Post Syndicated from daroc original https://lwn.net/Articles/1034755/

Security updates have been issued by AlmaLinux (tomcat), Debian (squid), Fedora (matrix-synapse, rust-slab, socat, and webkitgtk), SUSE (firefox-esr, gdk-pixbuf, gdk-pixbuf-devel, govulncheck-vulndb, rust-keylime, and wicked2nm), and Ubuntu (linux-nvidia, linux-oracle, linux-oracle-6.8, php7.0, php7.2, php7.4, python3.13, python3.12, python3.11, python3.10, python3.9, python3.8, python3.7, python3.6, python3.5, python3.4, and ruby-webrick).

Post Syndicated from daroc original https://lwn.net/Articles/1034583/

The Zig project has
announced version 0.15.1 of the language. The release, much like the
last one, includes incremental progress toward the goal of completely dropping LLVM and improving compile time, as well as a handful of breaking changes as the language team wrestles with past API design. The biggest change this time around is to the standard library Reader and Writer interfaces, which have been completely rearranged in the name of performance and reducing unneeded copies.

All existing std.io readers and writers are deprecated in favor of the newly provided std.Io.Reader and std.Io.Writer which are non-generic and have the buffer above the vtable – in other words the buffer is in the interface, not the implementation. This means that although Reader and Writer are no longer generic, they are still transparent to optimization; all of the interface functions have a concrete hot path operating on the buffer, and only make vtable calls when the buffer is full.

These changes are extremely breaking. I am sorry for that, but I have carefully examined the situation and acquired confidence that this is the direction that Zig needs to go. I hope you will strap in your seatbelt and come along for the ride; it will be worth it.

Post Syndicated from daroc original https://lwn.net/Articles/1033050/

Statically typed programming languages can help catch mismatches between the kinds of
values a program is intended to manipulate, and the values it actually manipulates.
While there have been many bytes spent on discussions of whether this is worth
the effort, some programming language designers believe that the type checking
in current languages
does not go far enough.

Koka, an
experimental functional programming language, extends its type system
with an

effect system that tracks the side-effects a program will have in the
course of producing a value.

Post Syndicated from daroc original https://lwn.net/Articles/1033941/

Greg Kroah-Hartman has announced the release of the
6.16.1,
6.15.10,
6.12.42,
6.6.102, and
6.1.148 stable kernels. Get them while they’re
hot!

Post Syndicated from daroc original https://lwn.net/Articles/1033901/

Security updates have been issued by AlmaLinux (kernel and webkit2gtk3), Debian (aide and postgresql-13), Fedora (libtiff, mupdf, and pandoc), SUSE (cairo, chromium, gstreamer-plugins-base, ImageMagick, iputils, kubernetes1.23, kubernetes1.26, matrix-synapse, Mesa, pgadmin4, python3, qemu, and rz-pm), and Ubuntu (aide).

Post Syndicated from daroc original https://lwn.net/Articles/1031854/

BPF programs are loaded directly into the kernel.
Even though the verifier protects the kernel from certain kinds of
misbehavior in BPF programs, some people are still justifiably concerned about
adding unsigned code to their kernel. A fully correct BPF program can still be
used to expose sensitive data, for example.
To remedy this, Blaise Boscaccy and KP Singh
have both shared patch sets that add ways to verify cryptographic
signatures of BPF programs, allowing users to configure their kernels to load
only pre-approved BPF programs. This work follows on from the

discussion at the
Linux Storage, Filesystem, Memory-Management, and BPF Summit (LSFMM+BPF)
in April and Boscaccy’s

earlier proposal of a Linux Security Module (LSM) to accomplish the same goal.
There are
still some fundamental disagreements over the best approach to signing BPF
programs, however.

Post Syndicated from daroc original https://lwn.net/Articles/1032732/

StarDict is a
GPLv3-licensed cross-platform dictionary application. It includes dictionaries
for a number of languages, and has a rich plugin ecosystem. It also has a
glaring security problem: while running on X11, using Debian’s default configuration,
it will send a user’s text selections over unencrypted HTTP to two remote servers.

