Post Syndicated from daroc original https://lwn.net/Articles/999102/

Security updates have been issued by Debian (postgresql-13, postgresql-15, and webkit2gtk), Fedora (libsndfile, microcode_ctl, and trafficserver), Mageia (kanboard, kernel, kmod-xtables-addons, kmod-virtualbox, and bluez, kernel-linus, opendmarc, and radare2), Oracle (.NET 9.0, bubblewrap and flatpak, buildah, expat, firefox, grafana, grafana-pcp, kernel, krb5, libsoup, libvpx, NetworkManager-libreswan, openexr, pcp, python3.11, python3.11-urllib3, python3.12, python3.9, squid, thunderbird, tigervnc, and webkit2gtk3), Red Hat (.NET 9.0, binutils, expat, grafana-pcp, kernel, libsoup, NetworkManager-libreswan, openexr, python3.11, python3.12, python39:3.9, squid, tigervnc, and webkit2gtk3), SUSE (chromedriver, cobbler, govulncheck-vulndb, and icinga2), and Ubuntu (linux-lowlatency, linux-lowlatency-hwe-6.8, python2.7, and zbar).

Post Syndicated from daroc original https://lwn.net/Articles/998856/

CHICKEN Scheme, a portable Scheme compiler, is gearing up for its next major release. Maintainer Felix Winkelmann has
shared

an article about what changes to expect in version 6 of the language, including better Unicode support and support for the

R7RS (small) Scheme standard.

Every major release is a chance of fixing long-standing problems with the codebase and address bad design decisions. CHICKEN is now nearly 25 years old and we had many major overhauls of the system. Sometimes these caused a lot of pain, but still we always try to improve things and hopefully make it more enjoyable and practical for our users. There are places in the code that are messy, too complex, or that require cleanup or rewrite, always sitting there waiting to be addressed. On the other hand CHICKEN has been relatively stable compared to many other language implementations and has a priceless community of users that help us improving it. Our users never stop reminding us of what could be better, where the shortcomings are, where things are hard to use or inefficient.

Post Syndicated from daroc original https://lwn.net/Articles/998854/

Security updates have been issued by Debian (guix, libmodule-scandeps-perl, needrestart, and thunderbird), SUSE (gh), and Ubuntu (kernel, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp,
linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux, linux-aws, linux-gcp, linux-gcp-6.8, linux-gke, linux-hwe-6.8,
linux-ibm, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency,
linux-oem-6.8, linux-oracle, linux-raspi, linux-iot, linux-lowlatency, linux-lowlatency-hwe-6.8, needrestart, python2.7, python3.10, python3.12, python3.8, and Waitress).

Post Syndicated from daroc original https://lwn.net/Articles/998291/

Security updates have been issued by Debian (curl and unbound), Fedora (krb5 and microcode_ctl), Red Hat (kernel and kernel-rt), SUSE (glib2, python3-wxPython, and ucode-intel), and Ubuntu (golang-1.17, golang-1.18, libgd2, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-gke, linux-raspi, linux-raspi, linux-raspi-5.4, and php7.0, php7.2).

Post Syndicated from daroc original https://lwn.net/Articles/997238/

Programming language polyglots are files that are valid
programs in multiple languages, and do different things in each. While polyglots are normally
nothing more than a curiosity, the

Cosmopolitan Libc project has been trying
to put them to a novel use: producing native, multi-platform binaries that
run directly on several operating systems and architectures. There are still
some rough edges with the project’s approach, but it is generally possible to
build C programs into a polyglot format with with minimal
tweaking.

Post Syndicated from daroc original https://lwn.net/Articles/996720/

Back In Time is a GPL-2.0-licensed backup tool based on

rsync and written in Python. It has both graphical and command-line interfaces, and
supports backups to local disks or over SSH.
Back In Time was originally written by
Oprea Dan and released in 2009. The tool has been
through some rough patches over the years, and is currently on its third set of
maintainers. Christian Buhtz, one of the current maintainers, explained to me
how he and his co-maintainers had revived the project, as well as why he thought
Back In Time stood out from all of the existing backup solutions.

Post Syndicated from daroc original https://lwn.net/Articles/997525/

Greg Kroah-Hartman has shared another seven stable kernel updates:
6.6.60,
6.11.7,
6.1.116,
5.15.171,
5.10.229,
5.4.285, and
4.19.323.

Post Syndicated from daroc original https://lwn.net/Articles/997480/

Security updates have been issued by AlmaLinux (edk2), Debian (webkit2gtk), Fedora (thunderbird), Oracle (bzip2, container-tools:ol8, edk2, go-toolset:ol8, libtiff, python-idna, python3.11, and python3.12), Slackware (expat), and SUSE (apache2, govulncheck-vulndb, grub2, java-1_8_0-openjdk, python3, python39, qemu, xorg-x11-server, and xwayland).

