All posts by corbet

Huston: Revisiting time

Post Syndicated from corbet original https://lwn.net/Articles/1061930/

Geoff Huston looks at the network
time protocol, and efforts to secure it, in detail.

NTP operates in the clear, and it is often the case that the
servers used by a client are not local. This provides an
opportunity for an adversary to disrupt an NTP session, by
masquerading as a NTP server, or altering NTP payloads in an effort
to disrupt a client’s time-of-day clock. Many application-level
protocols are time sensitive, including TLS, HTTPS, DNSSEC and
NFS. Most Cloud applications rely on a coordinated time to
determine the most recent version of a data object. Disrupting time
can cause significant chaos in distributed network environments.

While it can be relatively straightforward to secure a TCP-based
protocol by adding an initial TLS handshake and operating a TLS
shim between TCP and the application traffic, it’s not so
straightforward to use TLS in place of a UDP-based protocol for
NTP. TLS can add significant jitter to the packet exchange. Where
the privacy of the UDP payload is essential, then DTLS might
conceivably be considered, but in the case of NTP the privacy of
the timestamps is not essential, but the veracity and authenticity
of the server is important.

NTS, a secured version of NTP, is designed to address this
requirement relating to the veracity and authenticity of packets
passed from a NTS server to an NTS client. The protocol adds a NTS
Key Establishment protocol (NTS-KE) in additional to a conventional
NTPv4 UDP packet exchange (RFC 8915).

A GitHub Issue Title Compromised 4,000 Developer Machines (grith.ai)

Post Syndicated from corbet original https://lwn.net/Articles/1061548/

The grith.ai blog reports
on an LLM prompt-injection vulnerability that led to 4,000 installations of
a compromised version of the Cline utility.

For the next eight hours, every developer who installed or updated
Cline got OpenClaw – a separate AI agent with full system access –
installed globally on their machine without consent. Approximately
4,000 downloads occurred before the package was pulled.

The interesting part is not the payload. It is how the attacker got
the npm token in the first place: by injecting a prompt into a
GitHub issue title, which an AI triage bot read, interpreted as an
instruction, and executed.

[$] The relicensing of chardet

Post Syndicated from corbet original https://lwn.net/Articles/1061534/

Chardet
is a Python module that attempts to determine which character set was used
to encode a text string. It was originally written by Mark Pilgrim, who is
also the author of a number of Python books; the 1.0 release happened in
2006. For many years, this module has been under the maintainership of
Dan Blanchard. Chardet has always been licensed under the LGPL, but, with
the 7.0.0
release, Blanchard changed the terms to the permissive MIT license.
That has led to an extensive (and ongoing) discussion on when code can be
relicensed against the wishes of its original author, and whether using a
large language model to rewrite code is a legitimate way to strip copyleft
requirements from code.

[$] Reconsidering the multi-generational LRU

Post Syndicated from corbet original https://lwn.net/Articles/1060967/

The multi-generational LRU (MGLRU) is an
alternative memory-management algorithm that was merged for the 6.1 kernel
in late 2022. It brought a promise of much-improved performance and
simplified code. Since then, though, progress on MGLRU has stalled, and it
still is not enabled on many systems. As the 2026 Linux Storage,
Filesystem, Memory-Management and BPF Summit (LSFMM+BPF) approaches,
several memory-management developers have indicated a desire to talk about
the future of MGLRU. While some developers are looking for ways to improve
the subsystem, another has called for it to be removed entirely.

CBP Tapped Into the Online Advertising Ecosystem To Track Peoples’ Movements (404 Media)

Post Syndicated from corbet original https://lwn.net/Articles/1061085/

This
404 Media article looks at how the US Customs and Border Protection
agency (CBP) is using location data from phones to track the location of
people of interest.

Specifically, CBP says the data was in part sourced via real-time
bidding, or RTB. Whenever an advertisement is displayed inside an
app, a near instantaneous bidding process happens with companies
vying to have their advert served to a certain demographic. A side
effect of this is that surveillance firms, or rogue advertising
companies working on their behalf, can observe this process and
siphon information about mobile phones, including their
location. All of this is essentially invisible to an ordinary phone
user, but happens constantly.

We should note that the minimal advertising shown on LWN is not delivered
via this bidding system.

Garrett: To update blobs or not to update blobs

Post Syndicated from corbet original https://lwn.net/Articles/1061048/

Matthew Garrett examines
the factors that go into the decision about whether to install a
firmware update or not.

I trust my CPU vendor. I don’t trust my CPU vendor because I want
to, I trust my CPU vendor because I have no choice. I don’t think
it’s likely that my CPU vendor has designed a CPU that identifies
when I’m generating cryptographic keys and biases the RNG output so
my keys are significantly weaker than they look, but it’s not
literally impossible. I generate keys on it anyway, because what
choice do I have? At some point I will buy a new laptop because
Electron will no longer fit in 32GB of RAM and I will have to make
the same affirmation of trust, because the alternative is that I
just don’t have a computer.

