Language Selection

English French German Italian Portuguese Spanish

LWN

Syndicate content
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Updated: 6 hours 32 min ago

Open-Sourcing Google Earth Enterprise

Tuesday 31st of January 2017 09:21:07 PM
Google has announced that Google Earth Enterprise (GEE) will be published on GitHub under the Apache2 license in March. GEE is an enterprise product that allows developers to build and host their own private maps and 3D globes. This release includes GEE Fusion, GEE Server, and GEE Portable Server source code. "Feedback is important to us and we’ve heard from our customers that GEE remains in-use in mission-critical applications. Many customers have not transitioned to other technologies. Open-sourcing GEE allows our customer community to continue to improve and evolve the project in perpetuity. Note that the Google Earth Enterprise Client, Google Maps JavaScript® API V3 and Google Earth API will not be open sourced. The Enterprise Client will continue to be made available and updated. However, since GEE Fusion and GEE Server are being open-sourced, the imagery and terrain quadtree implementations used in these products will allow third-party developers to build viewers that can consume GEE Server Databases." (Thanks to Paul Wise)

Time To Upgrade Your Python: TLS v1.2 Will Soon Be Mandatory

Tuesday 31st of January 2017 08:53:20 PM
The Python Software Foundation has announced that python.org and related sites will begin disabling the old TLS versions 1.0 and 1.1. "This change was imposed on us by our content delivery network, Fastly, in response to a change imposed on them by the Payment Card Industry Security Standards Council. In order to continue serving websites that take credit card payments, Fastly is required to disable the old, insecure versions of TLS. Since the PSF's servers, including PyPI, use Fastly, the old versions of TLS will be disabled as well."

Security updates for Tuesday

Tuesday 31st of January 2017 05:46:21 PM

Debian has updated chromium-browser (multiple vulnerabilities).

Debian-LTS has updated libarchive (denial of service), ruby-archive-tar-minitar (file overwrites), and tcpdump (multiple vulnerabilities).

Fedora has updated flatpak (F24: sandbox escape), irssi (F25; F24: multiple vulnerabilities), kernel (F25; F24: multiple vulnerabilities), and python-crypto (F25; F24: denial of service).

Gentoo has updated ansible (code execution) and harfbuzz (multiple vulnerabilities).

openSUSE has updated lcms2 (42.1: heap memory leak) and virtualbox (42.1: multiple vulnerabilities).

Red Hat has updated kernel (RHEL7.2: two vulnerabilities), kernel (RHEL6.6; RHEL6.2 (code execution), and nagios (RHELOSP7 for RHEL7; RHELOSP6 for RHEL7; RHELOSP5 for RHEL6; RHELOSP5 for RHEL7: multiple vulnerabilities).

SUSE has updated kernel (SLE11-SP2: multiple vulnerabilities).

KDE Plasma 5.9 released

Tuesday 31st of January 2017 03:29:36 PM
The KDE project has announced the release of the Plasma 5.9 desktop environment with a number of new features. "Global Menus have returned. KDE's pioneering feature to separate the menu bar from the application window allows for new user interface paradigm with either a Plasma Widget showing the menu or neatly tucked away in the window bar."

How to get up and running with sweet Orange Pi (Opensource.com)

Monday 30th of January 2017 08:48:24 PM
David Egts reviews the Orange Pi at Opensource.com. "Compared to a $5 Raspberry Pi Zero, the Orange Pi Zero is only a few dollars more expensive, but it is much more useful out of the box because it has onboard Internet connectivity and four CPU cores instead of one. This onboard networking capability also makes the Orange Pi Zero a better gift than a Raspberry Pi Zero because the Raspberry Pi Zero needs Micro-USB-to-USB adapters and a Wi-Fi USB adapter to connect to the Internet. When giving IoT devices as gifts, you want the recipient to enjoy the product as quickly and easily as possible, instead of giving something incomplete that will just end up on a shelf."

Security advisories for Monday

Monday 30th of January 2017 06:33:10 PM

Arch Linux has updated chromium (multiple vulnerabilities), firefox (multiple vulnerabilities), kernel (privilege escalation), lib32-openssl (three vulnerabilities), libimobiledevice (access restriction bypass), linux-lts (privilege escalation), linux-zen (privilege escalation), openssl (three vulnerabilities), and thunderbird (multiple vulnerabilities).

Debian has updated lcms2 (heap memory leak), openssl (three vulnerabilities), and tcpdump (multiple vulnerabilities).

Debian-LTS has updated bind9 (three denial of service flaws), imagemagick (multiple vulnerabilities), libgd2 (three vulnerabilities), tiff3 (invalid tiff files), and zoneminder (information leak, authentication bypass).

Fedora has updated fedmsg (F24: insufficient signature validation), firefox (F24: multiple vulnerabilities), flatpak (F25: sandbox escape), ghostscript (F25; F24: denial of service), ikiwiki (F25; F24: three vulnerabilities), libXpm (F24: code execution), mapserver (F25; F24: code execution), and pdns (F25; F24: multiple vulnerabilities).

