Linux Weekly News

Subscribe to Linux Weekly News feed
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Updated: 30 min 18 sec ago

Kernel prepatch 4.15-rc8

Sun, 01/14/2018 - 19:17
The 4.15-rc8 kernel prepatch is out for testing. Among other things, it includes the "retpoline" mechanism intended to mitigate variant 2 of the Spectre vulnerability. Testing of this change will be hard, though, since it requires a version of GCC that almost nobody has — watch LWN for a full article in the near future. "I'm still hoping that this will be the last rc, despite all the Meltdown and Spectre hoopla. But we will just have to see, it obviously requires this upcoming week to not come with any huge surprises."

[$] Opening up the GnuBee open NAS system

Fri, 01/12/2018 - 11:37
GnuBee is the brand name for a line of open hardware boards designed to provide Linux-based network-attached storage. Given the success of the crowdfunding campaigns for the first two products, the GB-PC1 and GB-PC2 (which support 2.5 and 3.5 inch drives respectively), there appears to be a market for these devices. Given that Linux is quite good at attaching storage to a network, it seems likely they will perform their core function more than adequately. My initial focus when exploring my GB-PC1 is not the performance but the openness: just how open is it really? The best analogy I can come up with is that of a door with rusty hinges: it can be opened, but doing so requires determination.

Security updates for Friday

Fri, 01/12/2018 - 11:06
Security updates have been issued by Arch Linux (intel-ucode), Debian (gifsicle), Fedora (awstats and kernel), Gentoo (icoutils, pysaml2, and tigervnc), Mageia (dokuwiki and poppler), Oracle (kernel), SUSE (glibc, kernel, microcode_ctl, tiff, and ucode-intel), and Ubuntu (intel-microcode).

Introducing Nextcloud Talk

Thu, 01/11/2018 - 14:02
Nextcloud has announced Nextcloud Talk, a fully open source video meeting software that is on-premise hosted and end-to-end encrypted. "Nextcloud Talk makes it easier than ever to host a privacy-respecting audio/video communication service for home users and enterprises. Business users have optional access to the Spreed High Performance Back-end offering enterprise-class scalability, reliability, and features through a Nextcloud subscription. With the easy-to-use interface, users can engage colleagues, friends, partners or customers, working in real time through High Definition (H265 based) audio and video in web meetings and webinars."

Security updates for Thursday

Thu, 01/11/2018 - 11:13
Security updates have been issued by Arch Linux (glibc and lib32-glibc), Debian (ming and poco), Fedora (electron-cash, electrum, firefox, heketi, microcode_ctl, and python-jsonrpclib), openSUSE (clamav-database and ucode-intel), Red Hat (flash-plugin), SUSE (OBS toolchain), and Ubuntu (webkit2gtk).

[$] LWN.net Weekly Edition for January 11, 2018

Wed, 01/10/2018 - 20:47
The LWN.net Weekly Edition for January 11, 2018 is available.

[$] Eelo seeks to make a privacy-focused phone

Wed, 01/10/2018 - 16:27

A focus on privacy is a key feature being touted by a number of different projects these days—from KDE to Tails to Nextcloud. One of the biggest privacy leaks for most people is their phone, so it is no surprise that there are projects looking to address that as well. A new entrant in that category is eelo, which is a non-profit project aimed at producing not only a phone, but also a suite of web services. All of that could potentially replace the Google or Apple mothership, which tend to collect as much personal data as possible.

A tribute to James Dolan, co-creator of SecureDrop

Wed, 01/10/2018 - 13:20
Freedom of the Press Foundation has a tribute to James Dolan. James worked with Aaron Swartz and journalist Kevin Poulsen to build the original prototype of SecureDrop, an open-source whistleblower submission system. "He was our first full-time employee at Freedom of the Press Foundation, and quickly set out to teach other developers, contributors, and anyone interested in how the system worked. He poured his heart and soul into the work, traveling to newsrooms around North America to teach IT staffs and journalists in person how to install and use SecureDrop. He completely reworked the installation process, he pushed us to get independent security audits of the system, and he helped us hire the initial team that would take over SecureDrop once he was gone." (Thanks to Paul Wise)

Stable kernel updates

Wed, 01/10/2018 - 11:10
Greg Kroah-Hartman has released stable kernels 4.14.13, 4.9.76, and 4.4.111. As usual, they all contain important fixes and users should update.

Security updates for Wednesday

Wed, 01/10/2018 - 11:02
Security updates have been issued by Debian (awstats, gdk-pixbuf, plexus-utils, and plexus-utils2), Fedora (asterisk, gimp, heimdal, libexif, linux-firmware, mupdf, poppler, thunderbird, webkitgtk4, wireshark, and xrdp), openSUSE (diffoscope, irssi, and qemu), SUSE (java-1_7_0-ibm, kernel-firmware, and qemu), and Ubuntu (irssi, kernel, linux, linux-aws, linux-euclid, linux-kvm, linux-hwe, linux-azure, linux-gcp, linux-oem, linux-lts-trusty, linux-lts-xenial, linux-lts-xenial, linux-aws, linux-raspi2, ruby1.9.1, ruby2.3, and sssd).

notmuch release 0.26 now available

Wed, 01/10/2018 - 09:40
Version 0.26 of the notmuch email client/indexer is available with a long list of new features. "It's now possible to include the cleartext of encrypted e-mails in the notmuch index. This makes it possible to search your encrypted e-mails with the same ease as searching cleartext."