[$] The ongoing quest for atomic buffered writes

Post Syndicated from corbet original https://lwn.net/Articles/1060063/

There are many applications that need to be able to write multi-block
chunks of data to disk with the assurance that the operation will either
complete successfully or fail altogether — that the write will not be
partially completed (or “torn”), in other words. For years, kernel
developers have worked on providing atomic writes as a way of satisfying
that need; see, for example, sessions from the Linux Storage, Filesystem,
Memory Management, and BPF (LSFMM+BPF) Summit from 2023, 2024,
and 2025 (twice). While atomic direct I/O is now supported by some filesystems, atomic
buffered I/O still is not. Filling
that gap seems certain to be a 2026 LSFMM+BPF topic but, thanks to an early
discussion, the shape of a solution might already be coming into focus.

Høiland-Jørgensen: The inner workings of TCP zero-copy

Post Syndicated from corbet original https://lwn.net/Articles/1060953/

Toke Høiland-Jørgensen has posted an
overview of how zero-copy networking works in the Linux kernel.

Since the memory is being copied directly from userspace to the
network device, the userspace application has to keep it around
unmodified, until it has finished sending. The sendmsg()
syscall itself is asynchronous, and will return without waiting for
this. Instead, once the memory buffers are no longer needed by the
stack, the kernel will return a notification to userspace that the
buffers can be reused.

Motorola announces a partnership with the GrapheneOS Foundation

Post Syndicated from corbet original https://lwn.net/Articles/1060913/

Motorola has announced
that it will be working with the GrapheneOS Foundation, a producer of a
security-enhanced Android distribution. “Together, Motorola and the
GrapheneOS Foundation will work to strengthen smartphone security and
collaborate on future devices engineered with GrapheneOS
compatibility.“. LWN looked at
GrapheneOS last July.

[$] IIIF: images and visual presentations for the web

Post Syndicated from corbet original https://lwn.net/Articles/1059565/

The International Image Interoperability
Framework, or IIIF (“triple-eye eff”), is a small set of standards that
form a basis for serving, displaying, and reusing image data on the web. It
consists of a number of API definitions that compose with each other to
achieve a standard for providing, for example, presentations of
high-resolution images at multiple zoom levels, as well as bundling multiple images
together. Presentations may include metadata about details like authorship,
dates, references to other representations of the same work, copyright
information, bibliographic identifiers, etc. Presentations can be further
grouped into collections, and metadata can be added in the form of
transcriptions, annotations, or captions. IIIF is most popular with
cultural-heritage organizations, such as libraries, universities, and
archives.

Restarting LibreOffice Online

Post Syndicated from corbet original https://lwn.net/Articles/1060087/

LibreOffice online is a web-based version of the LibreOffice suite that can
be hosted on anybody’s infrastructure. This project was put into stasis back in 2022, a move marked by
some tension with Collabora, a major LibreOffice developer that has its own online offering. Now,
the Document Foundation has announced
a new effort to breathe life into this project.

We plan to reopen the repository for LibreOffice Online at The
Document Foundation for contributions, but provide warnings about
the state of the repository until TDF’s team agrees that it’s safe
and usable – while at the same time encourage the community to join
in with code, technologies and other contributions that can be used
to move forward.

Meanwhile, this
post from Michael Meeks suggests that the tension around online
versions of LibreOffice has not abated.

[$] As ye clone(), so shall ye AUTOREAP

Post Syndicated from corbet original https://lwn.net/Articles/1059673/

The facilities provided by the kernel for the management of processes have
evolved considerably in the last few years, driven mostly by the advent of
the pidfd API. A pidfd is a file
descriptor that refers to a process; unlike a process ID, a pidfd is an
unambiguous handle for a process; that makes it a safer, more deterministic
way of operating on processes. Christian Brauner, who has driven much of
the pidfd-related work, is proposing
two new flags for the clone3()
system call, one of which changes the kernel’s security model in a
somewhat controversial way.

GNU Octave 11.1.0 released

Post Syndicated from corbet original https://lwn.net/Articles/1059965/

Version
11.1.0 of the GNU Octave scientific programming language has been
released.

This major release contains many new and improved functions. Among
other things, it brings better support for classdef objects and
arrays, broadcasting for special matrix types (like sparse,
diagonal, or permutation matrices), updates for Matlab
compatibility (notably support for the nanflag, vecdim and other
parameters for many basic math and statistics functions), and
performance improvements in many functions.

See the release notes for
details.

The Ladybird browser project shifts to Rust

Post Syndicated from corbet original https://lwn.net/Articles/1059812/

The Ladybird browser project has announced a move to
the Rust programming language:

When we originally evaluated Rust back in 2024, we rejected it
because it’s not great at C++ style OOP. The web platform object
model inherits a lot of 1990s OOP flavor, with garbage collection,
deep inheritance hierarchies, and so on. Rust’s ownership model is
not a natural fit for that.

But after another year of treading water, it’s time to make the
pragmatic choice. Rust has the ecosystem and the safety guarantees
we need. Both Firefox and Chromium have already begun introducing
Rust into their codebases, and we think it’s the right choice for
Ladybird too.

Large language models are being used to translate existing code.