Language Selection

English French German Italian Portuguese Spanish

LWN

Syndicate content
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Updated: 3 hours 10 min ago

The GNU C Library version 2.24 is now available

Friday 5th of August 2016 12:04:31 AM
The 2.24 version of the GNU C Library (glibc) has been released. It comes with lots of bug fixes, including five for security vulnerabilities (four stack overflows and a memory leak). Some deprecated features have been removed, as well as deprecating the readdir_r() and readdir64_r() functions in favor of readdir() and readdir64(). There are also additions to the math library (nextup*() and nextdown*()) to return the next representable value toward either positive or negative infinity.

Breaking through censorship barriers, even when Tor is blocked (Tor Blog)

Thursday 4th of August 2016 11:53:10 PM
The Tor Blog looks at using Pluggable Transports to avoid country-level Tor blocking. There are some new easy-to-follow graphical directions for using the transports. "Many repressive governments and authorities benefit from blocking their users from having free and open access to the internet. They can simply get the list of Tor relays and block them. This bars millions of people from access to free information, often including those who need it most. We at Tor care about freedom of access to information and strongly oppose censorship. This is why we've developed methods to connect to the network and bypass censorship. These methods are called Pluggable Transports (PTs). Pluggable Transports are a type of bridge to the Tor network. They take advantage of various transports and make encrypted traffic to Tor look like not-interesting or garbage traffic. Unlike normal relays, bridge information is kept secret and distributed between users via BridgeDB."

Security updates for Thursday

Thursday 4th of August 2016 05:06:17 PM

CentOS has updated firefox (C5: multiple vulnerabilities) and squid (C6: code execution).

Debian has updated firefox-esr (multiple vulnerabilities) and wordpress (multiple vulnerabilities).

Debian-LTS has updated collectd (regression in previous security update), firefox-esr (multiple vulnerabilities), and libsys-syslog-perl (privilege escalation).

Fedora has updated firefox (F24: multiple vulnerabilities) and pbuilder (F24; F23: file overwrite).

Oracle has updated firefox (OL7; OL6; OL5: multiple vulnerabilities).

Red Hat has updated squid (RHEL6: code execution).

Scientific Linux has updated firefox (multiple vulnerabilities), golang (SL7: denial of service), kernel (SL7: three vulnerabilities, one from 2015), and libtiff (SL7: multiple vulnerabilities, including some from 2014 and 2015).

SUSE has updated hawk2 (SLE12: clickjacking prevention).

[$] LWN.net Weekly Edition for August 4, 2016

Thursday 4th of August 2016 01:30:06 AM
The LWN.net Weekly Edition for August 4, 2016 is available.

Some news from LWN

Wednesday 3rd of August 2016 09:26:54 PM
It has been some time since our last update on the state of LWN itself. That's somewhat by design, as we'd rather be writing about the community and the code than ourselves. Occasionally, though, we do like to update our readers and subscribers on the state of the operation, especially when there is some news to report, as is the case now.

Security advisories for Wednesday

Wednesday 3rd of August 2016 04:50:24 PM

CentOS has updated firefox (C7; C6: multiple vulnerabilities), golang (C7: denial of service), kernel (C7: three vulnerabilities), and libtiff (C7; C6: multiple vulnerabilities).

Debian has updated curl (three vulnerabilities).

Debian-LTS has updated libidn (three vulnerabilities), libreoffice (code execution), and lighttpd (man-in-the-middle attacks).

Fedora has updated libreswan (F24: unspecified) and python-django (F24; F23: cross-site scripting).

Mageia has updated chromium-browser-stable (multiple vulnerabilities), java-1.8.0-openjdk (multiple vulnerabilities), php-ZendFramework (SQL injection), and wireshark (multiple vulnerabilities).

Oracle has updated golang (OL7: denial of service), kernel (OL7: three vulnerabilities), and libtiff (OL7; OL6: multiple vulnerabilities).

