Language Selection

English French German Italian Portuguese Spanish

LWN

Syndicate content
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Updated: 4 hours 35 min ago

Google Infrastructure Security Design Overview

Saturday 14th of January 2017 03:46:22 PM
Google has posted an overview of its infrastructure security. It includes information about low-level details, such as physical security and secure boot, encryption of data at rest as well as communications between services and to users, keeping employee devices and credentials safe, and more. Undoubtedly there are lessons here for many different organizations. "This document gives an overview of how security is designed into Google’s technical infrastructure. This global scale infrastructure is designed to provide security through the entire information processing lifecycle at Google. This infrastructure provides secure deployment of services, secure storage of data with end user privacy safeguards, secure communications between services, secure and private communication with customers over the internet, and safe operation by administrators. Google uses this infrastructure to build its internet services, including both consumer services such as Search, Gmail, and Photos, and enterprise services such as G Suite and Google Cloud Platform."

Quantum Computing Is Real, and D-Wave Just Open-Sourced It (Wired)

Friday 13th of January 2017 09:12:45 PM
Wired covers the release of Qbsolv as open-source software (under the Apache License v2) by D-Wave, which is a company that makes quantum computing hardware. Qbsolv is "designed to help developers program D-Wave machines without needing a background in quantum physics". Further:

Qbsolv joins a small but growing pool of tools for would-be quantum computer programmers. Last year Scott Pakin of Los Alamos National Laboratory–and one of Qbsolv’s first users–released another free tool called Qmasm, which also eases the burden of writing code for D-Wave machines by freeing developers from having to worry about addressing the underlying hardware. The goal, Ewald says, is to kickstart a quantum computing software tools ecosystem and foster a community of developers working on quantum computing problems. In recent years, open source software has been the best way to build communities of both independent developers and big corporate contributors.

Of course to actually run the software you create with these tools, you’ll need access to one of the very few existing D-Wave machines. In the meantime, you can download a D-Wave simulator that will let you test the software on your own computer. Obviously this won’t be the same as running it on a piece of hardware that uses real quantum particles, but it’s a start.

Security advisories for Friday

Friday 13th of January 2017 05:03:29 PM

Arch Linux has updated ark (code execution), bind (multiple vulnerabilities), docker (privilege escalation), flashplugin (multiple vulnerabilities), irssi (multiple vulnerabilities), lib32-flashplugin (multiple vulnerabilities), and libvncserver (two vulnerabilities).

CentOS has updated java-1.6.0-openjdk (C7; C6; C5: multiple vulnerabilities) and kernel (three vulnerabilities).

Debian has updated rabbitmq-server (authentication bypass).

Debian-LTS has updated asterisk (two vulnerabilities, one from 2014).

Fedora has updated docker (F25: privilege escalation), libgit2 (F24: multiple vulnerabilities), and pcsc-lite (F24: privilege escalation).

Gentoo has updated postgresql (multiple vulnerabilities, two from 2015), runc (privilege escalation), and seamonkey (multiple vulnerabilities).

Mageia has updated flash-player-plugin (multiple vulnerabilities), php-ZendFramework2 (parameter injection), unzip (two vulnerabilities, one from 2014), and webmin (largely unspecified).

Oracle has updated java-1.6.0-openjdk (OL7; OL6; OL5: multiple vulnerabilities) kernel 2.6.39 (OL6; OL5:multiple vulnerabilities), kernel 3.8.13 (OL7; OL6: multiple vulnerabilities), and kernel 4.1.12 (OL7; OL6: multiple vulnerabilities).

Red Hat has updated java-1.6.0-openjdk (multiple vulnerabilities).

Scientific Linux has updated kernel (SL6: three vulnerabilities).

Masnick: Techdirt's First Amendment Fight For Its Life

Thursday 12th of January 2017 10:45:35 PM
Over at Techdirt, Mike Masnick writes about a libel suit filed against the site: "As you may have heard, last week we were sued for $15 million by Shiva Ayyadurai, who claims to have invented email. We have written, at great length, about his claims and our opinion — backed up by detailed and thorough evidence — that email existed long before Ayyadurai created any software. We believe the legal claims in the lawsuit are meritless, and we intend to fight them and to win. There is a larger point here. Defamation claims like this can force independent media companies to capitulate and shut down due to mounting legal costs. Ayyadurai's attorney, Charles Harder, has already shown that this model can lead to exactly that result. His efforts helped put a much larger and much more well-resourced company than Techdirt completely out of business."

The 4.9.3 and 4.4.42 stable kernels have been released

Thursday 12th of January 2017 07:38:28 PM
Greg Kroah-Hartman has announced the release of the 4.9.3 and 4.4.42 stable kernels. As usual, there are fixes throughout the tree and users of those kernel series should upgrade.

Thursday's security updates

Thursday 12th of January 2017 06:26:14 PM

Debian has updated bind9 (three vulnerabilities), ikiwiki (three vulnerabilities), and python-pysaml2 (XML external entity attack).

Debian-LTS has updated libav (two vulnerabilities).

