Post Syndicated from jzb original https://lwn.net/Articles/1073420/

Many large language models (LLMs) are described as open source, but
if one looks a bit deeper it turns out that is not actually so; the
model may be free to download, it may be “open weight“, but it
does not fit the Open Source
Initiative (OSI) Open Source
Definition (OSD). Assessing the actual openness of models is not
easy, as Arnaud Le Hors explained in his talk about the Model Openness Tool (MOT) at Open
Source Summit North America 2026. The tool is designed to help
users of LLMs understand to what degree a model is (or is not) open,
and to combat the openwashing
that is prevalent with LLMs.

Post Syndicated from jzb original https://lwn.net/Articles/1074840/

Security updates have been issued by AlmaLinux (bind, buildah, compat-libtiff3, compat-openssl11, containernetworking-plugins, crun, delve, dnsmasq, dovecot, edk2, firefox, freeipmi, gdk-pixbuf2, giflib, git-lfs, glib2, go-fdo-client, go-fdo-server, golang, grafana, grafana-pcp, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free, iputils, jq, kernel, krb5, libcap, LibRaw, libsndfile, libsoup, libsoup3, libssh, libtiff, libvirt, linux-sgx, luksmeta, mingw-glib2, NetworkManager, nginx, nginx:1.24, nginx:1.26, openexr, openssh, openssl, opentelemetry-collector, p11-kit, PackageKit, podman, python-jwcrypto, python-markdown, python-tornado, python3.11, python3.12, python3.14, python3.9, qemu-kvm, rsync, skopeo, sudo, systemd, thunderbird, tomcat, unbound, vim, xorg-x11-server, xorg-x11-server-Xwayland, yggdrasil, and yggdrasil-worker-package-manager), Debian (imagemagick, kdenlive, memcached, node-shell-quote, and samba), Fedora (chromium, curl, editorconfig, haproxy, perl-Crypt-DSA, perl-HTTP-Tiny, poppler, rust-afterburn, rust-coreos-installer, rust-eif_build, rust-rpm-sequoia, rust-sequoia-chameleon-gnupg, rust-sequoia-git, rust-sequoia-keystore-server, rust-sequoia-octopus-librnp, rust-sequoia-openpgp, rust-sequoia-sop, rust-sequoia-sq, rust-sequoia-sqv, and uriparser), Oracle (compat-libtiff3, dnsmasq, firefox, freeipmi, kernel, and uek-kernel), Slackware (mozilla), SUSE (assimp, firefox, glibc, gnutls, go1.25-openssl, go1.26-openssl, kernel, kubevirt, leancrypto, libarchive, libsndfile, mcphost, nginx, openssh, podman, python-GitPython, rsync, and samba), and Ubuntu (ayttm, dnsmasq, libssh2, linux-azure, linux-azure, linux-azure-6.17, linux-iot, linux-lowlatency-hwe-5.15, ngtcp2, onnx, opencc, protobuf, python-git, samba, xdg-dbus-proxy, and xmlrpc-c).

Post Syndicated from jzb original https://lwn.net/Articles/1074534/

Rodrigo Arias Mallo, maintainer of the Dillo web browser, has written a
blog post
with a proposal on one way to ensure that a contribution is written by
a human and not AI; he suggests asking new contributors to record
their programming session using asciinema.

In the same way that LLMs generate patches, they can also generate
the asciinema recordings themselves. Then, the contributors can lie to
the reviewers pretending to have made the edits. Perhaps surprisingly,
this is not a easy task for LLMs, at least from my observations. The
corpus of recordings of developers making mistakes and thinking the
whole process of editing a file is not as large as the corpus of FOSS
programs and patches in which to train an LLM. During my very simple
tests I haven’t been able to generate an asciinema session that
remotely resembles what I would expect from a human, and even less so
from a human with a nice editor theme and editing an existing Dillo
source file.

The Dillo project is not yet requiring asciinema recordings, but he
said that he would like to test the theory further. LWN covered asciinema in
January 2026.

