Language Selection

English French German Italian Portuguese Spanish

LWN

Syndicate content
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Updated: 1 hour 34 min ago

Kernel prepatch 3.19-rc4

Sunday 11th of January 2015 09:34:57 PM
Linus has released the 3.19-rc4 prepatch. "Another week, another -rc. Things have remained reasonably calm, although we also had a few last-minute MM regressions. Happily, most of them got fixed really quickly, with one remaining arm64 issue still pending."

Rust 1.0 alpha released

Friday 9th of January 2015 07:36:32 PM
The alpha version of the Rust 1.0 release has been announced. There is a long list of new features added to the language; see the release notes for details. "The language is feature-complete for 1.0. While we plan to make many usability improvements before the final release, all 1.0 language features are now in place and we do not expect major breaking changes to them."

Linux’s Creator Wants Us All to Chill Out About the Leap Second (Wired)

Friday 9th of January 2015 05:07:10 PM
Wired talks with Linus Torvalds about the potential for another leap-second bug. "Really, to the rest of us, just take the leap second as an excuse to have a small nonsensical party for your closest friends. Wear silly hats, get a banner printed that says 'Leap Second Doomsday Party', and get silly drunk. You’ll blink, and it’s over, but at least you’ll have the hangover next day to remind you of that glorious but fleeting extra second."

Friday's security updates

Friday 9th of January 2015 02:53:17 PM

Debian has updated curl (access restriction bypass) and file (multiple vulnerabilities).

Debian-LTS has updated file and (multiple vulnerabilities) firebird2.1 (denial of service).

Mandriva has updated asterisk (BS1: denial of service), file (BS1: multiple vulnerabilities), jasper (BS1: multiple vulnerabilities), krb5 (BS1: denial of service), libevent (BS1: denial of service), libjpeg (BS1: denial of service), nail (BS1: code execution), pwgen (BS1: multiple vulnerabilities), sox (BS1: code execution), unrtf (BS1: multiple vulnerabilities), unzip (BS1: multiple vulnerabilities), and znc (BS1: multiple vulnerabilities).

Red Hat has updated php (RHEL 6.5: multiple vulnerabilities) and python-keystoneclient (RHEL OpenStack Platform: man-in-the-middle attack).

SUSE has updated xen (SLED/SLES/SLESDK 12: multiple vulnerabilities).

Ubuntu has updated cpio (multiple vulnerabilities).

New stable kernels

Friday 9th of January 2015 01:55:31 AM

Greg Kroah-Hartman has released four new stable kernels: 3.10.64, 3.14.28, 3.17.8, and 3.18.2. Each contains important updates and fixes. The 3.17.8 release is also noteworthy because it will be the last release in the 3.17 series. 3.17 users need to move to the 3.18 series as soon as possible.

Thursday's security updates

Thursday 8th of January 2015 02:22:44 PM

CentOS has updated glibc (C6: multiple vulnerabilities).

Fedora has updated mpfr (F20; F21: buffer overflow), nss (F20: information leak), nss-softokn (F20: information leak), nss-util (F20: information leak), openvas-cli (F21: SQL injection), openvas-manager (F21: SQL injection), openvas-scanner (F21: SQL injection), tcpdump (F21: code execution), and thermostat (F20; F21: privilege escalation).

Mageia has updated apache (M4: access-restriction bypass), asterisk (M4: denial of service), ettercap (M4: multiple vulnerabilities), glibc (M4: multiple vulnerabilities), libsndfile (M4: multiple vulnerabilities), and libssh (M4: denial of service).

Mandriva has updated mediawiki (BS1: multiple vulnerabilities).

openSUSE has updated libssh (denial of service) and php5 (11.4: multiple vulnerabilities).

Oracle has updated glibc (O6: multiple vulnerabilities).

Red Hat has updated glibc (RHEL6: multiple vulnerabilities).

Scientific Linux has updated glibc (SL6: multiple vulnerabilities).

Ubuntu has updated bsd-mailx (code execution), exiv2 (14.10: denial of service), mime-support (code execution), and nss (information disclosure).

[$] LWN.net Weekly Edition for January 8, 2015

Thursday 8th of January 2015 02:03:21 AM
The LWN.net Weekly Edition for January 8, 2015 is available.

[$] Dark Mail publishes its secure-email architecture

Wednesday 7th of January 2015 08:56:41 PM

The Dark Mail Alliance has published the first description of the architecture that enables its secure-and-private alternative to the existing Internet email system. Called the Dark Internet Mail Environment (DIME), the system involves a new email message format and new protocols for email exchange and identity authentication. Nevertheless, DIME also makes an effort to be backward-compatible with existing email deployments. DIME includes several interesting ideas, but its main selling points remain its security: it not only offers end-to-end encryption, but it encrypts much of the message metadata other systems leave in cleartext, too, and it offers resistance to attacks that target servers between the sender and the recipient.

