Security updates have been issued by AlmaLinux (buildah, gvisor-tap-vsock, nodejs:18, python-urllib3, and skopeo), Debian (firefox-esr and openssl), Fedora (apr and seamonkey), Red Hat (podman), Slackware (mozilla and seamonkey), SUSE (bubblewrap and flatpak, buildah, docker, dovecot23, ffmpeg, frr, go1.21-openssl, graphviz, java-1_8_0-openj9, kubernetes1.26, kubernetes1.27, kubernetes1.28, openssl-1_0_0, openssl-3, perl-DBI, python-aiohttp, python-Django, python-WebOb, thunderbird, tiff, ucode-intel, unbound, webkit2gtk3, and xen), and Ubuntu (drupal7 and twisted).
Version130.0 of the Firefox browser has been released. Notable in thisrelease is the addition of a Firefox Labs tab in FirefoxSettings. This allows users to easily enable experimental features,such as the ability to translate selected text portions to differentlanguages after a full-page translation, and addan AI chatbot to the sidebar. Firefox 130 also addresses severalsecurity issues, adds 11 new languages to its translation support,and more.
One of the joys of writing about technology is the opportunity tocover interesting talks on opensource and freesoftware topics. Oneof the pains is creating transcriptions of said talks, or continuallyreferring back to a recording, to be able to write aboutthem. Speech Note is anopen-source application that uses machine-learning models, running locally, totranslate speech to text and take the pain out of transcription. Italso handles text to speech, and language translations. While notperfect, its transcriptions are better than one might expect, even whenhandling jargon, accents, and less-than-perfect audio.
At this year's GUADEC in Denver, Colorado, Behdad Esfahbod and Matthias Clasenpresented a two-part talk on a topic that's deeply important to desktopenvironments: fonts. Esfahbod covered advances in fonttechnology that are making their way to becoming standards, and Clasen brieflydiscussed improvements in GTK text rendering. The talk presented somefascinating insights into the problems around accurately renderingwriting systems on the desktop, and where font technologies may begoing in the near future.
Security updates have been issued by AlmaLinux (postgresql:16), Debian (dovecot, pymatgen, ruby2.7, systemd, and webkit2gtk), Fedora (microcode_ctl, python3.11, vim, and xen), Oracle (kernel, postgresql:12, postgresql:13, postgresql:15, and python39:3.9 and python39-devel:3.9), Slackware (libpcap), SUSE (cacti, cacti-spine, python-Django, and trivy), and Ubuntu (dovecot).
Linus has released 6.11-rc6 for testing."Things look pretty normal, although we have perhaps unusually manyfilesystem fixes here, spread out over smb, xfs, bcachefs and netfs."
Reading an established open-source project's developer mailing listmay leave new contributors wishing they had a decoder ring. GregSabino Mullane has written up a valuable explainerfor those new to the PostgreSQL hackers (pgsql-hackers)mailing list that may also be useful for decoding other lists as well:
Here is a piece of advice for anybody wanting an easy and frustration-freelife: do not run your own email system. While there are numerous advantages tokeeping some control over your communications, there is also a long list ofthings that can go wrong. A recent failure of spam filtering on the LWNemail system illustrated one of those ways, as well as shining a light onhow even a seemingly independent email system is tied to other servicesacross the net.
Back in 2021, the ElasticSearch search engine and Kibana visualizationplatform were relicensed under the non-freeServer Side Public License (SSPL). Now, Elastic (the company owning thoseprojects) has announcedthat those projects will also be distributable under the Affero GPL license.
Security updates have been issued by AlmaLinux (libvpx, postgresql, postgresql:12, postgresql:13, postgresql:15, and python39:3.9 and python39-devel:3.9), Debian (chromium and ghostscript), Fedora (python3.13), and SUSE (chromium and podman).
The KDE project plans to directlyask for donations in the Plasma desktop starting with version6.2. According to thisblog post by Nate Graham, users will see asystem notification once per year (in December) asking for adonation to the non-profit KDEe.V.:
Version 5.0.0 of GNUScreen hasbeen released. Notable changes in this release includenew commands for authentication, input into multiple windows at thesame time, and to turn on/off truecolor support.