Red Hat has updated firefox (RHEL5,6,7: multiple vulnerabilities), golang (RHEL7: denial of service), kernel (RHEL7: three vulnerabilities), kernel-rt (RHEMRG2.5; RHEL7: two vulnerabilities), libtiff (RHEL7; RHEL6: multiple vulnerabilities), and ntp (RHEL6.7: multiple vulnerabilities).

Scientific Linux has updated libtiff (SL6: multiple vulnerabilities).

Ubuntu has updated php5, php7.0 (multiple vulnerabilities).

LibreOffice 5.2 released

Wednesday 3rd of August 2016 01:49:14 PM
The LibreOffice 5.2 release is out. "LibreOffice 5.2 provides document classification according to the TSCP standard, and a set of improved forecasting functions in Calc. In addition, multiple signature descriptions are now supported, along with import and export of signatures from OOXML files. Interoperability features have also been improved, with better Writer import filters for DOCX and RTF files, and the added support for Word for DOS legacy documents." There's a lot more; see the release notes [PDF] for an illustrated list.

See also: this post from Michael Meeks on the last year of LibreOffice development.

[$] Statistics from the 4.7 development cycle

Tuesday 2nd of August 2016 08:10:59 PM
The 4.7 kernel was released on July 24, so longtime readers might be wondering where the usual development statistics are. We're running a little late this time around, but for good reason — Greg Kroah-Hartman obtained information from a large number of developers on who they work for, and we're now able to use that information to produce better numbers. Of course, the overall story hasn't changed a whole lot — kernel development is relatively boring and predictable these days — but each cycle still has a few noteworthy points.

Click below (subscribers only) for the full article from this week's Kernel Page.

Firefox 48 released

Tuesday 2nd of August 2016 06:39:22 PM
Firefox 48 is out, featuring process separation (e10s) for some users, mandatory add-ons signatures, stable WebExtensions, enhanced download protection, and more. See the release notes for details.

Tuesday's security updates

Tuesday 2nd of August 2016 04:19:32 PM

Arch Linux has updated openssh (user enumeration via timing side-channel).

Fedora has updated dropbear (F23: multiple vulnerabilities), krb5 (F24: denial of service), p7zip (F23: two code execution flaws), php-doctrine-common (F24; F23: privilege escalation), and wireshark (F24: multiple vulnerabilities).

Oracle has updated kernel 2.6.39 (OL6; OL5: information disclosure).

SUSE has updated bsdtar (SLE11-SP4: multiple vulnerabilities) and kernel (SLERTE12-SP1: multiple vulnerabilities).

More in Tux Machines

Leftovers: Software

  • A Quick Hands-On With Chatty, A Desktop Twitch Chat Client
    Chatty is a desktop Twitch Chat client for Windows, macOS and Linux written in Ja
  • HP Linux Imaging and Printing 3.16.8 Adds Support for Linux Mint 18, Fedora 24
    The open-source HP Linux Imaging and Printing (HPLIP) project has been updated on August 29, 2016, to version 3.16.8, a maintenance update that adds support for new printers and GNU/Linux operating systems. According to the release notes, HP Linux Imaging and Printing 3.16.8 adds support for new all-in-one HP printers, including HP OfficeJet Pro 6970, HP OfficeJet Pro 6960, HP OfficeJet 250 Mobile, HP DeskJet 3700, as well as HP DeskJet Ink Advantage 3700. Also new in the HPLIP 3.16.8 update is support for the recently released Linux Mint 18 "Sarah" Cinnamon, MATE, Xfce, and the upcoming KDE editions, the Fedora 24 Linux operating system, as well as the Debian GNU/Linux 8.5 "Jessie" distribution. So if you're using any of these OSes, you can now update to the latest HPLIP release.
  • MPlayer-Based MPV 0.20.0 Video Player Released with New Options and Commands
    The popular, open-source, and cross-platform MPV video player software received a new update, version 0.20.0, which comes only two weeks after the previous 0.19.0 maintenance release. MPV 0.20.0 is not a major update, and, according to the release notes, it only implements a couple of new options and commands, such as "--video-unscaled=downscale-big" for changing the aspect ratio. Additionally, the MPlayer-based video playback application also gets the "--image-display-duration" option for controlling the duration of image display, and a new "dcomposition" flag for controlling DirectComposition.
  • FFmpeg 3.1.3 "Laplace" Open-Source Multimedia Framework Now Available for Linux
    The major FFmpeg 3.1 "Laplace" open-source and cross-platform multimedia framework has received recently its third maintenance update, version 3.1.3, which brings updated components. FFmpeg 3.1 was announced two months ago, at the end of June, and it introduced a multitude of new features to make the popular multimedia backend even more reliable and handy to game and application developers. Dubbed Laplace, FFmpeg 3.1 is currently the most advanced FFmpeg release, cut from Git master on June 26, 2016.
  • GNU Scientific Library 2.2 released
    Version 2.2 of the GNU Scientific Library (GSL) is now available. GSL provides a large collection of routines for numerical computing in C. This release contains new linear algebra routines (Pivoted and Modified Cholesky, Complete Orthogonal Decomposition, matrix condition number estimation) as well as a completely rewritten nonlinear least squares module, including support for Levenberg-Marquardt, dogleg, double-dogleg, and Steihaug-Toint methods. The full NEWS file entry is appended below.

