Brief items

OpenSSH 9.6 released

OpenSSH 9.6 has been released. It includes some minor improvements and a fix for the so-called Terrapin attack.

While cryptographically novel, the security impact of this attack is fortunately very limited as it only allows deletion of consecutive messages, and deleting most messages at this stage of the protocol prevents user authentication from proceeding and results in a stuck connection.

Comments (none posted)

Security quotes of the week

And while Dropbox is not sending your data to OpenAI today, it could do so tomorrow with a simple change of its terms of service. So could your bank, or credit card company, your phone company, or any other company that owns your data. Any of the tens of thousands of data brokers could be sending your data to train AI models right now, without your knowledge or consent. (At least, in the US. Hooray for the EU and GDPR.)

[...] These foundation models want our data. The corporations that have our data want the money. It’s only a matter of time, unless we get serious government privacy regulation.

— Bruce Schneier

But unless these high-value applications are intrinsically risk-tolerant, they are poor candidates for automation. Cruise was able to nonconsensually enlist the population of San Francisco in an experimental murderbot development program thanks to the vast sums of money sloshing around the industry. Some of this money funds the inevitabilist narrative that self-driving cars are coming, it's only a matter of when, not if, and so SF had better get in the autonomous vehicle or get run over by the forces of history.

Once the bubble pops (all bubbles pop), AI applications will have to rise or fall on their actual merits, not their promise. The odds are stacked against the long-term survival of high-value, risk-intolerant AI applications.

— Cory Doctorow (worth reading in its entirety)

Comments (39 posted)

Kernel release status

The current development kernel is 6.7-rc6, released on December 17. Linus said: " Please do give this a test in between the last-minute xmas shopping or whatever else is going on ..."

Stable updates: 6.6.8, 6.1.69, 5.15.144, 5.10.205, 5.4.265, 4.19.303, and 4.14.334 were released on December 20.

The 5.15.145 update is in the review process, with a due date of December 22. It consists almost exclusively of ksmbd patches in a flurry of backporting that was seemingly inspired by the recent marking of ksmbd as broken in 5.15.

Comments (none posted)

Min: sched_ext: a BPF-extensible scheduler class (Part 1)

Changwoo Min provides an introduction to the sched_ext scheduling class:

Sched_ext was proposed to address the problems mentioned above. It allows users to write a custom scheduling policy using BPF without modifying the kernel code. You don't need to struggle to maintain the out-of-tree custom scheduler. In addition, BPF provides a safe kernel programming environment. In particular, the BPF verifier ensures that your custom scheduler has neither a memory bug nor an infinite loop. Also, if your custom scheduler misbehaves -- like failing to schedule a task for too long (say 30 seconds), the kernel portion of sched_ext kills your custom scheduler and falls back to the default kernel scheduler (CFS or EEVDF). Last but not least, you can update the BPF scheduler without reinstalling the kernel and rebooting a server.

(LWN looked at sched_ext in February 2023).

Comments (4 posted)

DeMaio: Insights from the openSUSE Logo Contest

In response to the expressed unhappiness over the recent logo-selection process in the openSUSE project (covered in this article), the project has announced that there will be a new vote:

During the community meeting this week where the results were discussed, participants expressed the view that members of the openSUSE Project have an opportunity to participate in the selection of our new logo, and that SUSE, which holds the trademark to the openSUSE logo, be involved with the process for selecting a branding decision with regard to the results. After all, this decision impacts the collective identity.

To facilitate this, there is a plan to organize a vote between the current logo and the proposed new design, allowing our community to have a say in this important decision. Furthermore, members of the project are collaborating with SUSE on the implications of the branding initiatives and some have expressed the desire for SUSE’s input to ensure there is an aligned vision for the future of openSUSE.

Comments (9 posted)

Qubes OS 4.2.0 released

Version 4.2.0 of the Qubes OS distribution has been released; changes include a switch to Xfce for the Fedora and Debian templates, a number of rewritten graphical applications, PipeWire support, and more. See the release notes for details. (Qubes OS was last covered here in 2021).

Full Story (comments: 1)

Firefox 121.0 released

Version 121.0 of the Firefox browser is out. Along with the usual pile of security fixes, this release add the ability to force links to be rendered with underlines and use of Wayland by default if it is available: "This brings support for touchpad & touchscreen gestures, swipe-to-nav, per-monitor DPI settings, better graphics performance, and more."

Comments (none posted)

25 years of Postfix

Wietse Venema posted a note to the postfix-users mailing list about the 25th anniversary of the Postfix mail server. As can be seen, it had a pivotal role in bringing more awareness of open-source software to IBM. Beyond that, of course, it is an excellent piece of software in its own right.

As a few on this list may recall, it is 25 years ago today that the "IBM secure mailer" had its public beta release. This was accompanied by a nice article in the New York Times business section.

There is some literature at https://www.postfix.org/press.html that attests how this project accelerated open-source adoption by a very large company.

That release was even noticed by a small publication in its first year of operation.

(Thanks to Kees van Vloten.)

Comments (20 posted)

QEMU 8.2.0 released

Version 8.2.0 of the QEMU emulator is out. Changes include new emulations for virtio-sound devices, universal flash storage devices, Xilinx Versal boards, and much more.

Comments (none posted)