Fedora has updated compat-guile18 (F25; F24: insecure directory creation), mingw-flac (F25: three vulnerabilities from 2015), qpid-java (F25: information disclosure), and springframework-security (F25: security constraint bypass).

openSUSE has updated flash-player (13.2: multiple vulnerabilities).

Red Hat has updated memcached (RHMAP4.2: two vulnerabilities).

Slackware has updated bind (denial of service), gnutls (multiple vulnerabilities), and irssi (multiple vulnerabilities).

SUSE has updated bind (SLE12-SP2,SP1; SLE12; SLE11-SP4,SP3: three vulnerabilities) and flash-player (SLE12-SP1: multiple vulnerabilities).

Ubuntu has updated bind9 (three vulnerabilities) and libvncserver (two vulnerabilities).

[$] LWN.net Weekly Edition for January 12, 2017

Thursday 12th of January 2017 02:18:25 AM
The LWN.net Weekly Edition for January 12, 2017 is available.

CVE-2016-9587: an unpleasant Ansible vulnerability

Wednesday 11th of January 2017 11:03:32 PM
The Ansible project is currently posting release candidates for the 2.1.4 and 2.2.1 releases. They fix an important security bug: "CVE-2016-9587 is rated as HIGH in risk, as a compromised remote system being managed via Ansible can lead to commands being run on the Ansible controller (as the user running the ansible or ansible-playbook command)." Until this release is made, it would make sense to be especially careful about running Ansible against systems that might have been compromised.

Update: see this advisory for much more detailed information.

[$] Python 2.8?

Wednesday 11th of January 2017 06:11:07 PM

The appearance of a "Python 2.8" got the attention of the Python core developers in early December. It is based on Python 2.7, with features backported from Python 3.x. In general, there was little support for the effort—core developers tend to clearly see Python 3 as the way forward—but no opposition to it either. The Python license makes it clear that these kinds of efforts are legal and even encouraged—any real opposition to the project lies in its name.

Subscribers can click below for the full article from this week's edition.

Security updates for Wednesday

Wednesday 11th of January 2017 05:37:51 PM

Debian has updated icedove (multiple vulnerabilities).

Debian-LTS has updated tomcat7 (information disclosure).

Gentoo has updated bind (denial of service), botan (two vulnerabilities), c-ares (code execution), dbus (denial of service), expat (multiple vulnerabilities, one from 2012), flex (code execution), nginx (privilege escalation), ntfs3g (privilege escalation from 2015), p7zip (two code execution flaws), pgbouncer (two vulnerabilities), phpBB (two vulnerabilities), phpmyadmin (multiple vulnerabilities), vim (code execution), and vzctl (insecure ploop-based containers from 2015).

openSUSE has updated jasper (42.2, 42.1: multiple vulnerabilities).

Oracle has updated kernel (OL6: three vulnerabilities).

Red Hat has updated flash-plugin (RHEL6: multiple vulnerabilities), kernel (RHEL6.7: code execution), and kernel (RHEL6: three vulnerabilities).

SUSE has updated freeradius-server (SLE12-SP1,2: insufficient certificate verification) and LibVNCServer (SLE11-SP4: two vulnerabilities).

Ubuntu has updated kernel (16.10; 16.04; 14.04; 12.04: multiple vulnerabilities), linux-lts-trusty (12.04: multiple vulnerabilities), linux-lts-xenial (14.04: three vulnerabilities), linux-raspi2 (16.10; 16.04: two vulnerabilities), linux-snapdragon (16.04: two vulnerabilities), linux-ti-omap4 (12.04: two vulnerabilities), and webkit2gtk (16.04: multiple vulnerabilities).

Kadlec: The MongoDB hack and the importance of secure defaults

Wednesday 11th of January 2017 05:09:53 PM
Tim Kadlec looks at the ongoing MongoDB compromises and how they came to be. "Before version 2.6.0, that wasn’t true. By default, MongoDB was left open to remote connections. Authentication is also not required by default, which means that out of the box installs of MongoDB before version 2.6.0 happily accept unauthenticated remote connections."

digiKam 5.4.0 is released

Tuesday 10th of January 2017 05:45:44 PM
The digiKam team has announced the release of version 5.4.0 of the digiKam Software Collection, a photo editing system. "This version introduces several improvements to the similarity search engine and a complete re-write of video file support." Under the hood, digiKam has been fully ported to the QtAV framework to handle video and audio files.

Synfig 1.2.0 released

Tuesday 10th of January 2017 05:29:19 PM
Synfig Studio 1.2.0, a 2D animation system, has been released. This version features a completely rewritten render engine and new lipsync features, along with many improvements and bugfixes.

Tuesday's security advisories

Tuesday 10th of January 2017 04:53:04 PM

Arch Linux has updated icoutils (code execution).

CentOS has updated gstreamer-plugins-bad-free (C7: three code execution vulnerabilities), gstreamer-plugins-good (C7: multiple vulnerabilities), gstreamer1-plugins-bad-free (C7: multiple vulnerabilities), and gstreamer1-plugins-good (C7: multiple vulnerabilities).

Debian-LTS has updated python-crypto (denial of service).

Gentoo has updated adobe-flash (multiple vulnerabilities), python (two vulnerabilities), and tiff (multiple vulnerabilities).

