Brief items

"run0" as a sudo replacement

This Mastodon stream from Lennart Poettering describes a sudo replacement — called run0 — that will be part of the upcoming systemd 256 release. It takes a rather different approach to the execution of privileged commands, avoiding the use of setuid (which he calls "SUID") permissions entirely.

So, in my ideal world, we'd have an OS entirely without SUID. Let's throw out the concept of SUID on the dump of UNIX' bad ideas. An execution context for privileged code that is half under the control of unprivileged code and that needs careful manual clean-up is just not how security engineering should be done in 2024 anymore.

Comments (151 posted)

Kernel release status

The current development kernel is 6.9-rc6, released on April 28. Linus said: "Things continue to look pretty normal, and nothing here really stands out."

Stable updates: 6.8.8, 6.6.29, 6.1.88, and 5.15.157 were released on April 27. 6.1.89 was released on April 29 to fix a build problem.

The 6.8.9, 6.6.30, 6.1.90, 5.15.158, 5.10.216, 5.4.275, and 4.19.313 stable updates are in the review process; they are due on May 2.

Comments (none posted)

Quote of the week

To illustrate my personal concerns, I confess to being a bit disgusted by those pontificating on software reliability, especially when they compare it unfavorably to things like house construction. The difference is of course that the average house is not under active attack by nation states. In contrast, whether we like it or not, the Linux kernel is under active attack by nation states, organized crime, and who knows what all else. For RCU at least, I will take all the help I can get, even if it requires me to do a little bit of work up front.

— Paul McKenney

Comments (none posted)

Eelco Dolstra steps down from NixOS Foundation board

The NixOS Foundation board announced on April 30 that Eelco Dolstra is stepping down from the board following the recent calls for his resignation.

Eelco is the principal author of Nix and undoubtedly a central figure in the ecosystem that grew around it. We confirm that Eelco showed no intention to be perceived as or act like the BDFL [Benevolent Dictator for Life] of the Nix ecosystem, or the Nix code base. To commit to that in a timely manner, he has decided to formally step down from the board.

The board also announced its intent to set up new, explicit governance for the project, answerable to the community:

We will appoint a constitutional assembly within the next 14 days. Its task will be to set up a new governance structure, run by the community, that is capable of serving the community's needs. Once established, we will delegate our power to institutions within that new structure. This entire process will take place in a public space, such that it's traceable for anyone concerned. We are committed to listening to everyone who may help with solving the problems the community is facing.

Comments (25 posted)

Ubuntu 24.04 LTS (Noble Numbat) released

Version 24.04 LTS of the Ubuntu distribution is out.

This release continues Ubuntu's proud tradition of integrating the latest and greatest open source technologies into a high-quality, easy-to-use Linux distribution. The team has been hard at work through this cycle, together with the community and our partners, to introduce new features and fix bugs.

The list of changes and enhancements is long; click below for some details. More information can be found in the release notes; see also this page for a summary of security-related changes.

Full Story (comments: 35)

Yocto Project 5.0 released

Version 5.0 of the Yocto Project distribution builder has been released. The list of new features is long; see the release notes for the details.

Comments (none posted)

Amarok 3.0 "Castaway" released

The Amarok music player project has announced the release of version 3.0, which is codenamed "Castaway". It is the first stable version using Qt 5 and KDE Frameworks 5, and the first stable release since the final Qt-4-based 2.9.0 in 2018.

The road to 3.0 has not been a short one. Much of the Qt5/KF5 porting was done in 2015 already, but finishing and polishing everything up has been a slow, sometimes ongoing and sometimes stalled process ever since. 3.0 Alpha was released in February 2021 and has been since used by many people, as have been nightly builds of git master available for various distributions. Now in the past few months, an effort was made to get everything ready for a proper 3.0 release.

Common usecases should work quite well, and in addition to fixing KF5 port related regressions reported in pre-releases, 3.0 features many bugfixes and implemented features for longstanding issues, the oldest such documented being from 2009. However, with more than 20 years of development history, it is likely that not every feature Amarok has been tested thoroughly in the new release, and specifically some Internet services that have changed their API in recent years are not available, at least for now. It might well be that getting them in better state wouldn't require huge effort, however, so if you know your way with Qt and KDE Frameworks and your favourite Internet music service does not work with Amarok 3.0, you are extremely welcome to join in and help!

Comments (10 posted)

Git 2.45.0 released

Version 2.45.0 of the Git source-code management system has been released. Changes include a new list command for git reflog, a couple of new configuration variables for git diff, the ability to drop redundant commits while cherry-picking, a number of performance improvements, and more.

Comments (4 posted)

McQueen: Update from the GNOME board

Robert McQueen has posted a message from the GNOME Foundation board describing the current financial situation, plans to improve it, and an increase in the size of the board.

The Foundation has a reserves policy which specifies a minimum amount of money we have to keep in our accounts. This is so that if there is a significant interruption to our usual income, we can preserve our core operations while we work on new funding sources. We've now "hit the buffers" of this reserves policy, meaning the Board can't approve any more deficit budgets – to keep spending at the same level we must increase our income.

Comments (28 posted)

GNU nano 8.0 released

Version 8.0 of the terminal text editor GNU nano has been released. This update includes several changes to keybindings to be more newcomer-friendly, such as remapping Ctrl-F to forward-search and adding an option for modern bindings:

Command-line option --modernbindings (-/) makes ^Q quit, ^X cut, ^C copy, ^V paste, ^Z undo, ^Y redo, ^O open a file, ^W write a file, ^R replace, ^G find again, ^D find again backwards, ^A set the mark, ^T jump to a line, ^P show the position, and ^E execute.

The release also provides access to 14 levels of gray scale in xterm (up from four), as well as many bug fixes.

Full Story (comments: 16)

Development quotes of the week

These are the main advantages of the Wayland design principles: Desktop environments can develop more freely, applications are more widely fitting in, and overall policy is where it is (should be) the easiest for an end user to customise: in the display server. All in all, more power to the window manager (a part of the display server a.k.a compositor), which unfortunately also means less power to the application developers to decide on the behaviour. The idea is that the window manager is in the best position to implement window management behaviour the end user wants. End users can pick and choose their DE, and they can tune its window management behaviour. Application developers can avoid worrying about it, and applications avoid imposing window management behaviour that might not always be wanted.

The disadvantage is that the design principles carry a revolutionary idea. Roughly nothing worked like this before Wayland. Porting to Wayland requires re-designing applications to stop explicitly managing their windows, and toolkits have it even worse. I'm sure there are still many use cases that just don't work yet, because there is no protocol extension to deliver a suitable description.

— Pekka Paalanen

For example, suppose you're lucky enough to be a committer. Every time you commit one of your own patches, you're at serious risk of having to drop everything and put a ton of work into fixing everything you did wrong, either as soon as you do the commit, or when the problems are found later, or both. Every time you commit one of somebody else's patches, you're at risk of having to do the same thing, which means you're probably going to be reluctant to commit anything unless you're pretty sure it's pretty good. That means that committing other people's patches is not primarily about the time it takes to type git commit and git push, but about all of the review you do beforehand, and the potential unfunded liability of having to be responsible for it afterward. I haven't talked to other committers about the extent to which this weighs on their decision-making process, but I'd be astonished if it didn't.

— Robert Haas

Comments (6 posted)