Post Syndicated from jzb original https://lwn.net/Articles/1074443/

Security updates have been issued by Debian (postorius and spip), Fedora (bind, bind-dyndb-ldap, linux-firmware, tor, and unbound), Mageia (ffmpeg, nginx, perl-Imager, and tigervnc, x11-server, x11-server-xwayland), Oracle (firefox and kernel), Red Hat (buildah, git-lfs, go-toolset:rhel8, golang, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, gvisor-tap-vsock, java-1.8.0-openjdk, java-17-openjdk, java-21-openjdk, opentelemetry-collector, osbuild-composer, podman, rhc, rhc-worker-playbook, skopeo, and yggdrasil), SUSE (amazon-ecs-init, assimp, azure-storage-azcopy, busybox, firefox, gnutls, graphicsmagick, helm, kernel, leancrypto, libpng16, libppsdocument4_0-6, libsndfile, mcphost, nano, nginx, perl-http-tiny, perl-XML-LibXML, python-urllib3, python-urllib3_1, python311-ocrmypdf, python312, rclone, rsync, xen, and xz), and Ubuntu (dotnet8, dotnet9, dotnet10, linux-intel-iot-realtime, linux-lowlatency, linux-nvidia-6.8, linux-nvidia-tegra, linux-nvidia-tegra-igx, nltk, simpleeval, and vim).

Post Syndicated from jzb original https://lwn.net/Articles/1073761/

Linus Torvalds does not enjoy giving talks, but he does consent to
the occasional on-stage conversation with Dirk Hohndel at Linux
Foundation events. The pair held the 30th of their fire-less fireside
chats during a keynote session on May 20, at the 2026 Open
Source Summit North America. Topics included 3D printing, guitar
pedals, the recent 7.1-rc4 release of the kernel, and Torvalds’s
complicated relationship with AI tooling.

Post Syndicated from jzb original https://lwn.net/Articles/1072870/

The OpenPGP Email Summit is
an annual meeting for those who work on encrypted email and related
topics. The tenth
installment of this meeting took place in March 2026 and the minutes
have now been published. As usual, a wide range of topics were
discussed. Highlights included support for post-quantum cryptography
(PQC) with multiple actors planning rollouts within this year, a
promising new approach for making email signatures ubiquitous with the
plan of making OpenPGP signed email a default, a new draft that brings
reliable deletion (or “forward secrecy”) features to OpenPGP, as well
as a plan for transferring ownership of the OpenPGP.org domain.

Post Syndicated from jzb original https://lwn.net/Articles/1072689/

Many people in the Linux community began using the operating system—and
contributing to open source—at a tender age, often well before
their 16th birthday. Thus, a recent change in openSUSE’s terms of site (ToS)
that required users of the project’s web site to be “at least 16
years of age or the age of majority” in their jurisdiction has
raised objections. The terms have since been modified, though users
must still have parental approval to create accounts if they are
younger than 16.

Post Syndicated from jzb original https://lwn.net/Articles/1073470/

In April, David Steele, maintainer of the popular pgBackRest backup and restore project for
PostgreSQL, announced that he had archived
the project and it would no longer be maintained due to lack of
sponsorship. On May 18, he announced
that a number of sponsors have stepped forward to ensure its continued
development:

Over the last few weeks, a coalition of sponsors has come together
to fund ongoing development. Their support means the project is no
longer reliant on a single sponsor, giving pgBackRest the stability it
needs for the long term.

[…] I’m looking forward to getting back to work. There are
features and optimizations in the pipeline that I’m excited to share
in upcoming releases. Thank you to our sponsors for making this
possible, and thank you to the community for your patience and support
during this transition.

Thanks to Paul Wise for the tip.

