Brief items

GitHub comments used to distribute malware (BleepingComputer)

BleepingComputer reported on April 20 that some malware was being distributed via GitHub. Uploading files as part of a comment gives them a URL that appears to be associated with a repository, even if the comment is never posted.

A GitHub flaw, or possibly a design decision, is being abused by threat actors to distribute malware using URLs associated with Microsoft repositories, making the files appear trustworthy.

While most of the malware activity has been based around the Microsoft GitHub URLs, this "flaw" could be abused with any public repository on GitHub, allowing threat actors to create very convincing lures.

Comments (20 posted)

Security quote of the week

A new bioadhesive makes it easier to attach trackers to squid.

Note: the article does not discuss squid privacy rights.

— Bruce Schneier

Comments (none posted)

Kernel release status

The current development kernel is 6.9-rc5, released on April 21. "But if you ignore those oddities, it all looks pretty normal and things appear fairly calm.."

Stable updates: none have been released in the last week. The 6.8.8, 6.6.29, 6.1.88, and 5.15.157 updates are in the review process; they are due on April 25.

Comments (none posted)

Quote of the week

Perhaps the most important takeaway of all is that it's not just a project's code, not even a project's direct and indirect runtime dependencies, but ALL its build dependencies as well, that can be used to inject backdoors. The kernel doesn't depend on any shared libraries at runtime -- but as long as we can hijack the build process, we can fairly easily inject code into the compiled kernel.

On my system, a kernel build runs more than 70 different binaries and loads more than 32 distinct shared libraries. That's a large attack surface.

— Vegard Nossum

Comments (4 posted)

Andreas Tille elected as Debian project leader

The Debian project leader election results are in and Andreas Tille has been elected. In a fairly competitive vote, Tille beat Sruthi Chandran to fill the position for the coming year. We looked at the election and the candidates a few weeks back.

Comments (none posted)

Fedora 40 released

The Fedora 40 distribution has been released. See the "what's new" pages for Fedora Workstation and Fedora KDE to learn more about the desktop spins, along with this LWN article, for more information.

Comments (1 posted)

A new crash reporter for Firefox

On April 23, Mozilla announced that Firefox's crash reporter has been rewritten in Rust, allowing the project to address a backlog of issues.

Even though it is important to properly handle main process crashes, the crash reporter hasn't received significant development in a while (aside from development to ensure that crash reports and telemetry continue to reliably be delivered)! It has long been stuck in a local maximum of "good enough" and "scary to maintain": it features 3 individual GUI implementations (for Windows, GTK+ for Linux, and macOS), glue code abstracting a few things (mostly in C++, and Objective-C for macOS), a binary blob produced by obsoleted Apple development tools, and no test suite. Because of this, there is a backlog of features and improvements which haven't been acted on.

Comments (2 posted)

QEMU 9.0 released

Version 9.0 of the QEMU emulator has been released. "This release contains 2700+ commits from 220 authors." The list of improvements is long; see the announcement and the changelog for details.

Comments (none posted)

The Open Home Foundation launches

The Open Home Foundation has announced its existence as a home and support resource for free home-automation projects.

We created the Open Home Foundation to fight for the fundamental principles of privacy, choice, and sustainability for smart homes. And every person who lives in one.

Ahead of today, we've transferred over 240 projects, standards, drivers, and libraries—Home Assistant, ESPHome, Zigpy, Piper, Improv Wi-Fi, Wyoming, and so many more—to the Open Home Foundation. This is all about looking into the future. We've done this to create a bulwark against surveillance capitalism, the risk of buyout, and open-source projects becoming abandonware. To an extent, this protection extends even against our future selves—so that smart home users can continue to benefit for years, if not decades. No matter what comes.

Comments (7 posted)

Hutterer: udev-hid-bpf: quickstart tooling to fix your HID devices with eBPF

Peter Hutterer announces udev-hid-bpf, a tool to facilitate the loading of BPF programs that make human-input devices work correctly.

eBPF was originally written for network packet filters but as of kernel v6.3 and thanks to Benjamin, we have BPF in the HID subsystem. HID actually lends itself really well to BPF because, well, we have a byte array and to fix our devices we need to do complicated things like "toggle that bit to zero" or "swap those two values".

See this article for more information on the BPF-HID mechanism.

Comments (6 posted)