Security advisories for Wednesday

Wednesday 7th of January 2015 05:01:41 PM

Debian has updated mantis (multiple vulnerabilities).

Mageia has updated kernel (multiple vulnerabilities), libevent (denial of service), libpng (memory overwrite), nvidia (code execution), and webmin (malicious symlinks).

McIntyre: Bootstrapping arm64 in Debian

Wednesday 7th of January 2015 12:05:23 AM
Steve McIntyre provides a progress report on the status of the arm64 port for Debian 8 "Jessie". "arm64 is officially a release architecture for Jessie, aka Debian version 8. That's taken a lot of manual porting and development effort over the last couple of years, and it's also taken a lot of CPU time - there are ~21,000 source packages in Debian Jessie! As is often the case for a brand new architecture like arm64 (or AArch64, to use ARM's own terminology), hardware can be really difficult to get hold of. In time this will cease to be an issue as hardware becomes more commoditised, but in Debian we really struggled to get hold of equipment for a very long time during the early part of the port."

Tuesday's security updates

Tuesday 6th of January 2015 07:14:37 PM

CentOS has updated libvirt (C7: information disclosure).

Debian has updated libevent (denial of service).

Fedora has updated bind (F21; F19: denial of service), cpio (F20: denial of service), jasper (F21; F20; F19: three code execution vulnerabilities), python-pip (F21: denial of service), python3 (F19: two vulnerabilities), and roundcubemail (F21; F20: cross-site scripting).

Mageia has updated libvirt (denial of service), openvas-manager (sql injection), privoxy (two vulnerabilities), and python-yaml (denial of service).

Oracle has updated libvirt (OL7: information disclosure).

Red Hat has updated kernel (RHEL4: privilege escalation) and libvirt (RHEL7: information disclosure).

Scientific Linux has updated libvirt (SL7: information disclosure).

SUSE has updated bind (SLE11 SP3: denial of service), mutt (SLE12: denial of service), and suseRegister (SLE11 SP3: man-in-the-middle attack).

Ubuntu has updated cgmanager (14.10, 14.04: information disclosure).

CyanogenMod CM12 nightly builds available

Tuesday 6th of January 2015 03:22:35 PM
For those of you who have been waiting for a CyanogenMod release based on Android "Lollipop," the first nightly builds are now available. "We would like to note that at this point we consider ourselves 85% complete for our initial CM12 M release. We’ll spend the remainder of this month bringing up additional devices and finishing up the features you’ve come to love from CM11 – implementing them into the new Material UI."

Kernel prepatch 3.19-rc3

Tuesday 6th of January 2015 02:12:26 AM
The 3.19-rc3 prepatch is out for testing. "It's a day delayed - not because of any particular development issues, but simply because I was tiling a bathroom yesterday. But rc3 is out there now, and things have stayed reasonably calm. I really hope that implies that 3.19 is looking good, but it's equally likely that it's just that people are still recovering from the holiday season."

Cuthbertson: NixOS and Stateless Deployment

Monday 5th of January 2015 09:03:17 PM
Here is a lengthy post from Tim Cuthbertson on the virtues of building servers with NixOS. "It should hopefully be obvious at this point why NixOS is better than puppet: Both are declarative, but puppet is impure and non-exhaustive - when you apply a config, puppet compares everything specified against the current state of the system. Everything not specified is left alone, which means you’re only specifying a very tiny subset of your system. With NixOS, if something is not specified, it is not present."

Security advisories for Monday

Monday 5th of January 2015 05:47:46 PM

Debian has updated strongswan (denial of service).

Debian-LTS has updated polarssl (denial of service), pyyaml (denial of service), and sox (code execution).

Fedora has updated claws-mail (F19: man-in-the-middle attack), claws-mail-plugins (F19: man-in-the-middle attack), curl (F19: information leak), denyhosts (F20; F19: denial of service), ettercap (F21; F20; F19: multiple vulnerabilities), freetype (F20: buffer overflow), kernel (F19: multiple vulnerabilities), libetpan (F19: man-in-the-middle attack), libssh (F21; F20; F19: denial of service), mailx (F21; F20; F19: command execution), mingw-pcre (F21; F20; F19: information leak), openjpeg (F19: multiple vulnerabilities), python-django-horizon (F21: denial of service), pyxdg (F20: symlink attacks), subversion (F21; F20: denial of service), and unrtf (F21: code execution).

Mandriva has updated c-icap (denial of service), ntp (multiple code execution vulnerabilities), pcre (information leak), php (code execution), and subversion (denial of service).

Ubuntu has updated strongswan (14.10, 14.04: denial of service).

[$] OpenMediaVault: a distribution for NAS boxes

Friday 2nd of January 2015 10:44:03 PM
The Linux community has no shortage of general-purpose distributions that can be made to serve almost any need. But many Linux deployments are not on general-purpose machines; often the owner has a more specific objective in mind. One such objective is to put together a network-attached storage (NAS) box. A general-purpose distribution can easily be used in such a setting, but there are also several specialized distributions that make the task easier. This article, the first in a series, will look at OpenMediaVault, a Debian-based NAS-oriented distribution.

