Brief items
Security
Trust Issues: Exploiting TrustZone TEEs (Project Zero)
Here is a lengthy and detailed look from Google's Project Zero at the trusted execution environments that, one hopes, protect devices from compromise. "In this blog post we’ll explore the security properties of the two major TEEs present on Android devices. We’ll see how, despite their highly sensitive vantage point, these operating systems currently lag behind modern operating systems in terms of security mitigations and practices. Additionally, we’ll discover and exploit a major design issue which affects the security of most devices utilising both platforms. Lastly, we’ll see why the integrity of TEEs is crucial to the overall security of the device, making a case for the need to increase their defences."
Security quote of the week
Around 12:00 PST, an unknown attacker exploited a critical flaw in the
Parity multi-signature wallet on the Ethereum network, draining three
massive wallets of over $31,000,000 worth of Ether in a matter of
minutes. Given a couple more hours, the hacker could’ve made off with over
$180,000,000 from vulnerable wallets.
— Haseeb
Qureshi
But someone stopped them.
Having sounded the alarm bells, a group of benevolent white-hat hackers from the Ethereum community rapidly organized. They analyzed the attack and realized that there was no way to reverse the thefts, yet many more wallets were vulnerable. Time was of the essence, so they saw only one available option: hack the remaining wallets before the attacker did.
By exploiting the same vulnerability, the white-hats hacked all of the remaining at-risk wallets and drained their accounts, effectively preventing the attacker from reaching any of the remaining $150,000,000.
Kernel development
Kernel release status
The current development kernel is 4.13-rc2, released on July 23. "Changes all over, although the diffstat is dominated by the new vboxvideo staging driver. I shouldn't have let it through, but Greg, as we all know, is 'special'. Also, Quod licet Iovi, and all that jazz - Greg gets to occasionally break some rules."
Stable updates: 4.12.3, 4.11.12, 4.9.39, 4.4.78, and 3.18.62 were released on July 21. Note that 4.11.12 is the final release in the 4.11.x series.
The (large) 4.12.4, 4.9.40, 4.4.79, and 3.18.63 stable updates are in the review process; they can be expected on or after July 27.
Distributions
Stable Debian releases
Debian has released updates to its stable and old stable distributions. Debian 9.1 is the first update to "stretch" and Debian 8.9 is the ninth update to "jessie". These updates do not constitute a new versions of Debian, they only update some of the packages included. "Those who frequently install updates from security.debian.org won't have to update many packages, and most such updates are included in the point release."
Debian reproducible builds project update
Debian's reproducible builds project has posted an update of what it has accomplished over the last few years. "On our website there are nice colourful graphs showing our progress in numerical terms. In particular, let us point to the stretch/amd64 graph: since our slow start ~3 years ago we have been steadily improving the reproducibility of our archive, reaching a staggering 94% at the time of writing!"
OpenSUSE Leap 42.3 released
OpenSUSE Leap 42.3 is now available. "After basing openSUSE Leap on SLE (SUSE Linux Enterprise) and adding more source code to Leap 42.2 from SLE 12, Leap 42.3 adds even more packages from SLE 12 SP 3 and synchronizes several common packages. The shared codebase allows for openSUSE Leap 42.3 to receive enhanced maintenance and bug fixes from both the openSUSE community and SUSE engineers." There is quite a bit of new stuff in this release; see this page for some details.
Distribution quote of the week
I think that the more mainstream something is, the less the need for
specialized teams to deal with every issue. Sure, somebody could
always escalate a sticky problem, but having an arch team do every
stabilization seems like having the gcc team look at every build
error.
— Rich Freeman
Development
The Document Foundation 2016 annual report
The Document Foundation has put out an extensive annual report [PDF] describing its activities in 2016. "According to Google Trends, LibreOffice surpassed all other free office suites in early 2016 in terms of user interest, winning a race that started in early 2011. At the end of the year, Datamation confirmed the leading position, with the first article about alternatives to LibreOffice" The report is also available in German [PDF].
The end of Flash
The long-awaited end of Flash has come a little closer with this announcement from Adobe. "Given this progress, and in collaboration with several of our technology partners – including Apple, Facebook, Google, Microsoft and Mozilla – Adobe is planning to end-of-life Flash. Specifically, we will stop updating and distributing the Flash Player at the end of 2020 and encourage content creators to migrate any existing Flash content to these new open formats."
Ring 1.0 released
Savoir-faire Linux has announced the release of Ring 1.0. "Ring is a free/libre and universal communication platform that preserves the users’ privacy and freedoms. It is a GNU package. It runs on multiple platforms; and, it can be used for texting, calls, and video chats more privately, more securely, and more reliably."
Miscellaneous
Intel kills Curie module and Arduino 101 SBC (LinuxGizmos.com)
LinuxGizmos reports that Intel is discontinuing its Curie wearables module and its Curie-enabled Arduino 101 SBC. "Intel will no longer update the Curie’s Open Developer Kit, and will continue forum support only through Sep. 15. After that, “Intel will make its online resources available for review only and maintain availability to the Intel Curie community until June 15, 2020,” according to the July 18 Intel forum post. Intel says it is “actively working with alternative manufacturers to continue to make the Arduino 101 development board available to the market.” The chipmaker will support orders of the Arduino 101 through Sep. 17, and will fulfill those orders through Dec. 17. Arduino.cc will continue to offer Arduino IDE support for the 101."
Page editor: Jake Edge
Next page:
Announcements>>