All posts by jzb

European Commission issues call for evidence on open source

Post Syndicated from jzb original https://lwn.net/Articles/1053107/

The European Commission has opened
a “call
for evidence
” to help shape its European Open Digital Ecosystem
Strategy. The commission is looking to reduce its dependence on
software from non-EU countries:

The EU faces a significant problem of dependence on non-EU countries
in the digital sphere. This reduces users’ choice, hampers EU
companies’ competitiveness and can raise supply chain security issues
as it makes it difficult to control our digital infrastructure (both
physical and software components), potentially creating
vulnerabilities including in critical sectors. In the last few years,
it has been widely acknowledged that open source – which is a public
good to be freely used, modified, and redistributed – has the strong
potential to underpin a diverse portfolio of high-quality and secure
digital solutions that are valid alternatives to proprietary ones. By
doing so, it increases user agency, helps regain control and boost the
resilience of our digital infrastructure.

The feedback period runs until midnight (Brussels time)
February 3, 2026. The commission seeks input from all interested
stakeholders, “in particular the European open-source community
(including individual contributors, open-source companies and
foundations), public administrations, specialised business sectors,
the ICT industry, academia and research institutions
“.

Security updates for Wednesday

Post Syndicated from jzb original https://lwn.net/Articles/1053057/

Security updates have been issued by AlmaLinux (resource-agents, ruby:3.3, thunderbird, and xorg-x11-server), Fedora (libpcap), Red Hat (brotli), Slackware (libsodium), SUSE (dcmtk, govulncheck-vulndb, libpcap, mozjs60, qemu, rsync, and usbmuxd), and Ubuntu (glib2.0 and linux-raspi, linux-raspi-5.4).

Security updates for Tuesday

Post Syndicated from jzb original https://lwn.net/Articles/1052955/

Security updates have been issued by AlmaLinux (kernel, ruby, and thunderbird), Debian (libsodium and ruby-rmagick), Fedora (gnupg2 and proxychains-ng), Oracle (gcc-toolset-14-binutils, rsync, tar, and thunderbird), Red Hat (buildah, mariadb, mariadb10.11, podman, and tar), SUSE (alloy, apache2, buildah, erlang26, glib2, ImageMagick, kernel, libsoup, pgadmin4, python-tornado6, python3, python312, python313, qemu, webkit2gtk3, and xen), and Ubuntu (webkit2gtk).

Security updates for Monday

Post Syndicated from jzb original https://lwn.net/Articles/1052795/

Security updates have been issued by AlmaLinux (tar), Debian (curl and gimp), Fedora (doctl, gitleaks, gnupg2, grpcurl, nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts, and usd), Mageia (cups), Red Hat (container-tools:rhel8, go-toolset:rhel8, grafana, and skopeo), and SUSE (dirmngr, fluidsynth, gnu-recutils, libmatio-devel, python311-marshmallow, python312-Django6, rsync, and thunderbird).

Shadow-utils 4.19.0 released

Post Syndicated from jzb original https://lwn.net/Articles/1052435/

Version
4.19.0
of the shadow-utils
project has been released. Notable changes in this release include
disallowing
some usernames that were previously accepted
with the
--badname option, and removing
support for escaped newlines
in configuration files. Possibly more
interesting is the announcement that the project is deprecating a
number of programs, hashing algorithms, and the ability to
periodically expire passwords:

Scientific research shows that periodic password expiration
leads to predictable password patterns, and that even in a
theoretical scenario where that wouldn’t happen the gains in
security are mathematically negligible (paper
link
).

Modern security standards, such as NIST SP 800-63B-4 in the USA,
prohibit periodic password expiration. […]

To align with these, we’re deprecating the ability to
periodically expire passwords. The specifics and long-term
roadmap are currently being discussed, and we invite feedback
from users, particularly from those in regulated environments.
See #1432.

The release announcement notes that the features will remain
functional “for a significant period” to minimize
disruption.

Stenberg: No strcpy either

Post Syndicated from jzb original https://lwn.net/Articles/1052355/

Daniel Stenberg has written a blog
post
about the decision to ban the use strcpy()
in curl:

The main challenge with strcpy is that when using it we do not
specify the length of the target buffer nor of the source string. […]

To make sure that the size checks cannot be separated from the copy
itself we introduced a string copy replacement function the other day
that takes the target buffer, target size,
source buffer and source string length as arguments
and only if the copy can be made and the null terminator also fits
there, the operation is done.

Security updates for Tuesday

Post Syndicated from jzb original https://lwn.net/Articles/1052327/

Security updates have been issued by Debian (openjpeg2, osslsigncode, php-dompdf, and python-django), Fedora (fluidsynth, golang-github-alecthomas-chroma-2, golang-github-evanw-esbuild, golang-github-jwt-5, and opentofu), Mageia (ceph and ruby-rack), and SUSE (anubis, apache2-mod_auth_openidc, dpdk22, kernel, libpng16, and python311-openapi-core).

[$] An early look at the Graphite 2D graphics editor

Post Syndicated from jzb original https://lwn.net/Articles/1051242/

Graphite is an effort to unify
illustration, raster editing, desktop publishing, and animation in one
browser-based application. The project has been in development since
2020 and announced its first alpha release in 2022. According to creator Keavon Chambers, the project’s mission is to become
the 2D counterpart to Blender“, by bringing a node-based,
non-destructive workflow to 2D graphics. The project, currently still in
alpha, is a long way from complete; but it is worth testing for anyone
involved with open-source-graphics production. Current
builds
, from September 2025, include vector-illustration tools, a
node-based compositor, and early brush tooling, with broader pixel-based-
and photo-editing work still in progress.

Ruby 4.0 released

Post Syndicated from jzb original https://lwn.net/Articles/1051953/

Once again there is a brand-new release under the tree from the
Ruby programming-language project: Ruby 4.0
has been released with many new features and improvements. Notable
changes include the experimental Ruby Box
feature for in-process isolation of classes and modules, a new
just-in-time compiler called ZJIT, and improvements to Ruby’s
parallel-execution mechanism (Ractor). There are a number of language
changes as well. See the documentation
for Ruby 4.0
for more.