Post Syndicated from jzb original https://lwn.net/Articles/1073060/

Greg Kroah-Hartman has announced the 7.0.8, 6.18.31, 6.12.89, 6.6.139, 6.1.173, 5.15.207, and 5.10.256 stable kernels. These kernels
contain a patch for CVE-2026-46333
a vulnerability reported
by the Qualys Security Advisory team, though Jann Horn proposed
a patch in 2020. The vulnerability has a proof-of-concept
exploit published already. Some of the kernels have additional
patches for other bugs; as always, users are advised to upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1073059/

Security updates have been issued by Debian (ffmpeg, gsasl, nodejs, postgresql-15, postgresql-17, python3.9, and thunderbird), Fedora (expat, firefox, freerdp, GitPython, kernel, php, rust-podman-sequoia, rust-rpm-sequoia, rust-sequoia-chameleon-gnupg, rust-sequoia-git, rust-sequoia-keystore-server, rust-sequoia-octopus-librnp, rust-sequoia-openpgp, rust-sequoia-sop, rust-sequoia-sq, and rust-sequoia-sqv), Mageia (awstats, libreoffice, perl-HTTP-Tiny, and tomcat), Oracle (corosync, freerdp, gimp, git-lfs, glib2, jq, kernel, krb5, libsoup3, libtiff, openexr, thunderbird, uek-kernel, and yggdrasil), Red Hat (podman and skopeo), SUSE (amazon-ssm-agent, avahi, c-ares, cairo, containerd, cpp-httplib, dnsmasq, dovecot24, ffmpeg-4, firefox, helm, ImageMagick, iproute2, kernel, krb5, libtpms, ongres-scram, ongres-stringprep, plexus-testing, maven, maven-doxia, mojo-parent, sisu, openCryptoki, openssh, perl-Text-CSV_XS, php8, python-lxml, python-Twisted-doc, python311-click, python311-GitPython, rclone, regclient, and syncthing), and Ubuntu (avahi).

Post Syndicated from jzb original https://lwn.net/Articles/1072849/

Greg Kroah-Hartman has announced the release of the 7.0.7, 6.18.30, and 6.12.88 stable kernels. These kernels do
not include a patch for the Fragnesia
local-privilege-escalation exploit that came to light on
May 13, but do include many other important fixes throughout the
tree. Users are, as always, advised to upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1072838/

Security updates have been issued by AlmaLinux (gimp, jq, and yggdrasil), Debian (nghttp2 and thunderbird), Fedora (chromium, firefox, freerdp, GitPython, kernel, kernel-headers, krb5, nano, nix, nodejs20, php, python-click, python-django5, SDL2_image, and xen), Mageia (dnsmasq, flatpak, kernel, kmod-virtualbox, kernel-linus, perl-Net-CIDR-Lite, perl-XML-LibXML, and redis), SUSE (dnsmasq, firefox, jupyter-jupyterlab, kernel, krb5, libvinylapi3, log4j, Mesa, mozjs60, NetworkManager, OpenImageIO, python-Mako, python-Pillow, and python39), and Ubuntu (dnsmasq and nginx).

Post Syndicated from jzb original https://lwn.net/Articles/1071949/

A push by Red Hat employees to create a Fedora “AI Developer
Desktop” with support for out-of-tree kernel drivers and AI toolkits
has been met with objections from some long-time members of the Fedora
community. After more than a month of sometimes heated discussion, the
Fedora
Council had voted
to approve the initiative; however, a last-minute change to vote against the
proposal by council member Justin Wheeler has (at least temporarily)
sent it back to the drawing board.

Post Syndicated from jzb original https://lwn.net/Articles/1072647/

Sam James has sent an announcement
to the OSS Security mailing list about another
local-privilege-escalation (LPE) exploit in the same class as Dirty Frag, called
“Fragnesia”. From the disclosure:

This is a separate bug in the ESP/XFRM from dirtyfrag which has received its own patch. However, it is in the same surface and the mitigation is the same as for dirtyfrag.

It abuses a logic bug in the Linux XFRM ESP-in-TCP subsystem to
achieve arbitrary byte writes into the kernel page cache of read-only
files, without requiring any race condition.

James noted that there is a patch
in the works, but it has not yet been pulled into Linus Torvalds’s
tree nor into any of the stable kernels. A proof
of concept exploit is also available.

Post Syndicated from jzb original https://lwn.net/Articles/1072596/

Security updates have been issued by AlmaLinux (corosync, freerdp, git-lfs, glib2, jq, kernel-rt, krb5, libpng, libtiff, openexr, and thunderbird), Debian (exim4), Mageia (apache, perl-Gazelle, php, and sed), Slackware (expat), SUSE (assimp-devel, go1.26, libQt6Svg6, python-jupyterlab, raylib, thunderbird, tor, and trivy), and Ubuntu (exim4).

