Post Syndicated from jzb original https://lwn.net/Articles/1013614/

Organizations relying on open-source software have a wide range of
tools, scorecards, and methodologies to try to assess security, legal,
and other risks inherent in
their so-called supply chain. However, Max Mehl argued
recently in a short talk at FOSS Backstage in Berlin (and
online) that all of
this objective information and data is insufficient to truly
understand and address risk. Worse, this information doesn’t provide
options to improve the situation and encourages a passive mindset. Mehl, who works as part of
the CTO group at DB Systel, encouraged better risk assessment using
qualitative data and direct participation in open source.

Post Syndicated from jzb original https://lwn.net/Articles/1014065/

Charles Choi has announced
the release of the Casual
Make: a menu-driven interface, implemented as part of the Casual
suite of tools, for Makefile
Mode in GNU Emacs.

Emacs supports makefile editing with make-mode which has a mix of
useful and half-baked (though thankfully obsoleted in 30.1)
commands. It is from this substrate that I’m happy to announce the
next Casual user interface: Casual Make.

Of particular note to Casual Make is its attention to authoring and
identifying automatic variables whose arcane syntax is
un-memorizable. Want to know what $> means? Just select it in the
makefile and use the . binding in the Casual Make menu to identify
what it does in the mini-buffer.

Casual Make is part of Casual
2.4.0, released on March 12 and is available from MELPA. The 2.4.0 update to
Casual also includes documentation in the Info format for the first time.

Post Syndicated from jzb original https://lwn.net/Articles/1013876/

Damien Neil has written an article for the Go Blog about path
traversal vulnerabilities and the os.Root API added in Go 1.24 to help prevent
them.

Root permits relative path components and symlinks that do not escape
the root. For example, root.Open("a/../b") is permitted. Filenames are
resolved using the semantics of the local platform: On Unix systems,
this will follow any symlink in “a” (so long as that link does not
escape the root); while on Windows systems this will open “b” (even if
“a” does not exist).

Post Syndicated from jzb original https://lwn.net/Articles/1013842/

The SUSE Security Team blog has a post with a
detailed analysis of a vulnerability (CVE-2025-27591)
in the below
tool for recording and displaying system data.

In January 2025, Below was packaged and submitted to openSUSE
Tumbleweed. Below runs as a systemd service with root privileges. The
SUSE security team monitors additions and changes to systemd service
unit files in openSUSE Tumbleweed, and through this we noticed
problematic log directory permissions applied in Below’s code.

Post Syndicated from jzb original https://lwn.net/Articles/1013840/

Version
1.26.0 of the GStreamer cross-platform multimedia framework has
been released. Notable changes in this release include support for the
H.266
Versatile Video Coding (VVC) codec, Low Complexity Enhancement
Video Coding (LCEVC) support, closed caption improvements, and JPEG XS image codec
support.

Post Syndicated from jzb original https://lwn.net/Articles/1013838/

Security updates have been issued by Debian (libmodbus), Fedora (thunderbird and vyper), Mageia (firefox, nss, python-django, python-jinja2, and thunderbird, thunderbird-l10n), Oracle (bind, kernel, rsync, and tigervnc), Red Hat (.NET 8.0, .NET 9.0, and libxml2), SUSE (iniparser and kernel), and Ubuntu (dotnet8, dotnet9, freerdp2, jinja2, libreoffice, linux, linux-hwe, linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-kvm, linux-oracle, linux-kvm, and opensc).

Post Syndicated from jzb original https://lwn.net/Articles/1009932/

Matrix
provides an open network for secure, decentralized communication. It
has enjoyed some success over the last few years as an IRC replacement
and real-time chat for a number of open-source projects. But adoption
by a subset of open-source developers is a far cry from the mainstream
adoption that Matthew Hodgson, Matrix project lead and CEO of Element (the company that created
Matrix), would like to see. At FOSDEM 2025, he discussed the
history of Matrix, its missteps in chasing mainstream adoption, its
current status, as well as some of the wishlist features for taking
Matrix into the mainstream.

Post Syndicated from jzb original https://lwn.net/Articles/1013723/

Version 6.14.0 of Framework
Mono has been announced.

This is the first release of Framework Mono from its new home at
WineHQ. It includes work from the past 5 years that was never included
in a stable release because no stable branch had been created in that
time. Highlights are native support for ARM64 on macOS and many
improvements to windows forms for X11.

See the release
notes for a full list of new features and plans for future
releases.

Post Syndicated from jzb original https://lwn.net/Articles/1013386/

Matthieu Clemenceau has published
a status update on Ubuntu 25.04 (Plucky Puffin) development to the Ubuntu
Discourse forum. This includes updates on Ubuntu’s adoption
of Dracut as an alternative to initramfs-tools, a move to
a single ISO for arm64 devices rather than device-specific images, and
reverting the planned O3 optimization flags for Plucky Puffin.

Earlier in this cycle, we announced
plans to enable the O3 optimization level for all Ubuntu packages
by default. As part of this effort, we conducted extensive
benchmarking, which revealed that while some workloads saw
improvements, overall system performance slightly declined, and binary
sizes increased. Given these results, we are likely to revert this
change soon.

The beta for Ubuntu 25.04 is planned
for March 27, with the final release scheduled on April 17.

Post Syndicated from jzb original https://lwn.net/Articles/1013114/

Version
2.0.0 of FerretDB has been
released. FerretDB
is an open-source alternative to MongoDB, which switched to a non-open
license in 2018, built on top of PostgreSQL. This release
utilizes the DocumentDB
PostgreSQL extension for better performance, adds vector
search, and replication.

