Immutable data makes concurrent access easier, since iteliminates the data-race conditions that can plague multithreaded programs. AtPyCon2024, Yury Selivanovintroduced an early-stage project called MemHive, which uses Pythonsubinterpreters and immutable data toovercome the problems of thread serialization that are caused by thelanguage's Global Interpreter Lock (GIL). Recent developments in the Python world have openedup different strategies for avoiding the longstanding problems with theGIL.
Achieving consensus among Debian Developers on technical topics andprocedures can be, to put it mildly, challenging. Nevertheless, thatis exactly what Otto Kekalainen has tried to do with a proposal thatwould set up "principles all Debian packages should follow to beopen for collaboration in package maintenance". In the near term,it seems unlikely that the proposal will be accepted, but thediscussion may be effective at improving collaboration nonetheless.
Security updates have been issued by Fedora (calibre, dotnet8.0, dovecot, webkit2gtk4.0, and webkitgtk), Oracle (nodejs:20), Red Hat (bind, bind and bind-dyndb-ldap, postgresql:16, and squid), Slackware (kcron and plasma), SUSE (keepalived and webkit2gtk3), and Ubuntu (drupal7).
The Mono project was started in 2001 to develop a .NET environment forLinux systems. Microsoft has owned that project since 2016, but has notmade a major release since 2019. The company has now announced that Mono is beinghanded over to the WineHQ organization, which will maintain the repository goingforward. Microsoft, meanwhile, is steering users toward its "modernfork" that it continues to maintain.
KDE developer Carl Schwan has announcedthe release of Calligra Officeversion 4.0. The most significant changes in this release include a "majoroverhaul" of the office suite's user interface, and a transition to Qt6 and KDEFrameworks6.
Nominations are nowopen for people interested in joining the UbuntuCommunity Council, "the highest governance body of the Ubuntuproject". Any Ubuntu Member canapply from now until Sunday, September 22 at 23:59 UTC.
On August 13, the US National Institute of Standards and Technology (NIST)published the final form of its new post-quantum cryptographic standards. Onekey-exchange mechanism and two digital-signature schemes are now officiallysanctioned by the institute. Adopting the new standards should be fairlypainless for most developers, but the overhead added by the schemes could posechallenges for some applications.
Security updates have been issued by AlmaLinux (nodejs:20), Debian (python3.11), Fedora (dotnet8.0), Red Hat (bind, krb5, libreoffice, linux-firmware, orc, orc:0.4.28, and orc:0.4.31), SUSE (mariadb and openssl-3), and Ubuntu (linux-aws-5.4).
The developers of the Pidgin chat programhave announced thata malicious plugin had been listed on its third-party plugins list for overone month. This plugin included a key logger and could capturescreenshots.
The FreeBSD Foundation has announced that Germany's Sovereign TechFund (STF) has agreed to invest 686,400 toward improvements in theFreeBSD project's infrastructure, security, regulatory compliance, anddeveloper experience:
The genksyms tool has long been buried deeply within the kernel'sbuild system; it is one of the two C-code parsers shipped with the kernel(the other being thehorrifying kernel-doc script). It is a key part of how thekernel's module-loading infrastructure works. While genksyms hasquietly done its job for decades, that period may soon be coming to an end.It would seem that genksyms is not up to the task of handling Rustcode, so Sami Tolvanen is proposinga new tool to handle this task going forward.
The 6.11-rc5 kernel prepatch is out fortesting. "Other than the timing, there's not a whole lot unusualhere. The diffstat looks fairly flat, which means 'mostly pretty smallchanges'." Linus Torvalds added anote that today marks the 33rd anniversary of the first Linuxannouncement; "A third of a century. And it *still* isn't ready".
On the second day of DebConf24in Busan, South Korea, Holger Levsen provided a history lesson on the"first 11 years" of the Reproducible Builds project.He has been involved in the project for most of that time and has been aDebian user since the mid-1990s, contributor since 2001, and a Debianmember since 2007; "I love Debian". Meanwhile, his aim is to make all freesoftware be reproducible, so that anyone can check that a binary programcomes from the source code it purports to.
