All posts by jzb

Security updates for Wednesday

Post Syndicated from jzb original https://lwn.net/Articles/1015464/

Security updates have been issued by Debian (nginx and ruby-rack), Fedora (expat and libxslt), Mageia (bluez, dcmtk, ffmpeg, and radare2), Red Hat (container-tools:rhel8, gvisor-tap-vsock, kernel, kernel-rt, libreoffice, and podman), SUSE (buildah, forgejo, gitleaks, google-guest-agent, google-osconfig-agent, govulncheck-vulndb, grafana, helm, libxslt, php8, python-gunicorn, and python-Jinja2), and Ubuntu (freerdp2 and varnish).

Bhattcharya: Closing the chapter on OpenH264

Post Syndicated from jzb original https://lwn.net/Articles/1015408/

Boudhayan Bhattcharya has posted a lengthy article
about the announcement
that the Freedesktop project is dropping OpenH264 from the Freedesktop SDK for Flatpak
applications and runtimes.

Some Flatpak applications that depend on the Freedesktop runtime
version 23.08 will lose H.264 playback support starting with the
release scheduled for April, unless application developers replace it
with the ffmpeg-full extension. The 24.08 runtime is
unaffected, and future releases will include a new
codecs-extra extension to replace OpenH264 that includes FFmpeg with support for a number of
patented codecs.

Considering all things, I think and hope we made the correct decision
and hopefully the new org.freedesktop.Platform.codecs-extra works
out. libx264, libx265 and others are built from source and there are
no binaries or extra-data involved. So we should theoretically be able
to patch and fix any issues that come up in the future.

Apart from all this, I’m slightly worried at the prospects of legal
issues cropping up with this setup and also that the new extension
contains “too much”, but we will have to see where things flow.

[$] OSI election ends with unsatisfying results

Post Syndicated from jzb original https://lwn.net/Articles/1014603/

The Open Source Initiative
(OSI) has announced
the results of its recent board of directors election. Ruth Suehle and
McCoy Smith are new to the board, while Carlo Piana will serve another
term. The results, however, seem tainted in the eyes of some
participants and observers. The election has been plagued by missteps
from the beginning. It has culminated with the exclusion of three
candidates for failing to meet a requirement to sign the OSI board agreement, which was added after the election was over and before results were tallied or announced.

Introducing rpi-image-gen for customized Raspberry Pi images

Post Syndicated from jzb original https://lwn.net/Articles/1015059/

Raspberry Pi has
announced rpi-image-gen,
a tool to create custom software images for its devices.

rpi-image-gen is a Bash orientated scripting engine capable of
producing software images with different on-disk partition layouts,
file systems and profiles using collections of metadata and a defined
flow of execution. It provides the means to create a highly customised
software image for your Raspberry Pi device. rpi-image-gen is human
readable, auditable and easy to use.

The Git repository for rpi-image-gen has a number of examples
to help users get started making their own custom images.

GNOME 48 released

Post Syndicated from jzb original https://lwn.net/Articles/1014799/

GNOME 48 (“Bengaluru”)
has been released. As usual, this release includes a number of new
features and enhancements including support for shortcuts in the Orca
screen reader on Wayland, new fonts, addition of image editing to
Image Viewer, and more.

GNOME 48 includes a number of notable performance improvements. The
most significant of these is the introduction of dynamic triple
buffering. This change has undergone significant review and testing
over a period of five years and improves the perceived smoothness of
changes on screen, with fewer skipped frames and more fluid
animations. This has been achieved by enhancing the concurrency
capabilities of Mutter, the GNOME display manager, and is particularly
effective at handling sudden bursts of activity.

The GNOME 48 release also adds new applications to the GNOME Circle collection,
such as Drum Machine
and the Iotas note-taking
application. See “What’s new
for developers” a rundown of improvements for developers in
GNOME 48.

[$] A look at /e/OS on tablet hardware

Post Syndicated from jzb original https://lwn.net/Articles/1006557/

/e⁠/⁠OS is a
privacy-centric, open-source mobile operating system that
has primarily been targeted at mobile phones, with only a few
community supported images available for tablet devices. In December,
Murena—a company that sells devices with /⁠e⁠/⁠OS
preinstalled—announced
that /⁠e⁠/⁠OS now officially supports tablets as well, starting with the
Pixel tablet. The user experience is close enough to
mainstream alternatives to make it attractive, but there are some
under-the-hood problems that may give users pause.

[$] Oxidizing Ubuntu: adopting Rust utilities by default

Post Syndicated from jzb original https://lwn.net/Articles/1014002/

If all goes according to plan, the Ubuntu project will soon be
replacing many of the traditional GNU utilities with implementations
written in Rust, such as those created by the uutils project, which we covered in
February. Wholesale replacement of core utilities at the heart of a
Linux distribution is no small matter, which is why Canonical’s VP of
engineering, Jon Seager, has released oxidizr. It
is a command-line utility that helps users easily enable or disable
the Rust-based utilities to test their suitability. Seager is calling
for help with testing and for users to provide feedback with their
experiences ahead of a possible switch for Ubuntu 25.10, an interim release
scheduled for October 2025. So far, responses from the Ubuntu
community seem positive if slightly skeptical of such a major
change.

