Post Syndicated from corbet original https://lwn.net/Articles/933480/
Version
1.70.0 of the Rust language is out. Changes include enabling the
“sparse” protocol for Cargo, a couple of new types for the initialization
of shared data, and more. “You should see substantially improved
”
performance when fetching information from the crates.io index.
Post Syndicated from corbet original https://lwn.net/Articles/933043/
Like most other distributions, the Debian project decided to end the
separation between the root and /usr filesystems years ago.
Unlike most others, though, Debian is still working on the implementation
of this decision. The upcoming Debian 12 (“bookworm”) release will
feature a merged /usr in most respects, but there are a couple of
nagging issues that threaten to stretch this transition out for some time
yet.
Post Syndicated from corbet original https://lwn.net/Articles/932927/
The LWN.net Weekly Edition for June 1, 2023 is available.
Post Syndicated from corbet original https://lwn.net/Articles/932402/
The code-tagging mechanism proposed last
year by Suren Baghdasaryan and Kent Overstreet has been the subject of a
number of (sometimes tense) discussions. That conversation came to the
memory-management track at the 2023 Linux
Storage, Filesystem, Memory-Management and BPF Summit, where its
developers (Baghdasaryan attending in-person and Overstreet remotely) tried
to convince the attendees that its benefits justify its cost.
Post Syndicated from corbet original https://lwn.net/Articles/933380/
David Malcolm writes
about a number of new features that have been added to the static
analyzer in the GCC 13 release.
The above example makes the common mistake with C-style strings of
forgetting the null terminator when computing how much space to
allocate for str.GCC 13’s -fanalyzer option now keeps track of the sizes of
dynamically allocated buffers, and for many cases it checks the
simulated memory reads and writes against the sizes of the relevant
buffers. With this new work it detects the above problem.
Post Syndicated from corbet original https://lwn.net/Articles/933360/
Security updates have been issued by Debian (connman and kamailio), Fedora (texlive-base), Mageia (cups-filters, postgresql, qtbase5, tcpreplay, tomcat, and vim), Slackware (openssl), SUSE (amazon-ssm-agent, cni, cni-plugins, compat-openssl098, installation-images, libaom, openssl, openssl-1_0_0, openssl-1_1, terraform, terraform-provider-helm, tiff, tomcat, and wireshark), and Ubuntu (batik, flask, linux-oem-5.17, linux-oem-6.0, linux-oem-6.1, linux-oracle, linux-oracle-5.4, mozjs102, nanopb, openssl, openssl1.0, snapd, and texlive-bin).
Post Syndicated from corbet original https://lwn.net/Articles/933246/
Security updates have been issued by Debian (libssh and sssd), Fedora (microcode_ctl and python3.6), Gentoo (cgal, firefox firefox-bin, openimageio, squashfs-tools, thunderbird thunderbird-bin, tiff, tomcat, webkit-gtk, and xorg-server xwayland), SUSE (c-ares and go1.18-openssl), and Ubuntu (Jhead, node-hawk, node-nth-check, and perl).
Post Syndicated from corbet original https://lwn.net/Articles/933198/
The Rust community has experienced some turbulence in response to the
cancellation of a keynote talk at the upcoming RustConf event. The
Rust project leadership has now put out a blog post
apologizing for and explaining its role in the event, describing its
“decision-making and communication processes
” as the primary cause
of the failure.
Organizationally, within leadership chat we will enforce a strict
consensus rule for all decision making, so that there is no longer
ambiguity of whether something is an individual opinion or a group
decision. We are going to launch the new governance council as soon
as possible. We’ll assist the remaining teams to select their
representatives in a timely manner, so that the new governance
council can start and the current leadership chat can disband.
Post Syndicated from corbet original https://lwn.net/Articles/933183/
A
series of blog posts from the 2023 Python Language Summit has been
posted; topics covered include the C API, the global interpreter lock,
the standard library, and a talk on burnout from Guido van Rossum:
The first known case of burnout in the field of open-source
software, van Rossum speculated, may have been Charles Babbage, who
gave up the post of Lucasian Professor of Mathematics (the “Chair
of Newton”) at Cambridge University in 1839.
