LWN.net

The Linux Foundation and Goodwill are working together to bring free Linux training and certification to adult students in Texas."The scholarship program will begin with The Goodwill Excel Center and the Goodwill Career and Technical Academy in Central Texas and is expected to expand to other communities in the future. The Goodwill Excel Center is the first free public charter high school for adults in Texas. Students age 17-50 have the opportunity to earn their high school diploma, complete an in-demand professional certification and begin post-secondary education.The Extended Learning Linux Foundation Scholarship Program created by Linux Foundation and Goodwill includes free access to the Intro to Linux (LFS101x) and Essentials of System Administration (LFS201) courses, and the Linux Foundation Certified System Administrator exam at no cost. Hundreds of disadvantaged individuals from underserved communities and a variety of backgrounds are expected to enroll in the new program in the year ahead."

The 2016 Linux Plumbers Conference (LPC) has announced its Call for Microconferences. LPC will be held in Santa Fe, NM, USA on November 2-4, co-located with the Kernel Summit. "A microconference is a collection of collaborative sessions focused on problems in a particular area of the Linux plumbing, which includes the kernel, libraries, utilities, UI, and so forth, but can also focus on cross-cutting concerns such as security, scaling, energy efficiency, or a particular use case. Good microconferences result in solutions to these problems and concerns, while the best microconferences result in patches that implement those solutions."

Debian has updated libpng (twovulnerabilities), pygments (codeexecution), and wordpress (cross-site scripting).Debian-LTS has updated cacti (SQLinjection) and inspircd (denial of serviceand possible IRC network privilege escalation).Fedora has updated gajim (F23; F22:man-in-the-middle attack), nodejs-ws (F23; F22:remote information disclosure), and perl-PathTools (F23: tainting botch).Mageia has updated apache-commons-collections (code execution),kernel-linus (multiple vulnerabilities), kernel-tmb (multiple vulnerabilities), libtiff (three vulnerabilities), mono (code execution from 2009), and roundcubemail (path traversal).openSUSE has updated gajim (42.1:man-in-the-middle attack), libpng12 (42.1:code execution), libpng15 (42.1: codeexecution), libpng16 (42.1: codeexecution), libxml2 (42.1: multiplevulnerabilities), and python-rsa (signatureforgery).SUSE has updated java-1_6_0-ibm(SLE10SP4: multiple vulnerabilities).Ubuntu has updated thunderbird(multiple vulnerabilities).

Theo de Raadt suggests that a significant OpenSSH security issue is aboutto be exposed; the message reads, in full: "Important SSH patch comingsoon. For now, every on all operating systems, please do the following:Add undocumented 'UseRoaming no' to ssh_config or use '-oUseRoaming=no'to prevent upcoming #openssh client bug CVE-2016-0777. More later."Update: that important patch appears to be OpenSSH 7.1p2, available now. "The OpenSSH client code between 5.4 and 7.1 contains experimential support for resuming SSH-connections (roaming). The matching server code has never been shipped, but the client code was enabled by default and could be tricked by a malicious server into leaking client memory to the server, including private client user keys." There are a few other security fixes there as well.Update 2: see the Qualys advisory for vast amounts of detail.

The LWN.net Weekly Edition for January 14, 2016 is available.

The Qt Company has announced changes to the open source licensing andproduct structure of the Qt cross-platform application developmentframework. "New versions of Qt will be licensed under a commercial license, GPLv2, GPLv3, and LGPLv3, but no longer under LGPLv2.1. The updated open source licenses better ensure end user freedom when using open source licensed versions of Qt. LGPLv3 explicitly forbids the distribution of closed embedded devices. Distributing software under these terms includes a patent grant to all receivers of the software. Commercial Qt licensing removes these requirements and includes professional technical support from The Qt Company."

