Brief items

Security quotes of the week

This week we found a vulnerability in our voting processes that was exploited and had an impact on the outcome of the recent Board Election. That vulnerability has now been closed. OSI will engage an independent expert to do a forensic investigation to help us understand how this happened and put measures in place to keep it from ever happening again.

— Deb Nicholson, interim general manager of the Open Source Initiative (OSI)

The existence of platforms such as the Internet and cloud services enabled startups like YouTube and Instagram soar to huge valuations almost overnight, with only a handful of staff. But criminals also build infrastructure, from botnets through malware-as-a-service. There’s also dual-use infrastructure, from Tor to bitcoins, with entangled legitimate and criminal applications. So crime can scale too. And even “respectable” infrastructure has disruptive uses. Social media enabled both Barack Obama and Donald Trump to outflank the political establishment and win power; they have also been used to foment communal violence in Asia. How are we to make sense of all this?

— Ross Anderson

The CEO of pEp, a Luxembourg-based company that makes the pEp email encryption apps for Android and iOS, commissioned a marketing company to write fake reviews that he himself wrote in the summer of last year. Leon Schumacher asked the marketing company Mobiaso to post 40 five-star reviews in English, French, and German to the Google Play Store. Schumacher included an Excel spreadsheet that contained the specific text that he wanted Mobiaso to use.

[...] "That's certainly a novel approach to 'zero trust,'" Eva Galperin, the Electronic Frontier Foundation's director of cybersecurity, told Motherboard in an online chat. "I wouldn't trust them."

— Lorenzo Franceschi-Bicchierai in Vice (Thanks to Paul Wise.)

Comments (2 posted)

Kernel release status

The current development kernel is 5.12-rc4, released on March 21. Linus said: "So I'll just tempt the fates and say that everything looks pretty normal and this release seems to look good despite the rc1 hiccup."

Stable updates: 5.11.8, 5.10.25, 5.4.107, and 4.19.182 were released on March 20, followed by 5.11.9, 5.4.108, 4.19.183, 4.14.227, 4.9.263, and 4.4.263 on March 24.

Comments (none posted)

Time to recover .0 network addresses?

Seth David Schoen has posted this patch set changing the special status of the ".0" address in each subnet, which is currently treated as a broadcast address.

Read the post for the full story of why that address is reserved, and why it is safe to use it as a host address now. (Thanks to Dave Täht).

Comments (5 posted)

Rust support hits linux-next

Followers of the linux-next integration tree may have noticed a significant addition: initial support for writing device drivers in the Rust language. There is some documentation in Documentation/rust, while the code itself is in the rust top-level directory. Appearance in linux-next generally implies readiness for the upcoming merge window, but it is not clear if that is the case here; this code has not seen a lot of wider review yet. It is, regardless, an important step toward the ability to write drivers in a safer language.

Comments (30 posted)

Distribution quote of the week

The unpleasant realization that I came to a while back is that the free software world has fundamentally changed in large part due to our success, but in a way that is quite challenging for volunteer projects.

Free software won, in the sense that many (all?) of the largest corporations in the world are now based heavily on free software. [...]

However, this is where we encounter the fundamental economic problem: the pace of change in free software in general has occurred because of a dramatic increase in the number of people who are paid to develop free software as a substantial portion of their job. This unlocked significant additional resources in the form of paid work hours for free software. This is great for free software as a whole (overall; it causes problems as well, but I won't get into that here). But Debian is not structured (nor do I think we want it to be structured) in such a way as to get a similar significant infusion of resources.

Some project members have always been able to work on Debian during paid work time, and that hasn't changed, and possibly has increased slightly as a second-order effect from the growing [commercial] acceptance of free software, but the change is nowhere near as dramatic as the acceleration of development from, e.g., Facebook, Google, and Intel paying significant number of engineers to do full-time free software development.

— Russ Allbery

Comments (none posted)

Firefox 87 and Firefox ESR 78.9

Firefox 87 has been released. This version introduces SmartBlock, "a new intelligent tracker blocking mechanism for Firefox Private Browsing and Strict Mode."

Firefox ESR 78.9 has also been released with the usual set of fixes.

Comments (22 posted)

GNOME 40 released

The GNOME 40 release is out. "It brings new design for the Activities overview and improved support for input with Compose sequences and keyboard shortcuts, among many other things. Improvements to core GNOME applications include a redesigned Weather application, information popups in Maps, better tabs in Web, and many more." See the GNOME 40 page and the release notes for details.

Full Story (comments: 27)

2021 Free Software Awards announced

The Free Software Foundation has announced the recipients of its 2021 Free Software Awards. Alyssa Rosenzweig received the award for outstanding new free-software contributor, the CiviCRM project won the award for social benefit, and Bradley Kuhn received the award for the advancement of free software.

Comments (3 posted)

Richard Stallman returns to the FSF board

At the LibrePlanet conference over the weekend, Richard Stallman announced that he has returned to the Free Software Foundation's board of directors. Video of the announcement is available, but there is little information beyond that.

Comments (97 posted)