Greg Kroah-Hartman has announced the release of the 6.10.7, 6.6.48, and 6.1.107 stable kernels. They all containimportant fixes throughout the kernel tree, as is the norm.
Plasma Mobile is an open-sourceuser interface for mobile devices, developed by the KDE community. It'sbuilt on the same foundations as Plasma Desktop, including KDE Frameworks and the KWin windowmanager. Much like its desktop counterpart, Plasma Mobile caters toadvanced users by offering extensive customizability. It is offered as anoption on phones with various mobile Linuxdistributions.
Security updates have been issued by AlmaLinux (bind and bind-dyndb-ldap and postgresql:16), Fedora (less and python3.6), Mageia (nodejs & yarnpkg), Oracle (libvpx and postgresql:16), Red Hat (edk2, git, kernel, openldap, postgresql:15, postgresql:16, python3, and python39:3.9 and python39-devel:3.9), SUSE (apache2, python-setuptools, and python3-setuptools), and Ubuntu (linux-oracle).
Immutable data makes concurrent access easier, since iteliminates the data-race conditions that can plague multithreaded programs. AtPyCon2024, Yury Selivanovintroduced an early-stage project called MemHive, which uses Pythonsubinterpreters and immutable data toovercome the problems of thread serialization that are caused by thelanguage's Global Interpreter Lock (GIL). Recent developments in the Python world have openedup different strategies for avoiding the longstanding problems with theGIL.
Achieving consensus among Debian Developers on technical topics andprocedures can be, to put it mildly, challenging. Nevertheless, thatis exactly what Otto Kekalainen has tried to do with a proposal thatwould set up "principles all Debian packages should follow to beopen for collaboration in package maintenance". In the near term,it seems unlikely that the proposal will be accepted, but thediscussion may be effective at improving collaboration nonetheless.
Security updates have been issued by Fedora (calibre, dotnet8.0, dovecot, webkit2gtk4.0, and webkitgtk), Oracle (nodejs:20), Red Hat (bind, bind and bind-dyndb-ldap, postgresql:16, and squid), Slackware (kcron and plasma), SUSE (keepalived and webkit2gtk3), and Ubuntu (drupal7).
The Mono project was started in 2001 to develop a .NET environment forLinux systems. Microsoft has owned that project since 2016, but has notmade a major release since 2019. The company has now announced that Mono is beinghanded over to the WineHQ organization, which will maintain the repository goingforward. Microsoft, meanwhile, is steering users toward its "modernfork" that it continues to maintain.
KDE developer Carl Schwan has announcedthe release of Calligra Officeversion 4.0. The most significant changes in this release include a "majoroverhaul" of the office suite's user interface, and a transition to Qt6 and KDEFrameworks6.
Nominations are nowopen for people interested in joining the UbuntuCommunity Council, "the highest governance body of the Ubuntuproject". Any Ubuntu Member canapply from now until Sunday, September 22 at 23:59 UTC.
On August 13, the US National Institute of Standards and Technology (NIST)published the final form of its new post-quantum cryptographic standards. Onekey-exchange mechanism and two digital-signature schemes are now officiallysanctioned by the institute. Adopting the new standards should be fairlypainless for most developers, but the overhead added by the schemes could posechallenges for some applications.
Security updates have been issued by AlmaLinux (nodejs:20), Debian (python3.11), Fedora (dotnet8.0), Red Hat (bind, krb5, libreoffice, linux-firmware, orc, orc:0.4.28, and orc:0.4.31), SUSE (mariadb and openssl-3), and Ubuntu (linux-aws-5.4).
The developers of the Pidgin chat programhave announced thata malicious plugin had been listed on its third-party plugins list for overone month. This plugin included a key logger and could capturescreenshots.
The FreeBSD Foundation has announced that Germany's Sovereign TechFund (STF) has agreed to invest 686,400 toward improvements in theFreeBSD project's infrastructure, security, regulatory compliance, anddeveloper experience:
The genksyms tool has long been buried deeply within the kernel'sbuild system; it is one of the two C-code parsers shipped with the kernel(the other being thehorrifying kernel-doc script). It is a key part of how thekernel's module-loading infrastructure works. While genksyms hasquietly done its job for decades, that period may soon be coming to an end.It would seem that genksyms is not up to the task of handling Rustcode, so Sami Tolvanen is proposinga new tool to handle this task going forward.
