Vue normale
Security updates for Wednesday
[$] Magit and Majutsu: discoverable version-control
Jujutsu is an increasingly popular Git-compatible version-control system. It has a focus on simplifying Git's conceptual model to produce a smoother, clearer command-line experience. Some people already have a preferred replacement for Git's usual command-line interface, though: Magit, an Emacs package for working with Git repositories that also tries to make the interface more discoverable. Now, a handful of people are working to implement a Magit-style interface for Jujutsu: Majutsu.
CBP Tapped Into the Online Advertising Ecosystem To Track Peoples’ Movements (404 Media)
Specifically, CBP says the data was in part sourced via real-time bidding, or RTB. Whenever an advertisement is displayed inside an app, a near instantaneous bidding process happens with companies vying to have their advert served to a certain demographic. A side effect of this is that surveillance firms, or rogue advertising companies working on their behalf, can observe this process and siphon information about mobile phones, including their location. All of this is essentially invisible to an ordinary phone user, but happens constantly.
We should note that the minimal advertising shown on LWN is not delivered via this bidding system.
[$] Free software needs free tools
One of the contradictions of the modern open-source movement is that projects which respect user freedoms often rely on proprietary tools that do not: communities often turn to non-free software for code hosting, communication, and more. At Configuration Management Camp (CfgMgmtCamp) 2026, Jan Ainali spoke about the need for open-source projects to adopt open tools; he hoped to persuade new and mature projects to switch to open alternatives, even if just one tool, to reduce their dependencies on tech giants and support community-driven infrastructure.
Garrett: To update blobs or not to update blobs
I trust my CPU vendor. I don't trust my CPU vendor because I want to, I trust my CPU vendor because I have no choice. I don't think it's likely that my CPU vendor has designed a CPU that identifies when I'm generating cryptographic keys and biases the RNG output so my keys are significantly weaker than they look, but it's not literally impossible. I generate keys on it anyway, because what choice do I have? At some point I will buy a new laptop because Electron will no longer fit in 32GB of RAM and I will have to make the same affirmation of trust, because the alternative is that I just don't have a computer.
Security updates for Tuesday
[$] The ongoing quest for atomic buffered writes
Høiland-Jørgensen: The inner workings of TCP zero-copy
Since the memory is being copied directly from userspace to the network device, the userspace application has to keep it around unmodified, until it has finished sending. The sendmsg() syscall itself is asynchronous, and will return without waiting for this. Instead, once the memory buffers are no longer needed by the stack, the kernel will return a notification to userspace that the buffers can be reused.
Texinfo 7.3 released
Version 7.3 of Texinfo, the GNU documentation-formatting system, has been released. It contains a number of new features, performance improvements, and enhancements.
[$] The exploitation paradox in open source
The free and open-source software (FOSS) movements have always been
about giving freedom and power to individuals and organizations;
throughout that history, though, there have also been actors trying
to exploit FOSS to their own advantage. At Configuration Management
Camp (CfgMgmtCamp) 2026 in Ghent, Belgium, Richard Fontana described
the "exploitation paradox
" of open source: the recurring
pattern of crises when actors exploit loopholes to restrict freedoms
or gain the upper hand over others in the community. He also talked
about the attempts to close those loopholes as well as the need to
look beyond licenses as a means of keeping freedom alive.
Motorola announces a partnership with the GrapheneOS Foundation
Together, Motorola and the GrapheneOS Foundation will work to strengthen smartphone security and collaborate on future devices engineered with GrapheneOS compatibility.". LWN looked at GrapheneOS last July.
Gram 1.0 released
Version
1.0 of Gram, an "opinionated fork of the Zed code editor
",
has been released. Gram removes telemetry, AI features, collaboration
features, and more. It adds built-in documentation, support for
additional languages, and tab-completion features similar to the Supertab
plugin for Vim. The mission statement for
the project explains:
At first, I tried to build some other efforts I found online to make Zed work without the AI features just so I could check it out, but didn't manage to get them to work. At some point, the curiosity turned into spite. I became determined to not only get the editor to run without all of the misfeatures, but to make it a full-blown fork of the project. Independent of corporate control, in the spirit of Vim and the late Bram Moolenaar who could have added subscription fees and abusive license agreements had he so wanted, but instead gave his work as a gift to the world and asked only for donations to a good cause close to his heart in return.
This is the result. Feel free to build it and see if it works for you. There is no license agreement or subscription beyond the open source license of the code (GPLv3). It is yours now, to do with as you please.
According to a blog post on the site, the plan for the editor is to diverge from Zed and proceed slowly.
Security updates for Monday
Kernel prepatch 7.0-rc2
So I'm not super-happy with how big this is, but I'm hoping it's just the random timing noise we see every once in a while where I just happen to get more pull requests one week, only for the next week to then be quieter.
groff 1.24.0 released
[$] The troubles with Boolean inversion in Python
Two new stable kernels, possible regression
getting a repeatable Oops right when networking is initialized, likely when nft is loading its ruleset"; the problem did not appear to be present in 6.18.14. Users of nftables may wish to hold off on upgrades to 6.19.4 for now. We will provide updates as they are available.
Update: Kroah-Hartman has released the 6.19.5 and 6.18.15 kernels with a fix for the regression in 6.19.4 and 6.18.14. All users of netfilter are advised to upgrade to those versions.