Brief items

Buffer overruns, license violations, and bad code: FreeBSD 13’s close call (Ars Technica)

For those wanting more details on the saga of the WireGuard implementation that was almost released in FreeBSD 13 (a story that LWN covered recently), this Ars Technica story digs in deep. "Despite not having any kernel developers on-staff, Ars was able to verify at least some of Donenfeld's claims directly, quickly, and without external assistance. For instance, finding a validation function which simply returned true—and printf statements buried deep in cryptographic loops—required nothing more complicated than grep."

Comments (64 posted)

Google’s top security teams unilaterally shut down a counterterrorism operation (Technology Review)

Technology review covers the controversy that has resulted from Google's disclosure and fixing of a number of security vulnerabilities being exploited by Western intelligence agencies. "Instead of focusing on who was behind and targeted by a specific operation, Google decided to take broader action for everyone. The justification was that even if a Western government was the one exploiting those vulnerabilities today, it will eventually be used by others, and so the right choice is always to fix the flaw today."

Comments (37 posted)

PHP Git repository server compromised

The PHP project has announced that it is moving its PHP repository to GitHub after its own server was compromised. "Yesterday (2021-03-28) two malicious commits were pushed to the php-src repo from the names of Rasmus Lerdorf and myself. We don't yet know how exactly this happened, but everything points towards a compromise of the git.php.net server (rather than a compromise of an individual git account)."

Comments (18 posted)

Security quotes of the week

Basically, there is no reason to believe that software in weapons systems is any more vulnerability free than any other software. So now the question is whether the software can be accessed over the Internet. Increasingly, it is. This is likely to become a bigger problem in the near future. We need to think about future wars where the tech simply doesn’t work.

— Bruce Schneier

The broad range of data that this sneaky little bastard is capable of stealing is pretty horrifying. It includes: instant messenger messages and database files; call logs and phone contacts; Whatsapp messages and databases; pictures and videos; all of your text messages; and information on pretty much everything else that is on your phone (it will inventory the rest of the apps on your phone, for instance).

The app can also monitor your GPS location (so it knows exactly where you are), hijack your phone’s camera to take pictures, review your browser’s search history and bookmarks, and turn on the phone mic to record audio.

— Lucas Ropek at Gizmodo on Android malware that claims to be a system update

Comments (none posted)

Kernel release status

The current development kernel is 5.12-rc5, released on March 28. Linus said: "So if rc4 was perhaps a bit smaller than average, it looks like rc5 is a bigger than average. We're not breaking any records, but it certainly isn't tiny, and the rc's aren't shrinking. I'm not overly worried yet, but let's just say that the trend had better not continue, or I'll start feeling like we will need to make this one of those releases that need an rc8."

Stable updates: 5.11.10 and 5.10.26 were released on March 25, followed by 5.11.11, 5.10.27, 5.4.109, 4.19.184, 4.14.228, 4.9.264, and 4.4.264 on March 30.

Comments (none posted)

Quote of the week

Okay, this one is maybe a bit brave, let's see if it is suitable for upstream. This is an in-kernel logic analyzer based on GPIO polling with local irqs disabled.

— Wolfram Sang

Comments (none posted)

AlmaLinux gets a stable release and a foundation

CloudLinux has announced the availability of a "ready for production workloads" version of AlmaLinux, which is intended to be a replacement for CentOS 8. Also announced is the creation of a foundation to manage the distribution: "The company also announced the formation of a non-profit organization that will take over responsibility for managing the AlmaLinux project going forward. CloudLinux has committed a $1 million dollars annual endowment to support the project. The AlmaLinux project named Jack Aboutboul as community manager of AlmaLinux."

Full Story (comments: 14)

DigiKam 7.2.0 released

Version 7.2.0 of the digiKam photo-management application has been released. Changes include better renaming tools, improved album management, a reworked internal database, and more. "The neural network to process face detection have been a huge effort with this release. We use a new data model named Yolo. More faces on same images can be detected with complex shot conditions. The processing speed have been reduced and the older bugs about the wrong memory allocation definitively fixed."

Comments (1 posted)

Development quotes of the week

The free software movement promised to right these wrongs via free licenses on the source code, with adherents arguing free licenses provide immunity to these forms of malware since users could modify the code. Unfortunately most users lack the resources to do so. While the most egregious violations of user freedom come from companies publishing proprietary software, these ills can remain unchecked even in open source programs, and not all proprietary software exhibits these issues. The modern browser is nominally free software containing the trifecta of telemetry, advertisement, and DRM; a retro video game is proprietary software but relatively harmless.

— Alyssa Rosenzweig

In some crazy world wherein it would be useful if everyone picked the same coloured spoon, it turns out we all use green spoons. Why green? Dunno, it's pretty arbitrary. I'm sure the makers of red spoons and yellow spoons and all the other spoons are pretty annoyed about it, but in the end it doesn't matter. All the colours of spoon are just as good for eating soup, but one colour had to be picked so we'd all use the same one, and it turned out to be green. Perhaps we (the Perl core) are sat here trying to sell our blue spoons, and wondering why nobody wants to buy them any more. Do we want to turn our blue spoons a little greener, and make them less distinctively blue in the hope of making them more attractive? Would that help?

— Paul "LeoNerd" Evans

Comments (11 posted)

A new "board process" at the FSF

The Free Software Foundation has announced changes in how its board of directors is selected. "We will adopt a transparent, formal process for identifying candidates and appointing new board members who are wise, capable, and committed to the FSF's mission. We will establish ways for our supporters to contribute to the discussion. We will require all existing board members to go through this process as soon as possible, in stages, to decide which of them remain on the board."

Meanwhile, numerous community members have posted an open letter calling for the resignation of the entire Free Software Foundation board of directors after the announcement that Richard Stallman would be returning. The Free Software Foundation Europe has made its disapproval known, as has the Electronic Frontier Foundation. The Debian project has started discussing a general resolution affirming its support for the open letter. Various other organizations have expressed concern as well.

For those who feel differently, there is also an open letter in support of Stallman's return to the FSF.

Comments (86 posted)

More changes at the Free Software Foundation

John Sullivan, executive director of the Free Software Foundation, has announced his resignation from the organization. "It's been a humbling honor to serve this institution, and to work alongside the FSF's staff, members, and volunteers over the years. The current staff deserve your full confidence and support -- they certainly have mine."

Meanwhile, the FSF has announced the addition of Ian Kelling to its board of directors. "The board and voting members look forward to having the participation of the staff via this designated seat in our future deliberations. This is an important step in the FSF's effort to recognize and support new leadership, to connect that leadership to the community, to improve transparency and accountability, and to build trust. There is still considerable work to be done, and that work will continue."

Comments (46 posted)

Open Collective's funds for open source

Open Collective has put out an announcement describing its "Funds for Open Source" initiative, which is aimed at making it easy for corporations to fund the work of individual developers. "Big companies call the process for paying for stuff 'procurement'. It’s often pretty involved, with contracts, invoices, purchasing order numbers, and bureaucracy—a painful thing to go through repeatedly for small amounts. It's practically a blocker. It is so much simpler and more practical to ask corporations to make one large payment, to one vendor. Make it easy and companies will invest more."

Comments (1 posted)