All posts by corbet

[$] An update on the scraper situation

Post Syndicated from corbet original https://lwn.net/Articles/1080822/

Our article “Fighting the AI scraper bot
scourge“, published in early 2025, discussed the problem of widespread
scraping of web sites in search of training data for large language models
and related projects. This activity overwhelms sites with traffic. Over a
year after that article is published, the problem is still growing. The
hammering of sites by shadowy actors has reached new heights, and the open
web is becoming increasingly difficult to maintain. Where is this traffic
coming from, and what can be done about it?

Security updates for Friday

Post Syndicated from corbet original https://lwn.net/Articles/1082272/

Security updates have been issued by AlmaLinux (aardvark-dns, cups, edk2, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, kernel, libsolv, libtasn1, libxml2, nginx:1.24, nginx:1.26, oci-seccomp-bpf-hook, python-urllib3, and tomcat), Debian (rlottie), Fedora (c-ares, k9s, kind, libXfont2, nmap, pam, perl-DBI, php, python-pendulum, tmux, and xorg-x11-server-Xwayland), Mageia (7zip and ack), Slackware (tigervnc), SUSE (alloy, cargo-c, chromium, clamav, cosign, dirmngr, firefox, flannel, fluidsynth, gnutls, go1.25, go1.26, gol, GraphicsMagick, helm, kernel-devel, libaom, libexif, openQA, os-autoinst, python-Django, python-idna, python-sqlparse, rust-keylime, rustup, sccache, SUSE Manager Client Tools, SUSE_Multi-Linux_Manager Client Tools, transmission, and warewulf4), and Ubuntu (curl, expat, golang-go.crypto, libheif, libidn, libraw, libsoup2.4, linux, linux-azure-4.15, linux-azure-fips, linux-fips, linux-gcp-4.15, linux-gcp-fips, linux-kvm, linux-oracle, linux-aws, linux-aws-fips, linux-azure-fips, linux-fips, linux-raspi, linux-xilinx-zynqmp, and python2.7, python3.5).

Security updates for Thursday

Post Syndicated from corbet original https://lwn.net/Articles/1082030/

Security updates have been issued by AlmaLinux (389-ds-base, aardvark-dns, buildah, compat-openssl10, freeipmi, frr, gnutls, grafana, grafana-pcp, kernel, kernel-rt, libyang, nginx, openexr, pcs, perl-HTTP-Daemon, postgresql:18, python3.14-pip, skopeo, tomcat9, and wireshark), Debian (chromium and pgextwlist), Fedora (openssh, opkssh, perl-CSS-Minifier-XS, python-jiter, python-nh3, python-pendulum, rust-jiter, and upower), Mageia (openvpn and vips), Oracle (389-ds-base, aardvark-dns, compat-openssl10, container-tools:ol8, freeipmi, kernel, libyang, perl-HTTP-Daemon, python3.14-pip, and skopeo), Slackware (libXfont2, proftpd, and xorg-server), SUSE (alloy, apache2, apptainer, assimp, chromium, clamav, docker, docker-compose, dracut, glib-networking, go-sendxmpp, go1.26-openssl, gstreamer-plugins-good, haproxy, hauler, jackson-annotations, jackson-bom, jackson-core, jackson- databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent, kernel, krb5, kubevirt, libslirp, libXfont2, mpv, libkpipewirerecord6, ffmpegthumbs-kf5, netty, netty-tcnative, openqa, os-autoinst, podman, python-maturin, python-msgpack, python313-yt-dlp, radare2, rust-keylime, systemd, systemd, systemd-mini, tomcat11, trivy, xorg-x11-server, and xwayland), and Ubuntu (apache2, clamav, linux-raspi, and mailcap).

Security updates for Wednesday

Post Syndicated from corbet original https://lwn.net/Articles/1081798/

Security updates have been issued by AlmaLinux (container-tools:rhel8, kernel-rt, libreoffice, nodejs:22, nodejs:24, opentelemetry-collector, perl-HTTP-Daemon, and python-markdown), Debian (dpkg, imagemagick, and postfix), Fedora (betterleaks, docker-compose, firefox, helm, perl-Compress-Raw-Bzip2, perl-IO-Compress, perl-JavaScript-Minifier-XS, python-cramjam, python-fastar, python-pillow-jxl-plugin, python-rignore, and tor), Oracle (grafana, grafana-pcp, and ruby:4.0), Slackware (tftp), SUSE (gi-docgen, glibc, helm, helm3, json-c-devel, kubevirt-1.6, librpmbuild10, python313-dulwich, python313-lxml_html_clean, python313-openapi-spec-validator, and sdbootutil), and Ubuntu (ruby-addressable).

[$] The kernel’s iomap layer

Post Syndicated from corbet original https://lwn.net/Articles/1079415/

Conversations about the kernel’s filesystem implementations often involve a
layer called “iomap”, but relatively few people can reliably say what iomap
actually is. That is just the kind of gap that LWN exists to fill. In
short, iomap handles the mapping between data in the filesystem space
(identified by a file of interest, and an offset within that file) and in
the storage space (which may be a memory location, or a set of blocks on a
storage device). Using that mapping, iomap handles a long list of common,
filesystem-related tasks, allowing a lot of boilerplate code to be removed
from individual filesystem implementations.

