Brief items
Security
A very deep dive into iOS Exploit chains found in the wild (Project Zero)
It's not Linux but is worth a read: Google's Project Zero blog has a highly detailed analysis of several iOS exploits and how they were used to compromise large numbers of devices. "There's something thus far which is conspicuous only by its absence: is any of this encrypted? The short answer is no: they really do POST everything via HTTP (not HTTPS) and there is no asymmetric (or even symmetric) encryption applied to the data which is uploaded. Everything is in the clear. If you're connected to an unencrypted WiFi network this information is being broadcast to everyone around you, to your network operator and any intermediate network hops to the command and control server. This means that not only is the end-point of the end-to-end encryption offered by messaging apps compromised; the attackers then send all the contents of the end-to-end encrypted messages in plain text over the network to their server."
Security quotes of the week
I recently used my credit card to buy a banana. Then I tried to figure out
how my credit card let companies buy me.
— Geoffrey A. Fowler in The Washington Post (worth
reading in full)
You might think my 29-cent swipe at Target would be just between me and my bank. Heavens, no. My banana generated data that’s probably worth more than the banana itself. It ended up with marketers, Target, Amazon, Google and hedge funds, to name a few.
Oh, the places a banana will go in the sprawling card-data economy. Despite a federal privacy law covering cards, I found that six types of businesses could mine and share elements of my purchase, multiplied untold times by other companies they might have passed it to. Credit cards are a spy in your wallet — and it’s time that we add privacy, alongside rewards and rates, to how we evaluate them.
We are increasing the scope of GPSRP [Google Play Security Reward Program]
to include all apps in Google Play
with 100 million or more installs. These apps are now eligible for rewards,
even if the app developers don’t have their own vulnerability disclosure or
bug bounty program. In these scenarios, Google helps responsibly disclose
identified vulnerabilities to the affected app developer. This opens the
door for security researchers to help hundreds of organizations identify
and fix vulnerabilities in their apps. If the developers already have their
own programs, researchers can collect rewards directly from them on top of
the rewards from Google. We encourage app developers to start their own
vulnerability disclosure or bug bounty program to work directly with the
security researcher community.
— Adam
Bacchus, Sebastian Porst, and Patrick Mutchler in the Google Security Blog
Kernel development
Kernel release status
The current development kernel is 5.3-rc7, released on September 2. Linus noted that the final 5.3 release is likely to come out a week later than some might expect: "So I do suspect that with my timing (and a number of other developers are probably going to be traveling for LPC and KS too) I'll just make an rc8 even if it turns this Labor Day week ends up being very quiet and there might not be any _technical_ reason to delay the release."
Stable updates: 5.2.11, 4.19.69, and 4.14.141 were released on August 29.
grsecurity: Teardown of a Failed Linux LTS Spectre Fix
This grsecurity blog entry looks at how an ineffective Spectre fix found its way into the stable kernel releases. If one looks past the advertising, it's a good summary of how the kernel processes can produce the wrong result. "Despite this warning, this code was merged into Thomas Gleixner's x86/tip tree verbatim, as can be seen here. Prior to merging the fix for 5.3-rc1, Linus Torvalds noticed the warning as seen on the LKML mailing list here and fixed it correctly. However, when the actual merge of the tree was performed, no mention was made of the correction to the fix, and with no specific commit mentioning the correction and fixing it alone, everyone else's processes that depended on cherry-picking specific commits ended up grabbing the bad warning-inducing change. As a further failure, instead of looking at Linus' correct fix (observable by checking out the master tree at the time), the approach seems to have been to naively silence the warning by simply swapping the order of the two lines".
Quotes of the week
It just seems that every maintainer I spoke with is generally
making things "sort-of work well enough" by applying a lot of
baling wire around mail clients, patchwork.kernel.org, gitlab, or
all of the above, and I'm wondering if everyone is happy to do
that, or only doing that because a good tool written to fit with
the "kernel development model" doesn't exist.
— Konstantin
Ryabitsev
The major difference between filesystems and the rest of the kernel
that seems to be missed by most kernel developers is that
filesystems maintain persistent data - you can't fix a problem/bug
by rebooting or power cycling. Once the filesystem code screws up,
the user is left with a mess they have to fix and that invariably
results in data loss.
— Dave Chinner
Users remember when a filesystem eats their data - they don't tend to want to have anything to do with that filesystem ever again if it happens to them. We still get people saying "XFS ate my data back in 2002, I don't trust it and I'll never use it again".
Distributions
Android 10 released
Google has announced the release of Android 10, the free parts of which are available from the Android Open Source Project now. "Privacy is a central focus in Android 10, from stronger protections in the platform to new features designed with privacy in mind. Building on previous releases, Android 10 includes extensive changes to protect privacy and give users control, with improved system UI, stricter permissions, and restrictions on what data apps can use."
Distribution quote of the week
In addition to acting as a board member like my peers do, there is one aspect I see as my personal focus: bridging—helping to further connect and bridge between openSUSE and “SUSE corporate.” There are a lot of such bridges on the technical side, and SUSE employees who contribute to openSUSE, and personal and working relationships from openSUSE users and contributors towards the SUSE side, which is great. I hope we can grow those and add strong connections between some of my peers on the SUSE side and the board, them and contributors in specific areas, and generally further increase mutual visibility, understanding, and collaboration.
— Gerald
Pfeifer (new openSUSE board chairman)
Development
Firefox 69.0 released
Firefox 69.0 has been released. This release enables on-by-default Enhanced Tracking Protection for all users and gives more control over blocking playback of videos which start playing automatically. See the release notes for details.Ovid: Is Perl 6 Being Renamed?
Blogger Ovid writes about the push to rebrand Perl 6. "So yeah, there's bitterness and the Perl community not only needs to heal, but we need to find a way forward for both languages. The suggestion to change the name of Perl 6 to 'raku' is effectively designed to make this happen. Perl 5 can figure out how to get beyond the branding issue that's been plaguing it and Perl 6 can do the same thing."
Development quote of the week
Usual rules apply: don't expect any new features, don't think that this will change your life, it won't make you richer or more attractive, but it will hopefully be more stable and usable for people who've been victims of any of these bugs.
— Kodi 18.4 release announcement
Page editor: Jake Edge
Next page:
Announcements>>