Language Selection

English French German Italian Portuguese Spanish

LWN

Syndicate content
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Updated: 5 hours 5 min ago

Two rounds of stable kernels released

Saturday 18th of August 2018 03:30:53 PM
Greg Kroah-Hartman has released two batches of stable kernels. The first set has fixes in various parts of the tree, while the second batch has a single fix for a problem with the page-table entry inversion that is done as a mitigation for the L1TF speculative-execution vulnerability. The first batch includes: 4.18.2, 4.17.16, 4.14.64, 4.9.121, 4.4.149, and 3.18.119. The second batch is: 4.18.3, 4.17.17, 4.14.65, 4.9.122, and 4.4.150. Users should upgrade, presumably to something in the second batch unless they are running the 3.18 series.

Security updates for Friday

Friday 17th of August 2018 02:12:44 PM
Security updates have been issued by Debian (intel-microcode, keystone, php-horde-image, and xen), Fedora (rsyslog), openSUSE (apache2, clamav, kernel, php7, qemu, samba, and Security), Oracle (mariadb and qemu-kvm), Red Hat (docker, mariadb, and qemu-kvm), Scientific Linux (mariadb and qemu-kvm), SUSE (GraphicsMagick, kernel, kgraft, mutt, perl-Archive-Zip, python, and xen), and Ubuntu (postgresql-10, postgresql-9.3, postgresql-9.5, procps, and webkit2gtk).

[$] The first half of the 4.19 merge window

Friday 17th of August 2018 01:41:40 AM
As of this writing, Linus Torvalds has pulled just over 7,600 non-merge changesets into the mainline repository for the 4.19 development cycle. 4.19 thus seems to be off to a faster-than-usual start, perhaps because the one-week delay in the opening of the merge window gave subsystem maintainers a bit more time to get ready. There is, as usual, a lot of interesting new code finding its way into the kernel, along with the usual stream of fixes and cleanups.

The Problems and Promise of WebAssembly (Project Zero)

Thursday 16th of August 2018 10:36:40 PM
Over at Google's Project Zero blog, Natalie Silvanovich looks at some of the bugs the project has found in WebAssembly, which is a binary format to run code in the browser for web applications. She also looks to the future: "There are two emerging features of WebAssembly that are likely to have a security impact. One is threading. Currently, WebAssembly only supports concurrency via JavaScript workers, but this is likely to change. Since JavaScript is designed assuming that this is the only concurrency model, WebAssembly threading has the potential to require a lot of code to be thread safe that did not previously need to be, and this could lead to security problems. WebAssembly GC [garbage collection] is another potential feature of WebAssembly that could lead to security problems. Currently, some uses of WebAssembly have performance problems due to the lack of higher-level memory management in WebAssembly. For example, it is difficult to implement a performant Java Virtual Machine in WebAssembly. If WebAssembly GC is implemented, it will increase the number of applications that WebAssembly can be used for, but it will also make it more likely that vulnerabilities related to memory management will occur in both WebAssembly engines and applications written in WebAssembly."

Debian: 25 years and counting

Thursday 16th of August 2018 10:27:04 PM
The Debian project is celebrating the 25th anniversary of its founding by Ian Murdock on August 16, 1993. The "Bits from Debian" blog had this to say: "Today, the Debian project is a large and thriving organization with countless self-organized teams comprised of volunteers. While it often looks chaotic from the outside, the project is sustained by its two main organizational documents: the Debian Social Contract, which provides a vision of improving society, and the Debian Free Software Guidelines, which provide an indication of what software is considered usable. They are supplemented by the project's Constitution which lays down the project structure, and the Code of Conduct, which sets the tone for interactions within the project. Every day over the last 25 years, people have sent bug reports and patches, uploaded packages, updated translations, created artwork, organized events about Debian, updated the website, taught others how to use Debian, and created hundreds of derivatives." Happy birthday to the project from all of us here at LWN.

New stable kernels

Thursday 16th of August 2018 01:52:17 PM
Greg Kroah-Hartman has released a new batch of stable kernels: 4.18.1, 4.17.15, 4.14.63, 4.9.120, and 4.4.148. These include the fixes for the L1 terminal fault vulnerability and a few other fixes here and there. Users should upgrade.

Security updates for Thursday

Thursday 16th of August 2018 01:27:35 PM
Security updates have been issued by Debian (fuse), Fedora (cri-o, gdm, kernel-headers, postgresql, units, and wpa_supplicant), Mageia (iceaepe, kernel-linus, kernel-tmb, and libtomcrypt), openSUSE (aubio, libheimdal, nemo-extensions, and python-Django1), Red Hat (flash-plugin), SUSE (apache2, kernel, php7, qemu, samba, and ucode-intel), and Ubuntu (gnupg).