Post Syndicated from daroc original https://lwn.net/Articles/996329/

Image-based Linux distributions have seen increasing popularity, recently. They
promise reliability and security, but pose packaging problems for
existing distributions. Ryan Lahfa and Niklas Sturm spoke about the work that
NixOS has done to enable an image-based workflow at this year’s

All Systems Go!
conference in Berlin.
Unfortunately, LWN was not able to cover the conference for scheduling reasons,
but the

videos of the event are available for anyone interested in watching the
talks.
Lahfa and Sturm explained that it is currently possible to create a

NixOS system that
cryptographically verifies the kernel, initrd, and Nix store on boot — although
doing so still has some rough edges. Making an image-based NixOS installation is
similarly possible.

Post Syndicated from daroc original https://lwn.net/Articles/995814/

Joshua Liebow-Feeser took to the stage at
RustConf to describe the methodology
that his team uses to encode
arbitrary constraints in the Rust type system when working on the

Fuchsia operating system
(slides).
The technique is not unknown to
the Rust community, but Liebow-Feeser did a good job of both explaining the
method and making a case for why it should be used more widely.

Post Syndicated from daroc original https://lwn.net/Articles/996687/

Greg Kroah-Hartman has released another four stable Linux kernel updates:
6.11.6,
6.6.59,
6.1.115, and
5.15.170.

Post Syndicated from daroc original https://lwn.net/Articles/996679/

Security updates have been issued by Debian (firefox-esr), Fedora (xorg-x11-server-Xwayland), Oracle (buildah, e2fsprogs, grafana, kernel, and mod_http2), Red Hat (buildah, container-tools:rhel8, firefox, grafana, grafana:7.3.6, podman, and thunderbird), SUSE (alloy, cargo-audit-advisory-db-20241030, chromedriver, corepack22, netty, openvpn, python310-Werkzeug, thunderbird, uwsgi, and xsd), and Ubuntu (linux, linux-azure-6.8, linux-gcp-6.8, linux-hwe-6.8 and linux, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4).

Post Syndicated from daroc original https://lwn.net/Articles/996216/

Mozilla has
announced the release of a new version of Firefox. This version has the usual mix of

security fixes and new features, as well as a handful of deprecations. The release removes support for HTTP/2 Push, but adds hardware acceleration for SVGs, support for wide color gamuts on more platforms, and restores support for remote debugging via USB.

Post Syndicated from daroc original https://lwn.net/Articles/995276/

The first program that Martin Pool ever wrote, he said, had bugs; the ones he’s writing
now most likely have bugs too. The talk Pool gave at
RustConf this year was about a way to try
to write programs with fewer bugs. He has developed a tool called

cargo-mutants that highlights gaps in test coverage by identifying
functions that can be broken without causing any tests to fail.
This can be a valuable complement to other testing techniques,
he explained.

Post Syndicated from daroc original https://lwn.net/Articles/996196/

Security updates have been issued by Debian (exim4) and SUSE (chromium, openssl-1_1, and openssl-3).

Post Syndicated from daroc original https://lwn.net/Articles/995125/

Sparrow Li presented virtually at

RustConf 2024 about the current state of and
future plans for the Rust compiler’s performance. The compiler is relatively slow to compile
large programs, although it has been getting better over time. The next big
performance improvement to come will be parallelizing the compiler’s parsing,
type-checking, and related operations, but even after that, the project has
several avenues left to explore.

Post Syndicated from daroc original https://lwn.net/Articles/995768/

Security updates have been issued by Debian (distro-info-data), Fedora (libtiff), Mageia (firefox and oath-toolkit), Red Hat (krb5), and SUSE (openssl-1_1).

Post Syndicated from daroc original https://lwn.net/Articles/994334/

Currently in Rust, there is no efficient and safe way to turn an array of bytes
into a structure that corresponds to the array. Changing that was the topic of
Jack Wrenn’s talk this year at

RustConf:

“Safety Goggles for Alchemists”. The goal is to be able to “transmute” —
Rust’s name for this kind of conversion — values into arbitrary user-defined
types in a safer way. Wrenn justified the approach that the project has taken to
accomplish this, and spoke about the future work required to stabilize it.

Post Syndicated from daroc original https://lwn.net/Articles/994704/

The Image-Based Linux Summit has by now established itself as a yearly event.
Following on from last year’s edition,
the third edition was held in Berlin on September 24, the
day before

All Systems Go! 2024 (ASG). The purpose of this event is to gather
stakeholders from various engineering groups and hold friendly but lively
discussions around the topic of image-based Linux — that is, Linux distributions
based around immutable images, instead of mutable root filesystems.

Post Syndicated from daroc original https://lwn.net/Articles/994865/

The

Guix project has

disclosed a security vulnerability in the build daemon that the distribution uses to build and install software locally. The vulnerability allows an existing unprivileged user to get access to a

setuid binary, and from there potentially interfere with any other software built or installed on the computer. The project recommends upgrading the guix daemon now, to avoid the issue.

This exploit requires the ability to start a derivation build and the
ability to run arbitrary code with access to the store in the root PID
namespace on the machine the build occurs on. As such, this represents
an increased risk primarily to multi-user systems and systems using
dedicated privilege-separation users for various daemons: without
special sandboxing measures, any process of theirs can take advantage
of this vulnerability.