[$] Two LLM-assisted memory-management patch sets

Post Syndicated from corbet original https://lwn.net/Articles/1080162/

The kernel community (like many other free-software projects) has recently
seen a large influx of patches developed with the assistance of large
language models (LLMs). Those patches tend to come from developers who
were previously unknown to the community. At the moment, though, the
memory-management developers are evaluating two large patch sets, developed
with LLM assistance, that were submitted by established and well-respected
developers. The rather different reception accorded to that work may give
insights into how LLM-generated contributions will be handled going
forward.

[$] The rest of the 7.2 merge window

Post Syndicated from corbet original https://lwn.net/Articles/1078539/

Linus Torvalds released 7.2-rc1
and closed the 7.2 merge window on June 28; by that time, 13,412
non-merge commits had found their way into the mainline. That makes this
the busiest merge window since the 6.7 development cycle in 2024 (15,418
commits, including 2,800 for the entire bcachefs development history).
Just under half of those commits arrived after LWN’s summary of the first half of the merge
window was written. As usual, the commits in the latter part of the
merge window were more heavily focused on fixes, but there were still a lot
of new features and significant changes merged as well.

[$] Reports from OSPM 2026, day three

Post Syndicated from corbet original https://lwn.net/Articles/1078697/

The Power Management
and Scheduling in the Linux Kernel Summit, which still goes by the
historical acronym OSPM, was held in Cambridge, UK, in mid-April. As has
become traditional, the presenters at that event have since written
summaries of their sessions, and this work has kindly been made available
to LWN for publication. The third day’s sessions covered a wide range of
topics, including GPU affinity, profile-guided scheduling,
paravirtualization scheduling, quality of service, and more.

[$] What’s coming in Git 2.55

Post Syndicated from corbet original https://lwn.net/Articles/1079596/

The Git v2.55.0-rc2
testing release appeared on June 23, suggesting that the final Git
2.55 release can be expected in the near future. While this Git update
lacks radical new features, it does include a number of improvements that
regular Git users will appreciate, including commands to easily edit the
commit history, more formatting options, fsmonitor support for Linux, and
more.

The “Akrites” vulnerability-mitigation project launches

Post Syndicated from corbet original https://lwn.net/Articles/1079657/

The Linux Foundation, in a
letter co-signed by a large range of organizations and companies, has
announced the launch of “Akrites”, a project to fast-track vulnerability
fixes into projects.

As Akrites works upstream to fix projects at the source, we commit
to support downstream efforts to secure critical infrastructure
before it can be exploited. When patches are released to the
public, adversaries are able to utilize AI to rapidly reverse
engineer the underlying vulnerabilities, develop exploits, and
launch attacks. The success of our efforts therefore will be
measured in patch deployment, not publication. We will partner with
critical infrastructure owners and operators, civil society
efforts, and governments as they increase coordination to achieve
these goals.

Confidentiality is non-negotiable: An undisclosed flaw in a widely
deployed package is, in effect, a weapon, and the program is built
first to prevent leaks. Fixes flow back into each project’s own
home, working with the maintainers. The engineering resources and
other capabilities provided by Akrites participants contribute to
this effort. Additionally, when a critical package has no one
maintaining it, Akrites will stand as the maintainer of last resort
so a fix can still reach everyone in a timely fashion. We will also
align with government efforts so that public and private defenders
move together, rather than in a disjointed fashion.

[$] Hardening the kernel with allocation tokens and bootpatch-SLR

Post Syndicated from corbet original https://lwn.net/Articles/1078699/

There is a lot of work going into eliminating exploitable bugs from the
kernel and preventing the addition of new ones. Even if this work is
maximally successful, though, there is no chance that the kernel will be
free of these bugs anytime soon. Thus, there is also ongoing interest in
hardening the kernel to make the existing bugs more difficult to exploit.
The upcoming 7.2 kernel release will include a change to how dynamically
allocated structures are placed in memory to make them harder to overwrite,
while a project to randomize structure layout at boot time has a rather
longer timeline.

[$] Reports from OSPM 2026, day two

Post Syndicated from corbet original https://lwn.net/Articles/1078696/

The Power Management
and Scheduling in the Linux Kernel Summit, which still goes by the
historical acronym OSPM, was held in Cambridge, UK, in mid-April. As has
become traditional, the presenters at that event have since written
summaries of their sessions, and this work has kindly been made available
to LWN for publication. The second day’s sessions covered a wide range of
topics, including device frequency scaling, using time-slice duration for
CPU selection, scheduling domains on multi-cluster Arm systems, the LAVD
scheduler, and more.

[$] Reports from OSPM 2026, day one

Post Syndicated from corbet original https://lwn.net/Articles/1077759/

The Power Management
and Scheduling in the Linux Kernel Summit, which still goes by the
historical acronym OSPM, was held in Cambridge, UK, in mid-April. As has
become traditional, the presenters at that event have since written
summaries of their sessions, and this work has kindly been made available
to LWN for publication. The first day’s sessions covered a wide range of
topics, including idle-state selection, user-space schedulers with
sched_ext, lock-holder preemption, and much more.