[$] LWN.net Weekly Edition for August 16, 2018

Thursday 16th of August 2018 01:18:00 AM
The LWN.net Weekly Edition for August 16, 2018 is available.

[$] The Data Transfer Project

Wednesday 15th of August 2018 08:24:46 PM

Social networks are typically walled gardens; users of a service can interact with other users and their content, but cannot see or interact with data stored in competing services. Beyond that, though, these walled gardens have generally made it difficult or impossible to decide to switch to a competitor—all of the user's data is locked into a particular site. Over time, that has been changing to some extent, but a new project has the potential to make it straightforward to switch to a new service without losing everything. The Data Transfer Project (DTP) is a collaborative project between several internet heavyweights that wants to "create an open-source, service-to-service data portability platform".

Security updates for Wednesday

Wednesday 15th of August 2018 02:55:47 PM
Security updates have been issued by CentOS (kernel), Debian (kernel, linux-4.9, postgresql-9.4, and ruby-zip), Fedora (cgit, firefox, knot-resolver, mingw-LibRaw, php-symfony, php-symfony3, php-symfony4, php-zendframework-zend-diactoros, php-zendframework-zend-feed, php-zendframework-zend-http, python2-django1.11, quazip, sox, and thunderbird-enigmail), openSUSE (python-Django and seamonkey), Oracle (kernel), Red Hat (kernel, kernel-rt, and redhat-virtualization-host), Scientific Linux (kernel), Slackware (openssl), SUSE (clamav, firefox, kernel, and samba), and Ubuntu (kernel, libxml2, linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon, linux-hwe, linux-azure, linux-gcp, linux-lts-trusty, linux-lts-xenial, linux-aws, linux-raspi2, and samba).

[$] CVE-2018-5390 and "embargoes"

Tuesday 14th of August 2018 08:35:30 PM

A kernel bug that allows a remote denial of service via crafted packets was fixed recently and the resulting patch was merged on July 23. But an announcement of the flaw (which is CVE-2018-5390) was not released until August 6—a two-week window where users were left in the dark. It was not just the patch that might have alerted attackers; the flaw was publicized in other ways, as well, before the announcement, which has led to some discussion of embargo policies on the oss-security mailing list. Within free-software circles, embargoes are generally seen as a necessary evil, but delaying the disclosure of an already-public bug does not sit well.

[$] Meltdown strikes back: the L1 terminal fault vulnerability

Tuesday 14th of August 2018 05:59:13 PM
The Meltdown CPU vulnerability, first disclosed in early January, was frightening because it allowed unprivileged attackers to easily read arbitrary memory in the system. Spectre, disclosed at the same time, was harder to exploit but made it possible for guests running in virtual machines to attack the host system and other guests. Both vulnerabilities have been mitigated to some extent (though it will take a long time to even find all of the Spectre vulnerabilities, much less protect against them). But now the newly disclosed "L1 terminal fault" (L1TF) vulnerability (also going by the name Foreshadow) brings back both threats: relatively easy attacks against host memory from inside a guest. Mitigations are available (and have been merged into the mainline kernel), but they will be expensive for some users.

Security updates for Tuesday

Tuesday 14th of August 2018 02:56:39 PM
Security updates have been issued by Arch Linux (thunderbird), Debian (gdm3 and samba), openSUSE (cgit and lxc), SUSE (grafana, kafka, logstash, openstack-monasca-installer and samba), and Ubuntu (gdm3 and libarchive).

[$] The importance of being noisy

Monday 13th of August 2018 10:12:27 PM
Hundreds (at least) of kernel bugs are fixed every month. Given the kernel's privileged position within the system, a relatively large portion of those bugs have security implications. Many bugs are relatively easily noticed once they are triggered; that leads to them being fixed. Some bugs, though, can be hard to detect, a result that can be worsened by the design of in-kernel APIs. A proposed change to how user-space accessors work will, hopefully, help to shine a light on one class of stealthy bugs.

Security updates for Monday

Monday 13th of August 2018 02:49:44 PM
Security updates have been issued by Debian (blender, openjdk-8, postgresql-9.6, and sam2p), Fedora (libmspack, mingw-glib2, mingw-glibmm24, and rsyslog), Mageia (blender, glpi, godot, kernel, lftp, libjpeg, libsndfile, libsoup, mariadb, mp3gain, openvpn, and soundtouch), openSUSE (cgit, libvirt, mailman, NetworkManager-vpnc, and sddm), Slackware (bind), and SUSE (ffmpeg, glibc, and libvirt).

