Brief items

Cook: Security things in Linux v5.9

Kees Cook has posted a long list of security-related improvements that made it into the 5.9 kernel release. "Sasha Levin, Andy Lutomirski, Chang S. Bae, Andi Kleen, Tony Luck, Thomas Gleixner, and others landed the long-awaited FSGSBASE series. This provides task switching performance improvements while keeping the kernel safe from modules accidentally (or maliciously) trying to use the features directly (which exposed an unprivileged direct kernel access hole)."

Comments (11 posted)

Security quotes of the week

It is notable that the attacker only makes a few guesses at usernames, and successfully authenticates once the correct username has been found. While we don't have any specific evidence for this, a possible explanation is that the user database of master.php.net has been leaked, although it is unclear why the attacker would need to guess usernames in that case.

The master.php.net system, which is used for authentication and various management tasks, was running very old code on a very old operating system / PHP version, so some kind of vulnerability would not be terribly surprising.

— Nikita Popov reports on what caused the PHP Git repository compromise (Thanks to Paul Wise.)

I think this is an incredibly bad idea. It’s not just the bloating of what was a clean secure communications app. It’s not just that blockchain is just plain stupid. It’s not even that Signal is choosing to tie itself to a specific blockchain currency. It’s that adding a cryptocurrency to an end-to-end encrypted app muddies the morality of the product, and invites all sorts of government investigative and regulatory meddling: by the IRS, the SEC, FinCEN, and probably the FBI.

And I see no good reason to do this. Secure communications and secure transactions can be separate apps, even separate apps from the same organization. End-to-end encryption is already at risk. Signal is the best app we have out there. Combining it with a cryptocurrency means that the whole system dies if any part dies.

— Bruce Schneier reacts to the Wired report that the Signal app is adding support for a cryptocurrency

Comments (8 posted)

Kernel release status

The current development kernel is 5.12-rc6, released on April 4. Linus said: "Well, if rc5 was bigger than usual, and I worried about what that meant for this release, rc6 is positively tiny. So I think it was just due to the usual random timing fluctuations, probably mainly networking updates (which were in rc5, but not in rc6). Which means that unless things change in the next two weeks, the schedule for this release is going to be the usual one."

Stable updates: 5.11.12, 5.10.28, 5.4.110, 4.19.185, 4.14.229, 4.9.265, and 4.4.265 were released on April 7.

Comments (none posted)

LineageOS 18.1 released

Version 18.1 of LineageOS, the Android-based distribution once known as Cyanogen, is available. "With that said, we have been working extremely hard since Android 11’s release last August to port our features to this new version of Android. Thanks to our hard work adapting to Google’s fairly large changes in Android 10, we were able to rebase our changes onto Android 11 much more efficiently. This led to a lot of time to spend on cool new features!" Some of those features include in improved voice recorder, a new calendar, a built-in backup mechanism, an improved music player, and more.

Comments (5 posted)

Django 3.2 released

Version 3.2 of the Django web framework is out; it has been designated as a long-term-support release. New features include automatic AppConfig discovery, functional indexes, pymemcache support, and more; see the release notes for details.

Comments (none posted)

Eliminating Data Races in Firefox – A Technical Report

The Mozilla Hacks site has a report on the use of ThreadSanitizer to detect and fix data races in the Firefox browser. "While benign data races do exist, we found that data races are very easily misclassified as benign. The reasons for this are clear: It is hard to reason about what compilers can and will optimize, and confirmation for certain 'benign' data races requires you to look at the assembler code that the compiler finally produces. Needless to say, this procedure is often much more time consuming than fixing the actual data race and also not future-proof. As a result, we decided that the ultimate goal should be a 'no data races' policy that declares even benign data races as undesirable due to their risk of misclassification, the required time for investigation and the potential risk from future compilers (with better optimizations) or future platforms (e.g. ARM)."

Comments (21 posted)

Development quote of the week

xf86-input-libinput 1.0.0 is now available. I ran out of fingers counting past 30, hence the version bump to 1.0.0. The driver is now over 7 years old, we might as well pretend the semver has a meaning.

— Peter Hutterer

Comments (none posted)

Xinuos sues IBM

A company called Xinuos has announced a lawsuit against IBM and Red Hat that has a familiar echo to it. "Xinuos alleges that the IBM and Red Hat conspiracy has harmed the open-source community and specifically Xinuos’ OpenServer 10 product, which is based on FreeBSD, an open-source UNIX-based operating system and alternative to Red Hat’s Linux-based open-source operating system, RHEL. 'By dominating the Unix/Linux server operating system market, competing open-source operating systems, like our FreeBSD-based OpenServer 10, have been pushed out of the market.'" The full text of the suit [PDF] is available for those wanting the details.

Comments (46 posted)

US Supreme Court rules for Google over Oracle

The long saga of Oracle's copyright-infringement against Google, which copied much of the Java API for use in Android, has come to an end with this ruling [PDF] in favor of Google. "Google’s purpose was to create a different task-related system for a different computing environment (smartphones) and to create a platform—the Android platform—that would help achieve and popularize that objective. The record demonstrates numerous ways in which reimplementing an interface can further the development of computer programs. Google’s purpose was therefore consistent with that creative progress that is the basic constitutional objective of copyright itself."

Comments (71 posted)