The 6.11-rc5 kernel prepatch is out fortesting. "Other than the timing, there's not a whole lot unusualhere. The diffstat looks fairly flat, which means 'mostly pretty smallchanges'." Linus Torvalds added anote that today marks the 33rd anniversary of the first Linuxannouncement; "A third of a century. And it *still* isn't ready".
On the second day of DebConf24in Busan, South Korea, Holger Levsen provided a history lesson on the"first 11 years" of the Reproducible Builds project.He has been involved in the project for most of that time and has been aDebian user since the mid-1990s, contributor since 2001, and a Debianmember since 2007; "I love Debian". Meanwhile, his aim is to make all freesoftware be reproducible, so that anyone can check that a binary programcomes from the source code it purports to.
The Forgejo project has announced that, starting from version 9.0, Forgejo will be released under the GPLv3 license (or a later version). Older versions of the software forge remain MIT-licensed.
Security updates have been issued by Fedora (community-mysql, iaito, and radare2), Oracle (python3.12-setuptools and tomcat), Red Hat (krb5 and podman), Slackware (ffmpeg), SUSE (apache2, expat, firefox, webkit2gtk3, and xen), and Ubuntu (imagemagick and libxstream-java).
Version24.8 of the LibreOffice office suite has been released. Changesinclude the ability to filter identifying information from exported files,easier creation of cross reference, better control over hyphenation, anumber of new spreadsheet functions, accessibility improvements, and more.
On July 30, Al Viro senta patch set to the linux-fsdevel mailing list with acomprehensive cover letter explaining hisrecent work on ensuring that the kernel's internal representation offile descriptors are used correctly in the kernel.File descriptors are ubiquitous; many system callsneed to handle them. Viro's reviewidentified a few existing bugs, and may prevent more in the future. He also hadsuggestions for ways to keep uses consistent throughout the kernel.
Linux installers receive a disproportionate amount of attentioncompared to the amount of time that most users spend with them. Ideally,a user spends only a few minutes using the installer, versus years usingthe distribution after it is installed. Yet, the installer sets thefirst impression, and if it fails to do its job, little else matters.Installers also have to continually evolve to keep pace with newhardware, changes in distribution packaging (such as image-based Linuxdistributions), and so forth. Along those lines, the SUSE team that maintains thevenerable YaST installer hasdecided it's time to start (almost) fresh with a new Linux installerproject, called Agama,for new projects. YaST is not going away as an administration tool,but it is likely to be relieved of installer duties at some point.
Security updates have been issued by Debian (aom, cinder, dovecot, glance, and nova), Fedora (mysql8.0), Oracle (curl and libreoffice), SUSE (oniguruma, openssl-1_0_0, openssl1, and xen), and Ubuntu (cacti, curl, exfatprogs, firefox, and vim).
AtPyCon2024 in Pittsburgh,Pennsylvania, Anthony Shaw looked at the various kinds of parallelismavailable to Python programs. There have been two major developments onthe parallel-execution front over the last few years, with the effort toprovide subinterpreters, each with its ownglobal interpreter lock (GIL), along with the work to remove the GIL entirely. In the talk, heexplored the two approaches to try to give attendees a sense of how to makethe right choice for their applications.
Version 0.3.0 of the uvPython package and project manager has been released. Introduced inFebruary, uv is written in Rust and aims to be "Cargo forPython". Notable changes in this release include the addition ofinterfaces for managing projects, installingPython, and running scripts,along with adding new documentation. See theaccompanying blog post for more information.
One tactic often used by attackers set on compromising a system is heap spraying; inshort, the attacker fills as much of the heap as possible with crafted datain the hope of getting the target system to use that data in a bad way. Ifheap spraying can be blocked, attackers will lose an important tool. Thekernel has some heap-spraying defenses now, including the dedicated bucket allocator merged for theupcoming 6.11 release, but its author, Kees Cook, thinks that more can bedone.
The FreeBSD Project is, for the secondtime this year, engaging in a long-running discussion about thepossibility of including Rust in its basesystem. The sequel to the first discussion included some work byAlan Somers to show what it might look like to use Rust code in thebase tree. Support for Rust code does not appear much closer to beingincluded in FreeBSD's base system, but the conversation has beenenlightening.
LWN.net