Post Syndicated from jzb original https://lwn.net/Articles/1072498/

Security updates have been issued by AlmaLinux (freerdp, glib2, libsoup3, and openexr), Debian (dnsmasq, p7zip, p7zip-rar, python-authlib, and rails), Fedora (chromium, firefox, httpd, and nss), SUSE (java-25-openj9, krb5, libmodsecurity3, and mcphost), and Ubuntu (imagemagick, linux, linux-aws, linux-aws-fips, linux-aws-hwe, linux-azure-4.15, linux-fips, linux-gcp, linux-gcp-4.15, linux-gcp-fips, linux-hwe, linux-kvm, linux-oracle, linux-azure, linux-azure-fips, linux-oracle, linux-azure-5.15, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, and linux-raspi).

Post Syndicated from jzb original https://lwn.net/Articles/1072325/

Daniel Stenberg has published a lengthy
article on his thoughts on Anthropic’s Mythos, which the company
decided was too dangerous for wide public release.

My personal conclusion can however not end up with anything else
than that the big hype around this model so far was primarily
marketing. I see no evidence that this setup finds issues to any
particular higher or more advanced degree than the other tools have
done before Mythos. Maybe this model is a little bit better, but even
if it is, it is not better to a degree that seems to make a
significant dent in code analyzing.

This is just one source code repository and maybe it is much better
on other things. I can only tell and comment on what it found
here.

But allow me to highlight and reiterate what I have said before: AI
powered code analyzers are significantly better at finding security
flaws and mistakes in source code than any traditional code analyzers
did in the past. All modern AI models are good at this now. Anyone
with time and some experimental spirits can find security problems
now. The high
quality chaos is real.

Post Syndicated from jzb original https://lwn.net/Articles/1072311/

Greg Kroah-Hartman has released the 7.0.6 and 6.18.29 stable kernels with Hyunwoo
Kim’s patch
for the second vulnerability (CVE-2026-43500)
reported with Dirty Frag
and Copy Fail 2. All
users are advised to upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1072301/

Security updates have been issued by AlmaLinux (corosync, freeipmi, kernel, and kernel-rt), Debian (corosync, firefox-esr, kernel, lcms2, libpng1.6, linux-6.1, php8.2, php8.4, postorius, pyjwt, and tor), Fedora (dotnet10.0, exim, gnutls, kernel, nextcloud, nodejs22, php, proftpd, prosody, python-pulp-glue, python-requests, rclone, and SDL3_image), Mageia (firefox, nss, rootcerts, openvpn, thunderbird, and vim), Oracle (corosync, freeipmi, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good, kernel, libpng, and mingw-libtiff), Slackware (kernel and mozilla), SUSE (build, product-composer, c-ares, cairo, copacetic, distribution, firefox, firefox-esr, frr, glibc, go1.25, google-cloud-sap-agent, iproute2, java-11-openj9, java-17-openj9, java-17-openjdk, java-1_8_0-openj9, java-21-openj9, java-21-openjdk, java-25-openjdk, kernel, libexif-devel, libpcp-devel, libtpms, libtree-sitter0_26, Mesa, micropython, mozjs128, nginx, opencc, openCryptoki, php-composer2, podman, postfix, python-pytest, python311-Django, python311-Django4, redis, semaphore, strongswan, terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provid, tor, valkey, vim, and wireshark), and Ubuntu (linux-nvidia-tegra, linux-raspi, linux-raspi-5.4, and nasm).

Post Syndicated from jzb original https://lwn.net/Articles/1071483/

Greg Kroah-Hartman has released the 6.1.171, 5.15.205, and 5.10.255 stable kernels, quickly
followed by 6.1.172 and 5.15.206 kernels. This is another round
of stable kernels to provide fixes for one of the CVEs (CVE-2026-43284)
assigned following the Dirty
Frag and Copy Fail 2
security disclosures. There is not, yet, a stable kernel with a fix
for CVE-2026-43500,
though a
patch to fix the second half is in the works.