Brief items

OpenSSH 8.3 released (and ssh-rsa deprecation notice)

The OpenSSH 8.3 release is out. This primarily a bug-fix release with a handful of minor new features. It does, however, carry a prominent notice that ssh-rsa signature algorithm will be disabled in "a near-future release". The announcement includes information on how to determine whether hosts you care about are affected.

Full Story (comments: 40)

A review of open-source software supply chain attacks

Here's a preprint paper from Marc Ohm, Henrik Plate, Arnold Sykosch, and Michael Meier looking at attacks on language-specific repositories. "Recent years saw a number of supply chain attacks that leverage the increasing use of open source during software development, which is facilitated by dependency managers that automatically resolve, download and install hundreds of open source packages throughout the software life cycle. This paper presents a dataset of 174 malicious software packages that were used in real-world attacks on open source software supply chains, and which were distributed via the popular package repositories npm, PyPI, and RubyGems. Those packages, dating from November 2015 to November 2019, were manually collected and analyzed. The paper also presents two general attack trees to provide a structured overview about techniques to inject malicious code into the dependency tree of downstream users, and to execute such code at different times and under different conditions."

Comments (none posted)

Cook: security things in Linux v5.5

Kees Cook takes a look some changes improving security in Linux 5.5. Topics include restrict perf_event_open() from LSM, generic fast full refcount_t, linker script cleanup for exception tables, KASLR for 32-bit PowerPC, seccomp for RISC-V, and more.

Comments (none posted)

Kernel release status

The current development kernel is 5.7-rc7, released on May 24. "So it looks like I was worried for nothing last rc. Of course, anything can still change, but everything _looks_ all set for a regular release scheduled for next weekend. Knock wood."

Stable updates: 5.6.15, 5.4.43, 4.19.125, 4.14.182, 4.9.225, and 4.4.225 were all released on May 27.

Comments (none posted)

Carpenter: Writing the Ultimate Locking Check

Here's a detailed blog entry from Dan Carpenter on adding improved lock checking to the smatch static-analysis tool. "When Smatch gained the ability to do cross function analysis in 2010, I knew that I had to re-write the locking check to take advantage of the new cross function analysis feature. When you combine cross function analysis with top of the line flow analysis available and in depth knowledge of kernel locks then the result is the Ultimate Locking Check! Unfortunately, I have a tendency towards procrastination and it took me a decade to get around to it, but it is done now. This blog will step through how the locking analysis works."

Comments (none posted)

GoboLinux 017 released

Version 017 of the decidedly non-traditional GoboLinux distribution has been released. "This release introduces a simplified model for recipe management and contribution that's fully integrated with the Compile build tool. The recipe tree is now a plain Git repository managed via GitHub cloned into your /Data/Compile/Recipes directory and used by the GoboLinux Compile tool directly."

Comments (16 posted)

GNOME resolves Rothschild patent suit

The patent suit filed against the GNOME Foundation last September has now been resolved. "In this walk-away settlement, GNOME receives a release and covenant not to be sued for any patent held by Rothschild Patent Imaging. Further, both Rothschild Patent Imaging and Leigh Rothschild are granting a release and covenant to any software that is released under an existing Open Source Initiative approved license (and subsequent versions thereof), including for the entire Rothschild portfolio of patents, to the extent such software forms a material part of the infringement allegation." There is no mention of what the foundation had to give — if anything — for this settlement,

Comments (20 posted)