Language Selection

English French German Italian Portuguese Spanish

LWN

Syndicate content
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Updated: 4 hours 41 min ago

Kernel prepatch 4.2-rc4

Monday 27th of July 2015 03:42:44 AM
The fourth 4.2 prepatch is out for testing. Linus says: "I really wish that things were calming down, but it hasn't happened quite yet. It's not like this is particularly big or scary, but it's also not at the stage where it's really starting to get quiet and the bugs are really small and esoteric."

Plasma Mobile launched

Saturday 25th of July 2015 11:05:47 AM
Here is the announcement for Plasma Mobile, a KDE-based platform for smartphones. "The goal for Plasma Mobile is to give the user full use of the device. It is designed as an inclusive system, intended to support all kinds of apps. Native apps are developed using Qt; it will also support apps written in GTK, Android apps, Ubuntu apps, and many others, if the license allows and the app can be made to work at a technical level." There is a prototype build available for Nexus 5 phones.

etcd 2.1 released

Saturday 25th of July 2015 08:18:30 AM
The etcd 2.1 release is out. "For a quick overview, etcd is an open source, distributed, consistent key value store for shared configuration, service discovery, and scheduler coordination. By using etcd, applications can ensure that even in the face of individual servers failing, the application will continue to work. " New features include a new authentication/authorization API, various robustness improvements, better logging, and a new metrics API.

GNUnet: IETF getting cold feet about P2P Names?

Friday 24th of July 2015 09:28:37 PM

The GNUnet blog has this story about recent resistance from the IETF toward the standardization of "special use" domain names (such as .onion or .gnu) "to reduce the likelihood of ICANN accidentally creating a conflicting gTLD assignment."

Despite the provisions made in RFC 6761, the article notes that "there are also a number of DNS-centric people with a totally lack of alacrity in the dnsop WG to continue to stall the process by repeating arguments that were exchanged dozens of times in hundreds of e-mails." Among those offering resistance, it reports, is Internet Architecture Board Chair Andrew Sullivan, who "says the IETF should not support special use domain names threatening the DNS business model."

OpenSUSE Leap 42.1 milestone 1 released

Friday 24th of July 2015 09:03:02 PM
The first development release of the upcoming openSUSE 42.1 distribution is now available. "Milestone is being used to avoid the term Alpha because the milestone is able to be deployed without the additional future items and subsystems that will become available when Leap is officially released." As reported in June, openSUSE 42.1 is a new version of the distribution based on the SUSE Linux Enterprise core.

Friday's security updates

Friday 24th of July 2015 03:04:13 PM

Arch Linux has updated chromium (multiple vulnerabilities), crypto++ (private key recovery), libuser (multiple vulnerabilities), and openssh (authentication limits bypass).

CentOS has updated libuser (C7: multiple vulnerabilities).

Debian has updated chromium-browser (multiple vulnerabilities).

Gentoo has updated e2fsprogs (code execution).

Oracle has updated libuser (O7: multiple vulnerabilities).

Red Hat has updated java-1.7.0-ibm (RHEL 5: multiple vulnerabilities) and libuser (RHEL 6; RHEL 7: multiple vulnerabilities).

Scientific Linux has updated libuser (SL7: multiple vulnerabilities).

Ubuntu has updated kernel (12.04; 14.04; 14.10; 15.04: multiple vulnerabilities), linux-lts-trusty (12.04: multiple vulnerabilities), linux-lts-utopic (14.04: multiple vulnerabilities), linux-lts-vivid (14.04: multiple vulnerabilities), and linux-ti-omap4 (12.04: multiple vulnerabilities).

Day: HIG updates

Thursday 23rd of July 2015 10:24:31 PM

At his blog, Allan Day announces the first major update to the GNOME Human Interface Guidelines since the first GNOME 3 version (released in 2014). Day notes that the GNOME 3 HIG is structured around design patterns, in the hopes that it can be updated regularly to reflect current practices. "These new guidelines are the direct result of design work that has happened in the past year. They attempt to distill everything we’ve learned through our own process of trial and error." Furthermore, "the HIG now links to the relevant GTK+ API reference documentation for each design component. This is nice for knowing which widget does what; and makes the design guidelines a more effective accompaniment to the toolkit."