The 4.18 kernel is out

Sunday 12th of August 2018 09:11:05 PM
Linus has released the 4.18 kernel. "It was a very calm week, and arguably I could just have released on schedule last week, but we did have some minor updates." Some of the significant features in this release include unprivileged filesystem mounts, restartable sequences, a new zero-copy TCP receive API, support for active state management for power domains, the AF_XDP mechanism for high-performance networking, the core bpfilter packet filter implementation, and more. See the KernelNewbies 4.18 page for more details.

[$] The mismatched mount mess

Friday 10th of August 2018 11:26:54 PM
"Mounting" a filesystem is the act of making it available somewhere in the system's directory hierarchy. But a mount operation doesn't just glue a device full of files into a specific spot in the tree; there is a whole set of parameters controlling how that filesystem is accessed that can be specified at mount time. The handling of these mount parameters is the latest obstacle to getting the proposed new mounting API into the mainline; should the new API reproduce what is arguably one of the biggest misfeatures of the current mount() system call?

Security updates for Friday

Friday 10th of August 2018 02:41:58 PM
Security updates have been issued by CentOS (java-1.7.0-openjdk, openslp, and yum-utils), Fedora (exiv2, kernel-headers, kernel-tools, libgit2, and thunderbird-enigmail), openSUSE (blueman, cups, gdk-pixbuf, libcdio, libraw, libsoup, libtirpc, mysql-community-server, polkit, python-mitmproxy, sssd, virtualbox, and webkit2gtk3), Oracle (kernel), Red Hat (cobbler), SUSE (ceph, firefox, NetworkManager-vpnc, openssh, and wireshark), and Ubuntu (openjdk-7 and openjdk-8).

bzip.org changes hands

Thursday 9th of August 2018 09:15:16 PM
The bzip2 compression algorithm has been slowly falling out of favor, but is still used heavily across the net. A search for "bzip2 source" returns bzip.org as the first three results. But it would seem that the owner of this domain has let it go, and it is now parked and running ads. So we no longer have an official home for bzip2. If a new repository or tarball does turn up at that domain, it should be looked at closely before being trusted. (Thanks to Jason Kushmaul).

Five new stable kernels

Thursday 9th of August 2018 02:20:30 PM
Greg Kroah-Hartman has released the 4.17.14, 4.14.62, 4.9.119, 4.4.147, and 3.18.118 stable kernels. There are important fixes in each and users should upgrade.

More in Tux Machines

OSS Leftovers

  • Uber Open Sources Its Large Scale Metrics Platform M3
    Uber's engineering team released its metrics platform M3, which it has been using internally for some years, as open source. The platform was built to replace its Graphite based system, and provides cluster management, aggregation, collection, storage management, a distributed time series database (TSDB) and a query engine with its own query language M3QL. [...] M3's query engine provides a single global view of all metrics without cross region replication. Metrics are written to local regional M3DB instances and replication is local to a region. Queries go to both the regional local instances as well as to coordinators in remote regions where metrics are stored. The results are aggregated locally, and future work is planned wherein  any query aggregation would happen at the remote coordinators.
  • SD Times Open-Source Project of the Week: Dev.to
    This week’s highlighted project comes courtesy of a community of developers who hope that their codebase will be used to foster communities like theirs, focused on education and collaboration among peers of any skill level. Dev.to’s codebase is open-source as of last week week and the community-building platform’s developers think that further community involvement in development will lead to great things. [...] Halpern made sure to clarify in the post that this release is not simply a library for creating the types of community-driven communication platforms that dev.to embodies, but the for-profit company’s entire codebase. “However, that is a perfectly valid use case in the future,” Halpern wrote in a post leading up to the release. “If you are interested in contributing such that we can eventually help people stand up their own version of this platform for their own business or society, we’ll definitely welcome that input.” The platform is a Ruby on Rails app with a Preact front-end. The company is hard at work on native apps for iOS and Android but say its technology choices are fluid.
  • RLS 1.0 release candidate
    The current version of the Rust Language Server (RLS), 0.130.5, is the first 1.0 release candidate. It is available on nightly and beta channels, and from the 3rd September will be available with stable Rust. 1.0 for the RLS is a somewhat arbitrary milestone. We think the RLS can handle most small and medium size projects (notable, it doesn't work with Rust itself, but that is large and has a very complex build system), and we think it is release quality. However there are certainly limitations and many planned improvements. It would be really useful if you could help us test the release candidate! Please report any crashes, or projects where the RLS gives no information or any bugs where it gives incorrect information.
  • Mozilla brings back Stylish Add-on to Firefox after it was Banned Last Year
    The Stylish add-on, with which you can give websites their very own style, is back for Firefox. This improvement has been welcomed by many users. The history of this Add-on is quite complicated as it was supposedly twice removed and added back before it was removed again. Now it has been added back as reported by Vess (@VessOnSecurity). [...] The add-on Stylish has been brought back in the Mozilla’s add-on storehouse. What users should know: This expansion was criticized some time prior as a user data collector and has been prohibited and banned a year back from Mozilla’s Add-on store. Owing to its notoriety of collecting data of users’ website visits in a way which makes it convenient to reveal users’ identity to third parties, Google and Mozilla banned it last year. It is indeed surprising as to why Mozilla decided to bring it back to its browser after it was criticized for compromising users’ identity.
  • LibreOffice 6.1: A week in stats
    On August 8, we announced LibreOffice 6.1, a new version of the suite with many great features and updates created by our worldwide community. Let’s look at some stats from the last week!
  • Graphos 0.7 released
    Graphos 0.7 has been released a couple of days ago!
  • Tesla open sources its security software, Hollywood goes open source, and more news
  • How Changa Bell is taking an ‘open source’ approach to grow the Black Male Yoga Intiative
  • As Academic Publishers Fight And Subvert Open Access, Preprints Offer An Alternative Approach For Sharing Knowledge Widely
    That's certainly true, but is easy to remedy. Academics who plan to publish a preprint could offer a copy of the paper to the group of trusted journalists under embargo -- just as they would with traditional papers. One sentence describing why it would be worth reading is all that is required by way of introduction. To the extent that the system works for today's published papers, it will also work for preprints. Some authors may publish without giving journalists time to check with other experts, but that's also true for current papers. Similarly, some journalists may hanker after full press releases that spoon-feed them the results, but if they can't be bothered working it out for themselves, or contacting the researchers and asking for an explanation, they probably wouldn't write a very good article anyway. The other concern relates to the quality of preprints. One of the key differences between a preprint and a paper published in a journal is that the latter usually goes through the process of "peer review", whereby fellow academics read and critique it. But it is widely agreed that the peer review process has serious flaws, as many have pointed out for years -- and as Sheldon himself admits. Indeed, as defenders note, preprints allow far more scrutiny to be applied than with traditional peer review, because they are open for all to read and spot mistakes. There are some new and interesting projects to formalize this kind of open review. Sheldon rightly has particular concerns about papers on public health matters, where lives might be put at risk by erroneous or misleading results. But major preprint sites like bioRxiv (for biology) and the upcoming medRxiv (for medicine and health sciences) are already trying to reduce that problem by actively screening preprints before they are posted.
  • MUMPS Masochism part I: Line and Block Scope

