NetBSD 11.0 Released
The NetBSD project has announced the release of NetBSD 11.0, a significant update to their highly portable Unix-like operating system. This release notably features transparent disclosure of several open security issues, a candid approach attributed to the accelerated discovery of vulnerabilities by AI tools. Such openness offers a rare glimpse into the challenges of maintaining complex software in the modern security landscape, resonating with developers and system administrators on HN.
The Lowdown
The NetBSD project proudly presents the release of NetBSD 11.0, marking a major milestone for the enduring open-source operating system known for its exceptional portability. This latest version arrives with an unusual degree of transparency, openly acknowledging several known security vulnerabilities. The project attributes this decision to the rapid increase in security issue discovery, partly influenced by AI tools, opting for prompt release over further delays to patch every new finding.
- NetBSD 11.0 is now officially available for download, with installation images segmented for various media types.
- Users are advised to choose between smaller CD-ROM images (<700MB) or full-sized DVD images, and to prefer .img files for flash-based media like USB drives.
- Comprehensive installation notes and specific bootable ARM images are provided to assist users across diverse hardware architectures.
- Crucially, the release candidly lists three specific open security issues:
- A missing local user privilege check in
hdaudio(4), with a manual workaround available. - A remotely triggerable null pointer dereference in
ipfilter, which is not included in default kernel builds. - A use-after-free vulnerability in
pf, also deprecated and not in default kernel builds.
- A missing local user privilege check in
- These outstanding security problems are slated to be resolved and committed to the stable branch shortly after the 11.0 release, with a target for NetBSD 11.1 within two months.
- Despite efforts to streamline and automate the release process, manual interventions and network transfer speeds remain limiting factors.
In essence, NetBSD 11.0 is a testament to the project's commitment to regular updates and user transparency, navigating the complexities of modern software development and security challenges with an honest and direct approach to its community.