Games: ProtonDB, GNOME Crossword Puzzles, and Heroic Games Launcher 2.4.0

• Top 11 New Games to Play on Linux with Proton – August 2022 Edition - Boiling Steam

  We are back with our usual monthly update! Boiling Steam looks at the latest data dumps from ProtonDB to give you a quick list of new games that work (pretty much? see ratings) perfectly with Proton since they were released in June 2022 – all of them work out of the box or well enough with tweaks...

• Crosswords for GNOME

  Jonathan Blandford, who is a longtime GNOME contributor—and a cruciverbalist for longer still—thought it was time for GNOME to have a crossword puzzle application. So he set out to create one, which turned into something of a yak-shaving exercise, but also, ultimately, into Crosswords. Blandford came to GUADEC 2022 to give a talk describing his journey bringing this brain exerciser (and productivity bane) to the GNOME desktop. Blandford got his start with GNOME back in 1997; he is the author of the Evince PDF reader and Aisleriot solitaire card game, for example. He has moved into management over the years, so has done less programming for GNOME, but is still involved in the community. For the purposes of the talk, he said, the important thing to know about him is that he is "a passionate cruciverbalist". He has been doing crossword puzzles since he was a child, with his parents and grandparents; now he does them with his family as well. Beyond that, he had to work the word "cruciverbalist" into his talk because "people who love crosswords love words, and they love words like that". He started working on the Crosswords application in mid-July 2021—almost exactly a year before the talk. It is now around 24,000 lines of code, most of which is in C; "I have some regrets about that" but he was comfortable writing in C. The program has been translated into two languages beyond English—Dutch and Spanish—and the project has three additional contributors at this point. There were several motivations that led him to create the application. He has always thought that puzzles would make for an interesting program to write. In addition, anyone searching GNOME Software or Flathub for a crossword puzzle program would not have found one; in fact, Linux, in general, lacks for a good graphical crossword application. Writing a program for these puzzles turned out to be "a whole lot of fun" as well. But he wants its users to also experience fun; he had an overarching rule for the program: "it's a game, it has to be fun".

• Heroic Games Launcher 2.4.0 Released With Epic Overlay, GOG Cloud Save Support, and Anti-cheat Runtime

  As gaming on Linux continues to improve, so do the tools we use to play those games. Heroic Games Launcher is a great example of such a tool, as it gives users a native way to access and play Epic Games Store games on their Linux machines. One of its older releases, Heroic 2.0.0, brought major UI improvements, and this release further builds on those.

Security Leftovers

• Security updates for Thursday

  Security updates have been issued by Gentoo (aiohttp, faac, isync, motion, and nextcloud), Red Hat (.NET 6.0), SUSE (libnbd, oracleasm, python-codecov, rubygem-tzinfo, sssd, and thunderbird), and Ubuntu (http-parser, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux, linux-hwe-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-ibm, linux-kvm, linux-oracle, linux-raspi, linux-intel-iotg, linux-oem-5.14, linux-oem-5.17, and node-moment).

• CISA Issues Warning on Active Exploitation of UnRAR Software for Linux Systems [Ed: How to distract from the major problem CISA has just pointed out]

• PyPI Package 'secretslib' Drops Fileless Linux Malware to Mine Monero [Ed: The issue here is not "Linux" but people installing malware on it]

• The quantum state of Linux kernel garbage collection (Project Zero) [LWN.net]

  The Project Zero blog has posted a detailed look at CVE-2021-0920 in the first of a two-part series on how this bug created a vulnerability that was subsequently exploited.

• Security requirements for new kernel features [LWN.net]

  The relatively new io_uring subsystem has changed the way asynchronous I/O is done on Linux systems and improved performance significantly. It has also, however, begun to run up a record of disagreements with the kernel's security community. A recent discussion about security hooks for the new uring_cmd mechanism shows how easily requirements can be overlooked in a complex system with no overall supervision. Most of the operations that can be performed within io_uring follow the usual I/O patterns — open a file, read data, write data, and so on. These operations are the same regardless of the underlying device or filesystem that is doing the work. There always seems to be a need for something special and device-specific, though, and io_uring is no exception. For the kernel as a whole, device-specific operations are made available via ioctl() calls. That system call, however, has built up a reputation as a dumping ground for poorly thought-out features, and there is little desire to see its usage spread. In early 2021, io_uring maintainer Jens Axboe floated an idea for a command passthrough mechanism that would be specific to io_uring. A year and some later, that idea has evolved into uring_cmd, which was pulled into the mainline during the 5.19 merge window. There is a new io_uring operation that, in turn, causes an invocation of the underlying device or filesystem's uring_cmd() file_operations function. The actual operation to be performed is passed through to that function with no interpretation in the io_uring layer. The first user is the NVMe driver, which provides a direct passthrough operation.

Oaxaca, Endless OS, and indigenous languages

A rural Mexican state was the setting for an initiative to use the GNOME-based Endless OS to improve education in indigenous communities. Over the last several years, the Endless OS Foundation has teamed up with the Fundación Alfredo Harp Helú Oaxaca (FAHHO) to deliver offline-first computers to those communities, but also to assist these communities in preserving their native languages. In a talk at GUADEC 2022, Rob McQueen provided a look at the project and what it has accomplished. McQueen was not slated to give the talk—he already gave an earlier presentation at the conference—but Sergio Solis, who is from Guadalajara where the conference was held, was unfortunately unable to attend due to his family coming down with COVID. McQueen apologized for flying into Mexico from England to give a talk about Mexico when he had never been to the country before. But, as the CEO of the Endless OS Foundation, McQueen is obviously knowledgeable about the project and was able to step in and pinch-hit for Solis. Read on