Brief items
Security
Coker: The CUPS vulnerability
Debian Developer Russell Coker has written up an analysis of the remote exploit of CUPS announced in September:
He seems to have a different experience to me of reporting bugs, I have had plenty of success getting bugs fixed without hyping them. I just report the bug, wait a while, and it gets fixed. [...] I was quite confident that my systems wouldn't be at any risk.
When it was published my opinion was proven to be correct, it turned out to be a series of CUPS bugs.
Security quotes of the week
My point is that "worrying about AI" is a zero-sum game. When we train our fire on the stuff that isn't important to the AI stock swindlers' business-plans (like creating AI slop), we should remember that the AI companies could halt all of that activity and not lose a dime in revenue. By contrast, when we focus on AI applications that do the most direct harm – policing, health, security, customer service – we also focus on the AI applications that make the most money and drive the most investment.— Cory DoctorowAI hasn't attracted hundreds of billions in investment capital because investors love AI slop. All the money pouring into the system – from investors, from customers, from easily gulled big-city mayors – is chasing things that AI is objectively very bad at and those things also cause much more harm than AI slop. If you want to be a good AI critic, you should devote the majority of your focus to these applications. Sure, they're not as visually arresting, but discrediting them is financially arresting, and that's what really matters.
When I create a virtual machine server in the Amazon cloud, I am prompted for an RSA public key that will be used to control access to the machine. Typically, I create the public and private keypair on my laptop and upload the public key to Amazon, which bakes my public key into the server's administrator account. My laptop and that remove server are thus entangled, in that the only way to log into the server is using the key on my laptop. And because that administrator account can do nearly anything to that server—e.g. read its sensitive data or hack its web pages install malware on people who visit its website—the private key on my laptop represents a security risk for that server.— Simson GarfinkelHere's why it's impossible to evaluate a server and know if it is secure: as long that private key exists on my laptop, that server has a vulnerability. But if I delete that private key, the vulnerability goes away. By deleting the data, I have removed a security risk from the server and its security has increased. This is true entanglement! And it is spooky: not a single bit has changed on the server, yet it is more secure.
Kernel development
Kernel release status
The current development kernel is 6.12-rc5, released on October 27. Linus said:
rc5 looks perfectly normal, and maybe even on the small side of normal. The diffstat looks nice and flat too, with the exception of the removal of the da8xx fbdev driver due to it having been replaced by the tilcdc driver. And I'm sure we're all thinking the same thing: "What lovely descriptive driver names we have".
Stable updates: the 6.11.6, 6.6.59, 6.1.115, and 5.15.170 updates are in the review process; they are due at any time.
Distributions
Fedora 41 released
Fedora Linux 41 has been released. See the "what's new" pages for Fedora Workstation and Fedora KDE, to learn more about the latest in those editions. There is also a new Fedora Miracle Window Manager Spin that offers the Miracle tiling window manager for Wayland.
Ravier: What's new for Fedora Atomic Desktops in Fedora 41
Timothée Ravier has written a blog post about changes in the Fedora Atomic Desktops for Fedora Linux 41. Some of the notable new features for Atomic Desktops include bootloader updates enabled by default for UEFI systems, first steps towards using bootable containers, and more.
A new release of Raspberry Pi OS
The Raspberry Pi project has announced a new version of Raspberry Pi OS. It includes a number of significant changes, the most notable of which is that the Raspberry Pi Desktop now uses Wayland by default for all Pi models using the labwc compositor:
For most of this year, we have been working on porting labwc to the Raspberry Pi Desktop. This has very much been a collaborative process with the developers of both labwc and wlroots: both have helped us immensely with their support as we contribute features and optimisations needed for our desktop.
This release also features Linux 6.6.51, improved touchscreen support, a new screen configuration tool called raindrop, and more. See the release notes for a full list of changes.
Development
Firefox version 132.0 is now available
Mozilla has announced the release of a new version of Firefox. This version has the usual mix of security fixes and new features, as well as a handful of deprecations. The release removes support for HTTP/2 Push, but adds hardware acceleration for SVGs, support for wide color gamuts on more platforms, and restores support for remote debugging via USB.
Flock: a Flutter fork
A project called Flock has announced its existence. Flock is a fork of the Flutter user-interface toolkit project, motivated by frustration with the resources that Google is putting into Flutter.
We describe Flock as "Flutter+". In other words, we do not want, or intend, to fork the Flutter community. Flock will remain constantly up to date with Flutter. Flock will add important bug fixes, and popular community features, which the Flutter team either can't, or won't implement.
(LWN looked at Flutter in 2020).
Open Source Initiative announces Open Source AI Definition 1.0
The Open Source Initiative (OSI) has announced the release of version 1.0 of the Open Source AI Definition:
The OSAID offers a standard by which community-led, open and public evaluations will be conducted to validate whether or not an AI system can be deemed Open Source AI. This first stable version of the OSAID is the result of multiple years of research and collaboration, an international roadshow of workshops, and a year-long co-design process led by the Open Source Initiative (OSI).
LWN covered the OSAID process, and final release candidate, on October 25.
Thunderbird for Android now available
The first stable release of the Thunderbird mail client for Android is now available:
Just over two years ago, we announced our plans to bring Thunderbird to Android by taking K-9 Mail under our wing. The journey took a little longer than we had originally anticipated and there was a lot to learn along the way, but the wait is finally over! For all of you who have ever asked "when is Thunderbird for Android coming out?", the answer is – today!
It is immediately available on the Google
Play Store, via GitHub
Releases, or from the Thunderbird web site, and
it will be "coming soon
" to the F-Droid repository for FOSS Android
applications. See the release
notes for detailed information about Thunderbird 8.0 for
Android.
Development quote of the week
The obvious friction this bump caused, even when in reality it actually did not affect many users and the loud feedback we received, made a huge impact on me. It had not previously dawned on me exactly how important this was.
I decided there and then to do the utmost to never go through this again. To put ABI compatibility at the top of the priority list. Make it one of the most fundamental key properties of libcurl.
Do. Not. Break. The. ABI
Page editor: Daroc Alden
Next page:
Announcements>>