    It's sort of an open secret that I sometimes use ANSI M, better known as MUMPS. It was developed in the 60's, and it definitely still looks like something from the 60's. But it's 1,000 times uglier than anything from that decade. I've made plenty of people, from software testers at work to other developers on IRC, recoil in horror from showing them samples of even relatively mundane code like a simple "Hello, World!".

  • OpenSSH Username Enumeration
     

    We realized that without this patch, a remote attacker can easily test whether a certain user exists or not (username enumeration) on a target OpenSSH server

Microsoft Openwashing

  • Microsoft open sources new framework for Windows driver development [Ed: openwashing Microsoft Windows by pretending that when you write proprietary drivers for a proprietary O/S that does DRM, spies on users etc. you actually do something "open"]
  • Microsoft to Open Source Its Network Replication Software [Ed: Microsoft is openwashing some more of its entirely proprietary 'offerings', a hallmark of a company of liars. Come to us! The traps are free, the cages will be "open".]
  • GitHub goes off the Rails as Microsoft closes in [Ed: Microsoft will take GitHub off the rail like it did Skype and LinkedIn (totally lost)]
    GitHub's platform group is about 155 people at the moment and growing, said Lambert. And much of the group's focus is on breaking GitHub apart. GitHub is about a third of the way through an architectural change that began last year. The company is moving away from Ruby on Rails toward a more heterogeneous, composable infrastructure. Ruby still has a place at GitHub – Lambert referred to the company as a Ruby shop, but he said there's more Go, Java and even some Haskell being deployed for services. The goal, he explained, is to make GitHub's internal capabilities accessible to integrators and partners. "Our monolith is starting to break up and we're starting to abstract things into services," said Lambert. "The platform we've chosen to put them on is Kubernetes."

Android Leftovers

Benchmarks Of Btrfs RAID On Four Samsung 970 EVO NVMe SSDs

With the MSI MEG X399 CREATION that we received as part of the launch package for the Threadripper 2950X and Threadripper 2990WX it includes the XPANDER-AERO that provides 4-way M.2 NVMe SSD slots on a PCI Express x16 card. The XPANDER-AERO is actively cooled and could be passed off as a small form factor graphics card upon a very cursory examination. With this card I've been running tests on four Samsung 970 EVO NVMe SSDs in RAID to offer stellar Linux I/O performance. Here are some initial benchmarks using Btrfs. Read more