Arch Linux has updated libxslt (denial of service).Debian has updated isc-dhcp (denial of service).Debian-LTS has updated claws-mail (code execution).Fedora has updated openvpn (F22:multiple vulnerabilities), pitivi (F22: code execution), and shotwell (F23; F22: validate TLS certificates).openSUSE has updated ffmpeg(Leap42.1: multiple vulnerabilities).Slackware has updated dhcp (denial of service).Ubuntu has updated isc-dhcp(denial of service) and libvirt (multiple vulnerabilities).

The user namespaces feature is conceptuallyfairly straightforward—allow users to run as root in their own space, whilelimiting their privileges on the system outside that space—but theimplementation has, perhaps unsurprisingly, proven to be quite tricky. There are some assumptions about user IDs and howthey operate thatare deeply wired into the kernel in various subsystems; shaking those outhas taken some time, which led to some hesitation about enabling thefeature in distribution kernels. But that reluctance has largely passed atthis point, which makes the recent discoveryof a root-privilege escalation using user namespaces and the overlayfilesystem (overlayfs) that much more dangerous.Subscribers can click below for the full story from this week's edition.

Version 4.6 of theArdour audio editor is available. "4.6 includes some notable newfeatures - deep support for the Presonus FaderPort control surface,Track/Bus duplication, a new Plugin sidebar for the Mixer window - as wellas the usual dozens of fixes and improvements to all aspects of theapplication, particularly automation editing."The full list of enhancements is quite long; see the announcement fordetails.

Fedora has updated kernel (F23:multiple vulnerabilities), lighttpd (F23; F22:denial of service), nghttp2 (F22: codeexecution), qemu (F23: multiplevulnerabilities), and wireshark (F23: multiple vulnerabilities).Mageia has updated bugzilla (multiple vulnerabilities), claws-mail (code execution), mariadb (multiple vulnerabilities), openvpn (multiple vulnerabilities), python-rsa (signature forgery), and ruby (code execution).Red Hat has updated kernel(RHEL6.6: two vulnerabilities).Ubuntu has updated oxide-qt(15.10, 15.04, 14.04: multiple vulnerabilities).

Version 2.0 of theAnsible configuration management system has been released. "Thisis by far one of the most ambitious Ansible releases to date, and itreflects an enormous amount of work by the community, which continues toamaze me. Approximately 300 users have contributed code to what has beenknown as 'v2' for some time, and 500 users have contributed code to modulessince the last major Ansible release." New features includeplaybook-level exception handling, better error diagnostics, a new set ofOpenStack modules, and more. See thechangelog for more (terse) details.

Mark Radcliffe writesabout important legal developments from 2015, including the firstruling on GPLv3 (in Germany): "In this case, the user cured itsbreach within the necessary period, but refused to sign a 'cease anddesist' declaration which was sought by the plaintiff to ensure that thedefendant would have an incentive not to breach the terms of the GPLv3again. The court ruled that the reinstatement provision in Section 8 didnot eliminate the plaintiff's right to a preliminary injunction to preventfurther infringements, particularly if the defendant had refused to signthe plaintiff's cease-and-desist declaration."

Mozilla has announcedthat it will be shutting down the persona.org authentication service inNovember. It has been two years since Persona was "transitionedto community ownership"; now the other shoe has dropped. "Due tolow, declining usage, we are reallocating the project’s dedicated,ongoing resources and will shut down the persona.org services that we run.Persona.org and related domains will be taken offline on November 30th,2016." There is aset of "shutdown guidelines" to help sites still using Persona totransition to something else. (LWN looked atPersona in 2013).

Netcraft reportsthat the US Department of Defense (DoD) is still issuing SHA-1 signedcertificates, and using them to secure connections to .mil websites."The DoD is America's largest government agency, and is tasked with protecting the security of its country, which makes its continued reliance on SHA-1 particularly remarkable. Besides the well known security implications, this reliance could already prove problematic amongst the DoD's millions of employees. For instance, Mozilla Firefox 43 began rejecting all new SHA-1 certificates issued since 1 January 2016. When it encountered one of these certificates, the browser displayed an Untrusted Connection error, although this could be overridden. If DoD employees become accustomed to ignoring such errors, it could become much easier to carry out man-in-the-middle attacks against them."