Mageia has updated nvidia304, nvidia340 (three vulnerabilities) and xen (multiple vulnerabilities).

openSUSE has updated irssi (42.2, 42.1, 13.2; SPH for SLE12: multiple vulnerabilities).

Scientific Linux has updated subscription-manager (SL7: information disclosure).

[$] The long road to getrandom() in glibc

Monday 9th of January 2017 10:33:57 PM
The GNU C library (glibc) 2.25 release is expected to be available at the beginning of February; among the new features in this release will be a wrapper for the Linux getrandom() system call. One might well wonder why getrandom() is only appearing in this release, given that kernel support arrived with the 3.17 release in 2014 and that the glibc project is supposed to be more receptive to new features these days. A look at the history of this particular change highlights some of the reasons why getting new features into glibc is still hard.

Kernel prepatch 4.10-rc3

Sunday 8th of January 2017 11:21:08 PM
The 4.10-rc3 kernel prepatch is available for testing. Linus says: "It still feels a bit smaller than a usual rc3, but for the first real rc after the merge window (ie I'd compare it to a regular rc2), it's fairly normal."

Vault CFP deadline approaching

Saturday 7th of January 2017 08:03:51 PM
The Vault Storage and Filesystems conference will be held March 22 and 23 in Cambridge, MA, USA, immediately after the Linux Storage, Filesystem, and Memory-Management Summit. The call for presentations expires on January 14, and the conference organizers would really like to get a few more proposals in before then. Developers interested in speaking at a technical Linux event are encourage to sign up.

(Also, don't forget the LWN CFP deadlines calendar, which is a good way to stay on top of conference proposal deadlines.)

My WATCH runs GNU/Linux And It Is Amazing (LearntEmail)

Friday 6th of January 2017 08:45:59 PM
The LearntEmail blog has a look at running AsteroidOS on the LG Watch Urbane smartwatch. "It looks like a watch, it smells like a watch, but it runs like a normal computer. Wayland, systemd, polkit, dbus and friends look very friendly to hacking. Even Qt is better than android, but that's debatable. My next project - run Gtk+ on the watch :)" (Thanks to Paul Wise.)

Security updates for Friday

Friday 6th of January 2017 04:52:34 PM

Debian-LTS has updated pcsc-lite (privilege escalation).

Fedora has updated flac (F25: three vulnerabilities from 2015), pcsc-lite (F25: privilege escalation), php-PHPMailer (F25: code execution), subversion (F25: denial of service), thunderbird (F25: multiple vulnerabilities), and tinymce (F25: cross-site scripting).

Mageia has updated bash (code execution), thunderbird (multiple vulnerabilities), tor (denial of service), and unrtf (code execution).

openSUSE has updated kopete (SPH for SLE12; 42.2, 42.1, 13.2: encryption botch).

Red Hat has updated puppet-tripleo (OSP10.0: access restriction bypass).

Ubuntu has updated exim4 (information leak).

Stable kernel updates 4.9.1, 4.8.16, and 4.4.40

Friday 6th of January 2017 01:20:18 PM
The 4.9.1, 4.8.16, and 4.4.40 stable kernel updates have been released; each contains the usual collection of important fixes.

More in Tux Machines

Linux 4.10-rc5

Things seem to be calming down a bit, and everything looks nominal. There's only been about 250 changes (not counting merges) in the last week, and the diffstat touches less than 300 files (with drivers and architecture updates being the bulk, but there's tooling, networking and filesystems in there too). Read more Also: Linus Torvalds Announces Fifth Linux 4.10 Kernel RC, Everything Looks Nominal Linux 4.10-rc5 Released, Now Codenamed "Anniversary Edition"

Fedora 26 Linux to Enable TRIM for Better Performance of Encrypted SSD Disks

According to the Fedora 26 release schedule, the upcoming operating system is approaching an important milestone, namely the proposal submission deadline for system-wide changes, which is currently set for January 31. Read more Also: Fedora 26 Planning To Enable TRIM/Discard On Encrypted Disks

New CloudLinux 7 and CloudLinux 6 Linux Kernel Security Updates Pushed Into Beta

CloudLinux's Mykola Naugolnyi is informing users of the CloudLinux 7 and CloudLinux 6 enterprise-ready operating systems to upgrade their kernel packages immediately if they are using the Beta channel. Read more

KDE Neon Installer

  • KDE Neon Has Stylish New Install Wizard
    KDE Neon has adopted distro-agnostic Linux installer ‘Calamares’ its unstable developer edition. Calamares replaces the Canonical-developed Ubiquity installer as the default graphical installer used when installing the Ubuntu-based OS on a new machine. The stylish install wizard is already in use on a number of other KDE-based Linux distributions, including Chakra Linux and Netrunner.
  • KDE neon Inaugurated with Calamares Installer
    You voted for change and today we’re bringing change. Today we give back the installer to the people. Today Calamares 3 was released. It’s been a long standing wish of KDE neon to switch to the Calamares installer. Calamares is a distro independent installer used by various projects such as Netrunner and Tanglu. It’s written in Qt and KDE Frameworks and has modules in C++ or Python.