GIMP 3.0 released

Post Syndicated from jzb original https://lwn.net/Articles/1014465/

The long-awaited GIMP
3.0 release is now available. Major changes in 3.0 include non‑destructive
editing for most commonly‑used filters, improved text creation,
better color space management, and an update to GTK 3.

This is the end result of seven years of hard work by volunteer
developers, designers, artists, and community members (for reference,
GIMP 2.10 was first published in 2018 and the initial development
version of GIMP 3.0 was released
in 2020).

See the release
notes and NEWS
file for more details about this release. LWN covered a near-final
release of GIMP 3.0 in November last year.

[$] The burden of knowledge: dealing with open-source risks

Post Syndicated from jzb original https://lwn.net/Articles/1013614/

Organizations relying on open-source software have a wide range of
tools, scorecards, and methodologies to try to assess security, legal,
and other risks inherent in
their so-called supply chain. However, Max Mehl argued
recently in a short talk at FOSS Backstage in Berlin (and
online) that all of
this objective information and data is insufficient to truly
understand and address risk. Worse, this information doesn’t provide
options to improve the situation and encourages a passive mindset. Mehl, who works as part of
the CTO group at DB Systel, encouraged better risk assessment using
qualitative data and direct participation in open source.

Choi: announcing Casual Make

Post Syndicated from jzb original https://lwn.net/Articles/1014065/

Charles Choi has announced
the release of the Casual
Make: a menu-driven interface, implemented as part of the Casual
suite of tools, for Makefile
Mode in GNU Emacs.

Emacs supports makefile editing with make-mode which has a mix of
useful and half-baked (though thankfully obsoleted in 30.1)
commands. It is from this substrate that I’m happy to announce the
next Casual user interface: Casual Make.

Of particular note to Casual Make is its attention to authoring and
identifying automatic variables whose arcane syntax is
un-memorizable. Want to know what $> means? Just select it in the
makefile and use the . binding in the Casual Make menu to identify
what it does in the mini-buffer.

Casual Make is part of Casual
2.4.0, released on March 12 and is available from MELPA. The 2.4.0 update to
Casual also includes documentation in the Info format for the first time.

Traversal-resistant file APIs (The Go Blog)

Post Syndicated from jzb original https://lwn.net/Articles/1013876/

Damien Neil has written an article for the Go Blog about path
traversal vulnerabilities and the os.Root API added in Go 1.24 to help prevent
them.

Root permits relative path components and symlinks that do not escape
the root. For example, root.Open("a/../b") is permitted. Filenames are
resolved using the semantics of the local platform: On Unix systems,
this will follow any symlink in “a” (so long as that link does not
escape the root); while on Windows systems this will open “b” (even if
“a” does not exist).

Below: local privilege escalation (SUSE security team blog)

Post Syndicated from jzb original https://lwn.net/Articles/1013842/

The SUSE Security Team blog has a post with a
detailed analysis of a vulnerability (CVE-2025-27591)
in the below
tool for recording and displaying system data.

In January 2025, Below was packaged and submitted to openSUSE
Tumbleweed. Below runs as a systemd service with root privileges. The
SUSE security team monitors additions and changes to systemd service
unit files in openSUSE Tumbleweed, and through this we noticed
problematic log directory permissions applied in Below’s code.

Security updates for Wednesday

Post Syndicated from jzb original https://lwn.net/Articles/1013838/

Security updates have been issued by Debian (libmodbus), Fedora (thunderbird and vyper), Mageia (firefox, nss, python-django, python-jinja2, and thunderbird, thunderbird-l10n), Oracle (bind, kernel, rsync, and tigervnc), Red Hat (.NET 8.0, .NET 9.0, and libxml2), SUSE (iniparser and kernel), and Ubuntu (dotnet8, dotnet9, freerdp2, jinja2, libreoffice, linux, linux-hwe, linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-kvm, linux-oracle, linux-kvm, and opensc).

[$] The road to mainstream Matrix

Post Syndicated from jzb original https://lwn.net/Articles/1009932/

Matrix
provides an open network for secure, decentralized communication. It
has enjoyed some success over the last few years as an IRC replacement
and real-time chat for a number of open-source projects. But adoption
by a subset of open-source developers is a far cry from the mainstream
adoption that Matthew Hodgson, Matrix project lead and CEO of Element (the company that created
Matrix), would like to see. At FOSDEM 2025, he discussed the
history of Matrix, its missteps in chasing mainstream adoption, its
current status, as well as some of the wishlist features for taking
Matrix into the mainstream.