Thursday's security updates

Thursday 23rd of July 2015 02:26:05 PM

Debian has updated kernel (multiple vulnerabilities).

Fedora has updated hostapd (F21; F22: denial of service) and python-django (F22: multiple vulnerabilities).

Gentoo has updated libXfont (multiple vulnerabilities).

Mageia has updated java-1.7.0-openjdk (M4: multiple vulnerabilities) and php (M4: multiple vulnerabilities).

Red Hat has updated java-1.6.0-ibm (RHEL 5,6: multiple vulnerabilities) and java-1.7.1-ibm (RHEL 6,7: multiple vulnerabilities).

Ubuntu has updated nbd (multiple vulnerabilities).

[$] LWN.net Weekly Edition for July 23, 2015

Thursday 23rd of July 2015 12:13:14 AM
The LWN.net Weekly Edition for July 23, 2015 is available.

[$] Django Girls one year later

Wednesday 22nd of July 2015 09:06:30 PM

Though it got a bit of a late start due to some registration woes, the first day of EuroPython 2015 began with an engaging and well-received keynote. It recounted the history of a project that got its start just a year ago when the first Django Girls workshop was held at EuroPython 2014 in Berlin. The two women who started the project, Ola Sitarska and Ola Sendecka, spoke about how the workshop to teach women about Python and the Django web framework all came together—and the amazing progress that has been made by the organization in its first year.

Red Hat Enterprise Linux 6.7 released

Wednesday 22nd of July 2015 05:11:04 PM
Red Hat has announced the general availability of RHEL 6.7. "As the basis for large, complex IT deployments, Red Hat Enterprise Linux 6.7 offers enterprise IT teams new capabilities to bolster system security, proactively identify and resolve business-critical IT issues, and confidently embrace some of the latest open source technologies, such as Linux containers, without sacrificing operational stability." The release notes contain details.

Wednesday's security advisories

Wednesday 22nd of July 2015 04:49:58 PM

Arch Linux has updated jre7-openjdk (multiple vulnerabilities).

Debian has updated cacti (SQL injection).

Debian-LTS has updated python-tornado (side-channel attack).

openSUSE has updated ansible (13.2: two vulnerabilities), libressl (13.2: multiple vulnerabilities), pdns (13.2, 13.1: denial of service), and rubygem-activesupport-3_2 (13.2, 13.1: denial of service).

Red Hat has updated autofs (RHEL6: privilege escalation), bind (RHEL6: denial of service), curl (RHEL6: multiple vulnerabilities), freeradius (RHEL6: buffer overflow), gnutls (RHEL6: multiple vulnerabilities), grep (RHEL6: two vulnerabilities), hivex (RHEL6: code execution), httpd (RHEL6: access restriction bypass), ipa (RHEL6: cross-site scripting), kernel (RHEL6: multiple vulnerabilities), libreoffice (RHEL6: code execution), libxml2 (RHEL6: denial of service), mailman (RHEL6: two vulnerabilities), net-snmp (RHEL6: denial of service), ntp (RHEL6: multiple vulnerabilities), pacemaker (RHEL6: privilege escalation), pki-core (RHEL6: cross-site scripting), ppc64-diag (RHEL6: two vulnerabilities), python (RHEL6: multiple vulnerabilities), sudo (RHEL6: information disclosure), wireshark (RHEL6: multiple vulnerabilities), and wpa_supplicant (RHEL6: denial of service).

Ubuntu has updated lxc (15.04, 14.10, 14.04: two vulnerabilities) and mysql-5.5, mysql-5.6 (15.04, 14.10, 14.04, 12.04: multiple vulnerabilities).

