Brief items
Security
Six vulnerabilities discovered in rsync
Nick Tait announced on the oss-security mailing list that rsync, the widely used file transfer program, had a number of serious vulnerabilities. Users can mitigate all six vulnerabilities by upgrading to version 3.4.0, which was released on January 14. While all users should upgrade, servers that use rsyncd are especially impacted:
In the most severe CVE, an attacker only requires anonymous read access to a rsync server, such as a public mirror, to execute arbitrary code on the machine the server is running on.
Kernel development
Kernel release status
The current development kernel is 6.13-rc7, released on January 12. "So unless something odd happens the upcoming week, I expect to release a final 6.13 next week as per the normal schedule". Read the full announcement for your details on how to get a free guitar pedal assembled by Linus himself.
Stable updates: 6.12.9, 6.6.70, 6.1.124, 5.15.176, 5.10.233, and 5.4.289 were released on January 9; 6.6.71 followed, with a compilation-error fix, one day later.
The 6.12.10, 6.6.72, and 6.1.125 updates are in the review process; they are due on January 17.
Quotes of the week
Currently, given a pointer "p", C allows p->a but not p.a. There is a proposal from C++ that is being considered for C.— Paul McKenneyDo we care?
After buying a new WTF'o'meter -- reading about this proposal definitely shattered the old one -- I'm with everybody else so far, this will not make C better, and if it ever were to pass, we should ensure the kernel does not use it.— Peter Zijlstra
Distributions
Linux Mint 22.1 released
Linux Mint version 22.1, a long-term-support (LTS) release with support until 2029, is now available. Notable changes in this release include a transition to Aptkit for background package management tasks, Captain to install Debian packages, and a new default theme with improved Wayland compatibility. See the release notes for known issues.
Development
IPU6 camera support status update
Hans de Goede has posted an update about his work to support IPU6 cameras on Fedora and submitting fixes upstream.
The initial IPU6 camera support landed in Fedora 41 only works on a limited set of laptops. The reason for this is that with MIPI cameras every different sensor and glue-chip like IO-expanders needs to be supported separately.
I have been working on making the camera work on more laptop models. After receiving and sending many emails and blog post comments about this I have started filing Fedora bugzilla issues on a per sensor and/or laptop-model basis to be able to properly keep track of all the work.
LWN covered the lack of IPU6 drivers in 2022.
Git v2.48.0 released
Version 2.48.0 of the Git source-code management system has been released. There is a long list of incremental improvements and bug fixes; see the announcement and the highlights blog from GitHub for details.
Libvirt v11.0.0 released
Version 11.0.0 of the libvirt virtualization API has been released. Notable changes in this release include the ability to export virtiofs filesystems in read-only mode, the addition of support for vlan tagging and trunking of network interfaces with the network, qemu, and lxc drivers, as well as a number of bug fixes.
The people should own the town square (Mastodon Blog)
The Mastodon project has announced
that founder Eugen Rochko will be transferring "key Mastodon
ecosystem and platform components (including name and copyrights,
among other assets)
" to a new non-profit organization:
Practically Mastodon will remain headquartered in and operate from Europe primarily. We will continue day-to-day operations through the Mastodon GmbH for-profit entity, which will become wholly owned by the new European not-for-profit entity. The Mastodon GmbH entity automatically became a for-profit as a result of its charitable status being stripped away in Germany. The existing US-based non-profit entity, the 501(c)(3), will continue to function as a fundraising hub.
[...] We are in the process of a phased transition. First we are establishing a new legal home for Mastodon and transferring ownership and stewardship. We are taking the time to select the appropriate jurisdiction and structure in Europe. Then we will determine which other (subsidiary) legal structures are needed to support operations and sustainability.
Rochko has, naturally, also posted about the transition on Mastodon.social.
Rust 1.84.0 released
Version 1.84.0 of the Rust language has been released. Changes include improved version selection for dependencies in Cargo, the beginning of the migration to a new trait solver, and some updated pointer-provenance APIs.
Most of the time, programmers do not need to worry much about provenance, and it is very clear how a pointer got derived. However, when casting pointers to integers and back, the provenance of the resulting pointer is underspecified. With this release, Rust is adding a set of APIs that can in many cases replace the use of integer-pointer-casts, and therefore avoid the ambiguities inherent to such casts. In particular, the pattern of using the lowest bits of an aligned pointer to store extra information can now be implemented without ever casting a pointer to an integer or back. This makes the code easier to reason about, easier to analyze for the compiler, and also benefits tools like Miri and architectures like CHERI that aim to detect and diagnose pointer misuse.
Automattic reduces WordPress contributions
Automattic has announced that it is reallocating its resources away from contributing to the WordPress project as a response to the WP Engine lawsuit:
As part of this reset, Automattic will match its volunteering pledge with those made by WP Engine and other players in the ecosystem, or about 45 hours a week that qualify under the Five For the Future program as benefitting the entire community and not just a single company. These hours will likely go towards security and critical updates.
LWN last covered the ongoing WordPress saga in December. [Thanks to Paul Wise for the heads-up on this latest development.]
Development quote of the week
You can handwave all you want about how you don't like a given non-profit CEO's salary, or you think you could reduce hosting costs by self-hosting, or what have you. Or you can [try] pushing the high costs onto "volunteers".
But the bottom line is that if you want there to be a large-scale social network, even "do it as cheap as humanly possible" is millions of costs borne by someone.
Miscellaneous
RIP Helen Borrie
We have just now received word of the passing of Helen Borrie, a longtime contributor to the Firebird relational database project.
Helen's quiet leadership and dedication left a lasting impact on Firebird and its users. Her efforts helped build not just a powerful database but also a strong, collaborative community. She will be deeply missed by all who knew her and benefited from her work.
She will be greatly missed. (Thanks to Steve Friedl.)
Paolo Mantegazza RIP
We have just now received word of the passing of Paolo Mantegazza, the driving force behind the Real Time Application Interface project and a key figure in the development of realtime Linux.
Paolo used to describe himself as a simple practitioner of software development, one of whose missions was to contribute a free real-time system his students could use, study and improve for their research work at the university, welcoming others to join. Many Linux users and businesses owe him a lot, because under his leadership, the RTAI project has always defended the freedom of developers to implement real-time systems, particularly at times when it was threatened. His fierce will for RTAI served the Xenomai project, as well as others.
He will be missed. (LWN interviewed Mantegazza in 2001).
RIP Bill Gianopoulos
The blog of the SeaMonkey project, which develops an all-in-one internet application suite based on Mozilla code, has reported the sad news of the sudden passing of Bill Gianopoulos ("WG9s") on January 6 (obituary). He was a core developer and release engineer for the project.SFC reports a successful (L)GPL suit in Germany
The Software Freedom Conservancy is reporting that AVM has released the full source and installation scripts for its routers in response to a lawsuit, filed by Sebastian Steck, based on Lesser GNU Public License rights.
Historically, lawsuits have focused on the copyrights licensed under GPL (or the GPL and LGPL together). Steck's lawsuit uniquely focused exclusively on users' rights under the LGPL. Steck's work showed that despite being a "Lesser" license than GPL, LGPLv2.1 still guarantees users the right to repair, modify and reinstall modified versions of the software on their device. There is now no doubt that both GPL and LGPL mandate the device owner's ability to make changes to the software in the flash memory so those changes persist across reboots.
Page editor: Daroc Alden
Next page:
Announcements>>