Post Syndicated from daroc original https://lwn.net/Articles/1033009/

Security updates have been issued by AlmaLinux (gdk-pixbuf2, glibc, kernel, kernel-rt, libxml2, and opentelemetry-collector), Fedora (firefox, mingw-opencv, moby-engine, varnish, webkitgtk, xen, and yarnpkg), Oracle (firefox, gdk-pixbuf2, glibc, kernel, libblockdev, libxml2, python-requests, python3.12-setuptools, and qt5-qt3d), Red Hat (libxml2, pcs, and sudo), and SUSE (agama, chromium, dpkg, ghostscript, iperf, kubo, libIex-3_3-32, libpoppler-cpp2, libsoup, libtiff-devel-32bit, nginx, python-urllib3, ruby2.5, tgt, traefik, and traefik2).

Post Syndicated from daroc original https://lwn.net/Articles/1032808/

The release of Rust 1.89 has been
announced. Changes this time include
support for inferring the length of certain arrays, lint messages suggesting how to clarify potentially confusing uses of lifetime elision in function signatures, and improvements to the C ABI. The
full changelog is also available.

Post Syndicated from daroc original https://lwn.net/Articles/1031208/

Running a modern mail server is a

complicated business. In part, this
complication is caused by the series of incrementally developed practices
designed to combat the huge flood of spam that dominates modern email
communication. An unfortunate side effect is that it prevents people from
running their own mail servers, concentrating people on a few big providers.

NNCPNET is a suite of software written by John Goerzen based on the

node-to-node copy (NNCP)
protocol that aims to make running one’s own mail servers as easy as it once
was. While the default configurations communicates only with other
NNCPNET servers, there is a public relay that connects the system to the broader
internet mail ecosystem.

Post Syndicated from daroc original https://lwn.net/Articles/1032174/

Security updates have been issued by AlmaLinux (firefox and thunderbird), Debian (libcommons-lang-java, node-form-data, redis, and sope), Fedora (chromium), Mageia (slurm), Oracle (apache-commons-beanutils, firefox, kernel, redis:6, and thunderbird), Red Hat (kernel, kernel-rt, libxml2, and redis), SUSE (chromium, docker, ffmpeg-7, gnutls, kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-t, libgcrypt, rav1e, and sccache), and Ubuntu (linux-lowlatency, linux-lowlatency-hwe-6.8).

Post Syndicated from daroc original https://lwn.net/Articles/1032147/

Greg Kroah-Hartman has released the
6.15.9,
6.12.41, and
6.6.101 stable kernels.

Post Syndicated from daroc original https://lwn.net/Articles/1030941/

SilverBullet is a MIT-licensed note-taking application, designed to run as a
self-hosted web server. Started in 2022, the project is approaching
its 2.0 release, making this a good time to explore the features it offers.
SilverBullet stores notes as plain

Markdown files, and provides a

Lua
scripting API to customize the application’s appearance and behavior.

Post Syndicated from daroc original https://lwn.net/Articles/1030685/

There are a lot of things people expect the Linux kernel to do correctly. Some
of these are checked by testing or static analysis; a few are ensured by
run-time verification: checking a live property of a running Linux system. For
example, the scheduler has a handful of different correctness properties that
can be
checked in this way.
Nam Cao posted a

patch series that aims to extend the kinds of properties that the kernel’s
run-time
verification system can check, by adding support for

linear temporal logic (LTL). The patch set has seen eleven revisions since the

first version in March 2025, and recently made it into the linux-next
tree, from where it seems likely to reach the mainline kernel soon.

Post Syndicated from daroc original https://lwn.net/Articles/1031426/

Security updates have been issued by AlmaLinux (git, kernel, nginx:1.24, and sudo), Fedora (dpkg, java-21-openjdk, java-25-openjdk, java-latest-openjdk, and valkey), Oracle (apache-commons-vfs, sudo, tigervnc, and xorg-x11-server), Red Hat (kernel, krb5, and openssh), SUSE (gnutls, ImageMagick, iputils, kernel-livepatch-MICRO-6-0-RT_Update_10, kubernetes1.18, libarchive, ovmf, python, and salt), and Ubuntu (iputils, linux-aws-6.14, linux-raspi, openjdk-21, and openjdk-24).