Post Syndicated from corbet original https://lwn.net/Articles/932298/
Certain topics return predictably to development conferences every year,
usually because developers are still struggling to find a viable solution
to a specific problem. One such topic is the lack of scalability in the
kernel’s page-fault-handling code, so it was no surprise to see this
problem on the agenda for the 2023 Linux
Storage, Filesystem, Memory-Management and BPF Summit. Matthew Wilcox
led a session in the memory-management track to discuss the state of
page-fault handling and what can be done to improve it further.
Post Syndicated from corbet original https://lwn.net/Articles/933119/
Niels Provos reflects
on 25 years of experience with Bcrypt and ponders the future of password
security in a ;login article.
Bcrypt’s endurance can be attributed to several other factors
beyond our intentional algorithm design. Its wide availability in
open-source implementations has facilitated widespread adoption and
integration into various systems. According to Wikipedia, there are
implementations of bcrypt in C, C++, C#, Embarcadero Delphi,
Elixir, Go, Java, JavaScript, Perl, PHP, Python, and
Ruby. Moreover, bcrypt’s focus on computational cost scaling makes
it an attractive choice for large Internet services compared to
newer algorithms like Argon2, which also scale in memory
consumption.
Post Syndicated from corbet original https://lwn.net/Articles/933116/
The 6.4-rc4 kernel prepatch is out for
testing, a few hours earlier than usual. “Other than that timing
“.
change, things look fairly normal
Post Syndicated from corbet original https://lwn.net/Articles/932396/
The “vmap area” is a range of kernel address space used when the kernel
needs to virtually map a range of memory; among other things, memory
allocations obtained from vmalloc() and loadable modules are
placed there. At the 2023 Linux Storage,
Filesystem, Memory-Management and BPF Summit, Uladzislau Rezki,
presenting remotely,
explained a performance problem related to the vmap area and discussed
possible solutions.
Post Syndicated from corbet original https://lwn.net/Articles/932391/
The kernel’s memory-management subsystem is optimized for the sharing of
resources to the greatest extent possible. But, as Pasha Tatashin pointed
out during a memory-management session at the 2023 Linux Storage, Filesystem,
Memory-Management and BPF Summit, a lot of memory has a single owner
and will never be shared. He presented some ideas for optimizing the
management of that memory to a somewhat skeptical crowd.
Post Syndicated from corbet original https://lwn.net/Articles/932386/
The conversion to folios is intended to,
among other things, make it easy for the kernel to manage chunks of memory
in a number of different sizes. So far, though, that flexibility is not
being used in the kernel’s handling of anonymous pages. At the 2023 Linux Storage, Filesystem,
Memory-Management and BPF Summit, Yu Zhao and Yang Shi ran a session in
the memory-management track aimed at charting a path toward support for
anonymous pages in a variety of sizes.
Post Syndicated from corbet original https://lwn.net/Articles/932266/
The LWN.net Weekly Edition for May 25, 2023 is available.
Post Syndicated from corbet original https://lwn.net/Articles/932734/
Google has announced
the release of the results of internal audits on a number of rust crates.
You can easily import audits done by Googlers into your own
projects that attest to the properties of many open-source Rust
crates. Then, equipped with this data, you can decide whether
crates meet the security, correctness, and testing requirements for
your projects.
This work uses the cargo vet tool covered here one year ago.
Post Syndicated from corbet original https://lwn.net/Articles/932724/
Bootlin has released
a tool called Snagboot that is intended to help with the recovery of
bricked embedded systems.
Thankfully, most embedded platforms almost always include some form
of recovery via USB or UART, which usually involves sending a boot
image to the platform’s ROM code. A few tools exist that leverage
this functionality to offer quick recovery and reflashing via USB,
such as STM32CubeProgrammer, SAM-BA or UUU. However, these tools
are all vendor-specific, which means that developers working on
various kinds of platforms have to switch between different tools
and learn how to use each one.To address this issue, Bootlin is happy to release today a new
recovery and reflashing tool, called Snagboot.
Post Syndicated from corbet original https://lwn.net/Articles/932721/
The PyPI package archive has removed support
for PGP signatures on packages.
In other words, out of all of the unique keys that had uploaded
signatures to PyPI, only 36% of them were capable of being
meaningfully verified at the time of audit. Even if all of those
signatures uploaded in that 3 year period of time were made by one
of those 36% of keys that are able to be meaningfully verified,
that would still represent only 0.3% of all of those files.Given all of this, the continued support of uploading PGP
signatures to PyPI is no longer defensible.
By continuing to use the site, you agree to the use of cookies. more information
The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.