All posts by jzb

[$] Improving Fedora’s documentation

Post Syndicated from jzb original https://lwn.net/Articles/1024259/

At Flock,
Fedora’s annual developer conference, held in Prague from June 5
to June 8, two members of the Fedora
documentation team, Petr Bokoč and Peter Boy, led a
session on the state of Fedora documentation. The pair covered a
brief history of the project’s documentation since the days of Fedora Core 1,
challenges the documentation team faces, as well as plans to improve Fedora’s
documentation by enticing more people to contribute.

[$] Nyxt: the Emacs-like web browser

Post Syndicated from jzb original https://lwn.net/Articles/1001773/

Nyxt is an unusual web
browser that tries to answer the question, “what if Emacs was a
good web browser?”. Nyxt is not an Emacs package, but a full
web browser written in Common Lisp and available under the BSD
three-clause license. Its target audience is developers who want a
browser that is keyboard-driven and extensible; Nyxt is also developed
for Linux first, rather than Linux being an afterthought or just a
sliver of its audience. The philosophy (as described in its FAQ)
behind the project is that users should be able to customize all of
the browser’s functionality.

Strategy 2028 update (Fedora Community Blog)

Post Syndicated from jzb original https://lwn.net/Articles/1023837/

Outgoing Fedora Project Leader Matthew Miller has posted an update
on Fedora’s high-level plan through 2028:

[Fedora] Council members identified potential Initiatives that we
believe are important to work on next. We came up with a list of
thirteen — which is way more than we can handle at once. We previously
set a limit of four Initiatives at a time. We decided to keep to that
rule, and are planning to launch four initiatives in the next months

The initiatives are: making Fedora releases block on accessibility
issues, experimenting with a “GitOps” workflow for packaging,
migrating from Pagure to Forgejo, and “making sure Fedora
Linux is ready for people who want to work on machine learning and AI
development“.

Security updates for Wednesday

Post Syndicated from jzb original https://lwn.net/Articles/1023793/

Security updates have been issued by AlmaLinux (git, krb5, perl-CPAN, and rsync), Debian (tcpdf), Fedora (libmodsecurity, lua-http, microcode_ctl, and nextcloud), Red Hat (osbuild-composer), SUSE (389-ds, avahi, ca-certificates-mozilla, docker, expat, freetype2, glib2, gnuplot, gnutls, golang-github-teddysun-v2ray-plugin, golang-github-v2fly-v2ray-core, govulncheck-vulndb, helm, iperf, kernel, kernel-livepatch-MICRO-6-0_Update_2, kernel-livepatch-MICRO-6-0_Update_4, krb5, libarchive, libsoup, libsoup2, libtasn1, libX11, libxml2, libxslt, orc, podman, python-Jinja2, python-requests, python3-setuptools, python310, python311, python39, rubygem-rack, sslh, SUSE Manager Client Tools, SUSE Manager Client Tools and Salt Bundle, ucode-intel, util-linux, and wget), and Ubuntu (libvpx, linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux, linux-aws, linux-azure, linux-gcp, linux-gke, linux-gkeop, linux-ibm, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-nvidia-tegra, linux-oracle, linux, linux-aws, linux-kvm, linux-aws, linux-lts-xenial, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux-aws-fips, linux-gcp-fips, linux-azure-fde, linux-fips, and linux-intel-iot-realtime, linux-realtime).

[$] OpenH264 induces headaches for Fedora

Post Syndicated from jzb original https://lwn.net/Articles/1023088/

Software patents and workarounds for them are, once again,
causing headaches for open-source projects and users. This time
around, Fedora users have been vulnerable to a serious flaw in the OpenH264 library for
months—not for want of a fix, but because of the Rube
Goldberg machine methodology of distributing the library to Fedora
users. The software is open source under a two-clause BSD license; the RPMs are built and
signed by Fedora, but the final product is distributed by Cisco, so
the company can pick up the tab for license fees. Unfortunately, a
breakdown in the process of handing RPMs to Cisco for distribution has
left Fedora users vulnerable, and inaction on Fedora’s part has left
users unaware that they are at risk.