Stable kernels 4.1.3 and 4.0.9

Wednesday 22nd of July 2015 05:16:34 AM
The 4.1.3 and 4.0.9 stable kernel releases are available with the usual set of important fixes. Note that 4.0.9 is the last in the 4.0.x series.

[$] Domesticating applications, OpenBSD style

Tuesday 21st of July 2015 08:54:11 PM
One of the many approaches to improving system security consists of reducing the attack surface of a given program by restricting the range of system calls available to it. If an application has no need for access to the network, say, then removing its ability to use the socket() system call should cause no loss in functionality while reducing the scope of the mischief that can be made should that application be compromised. In the Linux world, this kind of sandboxing can be done using a security module or the seccomp() system call. OpenBSD has lacked this capability so far, but it may soon gain it via a somewhat different approach than has been seen in Linux.

"Cloud Native Computing Foundation" launched

Tuesday 21st of July 2015 06:15:23 PM
The Linux Foundation has announced the Cloud Native Computing Foundation. "This new organization aims to advance the state-of-the-art for building cloud native applications and services, allowing developers to take full advantage of existing and to-be-developed open source technologies. Cloud native refers to applications or services that are container-packaged, dynamically scheduled and micro services-oriented. Founding organizations include AT&T, Box, Cisco, Cloud Foundry Foundation, CoreOS, Cycle Computing, Docker, eBay, Goldman Sachs, Google, Huawei, IBM, Intel, Joyent, Kismatic, Mesosphere, Red Hat, Switch SUPERNAP, Twitter, Univa, VMware and Weaveworks. Other organizations are encouraged to participate as founding members in the coming weeks, as the organization establishes its governance model."

Security advisories for Tuesday

Tuesday 21st of July 2015 04:14:33 PM

CentOS has updated bind (C7: denial of service) and thunderbird (C7; C6; C5: multiple vulnerabilities).

Debian-LTS has updated cacti (SQL injection) and cacti (regression in previous update).

Fedora has updated asterisk (F22: SSL server spoofing), bind (F21: denial of service), httpd (F22: multiple vulnerabilities), java-1.8.0-openjdk (F22; F21: multiple vulnerabilities), libunwind (F22: buffer overflow), php-horde-Horde-Auth (F22; F21: multiple vulnerabilities), php-horde-Horde-Core (F22; F21: multiple vulnerabilities), php-horde-Horde-Form (F22; F21: multiple vulnerabilities), php-horde-Horde-Icalendar (F22; F21: multiple vulnerabilities), polkit (F21: multiple vulnerabilities), and squashfs-tools (F21: two vulnerabilities).

Oracle has updated bind (OL7: denial of service) and thunderbird (OL7; OL6: multiple vulnerabilities).

Red Hat has updated bind (RHEL7: denial of service) and thunderbird (RHEL5,6,7: multiple vulnerabilities).

Scientific Linux has updated bind (SL7: denial of service) and thunderbird (SL5,6,7: multiple vulnerabilities).

SUSE has updated mariadb (SLE12: multiple vulnerabilities).

Ubuntu has updated thunderbird (15.04, 14.10, 14.04, 12.04: multiple vulnerabilities).

Gorman: Continual testing of mainline kernels

Tuesday 21st of July 2015 08:43:43 AM
Mel Gorman introduces SUSE's kernel performance-testing system. "Marvin is a system that continually runs performance-related tests and is named after another robot doomed with repetitive tasks. When tests are complete it generates a performance comparison report that is publicly available but rarely linked. The primary responsibility of this system is to check SUSE Linux for Enterprise kernels for performance regressions but it is also configured to run tests against mainline releases."

Security updates for Monday

Monday 20th of July 2015 06:38:17 PM

Arch Linux has updated apache (multiple vulnerabilities).

Debian has updated freexl (denial of service), mariadb-10.0 (multiple vulnerabilities), mysql-5.5 (multiple vulnerabilities), and tidy (two vulnerabilities).

Debian-LTS has updated groovy (code execution), inspircd (denial of service), libidn (information disclosure), ruby1.9.1 (denial of service), and tidy (two vulnerabilities).

