Brief items

Preventing domain-resurrection attacks (PyPI blog)

The Python Package Index (PyPI) has announced that it is now checking for expired domains to try to prevent domain-resurrection attacks. In this type of attack, a malicious user buys an expired domain and uses it to take over an account by resetting the password associated with the email used with PyPI. Since June, PyPI has unverified more than 1,800 email addresses after their associated domains entered expiration phases.

After an initial bulk check period that took place in April 2025, PyPI will check daily for any domains in use for status changes, and update its internal database with the most recent status.

If a domain registration enters the redemption period, that's an indicator to PyPI that the previously verified email destinations may not be trusted, and will un-verify a previously-verified email address. PyPI will not issue a password reset request to addresses that have become unverified.

PyPI recommends that users add a second verified email address "from another notable domain (e.g. Gmail)" to their account, if they do not have one already.

Comments (none posted)

Kernel release status

The current development kernel is 6.17-rc2, released on August 17. Linus proclaimed:

So it's been a very calm week, and this is one of the smaller rc2 releases we've had lately. I'm definitely not complaining, since I've been jetlagged much of the week, but I have this suspicion that it just means that next week will see more noise.

Stable updates: 6.16.2, 6.15.11, and 6.12.43 were released on August 20. 6.6.102 and 6.1.148 were released on August 15. 6.15.11 was the last entry in the 6.15 series.

Comments (none posted)

Adding stubble to Ubuntu's generic Arm64 Desktop ISOs

Tobias Heider has written an article that explains changes that are coming for Ubuntu's generic Arm64 desktop ISO images in the 25.10 release. The current solution, Heider says, depends on GRUB features that are unavailable in secure boot mode and require adding device-specific logic to multiple packages. The new solution, called stubble, is derived from systemd-stub:

A bundled stubble image contains stubble itself, a Linux kernel, a HWID lookup table to map devices to device trees and multiple device trees. When grub loads this "kernel", stubble executes first, reads the SMBIOS table to generate HWIDs, looks for a match in the embeeded lookup table and loads a matching device tree before passing control to the actual Linux kernel.

The elegance in this approach lies in how it interacts with the rest of the system. Integrating stubble happens entirely at build time in the kernel package. The stubble package is a build dependency for the kernel. After building the kernel itself, we bundle it with stubble and our DTBs and ship the combined binary instead. The resulting stubble + kernel + dtb bundle can be loaded by grub like any other Ubuntu kernel. No further changes in grub or other packages are necessary to make it work.

Comments (9 posted)

Distributions quote of the week

I think my time is more valuable than others because there are many more people clamoring for [my] attention. If we're considering the number of users of e2fsprogs/ext4, they outnumber me millions to one. As a result, I *expect* that people who ask me to review their code do things to make it easier for me. Otherwise, things just don't scale.

And no, team maintenance doesn't help; that [would] just make it be millions to three, and then you have the communications overhead between the co-maintainers.

We're all volunteers; and I think people who are trying to demand that volunteers do things *their* way is just being counter-productive. As a volunteer, I have a very simple answer to people who are demanding that I do things differently from the way I want: No.

— Ted Ts'o

Comments (6 posted)

Firefox 142.0 released

Version 142.0 of the firefox browser has been released. Changes include a new link preview feature (with optional "AI-generated key points"), and a "flexible exception list" for the strict tracking protection feature that allows relaxing specific protections on sites that otherwise will not work properly.

Comments (6 posted)

Git v2.51 released

The Git distributed version-control system has released version 2.51, with "506 non-merge commits since v2.50.1, contributed by 91 people, 21 of which are new faces". It brings multiple new features, some of which are highlighted in a post on the GitHub blog. It includes some performance improvements for multi-pack indexes (MIDXs), a way to import and export stash entries so they can be migrated more easily, and smaller pack files:

Git 2.51 takes the spirit of that change and goes a step further by introducing a new way to collect objects when repacking, called "path walk". Instead of walking objects in revision order with Git emitting objects with their corresponding path names along the way, the path walk approach emits all objects from a given path at the same time. This approach avoids the name-hash heuristic altogether and can look for deltas within groups of objects that are known to be at the same path.

As a result, Git can generate packs using the path walk approach that are often significantly smaller than even those generated with the new name hash function described above. Its timings are competitive even with generating packs using the existing revision order traversal.

Full Story (comments: 2)

Hashimoto: We rewrote the Ghostty GTK application

Mitchell Hashimoto has written a blog post about "fully embracing the GObject type system" with a rewrite of the GTK version of Ghostty:

In addition to memory management [improvements], we can now more easily create custom GTK widgets. This let us fully embrace modern GTK UI technologies such as Blueprint. For example, here is our terminal window Blueprint file. This has already led to more easily introducing GUI features like a new GTK titlebar tabs option, an animated border on bell, etc.

The rewrite is now the default if one builds Ghostty from source, and will be included in the 1.2 release that is expected in the next few weeks. LWN covered Ghostty in January.

Comments (35 posted)

LibreOffice 25.8 released

Version 25.8 of the LibreOffice open-source office suite has been released. Notable changes include several new functions in the Calc spreadsheet application, ability to export to the PDF 2.0 format, better PowerPoint font compatibility with Impress, and significant performance improvements. For a full list of changes, see the release notes on the Document Foundation wiki.

Comments (none posted)

The State of Python 2025

The JetBrains blog presents the results of the eighth annual Python Developers Survey, carried out in partnership with the Python Software Foundation.

This year, 51% of all surveyed Python developers are involved in data exploration and processing, with pandas and NumPy being the tools most commonly used for this.

Many of us in the Python pundit space have talked about Python as being divided into thirds: One-third web development, one-third data science and pure science, and one-third as a catch-all bin.

We need to rethink that positioning now that one of those thirds is overwhelmingly the most significant portion of Python.

Comments (18 posted)

Zig version 0.15.1

The Zig project has announced version 0.15.1 of the language. The release, much like the last one, includes incremental progress toward the goal of completely dropping LLVM and improving compile time, as well as a handful of breaking changes as the language team wrestles with past API design. The biggest change this time around is to the standard library Reader and Writer interfaces, which have been completely rearranged in the name of performance and reducing unneeded copies.

All existing std.io readers and writers are deprecated in favor of the newly provided std.Io.Reader and std.Io.Writer which are non-generic and have the buffer above the vtable - in other words the buffer is in the interface, not the implementation. This means that although Reader and Writer are no longer generic, they are still transparent to optimization; all of the interface functions have a concrete hot path operating on the buffer, and only make vtable calls when the buffer is full.

These changes are extremely breaking. I am sorry for that, but I have carefully examined the situation and acquired confidence that this is the direction that Zig needs to go. I hope you will strap in your seatbelt and come along for the ride; it will be worth it.

Comments (1 posted)

Development quote of the week

I feel that it is a bad idea to remove XSLT from the web platform at this time, and I chafe under the reality that it is large browser vendors who today decide what the "web platform" even is. Discussion of limited resources is moot, because the large browser vendors have effectively unlimited resources — which they are today using to snuff out important parts of the Open Web, redefining podcasts as YouTube channels, etc.

As you have seen in the other discussion prior to closing it and censoring a dozen on-topic comments written with care, there are a lot of very diverse ways that XSLT is being used to enrich the Web today. It's time to remember that the Web is all of us who publish websites. That's who ought to be deciding what is part of the "Web platform". I deeply love the World Wide Web, the creative and strange things that people put on there. Without lionising the problematic days of W3C, I wish that today's stewards of the Web came to it from a place of love for the platform and its history.

— Jon Sterling

Comments (1 posted)