Arch Linux has updated dhcpcd (denial of service), gajim (man-in-the-middle), wireshark-cli (multiple vulnerabilities), wireshark-gtk (multiple vulnerabilities), wireshark-qt (multiple vulnerabilities), and wordpress (cross-site scripting).Debian has updated gnutls26 (signature forgery), openssl (signature forgery), perl (returns untainted strings), prosody (two vulnerabilities), sudo (privilege escalation), and xscreensaver (denial of service).Debian-LTS has updated icu(information leak) and sudo (privilege escalation).Fedora has updated kea (F23:denial of service), mod_nss (F23: enablesinsecure ciphersuites), and rsync (F23: unsafe destination path).Mageia has updated armagetron (two vulnerabilities), kernel (multiple vulnerabilities), phpmyadmin (installation path disclosure), pitivi (code execution), and rtmpdump (code execution).openSUSE has updated phpMyAdmin(Leap42.1, 13.2, 13.1: installation path disclosure), pitivi (Leap42.1, 13.2: code execution), and rubygem-mail, (Leap42.1, 13.2: SMTP injection).Oracle has updated kernel 3.8.13 (OL7; OL6: denialof service), kernel 2.6.39 (OL6; OL5: multiple vulnerabilities), kernel2.6.32 (OL6; OL5: multiple vulnerabilities).Red Hat has updated openstack-nova (RHELOSP5,6,7 for RHEL7; RHELOSP5 for RHEL6: information leak).Ubuntu has updated firefox (signature forgery).

Linus has, as expected, announced therelease of the 4.4 kernel. Some of the headline features in this release includethe mlock2() system call withsupport for deferred memory locking,I/O polling in the block layer,the LightNVM patches for low-level controlof solid-state storage devices,the ability for unprivileged users to loadBPF programs into the kernel, and much more.Some more information can be found on the KernelNewbies 4.4 page.

At his blog, Daniel Vrátil provides an extensive update on the status of Akonadi, the KDE project's personal information management (PIM) data service. He focuses on the changes made during the port to KDE Frameworks 5, starting with the switch from a text-based to a binary protocol. "This means we spent almost zero time on serialization and we are able to transmit large chunks of data between the server and the applications very, very efficiently." The ripple effects include changes to the database operations and, eventually, to the public API. Finally, he addresses the disappearance of the KJots note-taking application. "What we did not realize back then was that we will effectively prevent people from accessing their notes, since we don’t have any other app for that! I apologize for that to all our users, and to restore the balance in the Force I decided to bring KJots back. Not as a part of the main KDE PIM suite but as a standalone app."

CentOS has updated gnutls (C6; C7: signature forgery),libldb (C6; C7: multiple vulnerabilities), nss (C6; C7: signature forgery),openssl (C6; C7: signature forgery), rpcbind (C6; C7:denial of service),samba (C6; C7: multiple vulnerabilities), and samba4 (C6: multiple vulnerabilities).Fedora has updated bugzilla (F23; F22:multiple vulnerabilities),kea (F22: denial of service), libvirt (F22: path traversal), mediawiki (F22: multiple vulnerabilities), nghttp2 (F23: code execution), roundcubemail (F23; F22:path traversal),ruby (F22: multiple vulnerabilities), and shellinabox (F23; F22:DNS rebinding).openSUSE has updated wireshark (13.1, 13.2, Leap 42.1:multiple vulnerabilities).Oracle has updated gnutls (O6; O7: signature forgery),libldb (O7; O6: remote memory disclosure), nss (O7; O6: signature forgery),openssl (O7; O6: signature forgery), rpcbind (O7; O6:denial of service),samba (O6; O7: multiple vulnerabilities), and samba4 (O6: multiple vulnerabilities).Red Hat has updated gnutls(RHEL 6,7: signature forgery), libldb(RHEL 6,7: multiple vulnerabilities), nss (RHEL 6,7: signature forgery), openssl (RHEL 6,7: signature forgery), openstack-nova (RHEL 6: insecure VM instances), rpcbind (RHEL 6,7: denial of service), samba (RHEL 7; RHEL 6: multiple vulnerabilities),and samba4 (RHEL 6: multiple vulnerabilities).Scientific Linux has updated gnutls (SL 6,7: signature forgery), libldb (SL 6,7: multiple vulnerabilities), nss (SL 6,7: signature forgery), openssl (SL 6,7: signature forgery), rpcbind (SL 6,7: denial of service), samba (SL 7; SL6: multiple vulnerabilities),and samba4 (SL 6: multiple vulnerabilities).Ubuntu has updated gnutls26,gnutls28 (12.04, 14.04, 15.04: signature forgery), nss (12.04, 14.04, 15.04, 15.10: signature forgery), and openssl (12.04: signature forgery).

PostgreSQL 9.5 has been releasedwith lots of new features for the database management system, includingUPSERT, row-level security, and several "big data" features. We previewedsome of these features back in July and August. "A most-requested feature by application developers for several years,'UPSERT' is shorthand for 'INSERT, ON CONFLICT UPDATE', allowing newand updated rows to be treated the same. UPSERT simplifies web andmobile application development by enabling the database to handleconflicts between concurrent data changes. This feature also removesthe last significant barrier to migrating legacy MySQL applications toPostgreSQL."

CentOS has updated thunderbird (C7; C6; C5: multiple vulnerabilities).Fedora has updated libpng (F23:two vulnerabilities).openSUSE has updated grub2 (42.1:code execution).Red Hat has updated kernel(RHEL6: two vulnerabilities).Scientific Linux has updated thunderbird (multiple vulnerabilities).Ubuntu has updated libpng (twovulnerabilities) and pygments (code execution).

Mozilla hasrun into a hitch with its plans to deprecate SHA-1 certificates."However, for Firefox users who are behind certain'man-in-the-middle' devices (including some security scanners and antivirusproducts), this change removed their ability to access HTTPS web sites.When a user tries to connect to an HTTPS site, the man-in-the-middle devicesends Firefox a new SHA-1 certificate instead of the server’s realcertificate. Since Firefox rejects new SHA-1 certificates, it can’tconnect to the server." An update backing out the SHA-1 deprecationhas been posted, but affected users will have to install it manually(assuming they don't use a distribution-supported version, of course).

The LWN.net Weekly Edition for January 7, 2016 is available.

Glyn Moody conducted an interview with Ian Murdock in 1999. In thisarticle on Ars Technica, Glyn looks back at Debian's early history, as Ianrecounted it in that interview. "When we spoke in 1999, he was delighted by how the project had continued to develop: "I often tell people that I didn't know that Debian would be a success until after I left. Because the whole idea was that Debian would be something that would take on a life of its own, and that if it could do that it would outlive my involvement. And it did, and in fact it's not just surviving, but it's thriving. And I'm very proud of that.""

Debian has updated git (code execution) and kernel (multiple vulnerabilities).Debian-LTS has updated linux-2.6(three vulnerabilities).Fedora has updated openvpn (F23: multiple vulnerabilities) and quassel (F23; F22: denial of service).Oracle has updated thunderbird (OL7; OL6: multiple vulnerabilities).Red Hat has updated thunderbird(RHEL5,6,7: multiple vulnerabilities).SUSE has updated samba(SLE11-SP2: multiple vulnerabilities).Ubuntu has updated kernel (15.10; 15.04:privilege escalation), ldb (twovulnerabilities), linux-lts-vivid (14.04:privilege escalation), linux-lts-wily(14.04: privilege escalation), linux-raspi2(15.10: privilege escalation), and samba (multiple vulnerabilities).

The kernel development community is organized as a hierarchy, withdevelopers submitting patches to maintainers who will, in turn, committhose patches to a repository and push them upstream to higher-level maintainers. Thishierarchy logically looks a lot like the directory hierarchy of the kernelsource itself; most maintainers look after one or more subtrees of thekernel source tree. But does that model really describe how patches makeit into the mainline? The kernel's git repository, with the aid of somescripting, holds an answer to that question.

Linux.com coverstwo announcements from the Linux Foundation Automotive Grade Linux (AGL)Collaborative Project. Four new major automotive OEMs have joinedthe project, and a new AGL Unified Code Base (UCB) distribution hasbeen released. "At CES, the AGL UCB will be featured as part of the GENIVI CES 2016 Demonstration Showcase in the Trump International Hotel on January 6-7, 2016. Demo applications for navigation, HVAC control, radio, media player and browser, settings and home screen are on display this week.This new distribution integrates the best components from AGL, Tizen, GENIVI and related open source code into a single AGL Unified Code Base, allowing carmakers to leverage a common platform for rapid innovation."

Fedora has updated bouncycastle(F22: invalid curve attack), jenkins (F23; F22:multiple vulnerabilities), libpng15 (F23; F22: twovulnerabilities), and pcre (F22: multiple vulnerabilities).openSUSE has updated xfsprogs(Leap42.1: information disclosure).SUSE has updated kvm (SLE11-SP3:two vulnerabilities).

The Git 2.7.0 release is now available, adding a number of enhancements tothis version-control system. The headline feature appears to be amuch-needed rework of gitk for better appearance on high-DPI displays, butthere are a number of other improvements as well.

Dan Gillmor describeshis experience moving to Ubuntu full-time. "So for anyone who’seven slightly interested in retaining significant independence in desktopand laptop computing, Linux is looking like the last refuge. (On anassortment of other devices, from supercomputers to servers to mobilephones to embedded systems, Linux is already a powerhouse.) I’m glad I madethis move."

RFC 1883, Internet Protocol, Version 6 (IPv6) Specification, was published20 years ago. Ars Technica takesa look at IPv6 adoption. "First the good news. According to Google's statistics, on December 26, the world reached 9.98 percent IPv6 deployment, up from just under 6 percent a year earlier. Google measures IPv6 deployment by having a small fraction of their users execute a Javascript program that tests whether the computer in question can load URLs over IPv6. During weekends, a tenth of Google's users are able to do this, but during weekdays it's less than 8 percent. Apparently more people have IPv6 available at home than at work."

Arch Linux has updated rtmpdump (code execution).Debian has updated samba (multiple vulnerabilities).Debian-LTS has updated cacti(regression in previous update), libvncserver (memory corruption), and samba (multiple vulnerabilities).Fedora has updated claws-mail(F22: code execution), conntrack-tools (F23; F22:denial of service), libpng12 (F23;F22: multiple vulnerabilities), mediawiki (F23: multiple vulnerabilities),mingw-giflib (F23; F22: heap-based buffer overflow), thunderbird (F22: multiple vulnerabilities),and xen (F22: multiple vulnerabilities).openSUSE has updated claws-mail(Leap42.1, 13.2, 13.1: code execution) and firefox (Leap42.1, 13.2, 13.1: signature forgery).SUSE has updated kvm (SLE11-SP4: two vulnerabilities).

As expected, Linus has released 4.4-rc8rather than the final 4.4 release. "Normally, me doing an eighthrelease candidate means that there is some unresolved issue that stillneeds more time to get fixed. This time around, it just means that I wantto make sure that everybody is back from the holidays and there isn'tanything pending, and that people have time to get their merge window pullrequests all lined up. No excuses about how you didn't have time to getthings done by the time the merge window opened, now."

James Bottomley is tryingto make life easier for projects that want to accept contributionsusing the developer certificateof origin as the contribution agreement, but which are concerned aboutpatent grants. "The lever that will help to make this move is asimple pledge, which can be published on a corporate website, that allowscorporations expecting to make legitimate contributions to patent bindinglicences under the DCO to do so properly without needing any additionalContributor Licence Agreements. Essentially it would be an explicitstatement that when their developers submit code to a project under the DCOusing a corporate signoff, they’re acting as agents for the necessarypatent and copyright grants, meaning you can always trust a DCO signofffrom that corporation."

Just over one year ago, LWN covered thedeliberations within the Python project on how to improve itsdevelopment workflow. Now, after much discussion, it has been announcedthat the project will be moving over to GitHub. "While there werepeople who publicly said they would prefer not to go with GitHub but wouldbegrudgingly use it if we chose to go that route, I had multiple core devsemail me privately saying they hoped I would choose GitHub. I think most ofthat stemmed from having used GitHub for other open source projects and/orwork, making even dormant core devs say they would be able to become activeagain if we switched to GitHub thanks to eliminating the barrier of havingto keep up with our custom workflow for code reviews and using hg forcommits."

The GIMP project has released its annual year-end retrospective, looking back on development on the GIMP editor itself, project infrastructure, and closely related software projects like the Generic Graphics Library (GEGL). Highlights from the past twelve months include the conversion of more tools to using GEGL operations, support for a new perceptual color space, and improvements to image-blending modes. Several new features were added to support painting (including on-screen-canvas flipping and rotation), and work was put into the UI themes.For its part, GEGL gained experimental support for multithreading and mipmaps. The GIMP site was also redesigned, with the launch timed to correspond to GIMP's 20th birthday. "Most of the work we did this year is available in v2.9.2, the first development release in 2.9.x series made in late November. Improved MyPaint Brush tool and visual changes (icon themes, dark theme) will be available in upcoming v2.9.4 release. We expect to continue finalizing the GEGL port and the existing feature set in 2016."

The first security updates of 2016 have arrived.Debian has updated ganeti(multiple vulnerabilities) and icedove(multiple vulnerabilities).Debian-LTS has updated ia32-libs (multiple vulnerabilities).openSUSE has updated mozilla-nss (13.1, 13.2, Leap 42.1:signature forgery) and MozillaThunderbird (13.1, 13.2, Leap 42.1: multiple vulnerabilities).

Brett Cannon continues his series of posts on Python 3 with a blog post likening the path of its adoption to the Kübler-Ross model (i.e. the five stages of grief). "Unfortunately people are running up against the classic problem of lacking buy-in from management. I regularly hear from people that they would switch if they could, but their manager(s) don't see any reason to switch and so they can't (or that they would do per-file porting, but they don't think they can convince their teammates to maintain the porting work). This can be especially frustrating if you use Python 3 in personal projects but are stuck on Python 2 at work. Hopefully Python 3 will continue to offer new features that will eventually entice reluctant managers to switch. Otherwise financial arguments might be necessary in the form of pointing out that porting to Python 3 is a one-time cost while staying on Python 2 past 2020 will be a perpetual cost for support to some enterprise provider of Python and will cost more in the long-term (e.g., paying for RHEL so that someone supports your Python 2 install past 2020). Have hope, though, that you can get buy-in from management for porting to Python 3 since others have and thus reached the "acceptance" stage."

Debian-LTS has updated cacti(regression in previous security fix).Fedora has updated arts (F22:privilege escalation), claws-mail (F23:code execution), cups-filters (F22: codeexecution), kdelibs3 (F22: privilegeescalation), libpng10 (F22: readunderflow), php-horde-Horde-Core (F22:cross-site scripting), php-horde-Horde-Perms (F22: cross-sitescripting), php-horde-Horde-Service-Weather(F22: cross-site scripting), phpmyadmin (F23; F22:installation path disclosure), and python-django (F22: information leak).Gentoo has updated inspircd(three largely unspecified vulnerabilities, one from 2012) and systemsettings (privilege escalation).openSUSE has updated flash-player(11.4: many vulnerabilities).

Opensource.com introducesthe latest open movie from the Blender Institute, Glass Half."Like all of the other open movie projects released by the Blender Institute, Glass Half has been released under a Creative Commons Attribution license, along with all of the assets (3D models, textures, animations, etc.) used to create the short. However, there are some key differences between this animated short and the Blender Institute's larger projects like Cosmos Laundromat. For one, the production time for this piece was much shorter. Although there were some concepts and storyboards being put together by the team as Cosmos Laundromat's year-long production was wrapping up, the actual production time for Glass Half was just around seven weeks."

Sad news: Ian Murdockhas passed away. "Ian was perhaps best known professionally asthe founder of the Debian project, which he created while still a studentat Purdue University, where he earned his bachelor’s degree in computerscience in 1996. Debian was one of the first Linux distros to be forged,and it is widely regarded as a one of the most successful open-sourceprojects ever launched. Ian helped pioneer the notion of a truly openproject and community, embracing open design and open contribution; in factthe formative document of the open source movement itself (the Open SourceDefinition) was originally a Debian position statement."See also: the DebianProject's page on Ian's passing.

Debian-LTS has updated mono (codeexecution from 2009).Fedora has updated arts (F23:privilege escalation), kdelibs3 (F23:privilege escalation), mono (F23: codeexecution from 2009), and ruby (F23: two vulnerabilities).Gentoo has updated clamav(multiple vulnerabilities), encfs (multiplevulnerabilities), firebird (code executionfrom 2013), firefox (many vulnerabilities),gstreamer (code execution), and mpfr (code execution).openSUSE has updated flash-player(13.2, 13.1: multiple vulnerabilities).SUSE has updated flash-player (SLE12-SP1; SLE11-SP3,4: multiple vulnerabilities) and grub2 (SLE12: code execution).

Stefano Zacchiroli was therecipient of a Shuttleworth Foundation Flash Grant in January 2015. Henow reportshow he spent the money. "On grant money I've attended LibrePlanet 2015 (2015-03-19-boston-libreplanet label in the financial reports below), where I've given the talk Distributions and the Free "Cloud", and FSFE's LLW 2015 (2015-04-15-barcelona-fsfe-legal) workshop. Furthermore I've used the grant to reimburse otherwise not reimbursed out of pocket expenses in a trip to San Francisco (2015-11-06-san-francisco-gsoc+osi) that have been otherwise sponsored by Google (to attend the Summer of Code Mentor Summit) and OSI (to attend a F2F meeting of the Board of Directors). Finally, I've used grant money to offer lunch to invited lecturers in my master-level Free Software class at the university (label 2015-foss-class)."

Arch Linux has updated flashplugin,lib32-flashplugin (multiple vulnerabilities), libpng (code execution), and openvpn (information disclosure).Fedora has updated activemq (F22:unsafe deserialization), bind99 (F22:denial of service), dhcp (F22: denial ofservice), gwenhywfar (F23; F22: certificate update), libpng10 (F23: read underflow), libvirt (F23: path traversal),nodejs-handlebars (F23; F22: cross-site scripting), php-horde-Horde-Core (F23: cross-sitescripting), php-horde-Horde-Perms (F23:cross-site scripting), php-horde-Horde-Service-Weather (F23:cross-site scripting), qemu (F22: denial ofservice), and sos (F23: privilege escalation).Mageia has updated blueman(privilege escalation), bouncycastle(invalid curve attack), flash-player-plugin(multiple vulnerabilities), libpng12 (read underflow), perl-HTML-Scrubber (cross-site scripting), subversion (code execution), and thunderbird (multiple vulnerabilities).openSUSE has updated bind (11.4:denial of service) and grub2 (11.4: code execution).Red Hat has updated flash-plugin(RHEL5,6: multiple vulnerabilities).SUSE has updated grub2 (SLE12-SP1; SLE11-SP4; SLE11-SP3: code execution).