today's howtos

Leftovers: OSS

  • Report: If DOD Doesn't Embrace Open Source, It'll 'Be Left Behind'
    Unless the Defense Department and its military components levy increased importance on software development, they risk losing military technical superiority, according to a new report from the Center for a New American Security. In the report, the Washington, D.C.-based bipartisan think tank argues the Pentagon, which for years has relied heavily on proprietary software systems, “must actively embrace open source software” and buck the status quo. Currently, DOD uses open source software “infrequently and on an ad hoc basis,” unlike tech companies like Google, Amazon and Facebook that wouldn’t exist without open source software.
  • The Honey Trap of Copy/Pasting Open Source Code
    I couldn’t agree more with Bill Sourour’s article ‘Copy.Paste.Code?’ which says that copying and pasting code snippets from sources like Google and StackOverflow is fine as long as you understand how they work. However, the same logic can’t be applied to open source code. When I started open source coding at the tender age of fourteen, I was none the wiser to the pitfalls of copy/pasting open source code. I took it for granted that if a particular snippet performed my desired function, I could just insert it into my code, revelling in the fact that I'd just gotten one step closer to getting my software up and running. Yet, since then, through much trial and error, I’ve learned a thing or two about how to use open source code effectively.
  • Affordable, Open Source, 3D Printable CNC Machine is Now on Kickstarter
    The appeals of Kickstarter campaigns are many. There are the rewards for backers, frequently taking the form of either deep discounts on the final product or unusual items that can’t be found anywhere else. Pledging to support any crowdfunding campaign is a gamble, but it’s an exciting gamble; just browsing Kickstarter is pretty exciting, in fact, especially in the technological categories. Inventive individuals and startups offer new twists on machines like 3D printers and CNC machines – often for much less cost than others on the market.
  • Open Standards and Open Source
    Much has changed in the telecommunications industry in the years since Standards Development Organization (SDOs) such as 3GPP, ITU and OMA were formed. In the early days of telecom and the Internet, as fundamental technology was being invented, it was imperative for the growth of the new markets that standards were established prior to large-scale deployment of technology and related services. The process for development of these standards followed a traditional "waterfall" approach, which helped to harmonize (sometimes competing) pre-standard technical solutions to market needs.

Leftovers: BSD

  • The Voicemail Scammers Never Got Past Our OpenBSD Greylisting
    We usually don't see much of the scammy spam and malware. But that one time we went looking for them, we found a campaign where our OpenBSD greylisting setup was 100% effective in stopping the miscreants' messages. During August 23rd to August 24th 2016, a spam campaign was executed with what appears to have been a ransomware payload. I had not noticed anything particularly unusual about the bsdly.net and friends setup that morning, but then Xavier Mertens' post at isc.sans.edu Voice Message Notifications Deliver Ransomware caught my attention in the tweetstream, and I decided to have a look.
  • Why FreeBSD Doesn't Aim For OpenMP Support Out-Of-The-Box