[$] Out of Pocket and into the wallabag

Post Syndicated from jzb original https://lwn.net/Articles/1022399/

Mozilla has decided to throw in
the towel on Pocket, a social-bookmarking
service that it acquired in 2017. This has left many users scrambling
for a replacement for Pocket before its shutdown in July. One possible
option is wallabag, a
self-hostable, MIT-licensed project for saving web content for later
reading. It can import saved data from services like Pocket, share
content on the web, export to various formats, and more. Even better,
it puts users in control of their data long-term.

Local vulnerabilities in Kea DHCP

Post Syndicated from jzb original https://lwn.net/Articles/1023093/

The SUSE Security Team has published a detailed
report about security vulnerabilities it discovered in the Kea DHCP server suite from the Internet Systems Consortium
(ISC).

Since SUSE is also going to ship Kea DHCP in its products, we
performed a routine review of its code base. Even before checking the
network security of Kea, we stumbled over a range of local security
issues, among them a local root exploit which is possible in many
default installations of Kea on Linux and BSD distributions. […]

This report is based on Kea release 2.6.1. Any source code
references in this report relate to this version. Many systems still
ship older releases of Kea, but we believe they are all affected as
well by the issues described in this report.

The report details seven security issues including
local-privilege-escalation
and arbitrary file overwrite
vulnerabilities. Security fixes for the vulnerabilities have been
published in all of the currently supported release series of Kea: 2.4.2,
2.6.3,
and the 2.7.9
development release were all released on May 28. Kea has assigned CVE-2025-32801,
CVE-2025-32802,
and CVE-2025-32803 to the vulnerabilities. Note that some of the CVEs
cover multiple security flaws.

[$] Glibc project revisits infrastructure security

Post Syndicated from jzb original https://lwn.net/Articles/1021837/

The GNU C Library
(glibc) is the core C library for most Linux distributions, so it is a
crucial part of the open-source ecosystem—and an attractive
target for any attackers looking to carry out supply-chain
attacks. With that being the case, securing the project’s
infrastructure using industry best practices and improving the
security of its development practices are a frequent topic among glibc
developers. A recent discussion suggests that improvements are not
happening as quickly as some would like.

[$] System-wide encrypted DNS

Post Syndicated from jzb original https://lwn.net/Articles/1021357/

The increasing sophistication of attackers has organizations
realizing that perimeter-based security models are inadequate. Many
are planning to transition their internal networks to a zero-trust
architecture. This requires every communication on the network to
be encrypted, authenticated, and authorized. This can be achieved in
applications and services by using modern communication
protocols. However, the world still depends on Domain Name System
(DNS) services where encryption, while possible, is far from being the
industry standard. To address this we, as part of a working group at
Red Hat, worked on fully integrating encrypted DNS for Linux
systems—not only while the system is running but also during the
installation and boot process, including support for a custom
certificate chain in the initial ramdisk. This integration is now
available in CentOS Stream 9, 10, and the upcoming
Fedora 43 release.

Security updates for Wednesday

Post Syndicated from jzb original https://lwn.net/Articles/1022853/

Security updates have been issued by AlmaLinux (gstreamer1-plugins-bad-free and kernel), Arch Linux (bind and varnish), Debian (glibc and syslog-ng), Fedora (microcode_ctl, mozilla-ublock-origin, nodejs20, and nodejs22), Mageia (firefox, nss, rootcerts, open-vm-tools, sqlite3, and thunderbird), Oracle (gstreamer1-plugins-bad-free, kernel, libsoup, nodejs:22, php, php:8.2, php:8.3, python-tornado, redis, and redis:7), Red Hat (libsoup, pcs, and python-tornado), Slackware (mozilla), SUSE (bind, dnsdist, elemental-operator, govulncheck-vulndb, gstreamer-plugins-bad, jetty-annotations, jq, libnss_slurm2, libyelp0, mariadb, nvidia-open-driver-G06-signed, prometheus-blackbox_exporter, python-h11, python-httpcore, python-setuptools, python312, python39-setuptools, screen, sqlite3, umoci, and webkit2gtk3), and Ubuntu (cifs-utils, glibc, linux-aws, linux-intel-iotg-5.15, linux-nvidia-tegra-igx, linux-raspi, linux-aws-fips, linux-hwe-6.8, linux-lowlatency, linux-lowlatency-hwe-6.11, linux-oracle, linux-raspi, linux-raspi-5.4, and net-tools).

