LWN.net

Seven new stable kernels

jake — 2024-01-26T00:22:53+00:00

Greg Kroah-Hartman has announced the release of the 6.7.2, 6.6.14, 6.1.75, 5.15.148, 5.10.209, 5.4.268, and 4.19.306 stable kernels. As usual, they contain a long list of fixes throughout the kernel tree.

[$] The things nobody wants to pay for

corbet — 2024-01-25T15:53:59+00:00

The free-software community has managed to build a body of software that is worth, by most estimates, many billions of dollars; all of this code is freely available to anybody who wants to use or modify it. It is an unparalleled example of independent actors working cooperatively on a common resource. Free software is certainly a success story, but all is not perfect. One of the community's greatest strengths — convincing companies to contribute to this common resource — is also part of one of its biggest weaknesses.

GCC security features from AdaCore

corbet — 2024-01-25T15:10:41+00:00

The AdaCore blog describes some hardening features contributed to GCC for the GCC 14 release.

With -fharden-control-flow-redundancy, the compiler now verifies, at the end of functions, whether the traversed basic blocks align with a legitimate execution path. The purpose of this protective measure is to detect and thwart attacks attempting to infiltrate the middle of functions, thereby enhancing the overall security posture of the compiled code.

Security updates for Thursday

jake — 2024-01-25T14:18:02+00:00

Security updates have been issued by Debian (chromium, firefox-esr, php-phpseclib, phpseclib, thunderbird, and zabbix), Fedora (dotnet7.0, firefox, fonttools, and python-jinja2), Mageia (avahi and chromium-browser-stable), Oracle (java-1.8.0-openjdk, java-11-openjdk, LibRaw, openssl, and python-pillow), Red Hat (gnutls, kpatch-patch, php:8.1, and squid:4), SUSE (apache-parent, apache-sshd, bluez, cacti, cacti-spine, erlang, firefox, java-11-openjdk, opera, python-Pillow, tomcat, tomcat10, and xwayland), and Ubuntu (paramiko and puma).

[$] LWN.net Weekly Edition for January 25, 2024

corbet — 2024-01-25T00:23:52+00:00

The LWN.net Weekly Edition for January 25, 2024 is available.

[$] Python, packaging, and pip—again

jake — 2024-01-24T22:19:14+00:00

Python packaging discussions seem like they often just go around and around, ending up where they started and recapitulating many of the points that have come up before. A recent discussion revolves around the pip package installer, as they often do. The central role that is occupied by pip has both good points and bad. There is a clear need for something that can install from the Python Package Index (PyPI) immediately after Python itself is installed. Whether there should be additional features, including project management, that come "inside the box", as well, is much less clear—not unlike the question of which project management "style" should be chosen.

Security updates for Wednesday

corbet — 2024-01-24T14:46:13+00:00

Security updates have been issued by Debian (jinja2, openjdk-11, ruby-httparty, and xorg-server), Fedora (ansible-core and mingw-jasper), Gentoo (GOCR, Ruby, and sudo), Oracle (gstreamer-plugins-bad-free, java-17-openjdk, java-21-openjdk, python-cryptography, and xorg-x11-server), Red Hat (kernel, kernel-rt, kpatch-patch, LibRaw, python-pillow, and python-pip), Slackware (mozilla), SUSE (python-Pillow, rear118a, and redis7), and Ubuntu (libapache-session-ldap-perl and pycryptodome).

[$] Microdot: a web framework for microcontrollers

jake — 2024-01-23T22:51:14+00:00

There are many different Python web frameworks, from nano-frameworks all the way up to the full-stack variety. One that recently caught my eye is Microdot, the "impossibly small web framework for Python and MicroPython"; since it targets MicroPython, it is plausible for running the user interface of an "internet of things" (IoT) device, for example. Beyond that, it is Flask-inspired, which should make it reasonably familiar to many potential web developers.

Firefox 122.0 released

corbet — 2024-01-23T16:21:50+00:00

Version 122.0 of the Firefox browser is out. Changes include improved search suggestions, improvements to the in-browser translation feature, better line-breaking compatibility, and a shiny new .deb package.

Security updates for Tuesday

corbet — 2024-01-23T14:48:53+00:00

Security updates have been issued by Debian (kodi and squid), Fedora (ansible-core, java-latest-openjdk, mingw-python-jinja2, openssh, and pgadmin4), Gentoo (Apache XML-RPC), Red Hat (gnutls and xorg-x11-server), Slackware (postfix), SUSE (bluez and openssl-3), and Ubuntu (gnutls28, libssh, and squid).

[$] The rest of the 6.8 merge window

corbet — 2024-01-22T17:20:31+00:00

Linus Torvalds was able to release 6.8-rc1 and close the 6.8 merge window on time despite losing power to his home for most of a week. He noted that this merge window is "maybe a bit smaller than usual", but 12,239 non-merge changesets found their way into the mainline, so it's not that small. About 8,000 of those changes were merged since the first-half summary was written; the second half saw a lot of device-driver updates, but there were other interesting changes as well.

Security updates for Monday

jake — 2024-01-22T14:36:35+00:00

Security updates have been issued by Debian (keystone and subunit), Fedora (dotnet6.0, golang, kernel, sos, and tigervnc), Mageia (erlang), Red Hat (openssl), SUSE (bluez, python-aiohttp, and seamonkey), and Ubuntu (postfix and xorg-server).

Kernel prepatch 6.8-rc1

corbet — 2024-01-22T00:47:05+00:00

The 6.8-rc1 kernel prepatch is out for testing.

So this wasn't the most pleasant merge window, but most of the unpleasantness was entirely unrelated to the code base and almost entirely related to nasty weather. Just a few technical hiccups. And after a very big 6.7 release, 6.8 looks to actually be smaller than average, although not really all that significantly so.

Some weekend stable kernel updates

corbet — 2024-01-20T17:00:16+00:00

The 6.7.1, 6.6.13, and 6.1.74 stable kernel updates have been released; each contains another set of important fixes.

SourceHut outage post-mortem

daroc — 2024-01-19T20:20:54+00:00

SourceHut has published a post-mortem of its outage earlier this month. The post-mortem covers the causes of the outage and what steps SourceHut took to mitigate it, ending by saying:

As unfortunate as these events were, we welcome opportunities to stress-test our emergency procedures; we found them to be compatible with our objectives for the alpha and we learned a lot of ways to improve our reliability further for the future. We are going to continue working on our post-incident tasks, building up our infrastructure’s resilience, reliability, and scalability as planned. Once we address the high-priority tasks, though, our first order of business in the immediate future will be to get some rest.