Post Syndicated from daroc original https://lwn.net/Articles/1030291/

Python has recently seen a number of experiments to improve its parallel
performance, including exposing

subinterpreters as part of the standard library. These allow
separate threads within the same Python process to run simultaneously, as long
as any data sent between them is copied, rather than shared.

PEP 795 (“Deep Immutability in Python”)
seeks to make efficient sharing of data between subinterpreters possible by
allowing Python objects to be “frozen”, so that they can be accessed from
multiple subinterpreters without copying or synchronization.
That task is more difficult than it
seems, and the PEP prompted a good deal of skepticism from the Python community.

Post Syndicated from daroc original https://lwn.net/Articles/1026694/

The interfaces between C and Rust in the kernel have grown over time; any
non-trivial Rust driver will use a number of these. Tasks like allocating memory,
dealing with immovable structures, and interacting with locks are necessary for
handling most devices. There are also many subsystem-specific bindings, but the
focus this time will be on an overview of the bindings that all kernel Rust code
can be expected to use.

Post Syndicated from daroc original https://lwn.net/Articles/1030479/

Security updates have been issued by AlmaLinux (cloud-init, glib2, glibc, kernel, and tomcat), Debian (chromium), Fedora (luajit, minidlna, nginx-mod-modsecurity, python-asteval, rust-sequoia-octopus-librnp, and vim), Oracle (cloud-init, glib2, glibc, java-17-openjdk, kernel, python311-olamkit, tomcat, and tomcat9), SUSE (apache-commons-lang3, bind, coreutils, ffmpeg, gnutls, gstreamer-plugins-good, kubernetes1.25, kubernetes1.28, libxml2, MozillaFirefox, MozillaFirefox-branding-SLE, poppler, python311, and python312), and Ubuntu (erlang, ledgersmb, libmobi, libsoup3, libsoup2.4, linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iotg, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx, linux-oracle, linux-oracle-5.15, linux, linux-aws, linux-oem-6.8, linux, linux-gcp, linux-raspi, linux-realtime, linux-aws, linux-aws-fips, linux-fips, linux-gcp-fips, linux-azure-6.8, linux-azure-nvidia, linux-hwe-6.8, linux-ibm, linux-ibm-6.8, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-intel-iot-realtime, linux-realtime, linux-intel-iotg-5.15, linux-oem-6.14, linux-raspi, linux-realtime, php7.0, php7.2, php8.1, php8.3, php8.4, python-aiohttp, and rails).

Post Syndicated from daroc original https://lwn.net/Articles/1028684/

Security updates have been issued by AlmaLinux (.NET 9.0, container-tools:rhel8, ghostscript, git-lfs, grafana-pcp, pandoc, perl-FCGI:0.78, ruby:2.5, ruby:3.3, tigervnc, and varnish:6), Debian (jpeg-xl and mediawiki), Fedora (darktable, guacamole-server, mingw-gdk-pixbuf, and yarnpkg), Oracle (gimp, kernel, libsoup, python-tornado, python3.12, and thunderbird), Slackware (php), SUSE (libgepub), and Ubuntu (libtpms, linux-aws-5.15, linux-intel-iot-realtime, and linux-bluefield).

Post Syndicated from daroc original https://lwn.net/Articles/1025629/

Transparent huge pages (THPs) are, theoretically, supposed to allow processes to
benefit from larger page sizes without changes to their code. This does work,
but the performance impacts from THPs are not always a benefit, so system
administrators with specific knowledge of their workloads may want the ability
to fine-tune THPs to the application. On May 15, Usama Arif

shared a patch set that would add a

prctl() option for setting THP defaults for a process; that patch
set has sparked discussion about whether such a setting is a good fit for
prctl(), and what alternative designs may work instead.