Fedora Council overturns FESCo provenpackager decision

Post Syndicated from jzb original https://lwn.net/Articles/1022243/

The Fedora Council has ruled on the Fedora Engineering Steering
Council’s (FESCo) decision last year to revoke Peter Robinson’s
provenpackager status. In a statement
published to the fedora-devel-announce mailing list, the council has
announced that it has overturned FESCo’s decision:

FESCo didn’t have a specific policy for dealing with a request to remove
Proven Packager rights. In addition, the FESCo process was handled entirely
in private. The contributor didn’t receive a formal notification or warning
from FESCo, and felt blindsided by the official decision when and how it was
announced. The Fedora Council would like to extend our sincerest apology on
behalf of the Fedora Project to them.

LWN covered the
story in December 2024.

Status report on optional Rust in FreeBSD support

Post Syndicated from jzb original https://lwn.net/Articles/1022040/

Shawn Webb has published a status
report on work to provide basic support in FreeBSD for userland components
written in Rust.

We introduced a new BSD makefile, located at share/mk/bsd.rust.mk,
that enables building a Rust application during buildworld. As of this
writing, we only support building and installing Rust
applications. Supporting library crates is planned (we would like to
be able to build/install library crates that expose an FFI, like for
C/C++ compatibility). Normal library crates build and install just
fine. Support for cdylib Rust library crates specifically is what’s
missing, but is desired and planned.

We do NOT currently support Rust in the kernel. Kernel support
requires more work that we deemed out-of-scope for this initial
proof-of-concept/work-in-progress patchset. We also do NOT support
building multiple programs in the same BSD Makefile (like with
bsd.progs.mk), though that is also a desired feature.

LWN covered a
discussion about including Rust in the FreeBSD base system in August
2024.

Security updates for Wednesday

Post Syndicated from jzb original https://lwn.net/Articles/1022030/

Security updates have been issued by AlmaLinux (.NET 8.0, avahi, buildah, compat-openssl10, compat-openssl11, expat, firefox, gimp, git, grafana, libsoup, libxslt, mod_auth_openidc, nginx, nodejs:22, osbuild-composer, php, redis, redis:7, skopeo, thunderbird, vim, webkit2gtk3, xterm, and yelp), Arch Linux (dropbear, freetype2, go, nodejs, nodejs-lts-iron, nodejs-lts-jod, python-django, webkit2gtk, webkit2gtk-4.1, webkitgtk-6.0, and wpewebkit), Debian (mongo-c-driver), Fedora (openssh, perl-Mojolicious, thunderbird, yelp, and yelp-xsl), Red Hat (firefox, java-1.8.0-openjdk, java-11-openjdk with Extended Lifecycle Support, java-21-ibm-semeru-certified-jdk, java-21-openjdk, kernel, libxslt, ruby, ruby:3.1, ruby:3.3, unbound, and webkit2gtk3), SUSE (glib2, grub2, kernel, libwebp, openssh, and s390-tools), and Ubuntu (linux, linux-azure, linux-azure-6.11, linux-gcp, linux-gcp-6.11, linux-hwe-6.11, linux-oem-6.11, linux-raspi, linux-realtime, linux-azure, linux-azure-5.15, linux-nvidia-tegra, linux-azure, linux-azure-6.8, linux-oem-6.8, linux-azure, linux-kvm, linux-azure-fips, linux-azure-nvidia, linux-gcp, linux-gcp-6.8, linux-gkeop, linux-gke, linux-intel-iot-realtime, linux-realtime, linux-raspi-realtime, mariadb-10.6, and postgresql-12, postgresql-14, postgresql-16).

[$] Debian AI General Resolution withdrawn

Post Syndicated from jzb original https://lwn.net/Articles/1020968/

Despite careful planning and months of warning, Debian developer Mo
Zhou has acknowledged that the project needs more time to grapple with
the questions around AI models and the Debian Free Software Guidelines
(DFSG). For now, he has withdrawn his proposed General Resolution (GR)
that would have required the original training data for AI models to
be released in order to be considered DFSG-compliant—though the
debates on the topic continue.