[$] CVE-less vulnerabilities
23 hours ago, lwn

More bugs in free software are being found these days, which is good for many reasons, but there are some possible downsides to that as well. In addition, projects like OSS-Fuzz are finding lots of bugs in an automated fashion—many of which may be security relevant. The sheer number of bugs being reported is overwhelming many (most?) free-software projects, which simply do not have enough eyeballs to fix, or even triage, many of the reports they receive. A discussion about that is currently p...

GitLab 12.0
1 day ago, lwn

GitLab 12.0 has been released. "GitLab gives users the ability to automatically create review apps for each merge request. This allows anyone to see how the design or UX has been changed. In GitLab 12.0, we are expanding the ability to discuss those changes by bringing the ability to insert visual review tools directly into the Review App itself. With a small code snippet, users can enable designers, product managers, and other stakeholders to quickly provide feedback on a merge request without...

Introducing people.kernel.org
1 day ago, lwn

Konstantin Ryabitsev has announced a new public blogging platform for kernel developers. "Ever since the demise of Google+, many developers have expressed a desire to have a service that would provide a way to create and manage content in a format that would be more rich and easier to access than email messages sent to LKML. Today, we would like to introduce people.kernel.org, which is an ActivityPub-enabled federated platform powered by WriteFreely and hosted by very nice and accommodating fo...

Changes at the Apache Software Foundation
1 day ago, lwn

Here's a statement from the Apache Software Foundation regarding changes in its leadership: "It is with a mix of sadness and appreciation that the ASF Board accepted the resignations of Board Member Jim Jagielski, Chairman Phil Steitz, and Executive Vice President Ross Gardler last month." There is no indication of why all these people decided to leave at the same time....

[$] Lockdown as a security module
1 day ago, lwn

Technologies like UEFI secure boot are intended to guarantee that a locked-down system is running the software intended by its owner (for a definition of "owner" as "whoever holds the signing key recognized by the firmware"). That guarantee is hard to uphold, though, if a program run on the system in question is able to modify the running kernel somehow. Thus, proponents of secure-boot technologies have been trying for years to provide the ability to lock down many types of kernel functionalit...

Canonical backtracks on i386 packages
2 days ago, lwn

Canonical has let it be known that minds have been changed about removing all 32-bit x86 support from the Ubuntu distribution. "Thanks to the huge amount of feedback this weekend from gamers, Ubuntu Studio, and the WINE community, we will change our plan and build selected 32-bit i386 packages for Ubuntu 19.10 and 20.04 LTS. We will put in place a community process to determine which 32-bit packages are needed to support legacy software, and can add to that list post-release if we miss somethi...

Two years of postmarketOS
2 days ago, lwn

PostmarketOS is an Alpine Linux based operating system for mobile devices. The postmarketOS blog takes a look at the project after two years of development. "Wouldn't it be great if you could take any obsolete smartphone from the past ten years and replace its outdated and insecure software with a maintained, modular free software stack? How about then using it as a Raspberry Pi-like device for your next tinkering project? With some constraints, postmarketOS makes this possible today for 139 boo...

Kernel prepatch 5.2-rc6
3 days ago, lwn

The 5.2-rc6 kernel prepatch has been released. Linus worries that the volume of changes has increased — but not too much. "With all that out of the way, I'm still reasonably optimistic that we're on track for a calm final part of the release, and I don't think there is anything particularly bad on the horizon." He also notes that, due to travel, he'll be releasing 5.2-rc7 later than usual....

[$] FreeBSD turns 26
4 days ago, lwn

The FreeBSD operating system is continuing to make progress, 26 years after it got its name. Among the areas where work is being done is on improved support for RISC-V, FUSE filesystem updates, C runtime changes, and security improvements. FreeBSD Day is celebrated on June 19, in recognition of the date in 1993 when the name FreeBSD was coined for a fork of the 386BSD project. The first official release of FreeBSD did not occur until November 1, 1993, however. Ahead of FreeBSD Day, the proje...

