Brief items

Security quotes of the week

Today's internet systems are too complex to hope that if we are smart and build each piece correctly the sum total will work right. We have to deliberately break things and keep breaking them. This repeated process of breaking and fixing will make these systems reliable. And then a willingness to embrace inefficiencies will make these systems resilient. But the economic incentives point companies in the other direction, to build their systems as brittle as they can possibly get away with.

— Barath Raghavan and Bruce Schneier

I would like to posit that our industry has made somewhat of a mistake in the past decade. In our push to grow cybersecurity awareness, we have made most organizations afraid of security risks, to the point that a lot of organizations will adopt almost any security tool without considering the risk they are introducing while doing so, including reducing the reliability of their systems.

I do believe that, today and to a degree, security and reliability are incompatible. Security tooling adds entropy that reduces predictability that reliability depends on. But I think we could engineer security in a way that doesn’t interfere so much with reliability. Our security components could be better isolated from running systems, like we do for sidecar containers. Kernels could improve their telemetry frameworks like eBPF to allow security tooling to access the data they need without deploying dangerous drivers and modules. etc.

— Julien Vehent

Comments (13 posted)

Kernel release status

The current development kernel is 6.11-rc1, released on July 28. Linus remarked: "The merge window felt pretty normal, and the stats all look pretty normal too. I was expecting things to be quieter because of summer vacations, but that (still) doesn't actually seem to have been the case."

Stable updates: 6.9.11, 6.6.42, and 6.1.101 were released on July 25, followed by 6.10.2, 6.9.12, 6.6.43, 6.1.102, 5.15.164, 5.10.223, 5.4.281, and 4.19.319 on July 29. Note that 6.9.12 is the last in the 6.9.x series.

The 6.10.3, 6.6.44, and 6.1.103 updates are in the review process; they are due on August 1.

Comments (none posted)

A deprecation timeline for older Arm CPUs

Arnd Bergmann has posted a detailed timeline for the deprecation of support for old Arm CPUs in both the kernel and the compiler toolchain. Anybody who is working with that hardware will likely want to review this list and let the relevant developers know if any of that support is still needed.

Comments (3 posted)

Quotes of the week

And yes, I realize that nobody sane would do this in C, and this all should be done in some sane language that is actually meant for string parsing, and me writing scripts in C shows that there's something seriously wrong with me.

I'm aware.

— Linus Torvalds

That pretty much concludes the analysis as far as memory safety of struct fd uses goes. There had been several places where UAF got caught in the same functions (e.g. fetching ->private_data and accessing the object it points to after we'd done fdput(), without anything to guarantee that the object will live past the file shutdown that becomes possible at that point), plus the usual scattering of bugs one catches when looking through random places in the tree.

It wasn't impossibly hard, but it would be nice to reduce the amount of PITA next time around.

— Al Viro looks deeply into the kernel's file-descriptor handling

Comments (5 posted)

Funtoo Linux is being discontinued

Daniel Robbins, founder of the Gentoo Linux distribution and its spinoff Funtoo Linux, has announced that he has decided to end the Funtoo project:

Funtoo started as a philosophy to create a fun community of contributors building something great together. For me, it's no longer that so I need to move on to other things. There is not a successor BDFL for Funtoo nor am I interested in trying to find one, or hand the project off to someone else. You can expect the project to wind down through August. If you have a Funtoo container, it will continue to be online through the end of August so you have time to find another hosting solution if you need one.

Comments (18 posted)

Linux Mint 22 "Wilma" released

Linux Mint has announced version 22 of the distribution in three editions: Cinnamon, MATE, and Xfce. Mint 22 is based on Ubuntu 24.04 and uses kernel version 6.8.0:

Linux Mint 22 is a long term support release which will be supported until 2029. It comes with updated software and brings refinements and many new features to make your desktop even more comfortable to use.

LWN covered the Linux Mint 22 beta in early July. See the new features page and release notes for more information on this release.

Comments (none posted)

Vanilla OS 2 "Orchid" released

Version 2.0 of the Vanilla OS image-based Linux distribution has been released. Dubbed "Orchid", Vanilla OS is now based on Debian Sid (prior versions were Ubuntu-based), allows creation of customized Linux environments, support for running Android applications using Waydroid, and many other improvements.

Comments (2 posted)

Forgejo v8.0 released

Version 8.0 of the Forgejo software-development platform has been released. Notable changes include the removal of non-free software found in the codebase, improved stability, and a reduction in "seemingly random User Interface changes":

A gentle way of describing Forgejo User eXperience is that it is an acquired taste: it grew over the years, driven by the inspiration of the person with the keyboard in their hand. Once implemented it almost never changed. A user who started with Forgejo in 2022 can only see minor changes in 2024 and not all of them make intuitive sense. The solution to this problem is simple and was identified early on: User Research. But only in the making of Forgejo v8.0 did it get some momentum.

See the release notes for a full list of changes.

Comments (3 posted)

Git 2.46.0 released

Version 2.46.0 of the Git source-code management system has been released. This release seems to consist of a long list of interface and performance improvements rather than big new features; see the announcement for the details.

Comments (23 posted)

Rust 1.80.0 released

Version 1.80.0 of the Rust language has been released. Changes include the new LazyCell and LazyLock types (which delay data initialization until the first access), the stabilization of the exclusive-range syntax for match patterns, and more.

Comments (6 posted)

Development quote of the week

Years ago, Plasma adopted the motto "Simple by default, powerful when needed." Over time, this has become the motto for KDE software in general, and encouraging adherence to this principle animated a lot of decisions for the new HIG text. In essence, we want our software to be usable by people with basic to moderate tech skills, but grow with them over time and facilitate usage by experts as well.

Scaling all the way from beginners to experts is no mean feat! It means offering guidance that fades away as you gain proficiency; being customizable but not shoving it in your face, because the default settings are well chosen; and being extensible with the basics being already there. That sort of thing. Not easy, but doable.

— Nate Graham interviewed in Linux Magazine

Comments (none posted)