Brief items
Security
An unpleasant sudo vulnerability
It would appear that "sudo" has a buffer-overflow vulnerability that allows any local user to gain root privileges, whether or not they are in the sudoers file. It has been there since 2011. See this advisory for details, but perhaps run an update first.
Kernel development
Kernel release status
The current development kernel is 5.11-rc5, released on January 24. "Nothing particularly stands out. We had a couple of splice() regressions that came in during the previous release as part of the 'get rid of set_fs()' development, but they were for odd cases that most people would never notice. I think it's just that 5.10 is now getting more widely deployed so people see the fallout from that rather fundamental change in the last release."
Stable updates: 5.10.10, 5.4.92, 4.19.170, 4.14.217, 4.9.253, and 4.4.253 were released on January 23, followed by 5.10.11, 5.4.93, and 4.19.171 on January 27.
Corellium: How we ported Linux to the M1
The Corellium blog is carrying a description of how the Linux port to the Apple M1 processor was done. "Many components of the M1 are shared with Apple mobile SoCs, which gave us a good running start. But when writing Linux drivers, it became very apparent how non-standard Apple SoCs really are. Our virtual environment is extremely flexible in terms of models it can accommodate; but on the Linux side, the 64-bit ARM world has largely settled on a well-defined set of building blocks and firmware interfaces - nearly none of which were used on the M1."
Quote of the week
Because, 5.4 almost did not become "6 years" of support from me.
That was because in the beginning, no one said they were going to
use it in their devices and offer me help in testing and
backporting. Only when I knew for sure that we had people helping
this out did I change the date on kernel.org.
— Greg Kroah-Hartman
So far the jury is still out for 5.10, are you willing to help with this? If not, why are you willing to hope that others are going to do your work for you? I am talking to some companies, but am not willing to commit to anything in public just yet, because no one has committed to me yet.
What would you do if you were in my situation?
Development
Firefox 85 released
Version 85 of the Firefox browser has been released. The headline change appears to be the isolation of internal caches to defeat the use of "supercookies" to track users; see this blog entry for details. "In fact, there are many different caches trackers can abuse to build supercookies. Firefox 85 partitions all of the following caches by the top-level site being visited: HTTP cache, image cache, favicon cache, HSTS cache, OCSP cache, style sheet cache, font cache, DNS cache, HTTP Authentication cache, Alt-Svc cache, and TLS certificate cache."
This is 2021: what’s coming in free/libre software (Libre Arts)
Libre Arts (formerly Libre Graphics World) has posted a comprehensive survey of what 2021 might hold for a wide range of free content-creation software.
The topic of fullscreen color management implementation in Wayland is back,
and it’s a kinda frustrating story. In a nutshell:
- people who are now working on this (Collabora developers) seem to have little experience with color management but they appear to be motivated to hack on the code;
- all the while people who have a crapload of experience with color management have had bad experience discussing this before, do not like the approach by the new team, and don’t seem excited to contribute to this new effort (Graeme’s spec proposal is still available).
So we might end up with an implementation that is not suitable for professional work.
pip 21.0 has now been released
The Python Packaging Authority (PyPA) has announced the release of pip 21.0. This version removes Python 2.7 and 3.5 support, and drops support for legacy cache entries from pip < 20.0.Development quotes of the week
As a community and an industry, we need to move our focus beyond the licenses. Licenses will always be important, but the license is not enough. We have to pay attention to our inputs and our outputs. That means we have to do better about being inclusive and welcoming to new contributors—particularly those that aren't like us. We have to consider the effects of what we produce and mitigate the harm.
— Ben
Cotton
We need to be aware of our principles (in the understanding principles are not universally-held) and make sure we’re governing our projects in a way that’s compatible. Not only in the micro-effects, but in the macro-effects. And we need to develop a vocabulary that expresses our shared understanding and our difference.
The whole point behind Open Source is the same point behind Free
Software -- to transfer the power to discriminate between users to the
users themselves. It's the users who decide whether they want to use the
software or not. Open Source creates a free market in software. If you
don't want your software to be free for anyone to use, then you aren't
distributing Free Software as a concept, and aren't distributing Open
Source as a brand.
— Russell
Nelson (Thanks to Thorsten Glaser)
Page editor: Jake Edge
Next page:
Announcements>>