Gentoo has updated a2ps (code execution from 2014), ark (code execution), chromium (multiple vulnerabilities), ffmpeg (multiple vulnerabilities), firewalld (authentication bypass), freeimage (two vulnerabilities, one from 2015), libpng (NULL dereference bug), libXpm (code execution), perl (multiple vulnerabilities, two from 2015), and squashfs-tools (two vulnerabilities from 2015).

Mageia has updated 389-ds-base (denial of service), libvncserver (two vulnerabilities), mbedtls (two vulnerabilities), nvidia-current, ldetect-lst (three vulnerabilities), opus (code execution), pcsc-lite (privilege escalation), python-bottle (CRLF attacks), and shadow-utils (two vulnerabilities).

openSUSE has updated gstreamer-0_10-plugins-base (42.1: code execution), gstreamer-plugins-base (42.2: code execution), and rabbitmq-server (42.2: authentication bypass).

SUSE has updated gnutls (SLE11-SP4: multiple vulnerabilities).

Ubuntu has updated firefox (multiple vulnerabilities) and thunderbird (multiple vulnerabilities).

Kernel prepatch 4.10-rc6

Monday 30th of January 2017 02:49:06 PM
The 4.10-rc6 kernel prepatch is out for testing. Linus is worried that the patch activity has increased this time around. "It's still not all that big by historical standards, since 4.10 has generally been pretty calm, but it's a bit distressing. I was hoping to do the usual 'rc7 is the last rc' release schedule for once (with both 4.8 and 4.9 pushing out to rc8), and I really want things to calm down for that to happen." The codename has changed again, now it's "Fearless Coyote".

Shutting down FTP services (kernel.org)

Sunday 29th of January 2017 06:40:09 PM
Kernel.org has announced that it will be shutting down FTP access to its archives in two stages: March 1 will see the end of ftp.kernel.org, while December 1 is the termination date for mirrors.kernel.org.

Let's face it -- while kinda neat and convenient, offering a public NFS/CIFS server was a Pretty Bad Idea, not only because both these protocols are pretty terrible over high latency connections, but also because of important security implications.

Well, 19 years later we're thinking it's time to terminate another service that has important protocol and security implications -- our FTP servers. Our decision is driven by the following considerations:

  1. The protocol is inefficient and requires adding awkward kludges to firewalls and load-balancing daemons
  2. FTP servers have no support for caching or accelerators, which has significant performance impacts
  3. Most software implementations have stagnated and see infrequent updates
All kernel.org FTP services will be shut down by the end of this year.

Friday's security updates

Friday 27th of January 2017 05:02:51 PM

CentOS has updated firefox (C7; C6; C5: multiple vulnerabilities), mysql (C6: three vulnerabilities), squid (C7: information leak), and squid34 (C6: information leak).

Debian has updated libxpm (code execution).

Debian-LTS has updated asterisk (denial of service from 2014), firefox-esr (multiple vulnerabilities), lcms2 (denial of service), and libxpm (code execution).

Mageia has updated firefox (multiple vulnerabilities), gstreamer (code execution), and php-phpmailer (two vulnerabilities).

openSUSE has updated apache2 (42.2: denial of service) and gstreamer-0_10-plugins-good (42.1: multiple vulnerabilities).

Red Hat has updated chromium-browser (RHEL6: multiple vulnerabilities) and puppet-swift (OSP10.0: information disclosure).

Slackware has updated mozilla-thunderbird (multiple vulnerabilities).

Friday's security updates

Friday 27th of January 2017 05:02:51 PM

CentOS has updated firefox (C7; C6; C5: multiple vulnerabilities), mysql (C6: three vulnerabilities), squid (C7: information leak), and squid34 (C6: information leak).

Debian has updated libxpm (code execution).

Debian-LTS has updated asterisk (denial of service from 2014), firefox-esr (multiple vulnerabilities), lcms2 (denial of service), and libxpm (code execution).

Mageia has updated firefox (multiple vulnerabilities), gstreamer (code execution), and php-phpmailer (two vulnerabilities).

openSUSE has updated apache2 (42.2: denial of service) and gstreamer-0_10-plugins-good (42.1: multiple vulnerabilities).

Red Hat has updated chromium-browser (RHEL6: multiple vulnerabilities) and puppet-swift (OSP10.0: information disclosure).

Slackware has updated mozilla-thunderbird (multiple vulnerabilities).

An Interview with Krita Maintainer Boudewijn Rempt (Renderosity)

Friday 27th of January 2017 04:13:08 PM
Renderosity Magazine talks with Boudewijn Rempt about the Krita painting application. "Well, we make Krita for artists who want to create images. It's not an image editor with a brush engine, it's really meant for sketching, painting, illustrating. So that is what we optimize the workflow for. And people tell us that that works very well for them!"

An Interview with Krita Maintainer Boudewijn Rempt (Renderosity)

Friday 27th of January 2017 04:13:08 PM
Renderosity Magazine talks with Boudewijn Rempt about the Krita painting application. "Well, we make Krita for artists who want to create images. It's not an image editor with a brush engine, it's really meant for sketching, painting, illustrating. So that is what we optimize the workflow for. And people tell us that that works very well for them!"

KDE and Slimbook Release a Laptop for KDE Fans (KDE.News)

Thursday 26th of January 2017 09:30:40 PM
KDE has announced a partnership with Slimbook, a Spanish laptop retailer, to create the KDE Slimbook. "The KDE Slimbook allows KDE to offer our users a laptop which has been tested directly by KDE developers, on the exact same hardware and software configuration that the users get, and where any potential hardware-related issues have already been ironed out before a new version of our software is shipped to them. This gives our users the best possible way to experience our software, as well as increasing our reach: The easier it is to get our software into users' hands, the more it will be used." The laptop is available for pre-order with systems shipping mid-March.

KDE and Slimbook Release a Laptop for KDE Fans (KDE.News)

Thursday 26th of January 2017 09:30:40 PM
KDE has announced a partnership with Slimbook, a Spanish laptop retailer, to create the KDE Slimbook. "The KDE Slimbook allows KDE to offer our users a laptop which has been tested directly by KDE developers, on the exact same hardware and software configuration that the users get, and where any potential hardware-related issues have already been ironed out before a new version of our software is shipped to them. This gives our users the best possible way to experience our software, as well as increasing our reach: The easier it is to get our software into users' hands, the more it will be used." The laptop is available for pre-order with systems shipping mid-March.

The state of Jupyter (O'Reilly)

Thursday 26th of January 2017 07:46:51 PM
Here's an O'Reilly article describing the Jupyter project and what it has accomplished. "Project Jupyter aims to create an ecosystem of open source tools for interactive computation and data analysis, where the direct participation of humans in the computational loop—executing code to understand a problem and iteratively refine their approach—is the primary consideration."

The state of Jupyter (O'Reilly)

Thursday 26th of January 2017 07:46:51 PM
Here's an O'Reilly article describing the Jupyter project and what it has accomplished. "Project Jupyter aims to create an ecosystem of open source tools for interactive computation and data analysis, where the direct participation of humans in the computational loop—executing code to understand a problem and iteratively refine their approach—is the primary consideration."

Stable kernels 4.9.6 and 4.4.45

Thursday 26th of January 2017 06:10:16 PM
Greg Kroah-Hartman has announced the release of the 4.9.6 and 4.4.45 stable kernels. They contain fixes throughout the tree, as normal, and users of those kernel series should upgrade.

Stable kernels 4.9.6 and 4.4.45

Thursday 26th of January 2017 06:10:16 PM
Greg Kroah-Hartman has announced the release of the 4.9.6 and 4.4.45 stable kernels. They contain fixes throughout the tree, as normal, and users of those kernel series should upgrade.

Thursday's security advisories

Thursday 26th of January 2017 05:51:15 PM

Arch Linux has updated ed (denial of service).

Debian has updated firefox-esr (multiple vulnerabilities).

Debian-LTS has updated ming (multiple vulnerabilities) and pdns (multiple vulnerabilities).

Fedora has updated ansible (F25; F24: two vulnerabilities), firefox (F24: multiple vulnerabilities), and qemu (F24: multiple vulnerabilities).

openSUSE has updated gstreamer-0_10-plugins-bad (42.1: code execution), systemd (42.2: privilege escalation), and tigervnc (42.2, 42.1: code execution).

Oracle has updated firefox (OL7; OL6; OL5: multiple vulnerabilities).

Red Hat has updated ansible (RHOSP10.0: code execution) and kernel (RHEL6.4: code execution).

Ubuntu has updated openjdk-8 (16.10, 16.04: multiple vulnerabilities).

Thursday's security advisories

Thursday 26th of January 2017 05:51:15 PM

Arch Linux has updated ed (denial of service).

Debian has updated firefox-esr (multiple vulnerabilities).

Debian-LTS has updated ming (multiple vulnerabilities) and pdns (multiple vulnerabilities).

Fedora has updated ansible (F25; F24: two vulnerabilities), firefox (F24: multiple vulnerabilities), and qemu (F24: multiple vulnerabilities).

openSUSE has updated gstreamer-0_10-plugins-bad (42.1: code execution), systemd (42.2: privilege escalation), and tigervnc (42.2, 42.1: code execution).

Oracle has updated firefox (OL7; OL6; OL5: multiple vulnerabilities).

Red Hat has updated ansible (RHOSP10.0: code execution) and kernel (RHEL6.4: code execution).

Ubuntu has updated openjdk-8 (16.10, 16.04: multiple vulnerabilities).

More in Tux Machines

Red Hat News

Kernel Space/Linux

today's howtos

Ten Years as Desktop Linux User: My Open Source World, Then and Now

I've been a regular desktop Linux user for just about a decade now. What has changed in that time? Keep reading for a look back at all the ways that desktop Linux has become easier to use -- and those in which it has become more difficult -- over the past ten years. I installed Linux to my laptop for the first time in the summer of 2006. I started with SUSE, then moved onto Mandriva and finally settled on Fedora Core. By early 2007 I was using Fedora full time. There was no more Windows partition on my laptop. When I ran into problems or incompatibilities with Linux, my options were to sink or swim. There was no Windows to revert back to. Read more