Brief items

The "Trojan Source" vulnerability

The latest branded and trademarked vulnerability type is called "Trojan Source". By playing tricks with Unicode bidirectional support, an attacker can create malicious code that appears to be benign to reviewers. "The attack is to use control characters embedded in comments and strings to reorder source code characters in a way that changes its logic." Various releases, including Rust 1.56.1, are being made to address this problem.

Comments (120 posted)

Security quote of the week

And the ironic thing is, while it is very difficult indeed for automated checkers to detect underhanded code in ASCII, it is trivially easier for editors, linters and other tools to spot the sort of Unicode confusables we're talking about here. But we spend all our energy worrying about the minor issue, and almost none on the broader problem of malicious code in general.

— Steven D'Aprano

Comments (none posted)

Kernel release status

The 5.15 kernel was released on October 31. Linus said:

This release may have started out with some -Werror pain, but it calmed down fairly quickly and on the whole 5.15 was fair small and calm. Let's hope for more of the same - without Werror issues this time - for the upcoming merge window.

The code name for this release has been set to "Trick or Treat".

Significant features in this release include: the realtime preemption locking code, descriptorless files for io_uring, BPF timers, the removal of mandatory file-locking support, the ksmbd SMB filesystem server (but see this article), printk() indexing, the process_mrelease() system call, The DAMON memory-management optimization system, the ntfs3 filesystem implementation, and much more. See the LWN merge-window summaries (part 1, part 2) and the KernelNewbies 5.15 page for more information.

Stable updates: 5.14.16, 5.10.77, 5.4.157, 4.19.215, 4.14.254, 4.9.289, and 4.4.291 were released on November 2.

Comments (none posted)

Folios merged for 5.16

The long-running and sometimes acrimonious discussion on the memory folio patch set has come to an end: the folio patches were the first thing pulled into the mainline repository for the 5.16 development cycle. Now the developers involved just have to do all of the other work identified as necessary to clean up the memory-management subsystem and isolate it from other parts of the kernel.

Comments (6 posted)

Fedora 35 released

The Fedora 35 release has been announced.

No matter what variant of Fedora you use, you’re getting the latest the open source world has to offer. Following our “First” foundation, we’ve updated key programming language and system library packages, including Python 3.10, Perl 5.34, and PHP 8.0. Fedora Linux 35 also includes the 1.0 release of firewalld, the modern firewall service.

Some more information can be found in this "what's new" article.

Comments (none posted)

Yocto Project 3.4 (Honister) released

Version 3.4 of The Yocto Project has been released. Yocto provides a system for building embedded Linux distributions. This release comes with "Linux kernel 5.14, glibc 2.34 and ~280 other recipe upgrades", support for building and cross-compiling Rust code, tons of new recipes, a way to create a SPDX bill of materials (BoM), overlayfs and seccomp support, optimizations, bug fixes, and more. The full release notes have further information.

Full Story (comments: none)

Distribution quote of the week

Developers just want to get their work and changes done efficiently, and what we have taught them is that 'ask for forgiveness rather than permission' is the most efficient path. Any current or future complaints that developers are acting like politicians are moot, when we have made the best way to get a change done is to act like one.

— Stephen John Smoogen

Comments (1 posted)

Firefox 94.0 and Firefox ESR 91.3.0

Firefox 94.0 has been released. Linux users should see improved WebGL performance and reduced power consumption for many workloads. The about:unloads page shows the user information about open tabs and allows them to release system resources by unloading tabs without closing them. Site Isolation provides better protection against side-channel attacks. See the announcement for more new features in this release.

Firefox ESR 91.3 is also available, with various stability, functionality, and security fixes.

Comments (11 posted)

FSF: Free Software Awards nominations sought

The Free Software Foundation has opened nominations for the Free Software Awards. Nominations are open until November 30.

The dedication of the developers, documentation writers, community organizers, and volunteers of the free software movement is what has helped us all live liberation in the years the free software movement has been active. Just using free software makes you part of our collective journey to freedom, but some go above and beyond in their dedication to the free software movement. Now, it's time for us to show those community members and projects that we appreciate their vital work.

[...] Maybe you've been inspired by the work of a particular member of the free software community, or have been impressed by the great strides made by a project that incorporates free software into their platform for social change.

Comments (none posted)

Software Freedom Conservancy's DMCA Exemption Requests Granted

Software Freedom Conservancy has had several exemptions granted that it requested to the Digital Millennium Copyright Act (DMCA) by the US Library of Congress for activities of interest to free-software developers:

Software Freedom Conservancy is proud to announce that its efforts to stand up for the rights of FOSS developers have been successful and that it has been granted almost all of the exemptions that it requested in the Librarian of Congress' recent rule making, according to the final rule Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies, which was published today. Effective today, the Librarian of Congress ("LoC") granted DMCA exemptions for installing alternate firmwares on routers and for investigating copyleft compliance, and the exemption that Software Freedom Conservancy previously applied for and received on Smart TVs was also expanded. While our formal request to extend the security research exemption to include privacy research was not granted, the Register clarified that privacy research is indeed included in security research. Our executive director, Karen Sandler, also participated as an individual in a request to expand the existing exemption for medical devices which was also successful.

Full Story (comments: 8)