Fedora has updated bind (F22: denial of service), condor (F21: code execution), cups-filters (F21: code execution), drupal7-migrate (F22; F21: cross-site scripting), drupal7-views_bulk_operations (F22; F21: permission bypass), openstack-cinder (F21: file disclosure), pcre (F21: two vulnerabilities), python-keystonemiddleware (F22: certificate verification botch), rawstudio (F22; F21: two vulnerabilities), redis (F22; F21: code execution), squashfs-tools (F22: two vulnerabilities), thunderbird (F22; F21: multiple vulnerabilities), webkitgtk4 (F22: denial of service), and xen (F22; F21: privilege escalation).

Gentoo has updated postgresql (multiple vulnerabilities).

openSUSE has updated flash-player (11.4: two vulnerabilities), libcryptopp (13.2, 13.1: information disclosure), libidn (13.2, 13.1: information disclosure), firefox, thunderbird (11.4: multiple vulnerabilities), rubygem-jquery-rails (13.2, 13.1: CSRF vulnerability), rubygem-rack (13.2, 13.1: denial of service), rubygem-rack-1_3 (13.2, 13.1: denial of service), and rubygem-rack-1_4 (13.2, 13.1: denial of service).

Slackware has updated httpd (multiple vulnerabilities) and php (multiple vulnerabilities).

SUSE has updated firefox, nspr, nss (SLE12; SLES11SP4; SLE11SP3: multiple vulnerabilities) and PHP (SLE11SP3: multiple vulnerabilities).

dgit 1.0 released

Monday 20th of July 2015 06:13:55 AM
Ian Jackson has announced the availability of dgit 1.0. "dgit allows you to treat the Debian archive as if it were a git repository, and get a git view of any package. If you have the appropriate access rights you can do builds and uploads from git, and other dgit users will see your git history."

Kernel prepatch 4.2-rc3

Monday 20th of July 2015 06:08:10 AM
The third 4.2 kernel prepatch is out for testing. Linus says: "Normal Sunday release schedule, and a fairly normal rc release. There was some fallout from the x86 FPU cleanups, but that only hit CPU's with the xsaves instruction, and it should be all good now."

More in Tux Machines

Canonical Publishes Impressive Roadmap for All of Their Ubuntu Products

Canonical is working on multiple projects at the same time, and it's often difficult to understand their plans, but Director of Product Strategy Engineering Olli Ries has shed some light on how their inner workings are structured and how things are evolving, from the inside out. Read more

Making the Case for Koha: Why Libraries Should Consider an Open Source ILS

When Engard educates people on what open source is, what it means to use open source software, what types of software are available, which companies use it, and who trusts it, they see that their fears are unfounded, she says. To back up her discussions with facts, she maintains bibliographies on open source and open source security. She also has a set of bookmarks on Delicious, and she wrote a book, Practical Open Source Software for Libraries. “[W]hen people come to me and say open source is too risky … I have facts and figures, just what librarians want, to say no, all software has potential risk associated with it. You have to evaluate software side by side, and look at it, and really take the time to compare it. … I know you’re going to pick the open source solution over the proprietary because it is so quickly developed, so quickly fixed, so ahead of the curve as far as technology is concerned.” Read more

Review of Ubuntu Phone – A Work Still Under Progress

However, what one must remember is that the Ubuntu Phone is still a work in progress. The company is issuing updates every month and is relying on its current user base regarding the feedback and ideas. Right now, only three Ubuntu phones are present in the market ranging from $186 to $328 roughly. Ubuntu has been in hibernation mode for the development of this OS for a long time and it looked like they might be consumer ready now, however, after seeing the Ubuntu Phone it looks like they might be far from that scenario right now. Read more

Android M news: Release date delayed, to come out in September or October?

Google reveals that the newest Android operating system initially codenamed as "Android M" will be delaying the release of Android M Developer Preview 3 for selected Nexus devices. The information was shared by the company's employee and moderator Wojtek Kaliciński on the Developer community page in Google+. Read more