[$] Statistics from the 5.2 kernel — and before
5 days ago, lwn

As of this writing, just over 13,600 non-merge changesets have been pulled into the mainline repository for the 5.2 development cycle. The time has come, once again, for a look at where that work came from and who supported it. There are some unique aspects to 5.2 that have thrown off some of the usual numbers....

Huang: Open Source Could Be a Casualty of the Trade War
5 days ago, lwn

Bunnie Huang writes about the escalating trade wars and how they could be harmful to the open-source community. "Because the administrative action so far against Huawei relies only upon export license restrictions, the Linux Foundation has been able to find shelter under a license exemption for open source software. However, should Huawei be designated as a 'foreign adversary' under EO13873, it greatly expands the scope of the ban because it prohibits transactions with entities under the direct...

[$] C, Fortran, and single-character strings
6 days ago, lwn

The calling interfaces between programming languages are, by their nature, ripe for misunderstandings; different languages can have subtly different ideas of how data should be passed around. Such misunderstandings often have the effect of making things break right away; these are quickly fixed. Others can persist for years or even decades before jumping out of the shadows and making things fail. A problem of the latter variety recently turned up in how some C programs are passing strings to ...

Kubernetes 1.15 released
6 days ago, lwn

The Kubernetes container orchestrator team has announced the release of Kubernetes 1.15; the main themes of this release are "extensibility and continuous improvement". One of the focus areas was on usability and lifecycle stability for clusters: "Work on making Kubernetes installation, upgrade and configuration even more robust has been a major focus for this cycle for SIG Cluster Lifecycle (see our last Community Update). Bug fixes across bare metal tooling and production-ready user stories,...

[$] LWN.net Weekly Edition for June 20, 2019
6 days ago, lwn

The LWN.net Weekly Edition for June 20, 2019 is available....

[$] The TCP SACK panic
6 days ago, lwn

Selective acknowledgment (SACK) is a technique used by TCP to help alleviate congestion that can arise due to the retransmission of dropped packets. It allows the endpoints to describe which pieces of the data they have received, so that only the missing pieces need to be retransmitted. However, a bug was recently found in the Linux implementation of SACK that allows remote attackers to panic the system by sending crafted SACK information....

Ubuntu dropping i386 support
6 days ago, lwn

Starting with the upcoming "Eoan Ermine" (a.k.a. 19.10) release, the Ubuntu distribution will not support 32-bit x86 systems. "The Ubuntu engineering team has reviewed the facts before us and concluded that we should not continue to carry i386 forward as an architecture. Consequently, i386 will not be included as an architecture for the 19.10 release, and we will shortly begin the process of disabling it for the eoan series across Ubuntu infrastructure."...

Alpine Linux 3.10.0 released
6 days ago, lwn

Version 3.10.0 of the Alpine Linux distribution is out. It includes a switch to the iwd WiFi management daemon, support for the ceph filesystem, the lightdm display manager, and more....

[$] More frequent Python releases?
1 week ago, lwn

Python has followed an 18-month release cycle for many years now; each new 3.x release comes at that frequency. It has worked well, overall, but there is interest in having a shorter cycle, which would mean that new features get into users' hands more quickly. But changing that longstanding cycle has implications in many different places, some of which have come up as part of a discussion on switching to a cycle of a different length....

[$] Rebasing and merging in kernel repositories
1 week ago, lwn

Maintaining a subsystem, as a general rule, requires a familiarity with the Git source-code management system. Git is a powerful tool with a lot of features; as is often the case with such tools, there are right and wrong ways to use those features. This document looks in particular at the use of rebasing and merging. Maintainers often get in trouble when they use those tools incorrectly, but avoiding problems is not actually all that hard....

[$] CNCF outlines its technical oversight goals
1 week ago, lwn

At KubeCon + CloudNativeCon Europe 2019 there was a public meeting of the Cloud Native Computing Foundation (CNCF) Technical Oversight Committee (TOC); its members outlined the current state of the CNCF and where things are headed. What emerged was a picture of how the CNCF's governance is evolving as it brings in more projects, launches a new special interest group mechanism, and contemplates what to do with projects that go dormant....

Next