Brief items

Driving forward in Android drivers (Project Zero)

This Project Zero article looks at the exploitation of a few Android driver bugs in great detail.

As it becomes more difficult to find 0-days in core Android, third-party Linux kernel drivers continue to become a more and more attractive target for attackers. While the bulk of present-day detected ITW [in-the-wild] Android exploitation targets GPU drivers, it's equally important that other third-party drivers are encouraged towards the same security standards.

Comments (1 posted)

Security quote of the week

The LLMs aren't finding new vulnerabilities. They're exploiting zero-days—which means they are not trained on them—in new ways. So think about this sort of thing combined with another AI that finds new vulnerabilities in code.

— Bruce Schneier

Comments (none posted)

Kernel release status

The current development kernel is 6.10-rc4, released on June 16. According to Linus: "Apart from a rather unusual spike in the diffstat due to a parisc fix, things look normal and pretty small."

Stable updates: 6.9.5, 6.6.34, 6.1.94, 5.15.161, 5.10.219, 5.4.278, and 4.19.316 were released on June 16.

The 5.10.220 update is in the review process; it consists of 770 mostly NFS-related patches, and is due on June 20. Separately, the 6.9.6, 6.6.35, and 6.1.95 updates are also in the review process; they are due on June 21.

Comments (none posted)

Quote of the week

These are great. What I wish is that someone added that to Patchwork.

KTODO: Add Message-Id tag support to patchwork

(KTODO is like a when you say a wish and throw a coin into a fountain except it doesn't cost you a quarter).

— Dan Carpenter

Comments (none posted)

Schaller: Fedora Workstation development update – AI edition

Christian Schaller writes about AI and GPU-related features that are in flight and planned for Fedora 41.

Milan Crha has been working together with Alan Day and Jakub Steiner to come up with a streamlined user experience in GNOME Software to let you install the binary NVIDIA driver and provide you with an integrated graphical user interface help to sign the kernel module for use with secure boot. This is a bit different than what we for instance are doing in RHEL, where we are working with NVIDIA to provide pre-signed kernel modules, but that is a lot harder to do in Fedora due to the rapidly updating kernel versions and which most Fedora users appreciate as a big plus. So instead what we are for opting in Fedora is as I said to make it simple for you to self-sign the kernel module for use with secure boot. We are currently looking at when we can make this feature available, but no later than Fedora Workstation 41 for sure.

Comments (6 posted)

PostmarketOS v24.06 released

PostmarketOS is an Alpine Linux derivative distribution aimed at mobile devices; the v24.06 release claims support for over 250 devices, though the level of that support varies widely. "This release is geared mainly towards Linux enthusiasts. We are working hard on stability improvements and automated testing, but if you expect Android or iOS levels of polish, then this is not for you yet." Changes include an upgrade to Alpine Linux 3.20, newer GNOME and KDE versions, and more.

Comments (3 posted)

Distribution quote of the week

I am an old man, but even I understand that sometimes backwards compatibility has to go if there are tangible benefits to breaking changes and no practical workarounds, whether it's 32-bit-only support, or X11, or QEMU; I accept it even if I am personally affected.

— Przemek Klosowski

Comments (none posted)

Reports from the Python Language Summit

The Python Software Foundation has published a set of reports from the 2024 Python Language summit. Topics covered include version numbering, the limited C API, a new default read-eval-print loop, and Python's security model in light of the XZ backdoor:

For multiple reasons like being able to fix bugs and single-maintainer modules, CPython doesn't require reviewers on the pull requests of core developers. This can lead to "unilateral action", meaning that a change is introduced into CPython without the review of someone besides the author. Other situations like release managers backporting fixes to other branches without review are common.

Comments (8 posted)

Rust 1.79.0 released

Version 1.79.0 of the Rust language has been released. Changes this time include inline const expressions, the "associated item bounds syntax", and more.

Comments (9 posted)

New Human Interface Guidelines for KDE

KDE developer Nate Graham has announced a new set of KDE Human Interface Guidelines (HIG) for the KDE project. Graham says that the goals for the new HIGs were to reflect how KDE designs software today, make the content 100% actionable, improve navigation, and to improve the guidelines so people feel comfortable contributing:

Like any rewrite, there are bound to be rough edges and omissions compared to the old version. Maybe I missed a piece of useful information in the old HIG that had been buried somewhere but retained some value. Maybe there's low-hanging fruit for improvement. Help out by contributing!

Comments (29 posted)

Libgcrypt 1.11.0 released

Version 1.11.0 of Libgcrypt, a general-purpose library of cryptographic building blocks, has been released by the GnuPG project:

This release starts a new stable branch of Libgcrypt with full API and ABI compatibility to the 1.10 series. Over the last years Jussi Kivilinna put again a lot of work into speeding up the algorithms for many commonly used CPUs. Niibe-san implemented new APIs and algorithms and also integrated quantum-resistant encryption algorithms.

Full Story (comments: 2)

Mate 1.28 released

Version 1.28 of the MATE Desktop has been released.

MATE 1.28 has made significant strides in updating the codebase, including the removal of deprecated libraries and ensuring compatibility with the latest GTK versions. One of the most notable improvements is the enhanced support for Wayland, bringing us closer to a fully native MATE-Wayland experience. Several components have been updated to work seamlessly with Wayland, ensuring a more integrated and responsive desktop environment.

See the announcement for a full list of improvements and bug fixes.

Comments (15 posted)

Plasma 6.1 released

Version 6.1 of the Plasma desktop environment has been released.

Plasma 6 hits its stride with version 6.1. While Plasma 6.0 was all about getting the migration to the underlying Qt 6 frameworks correct (and what a massive job that was), 6.1 is where developers start implementing the features that will take you desktop to a new level.

Enhancements include better remote-desktop support, improved customization, persistent apps, smoother animation under Wayland, and more; see the changelog for the full list.

Comments (2 posted)