Brief items
Security
Firefox extended tracking protection
This Mozilla Security Blog entry describes the new redirect-tracking protections soon to be provided by the Firefox browser. "ETP 2.0 clears cookies and site data from tracking sites every 24 hours, except for those you regularly interact with. We’ll be rolling ETP 2.0 out to all Firefox users over the course of the next few weeks."
Linux Foundation announces Open Source Security Foundation
The Linux Foundation has announced the formation of the Open Source Security Foundation (OpenSSF). The foundation aims to improve the security of open source software. "The OpenSSF brings together the industry’s most important open source security initiatives and the individuals and companies that support them. The Linux Foundation’s Core Infrastructure Initiative (CII), founded in response to the 2014 Heartbleed bug, and the Open Source Security Coalition, founded by the GitHub Security Lab, are just a couple of the projects that will be brought together under the new OpenSSF. The Foundation’s governance, technical community and its decisions will be transparent, and any specifications and projects developed will be vendor agnostic. The OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open source security for all."
X.org security fixes address potential ASLR bypass, heap corruption
The X.Org project has announced two security advisories that impact Xserver and libX11. The first advisory for X server is regarding uninitialized memory in AllocatePixmap() that could lead to address space layout randomization bypass. The second, impacting libX11, is a heap corruption caused by integer overflows and signed/unsigned comparisons.Security quotes of the week
The publishers’ lawsuit does not stop at seeking to end the practice of Controlled Digital Lending. These publishers call for the destruction of the 1.5 million digital books that Internet Archive makes available to our patrons. This form of digital book burning is unprecedented and unfairly disadvantages people with print disabilities. For the blind, ebooks are a lifeline, yet less than one in ten exists in accessible formats. Since 2010, Internet Archive has made our lending library available to the blind and print disabled community, in addition to sighted users. If the publishers are successful with their lawsuit, more than a million of those books would be deleted from the Internet’s digital shelves forever.
I call on the executives at Hachette, HarperCollins, Wiley, and Penguin Random House to come together with us to help solve the pressing challenges to access to knowledge during this pandemic. Please drop this needless lawsuit.
It's a weird way to "attack" the power of big tech by forcing them to collect and store more of your private info. But, hey, it's not about what's actually in the bill. It's about whatever bullshit narrative Graham and others know the press will say is in the bill.
Either way, we've heard that Graham and his bi-partisan supporter for EARN IT, Senator Richard Blumenthal, are looking to rush EARN IT through with no debate, via a process known as hotlining.
Kernel development
Kernel release status
The 5.8 kernel was released on August 2; in the announcement Linus said that: "I considered making an rc8 all the way to the last minute, but decided it's not just worth waiting another week when there aren't any big looming worries around."
Headline features in this release include: branch target identification and shadow call stacks for the arm64 architecture, the BPF iterator mechanism, inline encryption support in the block layer, the CAP_PERFMON and CAP_BPF capabilities, a generalized kernel event-notification subsystem, the KCSAN data-race detector, and more. As always, see the KernelNewbies 5.8 page for more information.
Stable updates: 5.7.12, 5.4.55, 4.19.136, 4.14.191, 4.9.232, and 4.4.232 were released on July 31, followed by 5.7.13, 5.4.56, 4.19.137, and 4.14.192 on August 5.
Distributions
Debian 10.5 released
Debian 10 "buster" received a fifth update. In addition to the usual security and bug fixes, this point release addresses Debian Security Advisory: DSA-4735-1 grub2. This security update covers multiple CVE issues regarding the GRUB2 UEFI SecureBoot 'BootHole' vulnerability.Grub2 updates for Red Hat systems are making some unbootable
As reported in the comments on the Grub2 secure-boot vulnerabilities report, the updates for grub2 for RHEL 8 and CentOS 8 are making some systems unbootable. The boot problems are seemingly unrelated to whether the system has secure boot enabled. It may be worth waiting a bit for that to shake out.Distribution quote of the week
Development
Julia 1.5 has been released
Version 1.5 of the Julia programming language has been released. On the Julia blog, Jeff Bezanson and Stefan Karpinski describe the highlights of the release, which includes struct layout improvements for decreasing heap allocations, stabilization of the multithreading API, faster random numbers, changes to the scoping rules in the read-eval-print loop (REPL), and more. "Julia excels at simulations, so random numbers are important to a lot of users of the language. For this release Rafael Fourquet, one of the primary architects of the Random standard library and a prolific contributor in general, implemented some impressive algorithmic improvements for some popular cases. The first is a major improvement when generating normally-distributed double-precision floats. Calling randn(1000) is nearly twice as fast in Julia 1.5 compared with Julia 1.4. Generating random booleans also got much faster: rand(Bool, 1000) is nearly 6x faster. Finally, sampling from discrete collections has also gotten faster: rand(1:100, 1000) got 25% faster." LWN looked at Julia (part 1, part 2) back in 2018, shortly after the release of Julia 1.0.
LibreOffice 7.0 released
Version 7.0 of the LibreOffice office suite is out. It brings a long list of new features, including: "support for OpenDocument Format (ODF) 1.3; Skia graphics engine and Vulkan GPU-based acceleration for better performance; and carefully improved compatibility with DOCX, XLSX and PPTX files". The plan to create a differentiated "enterprise edition" that was discussed in July has been deferred and is not part of this release.
systemd 246 released
Systemd 246 has been released. There is an incredibly long list of new features, many of which have to do with support for encrypted and signed disk volumes. "Various command line parameters and configuration file settings that configure key or certificate files now optionally take paths to AF_UNIX sockets in the file system. If configured that way a stream connection is made to the socket and the required data read from it. This is a simple and natural extension to the existing regular file logic, and permits other software to provide keys or certificates via simple IPC services, for example when unencrypted storage on disk is not desired."
Development quotes of the week
[...] The whole point of perl7 is radically choosing approachability over stability.
The crucial thing to realize here is that that means that perl7 is not just a fork of the interpreter, it is also a fork of our community and our ecosystem. To some extent that fork can be postponed until perl8 drops perl5 compatibility, but given this new course it is inevitable. Some will join this brave new world, and some will not
Page editor: Jake Edge
Next page:
Announcements>>