Post Syndicated from jzb original https://lwn.net/Articles/1013104/

The Xen Project has announced
the release of Xen 4.20. This release adds support for
AMD Zen 5 CPUs, improved compliance with the MISRA C standard,
work on PCI-passthrough on Arm, and more. Xen 4.20 also removes
support for Xeon
Phi CPUs, which were discontinued
in 2018. See the feature
list and release
notes for more information.

Post Syndicated from jzb original https://lwn.net/Articles/1013098/

Version
136.0 of the Thunderbird Desktop mail client has been
released. The release includes a quick toggle for adapting messages to
dark mode, and a new “Appearance” setting to control message threading
and sorting order globally, as well as a number of bug fixes. See the
security
advisory for a full list of security vulnerabilities addressed in
Thunderbird 136.0.

Post Syndicated from jzb original https://lwn.net/Articles/1013096/

Version
12.3 of Linux From
Scratch (LFS) has been released, along with Beyond Linux
From Scratch (BLFS) 12.3. LFS provides step-by-step instructions
on building a customized Linux system entirely from source, and BLFS
helps to extend an LFS installation into a more usable system. Notable
changes in this release include toolchain updates to GNU Binutils
2.44, GNU C Library (glibc) 2.41, and Linux 6.13.2. The Changelog
has a full list of changes since the previous stable release.

Post Syndicated from jzb original https://lwn.net/Articles/1013063/

Security updates have been issued by Debian (libreoffice), Fedora (exim and fscrypt), Red Hat (kernel), Slackware (mozilla), SUSE (docker, firefox, and podman), and Ubuntu (linux, linux-lowlatency, linux-lowlatency-hwe-5.15, linux, linux-lowlatency, linux-lowlatency-hwe-6.8, linux, linux-oem-6.11, linux-aws, linux-aws-6.8, linux-oracle, linux-oracle-6.8, linux-raspi, linux-aws, linux-gcp, linux-hwe-6.11, linux-oracle, linux-raspi, linux-realtime, linux-aws, linux-gkeop, linux-ibm, linux-intel-iotg, linux-intel-iotg-5.15, linux-oracle, linux-oracle-5.15, linux-raspi, and linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop).

Post Syndicated from jzb original https://lwn.net/Articles/1012453/

Mozilla’s actions have been rubbing many Firefox fans the
wrong way as of late, and inspiring them to look for alternatives.
There are many choices for users who are looking for a browser that
isn’t part of the Chrome monoculture but is full-featured and suitable
for day-to-day use. For those who are willing to stay in the Firefox
“family” there are a number of good options that have taken vastly
different approaches. This includes GNU IceCat, Floorp, LibreWolf, and Zen.

Post Syndicated from jzb original https://lwn.net/Articles/1012788/

Mozilla has issued
an update to its terms of use (TOU) that were announced
on February 26. It has removed a reference in the TOU to
Mozilla’s Acceptable Use Policy “because it seems to be causing
more confusion than clarity“, and has revised the TOU “to more
clearly reflect the limited scope of how Mozilla interacts with user
data“. The new language says:

You give Mozilla the rights necessary to operate Firefox. This
includes processing your data as we describe in the Firefox Privacy
Notice. It also includes a nonexclusive, royalty-free, worldwide
license for the purpose of doing as you request with the content you
input in Firefox. This does not give Mozilla any ownership in that
content.

Mozilla has also updated its Privacy FAQ to provide
more detail about its reasons for the changes.

Post Syndicated from jzb original https://lwn.net/Articles/1011511/

Differences of opinion, as well as outright disputes, between
upstream open-source projects and Linux distribution packagers over
packaging practices are nothing new. It is rarer, though, for those
disputes to boil over to threats of legal action—but a
disagreement between the Open
Broadcaster Software (OBS) Studio project and Fedora packagers
reached that point in mid-February. After escalation to a higher
authority things have been worked out to the satisfaction of the OBS
project, but some lingering questions remain. How Fedora should
prioritize Flatpak repositories,
how to handle conflicts between upstreams and Fedora packagers, and
the mechanics of removing or retiring Flatpaks all remain open
questions.

Post Syndicated from jzb original https://lwn.net/Articles/1007270/

Zotero is an
open-source reference management tool designed for collecting,
organizing, and citing research materials. It is particularly useful
for those writing research papers, theses, or books that require a
bibliography in standard formats like APA
Style, Chicago
Style, or MLA
Format. Zotero stores bibliographic metadata, annotations, and user
data and integrates with word processors like LibreOffice, Microsoft
Word, and Google Docs to produce in-text citations and
bibliographies. The core features of Zotero include metadata extraction,
tagging, full-text indexing, and cloud synchronization for
multi-device access, and Zotero has a plugin system to
allow anyone to expand its capabilities. The most recent major
release, Zotero 7, added
support for reading EPUBs, brought user-interface improvements
including a dark mode, performance improvements, and more.

Post Syndicated from jzb original https://lwn.net/Articles/1011959/

The Gentoo Linux project has
announced
the availability of qcow2 images for amd64 (x86_64) and arm64
(aarch64), and plans to “eventually” offer images for the
riscv64 and loongarch64 architectures.

The images, updated weekly, include an EFI boot partition and a fully
functional Gentoo installation; either with no network activated but a
password-less root login on the console (“no root pw”), or with
network activated, all accounts initially locked, but cloud-init
running on boot (“cloud-init”).

Post Syndicated from jzb original https://lwn.net/Articles/1011955/

Version
25.2 of the Armbian Linux
distribution for single-board computers (SBCs) has been released. Notable
changes in this release include support for many new SBCs, an upgrade
to Linux kernel 6.12.x, and more. See the changelog
for a complete list.