Brief items
Security
Spectre variants 3a and 4
Intel has, finally, disclosed two more Spectre variants, called 3a and 4. The first ("rogue system register read") allows system-configuration registers to be read speculatively, while the second ("speculative store bypass") could enable speculative reads to data after a store operation has been speculatively ignored. Some more information on variant 4 can be found in the Project Zero bug tracker. The fix is to install microcode updates, which are not yet available.Security quotes of the week
Likewise, our adversaries certainly will not interpret this as a signifier that the United States will be less capable of developing a strategy to respond to cyber threats.
Most importantly, we would never question whether folding the cyber czar's job into the role of another National Security Council member would lead to decreased attention to the functions of the cybersecurity coordinator at the highest level of the administration. Never.
Kernel development
Kernel release status
The current development kernel is 4.17-rc6, released on May 20. Linus said: "So nothing special to report. Go read the shortlog, pull the changes, build, and test. It should all be good and pretty stable by this point."
Stable updates: 4.16.10, 4.14.42, and 4.9.101 were released on May 20, followed by 4.16.11, 4.14.43, and 4.9.102 on May 22.
Quotes of the week
Distributions
Parrot 4.0 is out
Parrot 4.0 has been released. Parrot is a security-oriented distribution aimed at penetration tests and digital forensics analysis, with additional tools to preserve privacy. "On Parrot 4.0 we decided to provide netinstall images too as we would like people to use Parrot not only as a pentest distribution, but also as a framework to build their very own working environment with ease." Docker templates are also available.
Distribution quote of the week
I think this is not happening because people believe things have been sorted out and we take care of them. But we are not, we can't do this alone.
Debian stretch
the 'reproducibly in theory but not in practice' release
Debian buster
the 'we should be reproducible but we are not' release?
Debian bullseye
the 'we are almost there but still haven't sorted out...' release???
I rather hope for:
Debian buster
the release is still far away and we haven't frozen yet! ;-)
Development
Williams: Introducing Git protocol version 2
Brandon Williams writes about the new Git remote protocol that will debut in the 2.18 release. "We recently rolled out support for protocol version 2 at Google and have seen a performance improvement of 3x for no-op fetches of a single branch on repositories containing 500k references. Protocol v2 has also enabled a reduction of 8x of the overhead bytes (non-packfile) sent from googlesource.com servers. A majority of this improvement is due to filtering references advertised by the server to the refs the client has expressed interest in."
Kata Containers 1.0
Kata Containers 1.0 has been released. "This first release of Kata Containers completes the merger of Intel’s Clear Containers and Hyper’s runV technologies, and delivers an OCI compatible runtime with seamless integration for container ecosystem technologies like Docker and Kubernetes."
Haas: Built-in Sharding for PostgreSQL
Robert Haas writes about the sharding capabilities that PostgreSQL will someday have. "The capabilities already added are independently useful, but I believe that some time in the next few years we're going to reach a tipping point. Indeed, I think in a certain sense we already have. Just a few years ago, there was serious debate about whether PostgreSQL would ever have built-in sharding. Today, the question is about exactly which features are still needed."
Vim 8.1 released
Version 8.1 of the Vim editor is available. "The main new feature of Vim 8.1 is support for running a terminal in a Vim window. This builds on top of the asynchronous features added in Vim 8.0."
Development quotes of the week
[...]
I dunno about you all but whenever I've had to document such an egregious uncorrectable failure mode as any of the ones in the inotify manual, I have rewritten the software instead. In that spirit, I hope that some day we shall send inotify to the pet cemetery, to rest in peace beside Beagle.
Miscellaneous
The Software Freedom Conservancy on Tesla's GPL compliance
The Software Freedom Conservancy has put out a blog posting on the history and current status of Tesla's GPL compliance issues. "We're thus glad that, this week, Tesla has acted publicly regarding its current GPL violations and has announced that they've taken their first steps toward compliance. While Tesla acknowledges that they still have more work to do, their recent actions show progress toward compliance and a commitment to getting all the way there."
Page editor: Jake Edge
Next page:
Announcements>>