The Forgejo project has announced that, starting from version 9.0, Forgejo will be released under the GPLv3 license (or a later version). Older versions of the software forge remain MIT-licensed.
Security updates have been issued by Fedora (community-mysql, iaito, and radare2), Oracle (python3.12-setuptools and tomcat), Red Hat (krb5 and podman), Slackware (ffmpeg), SUSE (apache2, expat, firefox, webkit2gtk3, and xen), and Ubuntu (imagemagick and libxstream-java).
Version24.8 of the LibreOffice office suite has been released. Changesinclude the ability to filter identifying information from exported files,easier creation of cross reference, better control over hyphenation, anumber of new spreadsheet functions, accessibility improvements, and more.
On July 30, Al Viro senta patch set to the linux-fsdevel mailing list with acomprehensive cover letter explaining hisrecent work on ensuring that the kernel's internal representation offile descriptors are used correctly in the kernel.File descriptors are ubiquitous; many system callsneed to handle them. Viro's reviewidentified a few existing bugs, and may prevent more in the future. He also hadsuggestions for ways to keep uses consistent throughout the kernel.
Linux installers receive a disproportionate amount of attentioncompared to the amount of time that most users spend with them. Ideally,a user spends only a few minutes using the installer, versus years usingthe distribution after it is installed. Yet, the installer sets thefirst impression, and if it fails to do its job, little else matters.Installers also have to continually evolve to keep pace with newhardware, changes in distribution packaging (such as image-based Linuxdistributions), and so forth. Along those lines, the SUSE team that maintains thevenerable YaST installer hasdecided it's time to start (almost) fresh with a new Linux installerproject, called Agama,for new projects. YaST is not going away as an administration tool,but it is likely to be relieved of installer duties at some point.
Security updates have been issued by Debian (aom, cinder, dovecot, glance, and nova), Fedora (mysql8.0), Oracle (curl and libreoffice), SUSE (oniguruma, openssl-1_0_0, openssl1, and xen), and Ubuntu (cacti, curl, exfatprogs, firefox, and vim).
AtPyCon2024 in Pittsburgh,Pennsylvania, Anthony Shaw looked at the various kinds of parallelismavailable to Python programs. There have been two major developments onthe parallel-execution front over the last few years, with the effort toprovide subinterpreters, each with its ownglobal interpreter lock (GIL), along with the work to remove the GIL entirely. In the talk, heexplored the two approaches to try to give attendees a sense of how to makethe right choice for their applications.
Version 0.3.0 of the uvPython package and project manager has been released. Introduced inFebruary, uv is written in Rust and aims to be "Cargo forPython". Notable changes in this release include the addition ofinterfaces for managing projects, installingPython, and running scripts,along with adding new documentation. See theaccompanying blog post for more information.
One tactic often used by attackers set on compromising a system is heap spraying; inshort, the attacker fills as much of the heap as possible with crafted datain the hope of getting the target system to use that data in a bad way. Ifheap spraying can be blocked, attackers will lose an important tool. Thekernel has some heap-spraying defenses now, including the dedicated bucket allocator merged for theupcoming 6.11 release, but its author, Kees Cook, thinks that more can bedone.
The FreeBSD Project is, for the secondtime this year, engaging in a long-running discussion about thepossibility of including Rust in its basesystem. The sequel to the first discussion included some work byAlan Somers to show what it might look like to use Rust code in thebase tree. Support for Rust code does not appear much closer to beingincluded in FreeBSD's base system, but the conversation has beenenlightening.
Today's crop of new stable kernels consists of seven new versions: 6.10.6, 6.6.47, 6.1.106, 5.15.165, 5.10.224, 5.4.282, and 4.19.320. As usual, each contains importantfixes throughout the kernel tree.
The Rust code being added to the kernel is documented using the usual rustdocconventions; that documentation is now available on kernel.org informatted form. There is also the linux-next version ofthe documentation for Rust code that will land in the kernel soon.
