Brief items

Eden: NHS goes to war against open source

Terence Eden reports that the UK's National Health Service (NHS) is preparing to close almost all of its open-source repositories as a response to LLM tools, such as Anthropic's Mythos, becoming more sophisticated at finding security vulnerabilities. He does not, to put it mildly, agree with the decision:

The majority of code repos published by the NHS are not meaningfully affected by any advance in security scanning. They're mostly data sets, internal tools, guidance, research tools, front-end design and the like. There is nothing in them which could realistically lead to a security incident.

When I was working at NHSX during the pandemic, we were so confident of the safety and necessity of open source, we made sure the Covid Contact Tracing app was open sourced the minute it was available to the public. That was a nationally mandated app, installed on millions of phones, subject to intense scrutiny from hostile powers - and yet, despite publishing the code, architecture and documentation, the open source code caused zero security incidents.

Furthermore, this new guidance is in direct contradiction to the UK's Tech Code of Practice point 3 "Be open and use open source" which insists on code being open.

Comments (15 posted)

Kernel release status

The current development kernel is 7.1-rc2, released on May 3. Linus said: "It's not small, and while it's a bit early to say for sure, I do suspect we're seeing the same continued pattern of more patches than usual - probably due to AI tooling - that we saw in 7.0."

As of -rc2, the 7.1 development cycle has brought in 13,417 non-merge commits from 2,066 developers, 355 of whom are first-time kernel contributors. The release history looks like:

RC	Date	Commits
v7.1-rc1	2026-04-26	13963	13963
v7.1-rc2	2026-05-03	475	475

See the KSDB 7.1 page for lots of details.

Stable updates: 7.0.3, 6.18.26, 6.12.85, 6.6.137, 6.1.170, 5.15.204, and 5.10.254 were released on April 30. The 7.0.3 and 6.18.26 kernels only contain fixes needed for Xen users; the others, though, have backported fixes for the recently disclosed AEAD socket vulnerability.

Comments (none posted)

Quotes of the week

I love it how people think that "coordination of vulnerabilities" is actually something that can be done these days. Think of just who uses the software in question, and who should, and should not, be on such a list to get a "early disclosure notification".

As I have said for quite some time now, all early-disclosure lists are leaks, otherwise why would your government allow them to be in existence?

Software, and specifically open source software, runs the world. So should the whole world be on that notification list? :)

— Greg Kroah-Hartman

We do remove algorithms from AF_ALG occasionally, but we've been unable to remove ones like MD4 (yes, that MD4) that are still used by iwd: https://lore.kernel.org/linux-crypto/946591db-36aa-23db-a5c4-808546eab762@gmail.com/ Likewise with removing support for SHA-1 from KEYCTL_PKEY_* (https://lore.kernel.org/linux-crypto/f0492c92-1015-48e3-bfce-598c7a4843d1@quicinc.com/). People even post the Linus quote "we simply do not break user space".

Unfortunately, the developers and users of this small set of userspace programs are disconnected from the extraordinary amount of time and effort that the rest of the Linux community is putting in to maintain these UAPIs and respond to the continuous stream of vulnerabilities.

To them these are simply APIs available that work.

— Eric Biggers

Comments (none posted)

Alpine Linux systems currently offline

The Alpine Linux account on fosstodon.org reports that all systems hosted at Linode, including its GitLab instance, "are suspended at the moment due to some billing issue". They are working to get it resolved, but in the meantime all of their services appear to be down.

Update: Alpine Linux's servers are back online.

Comments (none posted)

Distributions quote of the week

2,442 days is a fair amount of time, and that's how long I had been on the openSUSE Board as its chair when I started this note.

That journey began on August 19th, 2019, and it ends today as I am stepping down as chair of the openSUSE Board.

It's been an intense time for most of it — just a bit calm the last year and a half. A time of joy and frustration, anger occasionally and rewarding more often than that.

During those years we have seen SUSE and openSUSE carve out from Micro Focus (escalations on the IT side included); a global pandemic; SUSE go public and return to private; the arrival of Rancher, NeuVector, and Losant; four CIOs and four (and de facto more) General Managers for Linux at SUSE; repeated discussions on the logo and name of our project; the creation of Geeko Foundation; people move on and others step up; seven board elections; board meetings become public; passionate debates and growing pains; web site refreshes; the number of distros and tooling around them grow and evolve; and quite a bit more.

If I can leave one piece of advice, it is to embrace open, non-violent communication and trust — both given and received.

I encourage more lateral sharing (of accomplishments, changes, challenges, calls for collaboration) between the cells and bodies that make up openSUSE, and above all applying the PRINCIPLE OF CHARITY. That is, giving others the benefit of the doubt, assuming good intentions, and looking for real value in their perspectives.

Does that always come easy? Absolutely not.
Does it make a difference? A lot.

— Gerald Pfeifer

Comments (none posted)

GCC 16.1 released

Version 16.1 of the GNU Compiler Collection (GCC) has been released.

The C++ frontend now defaults to the GNU C++20 dialect and the corresponding parts of the standard library are no longer experimental. Several C++26 features receive experimental support, including Reflection (-freflection), Contracts, expansion statements and std::simd.

Other changes include the introduction of an experimental compiler frontend for the Algol68 language, ability to output GCC diagnostics in HTML form, and more.

Comments (9 posted)

Incus 7.0 LTS released

Version 7.0 of the Incus container and virtual-machine management system has been released. Notable changes in this release include the inclusion of a low-level backup API, the addition of basic S3 operations directly in Incus to replace the now-unmaintained MinIO project, as well as the removal of support for cgroups v1 and xtables (iptables/ip6tables/ebtables). This is a long-term-support (LTS) release, with support through June 2031.

The first 2 years will feature bug and security fixes as well as minor usability improvements, delivered through occasional point releases (7.0.x). After that initial two years, Incus 7.0 LTS will move to security only maintenance for the remaining of its 5 years of support.

A total of 204 individuals contributed to Incus between the 6.0 LTS and 7.0 LTS releases with 45 contributing between the 6.23 and 7.0 LTS releases.

Comments (none posted)

NetHack 5.0.0 released

Version 5.0.0 of the NetHack dungeon-exploration game, a distant relative of Rogue and Hack, has been released. NetHack's code is now compliant with the C99 standard, and the release includes more than 3,100 bug fixes and changes, detailed in doc/fixes5-0-0.txt (may contain game spoilers). Saved games from previous versions will not work with NetHack 5.0.0.

Comments (4 posted)

The retirement of the PHP license

The PHP project has long shipped under its own license — except for the parts under the Zend Engine License. The PHP project has now announced that the PHP license has been retired, and the PHP code has been relicensed under the three-clause BSD license. See this blog entry for more details.

Getting here required more than writing an RFC. The PHP License gives the PHP Group the authority to change it, which meant tracking down each of the original PHP Group members and getting their written consent. Each approved the proposal. Perforce Software, the successor to Zend Technologies, needed to sign off on the Zend Engine side, as well. They provided a formal letter confirming their full authority and support for the change. I hired an attorney to review the proposal and provide advice on any legal questions that might surface during the discussion period. Speaking of which, I allowed for a six-month community discussion period preceding the vote, which passed unanimously.

LWN covered the license-change process back in March.

Comments (4 posted)

Development quote of the week

At the time, the prevalence of goblins did not look especially alarming. A few months later, the goblins came back to haunt us in a much more specific and reproducible form.

— OpenAI research

Comments (none posted)