|
|
Subscribe / Log in / New account

Brief items

Security

BleedingTooth: critical kernel Bluetooth vulnerability

Several flaws in the BlueZ kernel Bluetooth stack prior to Linux 5.9 are being reported by Intel and by Google (GHSA-h637-c88j-47wq, GHSA-7mh3-gq28-gfrq, and GHSA-ccx2-w2r4-x649). They are collectively being called "BleedingTooth", and more information will be forthcoming, though there is already a YouTube video demonstrating remote code execution using BleedingTooth.

Comments (28 posted)

Security quotes of the week

The Cellmate chastity lock works by allowing a trusted partner to remotely lock and unlock the chamber over Bluetooth using a mobile app. That app communicates with the lock using an API. But that API was left open and without a password [...] it may require the intervention of a heavy-duty bolt cutter or an angle grinder to free the user.
Zack Whittaker at TechCrunch

We have knowingly and willingly built the architecture of a police state, just so companies can show us ads.
Bruce Schneier

Comments (9 posted)

Kernel development

Kernel release status

The 5.9 kernel was released on October 11; Linus said: "Ok, so I'll be honest - I had hoped for quite a bit fewer changes this last week, but at the same time there doesn't really seem to be anything particularly scary in here. It's just more commits and more lines changed than I would have wished for."

Some of the significant features in this release are: x86 FSGSBASE support, capacity awareness in the deadline scheduler, the close_range() system call, proactive compaction in the memory-management subsystem, the rationalization of kernel-thread priorities, and more. See the KernelNewbies 5.9 page for more details.

Stable updates: 5.8.15, 5.4.71, 4.19.151, 4.14.201, 4.9.239, and 4.4.239 were released on October 14.

Comments (none posted)

Wishing David Miller well

David Miller is the long-time maintainer of the kernel's networking subsystem. On October 10, he wrote this to his Twitter feed: "I had a stroke on Tuesday and have been recovering since please pray for me". We at LWN wish David a fast and complete recovery. (Thanks to Harald Welte for the heads-up).

Comments (8 posted)

Quote of the week

I understand that this situation could be quite frustrating, but we can only expect a memory model to model memory. Its job is to help us understand what can work and what will not work from a memory-ordering perspective, which at best will provide you with the options that you seem to be so dissatisfied with. The memory model is quite incapable of browbeating intransigent human beings into agreeing on which option should be used in a given situation. This last never was a requirement of the LKMM project. Please rest assured that it will remain a non-requirement.
Paul McKenney

Comments (3 posted)

Distributions

Distribution quotes of the week

That is getting to be a fairer comparison. But we still are not comparing only package manager differences. In fact, this comparison is heavily skewed towards how a distribution chooses to package the software. Pacman appears at a disadvantage, because Arch packages all files for the software in a single package, and does not split binaries, libraries, docs, include files, etc into separate packages. That is a distribution decision, and not a package manager decision – all package managers in the comparison list are capable of splitting packages into smaller units. So maybe not apples to oranges, but rather oranges to orange segments? I don’t think I am good at analogies!
Allan McRae

Firstly it’s for designers, so they no longer have to suffer through countless hours of trying to build software themselves, in order to test the latest development versions of some of our core modules (most notably GNOME Shell). Tightening that feedback loop is incredibly valuable for delivering a polished product. After that, it’s for the release team, so it can validate releases before slinging them out the door; for developers and translators, so they can have a complete system to test and debug their changes on; for our downstream distributors and OS vendors, so that they can have a known to be working baseline against which they can compare their own products. Last but not least, it’s for the machines and robots that keep an eye out for regressions.

Enjoy GNOME OS!

Jordan Petridis (Thanks to Paul Wise)

Comments (4 posted)

Development

An open letter to Apache OpenOffice

On the 20th anniversary of the open-sourcing of the OpenOffice.org suite, the LibreOffice project has sent an open letter to the Apache OpenOffice project suggesting that it is time for the latter to recognize that the game is over. "If Apache OpenOffice wants to still maintain its old 4.1 branch from 2014, sure, that’s important for legacy users. But the most responsible thing to do in 2020 is: help new users. Make them aware that there’s a much more modern, up-to-date, professionally supported suite, based on OpenOffice, with many extra features that people need."

Comments (63 posted)

Krita 4.4.0 released

Version 4.4.0 of the Krita painting application has been released. "With a whole slew of new fill layer types, including the really versatile SeExpr based scriptable fill layer type, exciting new options for Krita’s brushes like the gradient map mode for brushes, lightness and gradient modes for brush textures, support for dynamic use of colors in gradients, webm export for animations, new scripting features — and of course, hundreds of bug fixes that make this version of Krita better than ever." See the release notes for details.

Comments (none posted)

LLVM 11.0.0 released

Version 11.0.0 of the LLVM compiler suite is out. Significant change include the addition of a Fortran frontend and a lot more; see the collection of release-note sets in the announcement for details.

Comments (4 posted)

Plasma 5.20 released

Version 5.20 of the Plasma KDE desktop is out. "A massive release, containing improvements to dozens of components, widgets, and the desktop behavior in general. Everyday utilities and tools, such as the Panels, Task Manager, Notifications and System Settings, have all been overhauled to make them more usable, efficient, and friendlier." There are also significant improvements in Plasma's Wayland support.

Comments (3 posted)

Plausible relicenses to AGPL

Plausible, a web-analytics package that was reviewed here in June, has announced a move from the MIT license to the Affero GPL, version 3. "This change makes no difference to any of you who subscribe to Plausible Cloud or who self-host Plausible, but it may upset a few corporations who tried to use our software to directly compete with us without contributing back."

Comments (4 posted)

Development quotes of the week

I suspect the above example of focus/activation requests will ultimately be addressed by a token exchange via Wayland, and the notification spec way of doing things will be implemented alongside it as well, rather than picking one way of doing things. And perhaps that's fine.

But it's worth stopping for a moment and being conscious of what's going on. We would all benefit from some commonly agreed-upon guidelines on where the scopes of Wayland and D-Bus end in our application platform, and where they overlap. Where does the windowing system start and end? Where should new protocols go? We also want to be smart in spec'ing out how the two mediums relate to each other, and making translations from one of the other safe and robust.

Eike Hein

Technologists have failed to listen to non-technologists. In technological circles, there’s a quantitative fallacy that if you can’t do maths on it, you can just ignore it. And so you just incinerate the qualitative elements and do maths on the dubious quantitative residue that remains. This is how you get physicists designing models for reopening American schools – because they completely fail to take on board the possibility that students might engage in, say, drunken eyeball-licking parties, which completely trips up the models.
Cory Doctorow (Thanks to Paul Wise)

Comments (3 posted)

Miscellaneous

The Open Invention Network's expanded Linux System Definition

The Open Invention Network, which offers patent protection for a wide range of open-source software, has expanded its Linux System Definition — the set of software covered by the OIN patent non-aggression agreement. In particular, the new definition includes the exFAT filesystem (once the subject of a lot of patent worries), the KDE Frameworks, the Robot Operating System, and version 10 of the Android Open Source Project.

Full Story (comments: none)

Page editor: Jake Edge
Next page: Announcements>>


Copyright © 2020, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds