The Tor Project has announced the beta release of a new,off-the-record (OTR) chat client called Tor Messenger. As expected,chat session traffic is sent entirely over Tor. In addition, theapplication requires the use of OTR encryption—rather thanmerely providing it as an option. The beta is available for Linux,Windows, and Mac OS X systems. A blogpost provides specifics about the implementation details.
The Software Freedom Conservancy has posted an updateon the GPL-infringement suit against VMware filed by ChristophHellwig. "The lawsuit continues to progress. VMware has filed astatement of defense, in which they assert arguments for the dismissal ofthe action. Christoph, with the assistance of his lawyer Till Jaeger, hasfiled his response to these arguments. Unfortunately, VMware has explicitlyasked for the filings not to be published and, accordingly, Conservancy hasnot been able to review either document. With the guidance of counsel,Christoph was able to provide Conservancy with a high-level summary of thefilings from which we are able to provide this update. VMware's statementof defense primarily focuses on two issues. First, VMware questionsChristoph's copyright interest in the Linux kernel and his right to bringthis action. Second, VMware claims vmklinux is an 'interoperability module'which communicates through a stable interface called VMK API."
The Tor Project's .onion (hidden services) addresses have been formallyapproved as a Special Use Domain Name by the Internet Engineering TaskForce (IETF). "[Jacob] Appelbaum, a security researcher and advocate at the Tor Project andAlec Muffett, a software engineer at Facebook, co-authored the Requestfor Comments (RFC 7686) to the IETF. Hidden services are used by humanrights defenders, political organizers, journalists, diplomats, andordinary people around the world who want to chat, email, blog or doother everyday work privately and without the use of a centralized,hackable server."
CentOS has updated qemu-kvm (C7: denial of service).Debian has updated openjdk-7 (multiple vulnerabilities) and php5 (two vulnerabilities).openSUSE has updated squid (13.2,13.1: nonce replay vulnerability) and wireshark (13.2, 13.1: multiple vulnerabilities).Red Hat has updated kubernetes(RHOSE3: directory path traversal).Ubuntu has updated ntp (multiplevulnerabilities), openjdk-7 (15.10, 15.04,14.04: multiple vulnerabilities), and php5 (denial of service).
One of the biggest freedoms associated with free software is the ability toreplace a program with an updated or modified version. Even so, of themany millions of people using Linux-powered phones, few are able torun a mainline kernel on those phones, even if they have the technicalskills to do the replacement. The sad fact is that no mainstream phoneavailable runs mainline kernels. A session at the 2015 Kernel Summit, ledby Rob Herring, explored this problem and what might be done to address it.
One of the recurring features of Linux Foundation events is an on-stagediscussion between Dirk Hohndel and Linus Torvalds on a variety ofkernel-related topics. The KoreaLinux Forum in Seoul, South Korea did not diverge from this pattern. The pair talked about a wide range of topics; there were fewsurprises and little that will be controversial, but the discussion did include someinsights into how the community is doing and where the kernel is going.
The Electronic Frontier Foundation has announcedthat its petition for an exemption to the US Digital Millennium CopyrightAct for automotive software has been accepted. "Because Section 1201prohibits unlocking 'access controls' on the software, car companies havebeen able to threaten legal action against anyone who needs to get aroundthose restrictions, no matter how legitimate the reason. While thecopyright office removed this legal cloud from much car software research,it also delayed implementation of the exemption for one year."
The Electronic Frontier Foundation reportsthat the Librarian of Congress has granted security researchers and othersthe right to inspect and modify the software in their cars and othervehicles. "EFF also won an [DMCA] exemption for users who want to play video games after the publisher cuts off support. For example, some players may need to modify an old video game so it doesn’t perform a check with an authentication server that has since been shut down. The Librarian also granted EFF’s petition to renew a previous exemption to jailbreak smartphones, and extended that to other mobile devices, including tablets and smartwatches. This clarifies the law around jailbreaking, making clear that users are allowed to run operating systems and applications from any source, not just those approved by the manufacturer. EFF also won the renewal and partial expansion of the exemptions for remix videos that use excerpts from DVDs, Blu-Ray discs, or downloading services."
Arch Linux has updated vorbis-tools (denial of service).CentOS has updated ntp (C7; C6: two vulnerabilities).Debian-LTS has updated libxml2(regression in previous update).Mageia has updated iceape/sqlite3 (multiple vulnerabilities) and virtualbox (two vulnerabilities).openSUSE has updated nodejs(13.2, 13.1: denial of service), haproxy(13.2: information leak), and libressl(13.2: two vulnerabilities).Oracle has updated ntp (OL7; OL6: twovulnerabilities) and qemu-kvm (OL7: denial of service).Red Hat has updated ntp (RHEL6,7:two vulnerabilities) and qemu-kvm (RHEL7: denial of service).Scientific Linux has updated ntp(SL6,7: two vulnerabilities) and qemu-kvm(SL7: denial of service).Ubuntu has updated apport (privilege escalation).
The first beta release of KDevelop 5.0.0 is available.The code base has been ported to Qt 5 and KDE frameworks 5,the legacy C++ parser and semantic analysis plugin has been replaced with amuch more powerful one that is based on Clang, the hand-written CMakeinterpreter has been removed in favor of upstream CMake, plus more features,code cleanup and bug fixes.
The 4.3-rc7 kernel prepatch is out."So it may still be Saturday at home, but with the Kernel Summit inKorea coming up, I'm ahead of the curve in a +0900 timezone, and it'sSunday here. So it's release day." This looks to be the finalprepatch, with 4.3 likely to come out on November 1.
Python language developer Nick Coghlan has posted asurvey of 27 languages that, he thinks, have lessons for Python."One of the things we do as part of the Python core developmentprocess is to look at features we appreciate having available in otherlanguages we have experience with, and see whether or not there is a way toadapt them to be useful in making Python code easier to both read andwrite. This means that learning another programming language that focusesmore specifically on a given style of software development can help improveanyone's understanding of that style of programming in the context ofPython."
Mozilla CEO Mitchell Baker has announced the launch of "an award program specifically focused on supporting open source and free software. The main focus of the program will be to provide financial support of other projects, "to recognize and celebrate communities who are leading the way with open source projects that contribute to our work and the health of the Web. It encompasses both: a) a “give back†element for open source and free software projects that Mozilla relies on; and b) a “give forward†component for supporting other projects where financial resources from Mozilla can make our entire community more successful." The initial funding allocation for the program is $1,000,000, and Mozilla is seeking applications for ten recipient projects. The announcement also notes that one planned component of the program will be to fund security-related work. (Thanks to Martin Michlmayr)
Here's asurvey of orchestration systems on the O'Reilly site. "Varioussoftware tools and solutions exist to help with these challenges. Let’sfocus on orchestration tools, which help make all the pieces work together,working with the cluster to start containers on appropriate hosts andconnect them together. Along the way, we’ll consider scaling and automaticfailover, which are important features."
Ubuntu 15.10 (codenamed "Wily Werewolf") has been released. "Under the hood, there have been updates to many core packages, includinga new 4.2-based kernel, a switch to gcc-5, and much more.Ubuntu Desktop has seen incremental improvements, with newer versions ofGTK and Qt, updates to major packages like Firefox and LibreOffice, andstability improvements to Unity.Ubuntu Server 15.10 includes the Liberty release of OpenStack, alongsidedeployment and management tools that save devops teams time whendeploying distributed applications - whether on private clouds, publicclouds, x86, ARM, or POWER servers, or on developer laptops. Severalkey server technologies, from MAAS to juju, have been updated to newupstream versions with a variety of new features." More informationcan be found in the releasenotes.
Arch Linux has updated ntp(multiple vulnerabilities).CentOS has updated java-1.7.0-openjdk (C7; C6; C5: many vulnerabilities) andjava-1.8.0-openjdk (C7; C6: many vulnerabilities).Debian-LTS has updated unzip (twovulnerabilities).openSUSE has updated python-django (13.1: two vulnerabilities).Oracle has updated java-1.7.0-openjdk (OL7; OL6; OL5: many vulnerabilities) and java-1.8.0-openjdk (OL7; OL6: many vulnerabilities).Red Hat has updated java-1.7.0-openjdk (RHEL6&7; RHEL5: many vulnerabilities) and java-1.8.0-openjdk (RHEL6&7: many vulnerabilities).Scientific Linux has updated java-1.7.0-openjdk (SL6&7; SL5: many vulnerabilities) and java-1.8.0-openjdk (SL6&7: many vulnerabilities).
Mark Shuttleworth introduces thenext Ubuntu release, 16.04 LTS.All of these are coming together beautifully, making Ubuntu the fastest path to magic of all sorts. And that magic will go by the codename… xenial xerus!What fortunate timing that our next LTS should be X, because “xenial†means “friendly relations between hosts and guestsâ€, and given all the amazing work going into LXD and KVM for Ubuntu OpenStack, and beyond that the interoperability of Ubuntu OpenStack with hypervisors of all sorts, it seems like a perfect fit.And Xerus, the African ground squirrels, are among the most social animals in my home country. They thrive in the desert, they live in small, agile, social groups that get along unusually well with their neighbours (for most mammals, neighbours are a source of bloody competition, for Xerus, hey, collaboration is cool). They are fast, feisty, friendly and known for their enormous… courage. That sounds just about right. With great… courage… comes great opportunity!
Access control lists (ACLs) can implement finer-grained access permissionsfor files than the traditional Unix mode bits. Linux has ACL support, butthe POSIX ACLs supported by Linux now have been showing their age for a while. POSIX ACLs may soon besuperseded by a more capable mechanism known as RichACLs. Click below (subscribers only) fora look at RichACLs and what they bring to Linux.
OwnCloud Server 8.2 is available.This release features a a revamped user interface and many improvements forownCloud administrators. "ownCloud Server 8.2 makes it possible forownCloud Administrators to send their users notifications, useful to letusers know about a maintenance window for example. Admins can now also setlimits on trash and version retention, ensuring that trashed files andversions get deleted after a set number of days or are not purged for acertain period. The occ command line tool has gained significant new maintenance and control features. It enables encrypting, decrypting and re-encrypting existing user data and can now set and get system and app configuration values. It can also be used to rescan the file system and update mime types after custom types have been defined."
Opensource.com has an interviewwith Sam Aaron, creator of Sonic Pi. "Sonic Pi is a musical instrument that happens to use code as its interface. It's also a programming environment that happens to be very capable of making sophisticated sounds. It's actually many things—a tool for learning how to program, for exploring new notations for music, for improvising electronic music, for collaborating on musical ideas via text, for researching new programming techniques related to time and liveness. Most of all, it's a lot of fun."
Arch Linux has updated flashplugin (multiple vulnerabilities), miniupnpc (code execution), and spice (multiple vulnerabilities).Debian has updated owncloud (multiple vulnerabilities).Debian-LTS has updated freeimage(integer overflow) and postgresql-8.4 (denialof service).Fedora has updated firefox (F22: multiple vulnerabilities) and lxdm (F22; F21: two vulnerabilities).Gentoo has updated bind (denial of service).Mageia has updated flash-player-plugin (multiple vulnerabilities).openSUSE has updated docker(13.2: two vulnerabilities).Red Hat has updated flash-plugin(RHEL6: multiple vulnerabilities).
Linus has released 4.3-rc6 fortesting. "Things continue to be calm, and in fact have gottenprogressively calmer. All of which makes me really happy, although mysuspicious nature looks for things to blame. Are people just on their bestbehavior because the Kernel Summit is imminent, and everybody is puttingtheir best foot forward?"
Theo de Raadt is celebrating the twentieth anniversary of the creation ofthe OpenBSD source tree. "Chuck [Cranor] and I also worked onsetting up the first 'anoncvs' to make sure noone was ever cut out from'the language of diffs' again. I guess that was the precursor for thegithub concept these days :-)"
Ars Technica reportsthat a handful of app distributors are putting many Android users at risk bybundling root exploits with their wares. "It took just one month of part-time work for the computer scientists to reverse engineer 167 exploits from a single provider so they could be reused by any app of their choosing. Ultimately, the researchers concluded that the providers, by providing a wide array of highly customized exploits that are easy to reverse engineer and hard to detect, are putting the entire Android user base at increased risk."
Here's alengthy Techdirt article looking through the US Appeals Court rulingthat Google's scanning of books constitutes fair use under copyright law."Thus, while authors are undoubtedly important intended beneficiariesof copyright, the ultimate, primary intended beneficiary is the public,whose access to knowledge copyright seeks to advance by providing rewardsfor authorship."
The Free Software Foundation has announced theposting of a setof criteria meant to be used for judging the suitability ofcode-hosting sites. "The criteria emphasize protection of privacy(including accessibility through the Tor network), functionality withoutnonfree JavaScript, compatibility with copyleft licensing and philosophy,and equal treatment of all users' traffic."
Red Hat has announcedthat it is acquiring Ansible, the company behind the Ansible configurationmanagement system. "Ansible's automation capabilities, togetherwith Red Hat's existing management portfolio, will help users drive downthe cost and complexity of deploying and managing both cloud-native andtraditional applications across hybrid cloud environments." LWN looked at Ansible in August.
Arch Linux has updated mbedtls (code execution).Fedora has updated fossil (F22; F21: man-in-the-middle attack).Mageia has updated roundcubemail (multiple vulnerabilities).openSUSE has updated flash-player(13.2, 13.1: multiple vulnerabilities), jakarta-taglibs-standard (13.2, 13.1: codeexecution), rsync (13.2, 13.1: filechecksum collision), and spice (13.2, 13.1:multiple vulnerabilities).Oracle has updated docker-engine (OL7; OL6: two vulnerabilities).Red Hat has updated flash-plugin(RHEL6: multiple vulnerabilities).SUSE has updated docker (SLE12: two vulnerabilities).Ubuntu has updated commons-httpclient (15.04, 14.04, 12.04:multiple vulnerabilities) and pollinate(15.04, 14.04: new certificate).
On the final day of LinuxCon Europe 2015, HP's Chief TechnologyOfficer Martin Fink delivered a bold keynote about softwarelicensing. Fink recapped the negative effects of licenseproliferation and addressed projects that use their choice of licenseas hostile act against the competition. He then ended the sessionwith an extended appeal to move the open-source software industry awayfrom permissive licenses like Apache 2.0 and toward copyleft licenseslike the GPL. Not doing so, he said, puts the FOSS community at justas much risk of collapse as license proliferation threatened to inyears past.
Arch Linux has updated chromium (multiple vulnerabilities) and flashplugin (multiple vulnerabilities).Fedora has updated icu (F22:multiple vulnerabilities), php (F22:multiple vulnerabilities), and xen (F22; F21:denial of service).Mageia has updated flash-player-plugin (multiplevulnerabilities), git (multiplevulnerabilities), openjpeg2 (codeexecution), and qemu (multiple vulnerabilities).openSUSE has updated polkit(13.2, 13.1: multiple vulnerabilities).SUSE has updated flash-player (SLE12; SLE11-SP3,4: multiple vulnerabilities).Ubuntu has updated gdk-pixbuf(15.04, 14.04, 12.04: two vulnerabilities).
There has been a lot of concern recently that a newset of rules [PDF] from theUS Federal Communications Commission (FCC) could lead to locking-down ofhome router devices. It appears that the worst-case scenario feared bymany will not come to pass, but that has not stopped a large, high-profilegroup of developers from putting together a detailed counter-proposalto the FCC that could change the game entirely. Not content with fendingoff the lockdown threat, this group seeks to push the pendulum the otherway by forcing router software to be open. The result, it is said, would be anInternet that performs better and which is much more secure.
The term "bundling" refers to the practice of distributing a copy of onesoftware project (usually some sort of library) within another one.Software developers may have a number of reasons for bundling, but Linux distributors tend to dislike it forreasons of their own. The Fedora project, in particular, has longforbidden bundling except in a few cases where it could not beavoided. It now seems, though, that Fedora has decided to back off a biton its anti-bundling policy — a decision that is not uniformly popular inits development community, but which may well be necessary to help ensurethe distribution's ongoing relevance.
CentOS has updated spice (C7:multiple vulnerabilities) and spice-server(C6: multiple vulnerabilities).Debian has updated kernel (multiple vulnerabilities).Debian-LTS has updated linux-2.6 (multiple vulnerabilities).Fedora has updated openjpeg2(F21: code execution) and php (F21: multiple vulnerabilities).Oracle has updated spice (OL7:multiple vulnerabilities) and spice-server(OL6: multiple vulnerabilities).Red Hat has updated spice (RHEL7:multiple vulnerabilities) and spice-server(RHEL6: multiple vulnerabilities).Scientific Linux has updated spice (SL7: multiple vulnerabilities) and spice-server (SL6: multiple vulnerabilities).SUSE has updated kernel-source(SLE12: multiple vulnerabilities).
Here is anarticle in Slate about the dangers of using closed-source software toprovide evidence in criminal trials. "Because eliminating errorsfrom code is so hard, experts have endorsed openness to public scrutiny asthe surest way to keep software secure. Similarly, requiring the governmentto rely exclusively on open-source forensic tools would crowd-sourcecross-examination of forensic device software. Forensic devicemanufacturers, which sell exclusively to government crime laboratories, maylack incentives to conduct the obsessive quality testing required."
The Electronic Frontier Foundation reportsthat 567 relays from the 2014 Tor Challenge are still up and running—"more than were established during the entire inaugural Tor Challenge back in 2011. To put that number in perspective, these nodes represent more than 8.5% of the roughly 6,500 public relays currently active on the entire Tor network, a system that supports more than 2-million directly connecting clients worldwide."
The fifth 4.3 prepatch is out. "It'sthe usual 'lots of small fixes to drivers and architecture code, with somefilesystem updates thrown in for variety'." This prepatch alsofeatures a change to the kernel codename, which is now "Blurry Fish Butt".
The new version of the WRT1900AC router from Linksys looks like justanother high-end home router, but there is an important difference:"Linksys has collaborated with OpenWrt and Marvell to provide fullopen source support for the WRT1900ACS in OpenWrt's stable and developmentbranches." When asked, the company confirmed that the router isfully supported by free drivers. LWN is not normally filled withnew-product announcements, but, given the pervasive binary-blob problem inthis space, a router with free drivers seems noteworthy.
Arch Linux has updated opensmtpd(multiple vulnerabilities).Fedora has updated 389-ds-base(F21: cipher downgrade), kernel (F22: threevulnerabilities), and qemu (F22 F21: multiple vulnerabilities).openSUSE has updated freetype2(13.1: two vulnerabilities from 2014).Red Hat has updated OpenStackdirector (RHELOSP7: authentication bypass) and python-django (RHELOSP7: denial of service).SUSE has updated firefox(SLE11SP3, SLE11SP4: multiple vulnerabilities).
LWN.net