O'Callahan: The Fight For Patent-Unencumbered Media Codecs Is Nearly Won

Wed, 01/10/2018 - 08:33
Robert O'Callahan notes an important development in the fight for media codecs without patent issues. "Apple joining the Alliance for Open Media is a really big deal. Now all the most powerful tech companies — Google, Microsoft, Apple, Mozilla, Facebook, Amazon, Intel, AMD, ARM, Nvidia — plus content providers like Netflix and Hulu are on board. I guess there's still no guarantee Apple products will support AV1, but it would seem pointless for Apple to join AOM if they're not going to use it: apparently AOM membership obliges Apple to provide a royalty-free license to any 'essential patents' it holds for AV1 usage."

[$] A look at the handling of Meltdown and Spectre

Tue, 01/09/2018 - 18:15

The Meltdown/Spectre debacle has, deservedly, reached the mainstream press and, likely, most of the public that has even a remote interest in computers and security. It only took a day or so from the accelerated disclosure date of January 3—it was originally scheduled for January 9—before the bugs were making big headlines. But Spectre has been known for at least six months and Meltdown for nearly as long—at least to some in the industry. Others that were affected were completely blindsided by the announcements and have joined the scramble to mitigate these hardware bugs before they bite users. Whatever else can be said about Meltdown and Spectre, the handling (or, in truth, mishandling) of this whole incident has been a horrific failure.

Tails 3.4 is out

Tue, 01/09/2018 - 17:26
The privacy focused Tails distribution has released version 3.4. This released updates the kernel to 4.14.12 to include the latest Meltdown and Spectre patches. Many other security issues have been fixed in this release, and users should upgrade.

[$] A new kernel polling interface

Tue, 01/09/2018 - 16:56
Polling a set of file descriptors to see which ones can perform I/O without blocking is a useful thing to do — so useful that the kernel provides three different system calls (select(), poll(), and epoll_wait() — plus some variants) to perform it. But sometimes three is not enough; there is now a proposal circulating for a fourth kernel polling interface. As is usually the case, the motivation for this change is performance.

Security updates for Tuesday

Tue, 01/09/2018 - 11:24
Security updates have been issued by Arch Linux (graphicsmagick and linux-lts), CentOS (thunderbird), Debian (kernel, opencv, php5, and php7.0), Fedora (electrum), Gentoo (libXfont), openSUSE (gimp, java-1_7_0-openjdk, and libvorbis), Oracle (thunderbird), Slackware (irssi), SUSE (kernel, kernel-firmware, and kvm), and Ubuntu (awstats, nvidia-graphics-drivers-384, python-pysaml2, and tomcat7, tomcat8).

[$] Is it time for open processors?

Tue, 01/09/2018 - 09:32
The disclosure of the Meltdown and Spectre vulnerabilities has brought a new level of attention to the security bugs that can lurk at the hardware level. Massive amounts of work have gone into improving the (still poor) security of our software, but all of that is in vain if the hardware gives away the game. The CPUs that we run in our systems are highly proprietary and have been shown to contain unpleasant surprises (the Intel management engine, for example). It is thus natural to wonder whether it is time to make a move to open-source hardware, much like we have done with our software. Such a move may well be possible, and it would certainly offer some benefits, but it would be no panacea.

MusE 3.0.0 released

Mon, 01/08/2018 - 13:00
Three years after the last stable release, version 3.0 of the MusE MIDI/Audio sequencer is now available. As you might expect there many changes since the last release including a switch to Qt5, a new Plugin Path editor in Global Settings, a mixer makeover with lots of fixes, a system-wide move to double precision of all audio paths, and much more.

Security updates for Monday

Mon, 01/08/2018 - 10:59
Security updates have been issued by Arch Linux (linux-hardened, linux-lts, linux-zen, and mongodb), Debian (gdk-pixbuf, gifsicle, graphicsmagick, kernel, and poppler), Fedora (dracut, electron-cash, and firefox), Gentoo (backintime, binutils, chromium, emacs, libXcursor, miniupnpc, openssh, optipng, and webkit-gtk), Mageia (kernel, kernel-linus, kernel-tmb, openafs, and python-mistune), openSUSE (clamav-database, ImageMagick, kernel-firmware, nodejs4, and qemu), Red Hat (linux-firmware, ovirt-guest-agent-docker, qemu-kvm-rhev, redhat-virtualization-host, rhev-hypervisor7, rhvm-appliance, thunderbird, and vdsm), Scientific Linux (thunderbird), SUSE (kernel and qemu), and Ubuntu (firefox and poppler).

Kernel prepatch 4.15-rc7

Sun, 01/07/2018 - 22:47
Linus has released the 4.15-rc7 kernel prepatch. "Ok, we had an interesting week, and by now everybody knows why we were merging all those odd x86 page table isolation patches without following all of the normal release timing rules. But rc7 itself is actually pretty calm. "

Pages