Opensource.com looksat its top stories for 2015. "This year saw continuedgrowth for both use and adoption of open source software in theenterprise software market. Many companies made some of their software opensource, like Google, Facebook, Apple, Microsoft, and others. Also,Microsoft acquiredRevolution Analytics, an open source data analytics company. Fun fact: IBM made ~50 applications open source this year."

Arch Linux has updated mediawiki (multiple vulnerabilities), nghttp2 (code execution), and thunderbird (multiple vulnerabilities).Debian-LTS has updated cacti (SQLinjection), libpng (multiple vulnerabilities), and libxml2 (multiple vulnerabilities).Fedora has updated activemq (F23:unsafe deserialization), openstack-swift-plugin-swift3 (F23: replayattack), and samba (F22: multiple vulnerabilities).openSUSE has updated bind (13.2, 13.1; Leap42.1: denial of service), cups-filters (13.2: command execution), ffmpeg (Leap42.1: multiple vulnerabilities),grub2 (13.2, 13.1: code execution), gummi (Leap42.1, 13.2, 13.1: predictablefilenames in /tmp), krb5 (Leap42.1: memorycorruption regression), libxml2 (13.2, 13.1:multiple vulnerabilities), polarssl (13.2:code execution), Qt (Leap42.1: multiplevulnerabilities), subversion (13.2, 13.1:(code execution), subversion (Leap42.1:three vulnerabilities), and xulrunner(Leap42.1: multiple vulnerabilities).SUSE has updated bind (SLE12-SP1:denial of service).

Noting that "there is no rest for kernel developers," Linushas released the 4.4-rc7 prepatch. Still,it seems he plans to allow for a bit of rest in the near future: "Iexpect more of the same for next week, when I'd almost certainly ready tojust release the final 4.4, but will probably do an rc8 just to not openthe merge window while people are still recovering from theholidays."

The December24 entry in the Perl 6 advent calendar describes the "coming out"of Perl 6. "Of course, she’s still just 15. She does somethings really well now. Her communication skills are pretty good, and sheis very polite when she can’t understand you. She can carry on severalconversations at once. She’s getting pretty good at math, and shows skillin manipulating objects of various sorts. She loves foreign languages, andall those funny characters."The December 25entry follows with the Rakudo Perl 6 release. "This versionof the compiler targets the v6.c 'Christmas' specification of the Perl 6language. The Perl 6 community has been working toward this release overthe last 15 years."

Version2.0 of the darktable photo editor has been released. The list of newfeatures is long; see LWN's review fromNovember for the details.

Mageia has updated dpkg (codeexecution), keepassx (informationdisclosure), mediawiki (multiplevulnerabilities), php-phpmailer (messageinjection), and proftpd (denial of service).openSUSE has updated firefox(multiple vulnerabilities), glibc (13.2:pointer guard circumvention), ldb, samba,talloc, tdb, tevent (42.1: multiple vulnerabilities), and samba,ldb, talloc, tdb, tevent (13.2, 13.1: multiple vulnerabilities).Slackware has updated mozilla-thunderbird (multiple vulnerabilities).SUSE has updated the Linux Kernel(SLE11SP4: multiple vulnerabilities).

Qubes OS creator Joanna Rutkowska has announceda newpaper [PDF] describing a stateless laptop design that, she thinks, willaddress a number of the security problems she sees as being inherent in theIntel architecture. "The Trusted Stick, a small device of a 'USBstick' or an SD card form factor, is an element that the user alwayscarries with themselves and which contains all the 'state' for theplatform. This includes the (encrypted) user files and platformconfiguration. It also is expected to carry all the software and – what isunique as of today – firmware for the platform, and also enforceread-onlyness of these."