Friday's security updates

Friday 2nd of January 2015 03:09:33 PM

Fedora has updated glpi (F19; F20, F21: SQL injection), mingw-binutils (F20; F21: multiple vulnerabilities), mingw-curl (F20; F21: multiple vulnerabilities), mingw-dbus (F20; F21: multiple vulnerabilities), mingw-freetype (F20; F21: code execution), mingw-libjpeg-turbo (F20; F21: denial of service), mingw-libxml2 (F20; F21: denial of service), mingw-openssl (F20; F21: multiple vulnerabilities), and ntp (F19; multiple vulnerabilities).

openSUSE has updated libvirt (13.1: denial of service; 13.2: multiple vulnerabilities), ruby2.1 (13.2: multiple vulnerabilities), and ruby20 (13.1: multiple vulnerabilities).

More in Tux Machines

Android Leftovers

  • 1B Android phones shipped in 2014, but they don’t all help Google
    When Android first arrived in 2007, it was (and still is) a key part of the OHA, or Open-Handset Alliance. OHA partners — which include Samsung, LG, Dell, HTC, Huawei and ZTE, to name a few — all loosely work together to help improve Android, while competing against one another by using Android on their respective hardware products. Android is the commonality between all of the OHA partners. And then there’s Google.
  • Android beats iOS for app downloads, but revenues are still a different story
    There are plenty of caveats to this line of reasoning, though. First, Google Play is not the only Android app store – Amazon and Samsung run their own stores, while in countries like China there are dozens of stores offering Android apps.
  • HTC One M8 Android 5.0 Lollipop Update: What U.S. Owners Can Expect
    When Google announced Android 5.0 Lollipop back in October many smartphone owners like those with the HTC One or HTC One M8 instantly started waiting for details regarding the Android 5.0 Lollipop update. It has arrived for a few devices already, including the HTC One and HTC One M8 Google Play Edition handsets, but below we’ll go over what regular HTC One owners need to know about the Android 5.0 update.
  • Samsung Galaxy S4 Updated To The Android Lollipop 5.0 OS
    The Android Lollipop 5.0 update is finally available for the Samsung S4. The operating system is also available for the Samsung Galaxy S5, Note 4, Note 3, and Note Edge. Samsung Galaxy and Note users will be happy to hear that the long waited update is coming in the near future. But should Galaxy S4 users take advantage of the Android Lollipop update?
  • Don’t wait for Android 5.0, this app makes your phone look like Lollipop for free
    Android 5.0 Lollipop is a huge upgrade for Google’s mobile operating system. The only problem with it, of course, is that it’s only available for a handful of devices. Most Android smartphone users still have plenty more waiting to do before Lollipop is finally available for their handset, but now there’s a terrific app that will make your older version of Android look just like Lollipop — and it’s free!
  • Is this Apple’s secret weapon that could force Android users to buy an iPhone?
    There are many reasons why Android users switch to iPhone, and vice-versa, but Apple may have a secret (or not-so-secret) weapon that could pressure some Android fans to considering a move to the other side. No, it’s not Apple Pay, an exclusive iPhone 6 feature that’s heavily marketed by various banks in the U.S., further helping Apple market its 2014 iPhones. It’s actually a stock iOS app that has been hiding in plain sight for years.
  • Android 5.0.2 Lollipop Problems Frustrating Nexus Users
    Google rolled out its Android 5.0.2 Lollipop update to fix Nexus Lollipop problems. And while it did fix some of the bigger issues, Android 5.0.2 Lollipop problems continue to frustrate Nexus users.

Libreboot X200 laptop now FSF-certified to respect your freedom

This is the second Libreboot laptop from Gluglug (a project of Minifree, Ltd.) to achieve RYF certification, the first being the Libreboot X60 in December 2013. The Libreboot X200 offers many improvements over the Libreboot X60, including a faster CPU, faster graphics, 64-bit GNU/Linux support (on all models), support for more RAM, higher screen resolution, and more. The Libreboot X200 can be purchased from Gluglug at http://shop.gluglug.org.uk/product/libreboot-x200/. Read more

Ubuntu 15.04 Now Based on Linux Kernel 3.18.4, Devs Are Tracking the 3.19 Branch

A new Linux kernel has been made available for Ubuntu 15.04 (Vivid Vervet) and the developers are also tracking the current 3.19 branch of the kernel, which will eventually be adopted after it reaches a stable state. Read more

Ubuntu Users See Private, Hybrid Cloud Expansion

Canonical, the company behind the open source cross-platform operating system Ubuntu, released its annual cloud and server survey this week that seeks to cast more light on the makeup of cloud infrastructure, how it is managed, and what is driving cloud adoption. Canonical said it surveyed 3,100 customers, most of whom are Ubuntu server and cloud users, about the makeup of their cloud infrastructure and how it is being used. Read more