Brief items
Security
Security quote of the week
In projects where I do vulnerability management work, we've mostly given up pushing back on things others want to file CVEs about in our projects. Our view is that we decide what does and doesn't get an official advisory published, and we'll request a CVE assignment for that ourselves if one hasn't already been issued, but if anyone else wants a CVE for something in our software they can get one themselves and we generally don't have the time or energy to burn on disputing those. If someone comes to us about one of those third-party-issued CVEs not being fixed or fixes for it not getting backported, we remind them that we don't consider it a vulnerability and they're free to take it up with whoever requested or issued it.
Kernel development
Kernel release status
The current development kernel is 6.14-rc3, released on February 16. Linus said:
So the first few weeks of the 6.14 release development were smaller-than-usual, but rc3 is actually right in line with normal releases at this point. Probably just timing of pull requests, and we'll see how next week goes. But nothing looks worrisome.
Along with the usual stream of fixes, this release includes the "faux bus", designed for simple drivers that just need some sort of virtual bus to be associated with; this bus come with Rust bindings from the outset.
Stable updates: 6.13.3, 6.12.14, and 6.6.78 were released on February 17; they were followed by 6.12.15, containing some reverts to address a regression in the XFS filesystem that can lead to kernel crashes, on February 18.
The 6.13.4, 6.12.16, 6.6.79, and 6.1.129 updates are in the review process; they are due on February 21.
Quotes of the week
There is no justification for how some of these opinions are expressed. We have to do better if we are going to have a healthy community long term. It isn't ok that all of us operate with this shared understanding that some people are just assholes, and you just have to ignore it. There are tangible changes being made in that direction. But I think it's a mistake to take a few developers poorly expressed opinions as a representative view of the whole community.— Josef Bacik
The majority of bugs (quantity, not quality/severity) we have are due to the stupid little corner cases in C that are totally gone in Rust. Things like simple overwrites of memory (not that rust can catch all of these by far), error path cleanups, forgetting to check error values, and use-after-free mistakes. That's why I'm wanting to see Rust get into the kernel, these types of issues just go away, allowing developers and maintainers more time to focus on the REAL bugs that happen (i.e. logic issues, race conditions, etc.)— Greg Kroah-HartmanI'm all for moving our C codebase toward making these types of problems impossible to hit, the work that Kees and Gustavo and others are doing here is wonderful and totally needed, we have 30 million lines of C code that isn't going anywhere any year soon. That's a worthy effort and is not going to stop and should not stop no matter what.
But for new code / drivers, writing them in rust where these types of bugs just can't happen (or happen much much less) is a win for all of us, why wouldn't we do this?
Distributions
New leadership for Asahi Linux
The Asahi Linux project, which is working to support Linux on Apple silicon, has announced the resignation of Hector "marcan" Martin as its lead, and his replacement by a seven-person committee. "Today's news is bittersweet. We are grateful to marcan for kicking off this project and tirelessly working on it these past years. Our community will miss him. Still, with your support, the project has a bright future to come". Martin has explained his reasons for leaving at length in this blog post.
Lange: The secret maze of Debian images
Debian Developer Thomas Lange has written a blog post in the attempt to help users find the right Debian image for their systems.
It's difficult to find the right Debian image. We have thousands of ISO files and cloud images and we support multiple CPU architectures and several download methods. The directory structure of our main image server is like a maze, and our web pages for downloading are also confusing.
RISC-V and Fedora: All Aboard! (Fedora Magazine)
The Fedora Project has announced two milestones in its journey to supporting the RISC-V architecture: a dedicated RISC-V Koji build system instance is live in the Fedora data center, and Fedora 41-based images are now available for RISC-V. It is also possible to run Fedora RISC-V images using QEMU for those without supported hardware.
A milestone for reproducible openSUSE
The Reproducible-openSUSE project has announced that it has created a usable version of openSUSE with 100% reproducible packages.
[Bernhard] Wiedemann took on this 4-month-long project to create a fork of openSUSE that has 100% bit-reproducible packages. So far ring0 (aka bootstrap) and ring1 with 3,300 software packages have all successfully been patched and tested.
This build is not yet recommended for production use, though.
OpenSUSE Tumbleweed switches to SELinux
The openSUSE project has announced that future installations of the Tumbleweed rolling distribution will use SELinux for mandatory access control rather than AppArmor. Existing installations will not be migrated, and AppArmor will continue to be maintained for Tumbleweed. The openSUSE Leap 15 distribution is not changing.Distributions quote of the week
There is a huge confusion in many upstream's heads that putting their software on people's computers is what "distributing" means. The fact that their software is only semi-coherent with the system (only within a certain programming language boundary) is a problem.
Debian is a whole-system distribution; we make sure software works in a coherent system-wide way, and basing our packages on code which has already been pre-packaged for a subpar distribution (language-limited) isn't a good option.
Development
Mesa 25.0.0 released
Version 25.0.0 of the Mesa graphics library has been released. "The flashiest addition is probably the support for Vulkan 1.4 by Anv (Intel), Asahi (Apple), Lavapipe (software), NVK (NVIDIA), PanVK (Mali), RADV (AMD), and Turnip (Qualcomm). Users can expect the usual flurry of improvements across all drivers and components."
Mozilla announces leadership updates and next chapter
Mark Surman, president of the Mozilla Corporation, has announced
leadership updates for Mozilla. This includes a Mozilla Leadership
Council made up of executives from each Mozilla organization, and new
board chairs for the not-for-profit Mozilla Foundation, the
Mozilla Corporation, and Mozilla.ai. The announcement also
indicates a desire to further "diversify
" Mozilla's focus:
We've recognized that Mozilla faces major headwinds in terms of both financial growth and mission impact. While Firefox remains the core of what we do, we also need to take steps to diversify: investing in privacy-respecting advertising to grow new revenue in the near term; developing trustworthy, open source AI to ensure technical and product relevance in the mid term; and creating online fundraising campaigns that will draw a bigger circle of supporters over the long run. Mozilla's impact and survival depend on us simultaneously strengthening Firefox AND finding new sources of revenue AND manifesting our mission in fresh ways. That is why we're working hard on all of these fronts.
Pi-hole v6 released
Pi-hole v6 has been released. The latest version of the popular ad-blocking software sports a redesigned user interface, has support for subscribing to allowlists, and brings a new REST API and embedded web server. Its Docker/OCI image is now based on Alpine Linux rather than Debian to reduce image size. See the announcement for guidance on upgrading existing Pi-hole installations.
Development quote of the week
This has totally changed the conversation about open source graphics. When I started, everyone scoffed at Mesa. Today, the speed at which we're able to implement features and launch new API versions is the envy of the graphics industry. We're still not totally caught up everywhere—NVK and PanVK still need work and etnaviv Vulkan doesn't exist—but we're going toe to toe with the proprietary driver teams across most of the industry. Also, the fact that Linux Vulkan drivers are being hammered by most of Valve's library via DXVK and VKD3D often means the Mesa drivers are often more stable and robust than their closed source or Windows counterparts.— Faith EkstrandIt's a totally different world for 3D graphics now than it was a decade ago.
Page editor: Daroc Alden
Next page:
Announcements>>