2025 @10:56PM (#43478399)

There's a bunch of interesting recent commits from someone without a public signing key.

    Removed excess checks before free()
    Fixed possible wrong result bit shifting on 64bit after left op type overflow
    Fixed possible wrong result bit shifting on 64bit after left operand type overflow
    Fixed possible access out-of-bounds items array better check index before using

Could be legit or flawed. Or even fixes for the possible flaw.

[ Parent | on HN ]

Re:You might want to stop running atop by TheDong on Tuesday March 25, 2025 @11:26PM (#43478581)

1. Unsigned commits is the norm. It's weird to sign git commits. It's weird to upload your gpg key to github. gpg is a nightmare mess.

2. They aren't introducing the bug, those are all unreleased commits, so advice to "uninstall now" for something no distros are shipping would be silly.

3. The diff is trivial, you can read it and figure out if it looks like they're fixing a real exploitable thing. The answer is obviously no.

[ Parent | on HN ]

Re:You might want to stop running atop by twobiers on Wednesday March 26, 2025 @03:30AM (#43479701)

> It's weird to upload your gpg key to github. gpg is a nightmare mess.

I agree on that, but note that you're also able to use your existing SSH key for signing commits. https://docs.github.com/en/authentication/managing-commit-si...

[ Parent | on HN ]

Re:You might want to stop running atop by wejick on Tuesday March 25, 2025 @11:13PM (#43478518)

Seems they also are not coming PR. Sus

[ Parent | on HN ]

Re:You might want to stop running atop by TheDong on Tuesday March 25, 2025 @11:27PM (#43478586)

https://github.com/Atoptool/atop/pull/327 and https://github.com/Atoptool/atop/pull/325 are the PRs with those commits.

Come on.

[ Parent | on HN ]