Brief items

Security quotes of the week

While io_uring brings performance benefits, and promptly reacts to security issues with comprehensive security fixes (like backporting the 5.15 version to the 5.10 stable tree), it is a fairly new part of the kernel. As such, io_uring continues to be actively developed, but it is still affected by severe vulnerabilities and also provides strong exploitation primitives. For these reasons, we currently consider it safe only for use by trusted components.

— Tamás Koczka in the Google Security Blog

With io_uring in the news this week for security issues, I want to try once again to appeal to various subsystem maintainers in the Linux Kernel - please work with the security folks when adding, or significantly changing, kernel functionality. We would *love* to be able to work with you in the design stages, and we might be able to help you avoid some future security headaches.

— Paul Moore

Comments (1 posted)

Kernel release status

The current development kernel is 6.4-rc7, released on June 18. Linus said: "Nothing particular stands out in the rc this week, unless you count the mptcp selftest changes that are about making the tests work on stable kernels too." The final 6.4 release seems certain to happen on June 25.

Stable updates: 6.3.9, 6.1.35, 5.15.118, 5.10.185, 5.4.248, 4.19.287, and 4.14.319 were all released on June 21.

Comments (none posted)

Quotes of the week

Part of the mechanical effects of the open source revolution was to empower employees over employers: it's the employees who submit the code and are part of the community, not the employer. In many ways employees in Open Source become Ambassadors and Agents for their employers. There's a big drive in Foundation driven Corporate Open Source to try to minimize this employee empowerment effect, but it's there nonetheless. A good open source employee recognizes this, often moves employers keeping the same open source community roles and tries to find a synergy between corporate goals and community ones (the best actually alter the corporate goals to effect this).

— James Bottomley

Comments (2 posted)

Red Hat cutting back RHEL source availability

Red Hat has announced that public source releases will be restricted to CentOS Stream going forward:

As the CentOS Stream community grows and the enterprise software world tackles new dynamics, we want to sharpen our focus on CentOS Stream as the backbone of enterprise Linux innovation. We are continuing our investment in and increasing our commitment to CentOS Stream. CentOS Stream will now be the sole repository for public RHEL-related source code releases. For Red Hat customers and partners, source code will remain available via the Red Hat Customer Portal.

(Emphasis in original; thanks to Janne Blomqvist).

Comments (135 posted)

The faster-cpython plan for 3.13

The developers working on improving the speed of the CPython interpreter have posted a plan describing their objectives for the Python 3.13 release. The biggest piece appears to be the tier-2 optimizer, which will optimize larger chunks of Python code: "https://github.com/faster-cpython/ideas/issues/557".

Comments (none posted)

The Rust Leadership Council

The Rust project has announced the formation of the Rust Leadership Council, which will take the place of the existing Core Team and Leadership Chat groups.

The Council will assume responsibility for top-level governance concerns while most of the responsibilities of the Rust Project (such as maintenance of the compiler and core tooling, evolution of the language and standard libraries, administration of infrastructure, etc.) remain with the nine top level teams.

The details on how this body is supposed to work can be found in RFC 3392.

Comments (6 posted)

DeVault: Reforming the free software message

Drew DeVault has announced the launch of a new web site that is intended to be a better introduction to the free-software community.

Some of my criticisms focused on the message: fsf.org and gnu.org together suffer from no small degree of incomprehensibility and inaccessibility which makes it difficult for new participants to learn about the movement and apply it in practice to their own projects.

This is something which is relatively easily fixed!

Comments (176 posted)

Registration for LPC 2023 is open

The registration for this year's Linux Plumbers Conference (LPC) is now open. It will be held November 13-15 in Richmond, Virginia in the US. The attend page has all of the details. Meanwhile, some of the calls for proposals are still open, though the microconferences CFP is closed; this year's proposed microconference topics are listed here. Those who want to attend should note: "As usual we expect to sell [out] rather quickly so don't delay your registration for too long!"

Comments (none posted)