Python has hadformatted string literals(f-strings), a syntactic shorthand for buildingstrings, since 2015. Recently, Jim Baker, Guido van Rossum, and Paul Everitt haveproposedPEP 750 ("Tag Strings For Writing Domain-Specific Languages") which wouldgeneralize and expand that mechanism to provide Python library writers with additionalflexibility. Reactions to the proposed change were somewhat positive, althoughthere was a good deal of discussion of (and opposition to)the PEP's inclusion of lazy evaluation of template parameters.
The kernel's memory-management developers have been busy in recent times;it can be hard to keep up with all that has been happening in this corearea. In an attempt to catch up, here is a look at recent workaffecting tiered-memory systems, underutilized huge pages, and duplicatedfile data in the Enhanced Read-Only Filesystem (EROFS).
Security updates have been issued by AlmaLinux (container-tools:rhel8), Debian (flatpak), Fedora (389-ds-base, dotnet8.0, and roundcubemail), Red Hat (bind9.16, firefox, python-setuptools, and thunderbird), Slackware (dovecot), SUSE (389-ds, curl, kernel, kernel-firmware, kubernetes1.25, openssl-1_1, openssl-3, python-Pillow, and zziplib), and Ubuntu (busybox, linux-azure, and ruby-rmagick).
Rust is intended to let programmers write safer code.But compilers arenot omniscient, and writing Rust code that interfaces with hardware (or thatworks with memory outside of Rust's lifetime paradigm) requires, atsome point, the programmer's assurance that some operations are permissible. Benno Lossinsuggested addingsome more documentation tothe Rust-for-Linux project clarifying thestandards for commenting uses of unsafe in kernel code. There's generalagreement that such standards are necessary, but less agreement on exactly whenit is appropriate to use unsafe.
Markdown editors are a dime a dozen. Cheaper than that, actually,since many of them are opensource software. Despite the sheer number ofoptions, finding an editor that has all of the features that one might want canbe tricky. For some users, Zettlrmight be the right tool. It is a What You See is What YouMean (WYSIWYM) editor that stores its work locally as plain Markdownfiles. The project is billed as a "one-stop publicationworkbench", and is suitable for writing anything from blog posts toacademic papers, maintaining a personal journal, or keeping notes in a Zettlekasten. Itis simple to get started with, but rewards deeper exploration andcustomization.
ThePostgreSQL project hasreleased betaversions of PostgreSQL 17 containing several interesting security and usabilityimprovements, alongside the usual performance improvements and bug fixes. If therelease proceeds according to the usual timeline, the full release of version 17is expected in September or October.The most important changes are in what PostgreSQL does when a databasesupervisor has their credentials revoked, and addedsupport for incremental database backups.
Lix, the fork of Nix that LWN covered in July, has made its second release since forking. This one includes substantial changes to the backend code, including removing a dependency on Bison, and getting a change to the Nix language back upstream.
Security updates have been issued by Debian (kernel and roundcube), Fedora (microcode_ctl, pypy, python2.7, and python3.6), Oracle (389-ds-base, httpd, kernel, kernel-container, and linux-firmware), Red Hat (kernel-rt), SUSE (firefox, kubernetes1.23, libqt5-qtbase, openssl-1_1, python-gunicorn, python-Twisted, python-urllib3, and qt6-base), and Ubuntu (linux-aws-5.15, linux-gkeop-5.15, linux-ibm, linux-ibm-5.15, linux-raspi, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-oem-6.8, linux-oracle-5.15, and qemu).
Linux hardware vendor System76 started promotingits work on a Rust-based, Waylanddesktop environment for its Pop!_OSUbuntu-derivative distribution almost two yearsago. On August 8, the company released an alpha version of the COSMIC desktop environment forusers to test out. While it has rough edges and missing features, itis stable enough to get a good feel for what the finished product hasin store-and the initial results are promising.
Version 4.0 of the Magit text-basedGit user interface for Emacs has been released. Changes since the 3.3.0release include the addition of context menus, a makeover for themenu-bar menu, new menu commands, and many other new features and bugfixes. See the releasenotes for full details.
LWN.net