Vue normale

Reçu hier — 29 août 2025LWN

[$] The challenge of maintaining curl

Par :corbet
29 août 2025 à 15:20
Keynote sessions at Open Source Summit events tend not to allow much time for detailed talks, and the 2025 Open Source Summit Europe did not diverge from that pattern. Even so, Daniel Stenberg, the maintainer of the curl project, managed to cram a lot into the 15 minutes given to him. Like the maintainers of many other projects, Stenberg is feeling some stress, and the problems appear to be getting worse over time.

[$] Highlights from systemd v258: part one

Par :jzb
29 août 2025 à 14:47

The next release of systemd has been percolating for an unusually long time. Systemd releases are usually about six months apart, but v257 came out in December 2024, and v258 just now seems to be nearing the finish line; the third release candidate for v258 was published on August 20 (release notes). Now is a good time to dig in and take a look at some of the new features, enhancements, and removals coming soon to systemd. These include new workload-management features, a concept for multiple home-directory environments, and the final, once-and-for-all removal of support for control groups version 1.

Security updates for Friday

Par :daroc
29 août 2025 à 14:03
Security updates have been issued by AlmaLinux (aide, fence-agents, firefox, kernel-rt, python-cryptography, and thunderbird), Debian (golang-github-gin-contrib-cors, libxml2, and udisks2), Fedora (chromium), Oracle (postgresql16, postgresql:16, python3.11, and thunderbird), Red Hat (lz4 and mpfr), SUSE (chromium, docker, dpkg, firefox, gdk-pixbuf, git, git, git-lfs, obs-scm-bridge, python-PyYAML, gnutls, kernel, libarchive, libxml2, net-tools, netty, perl-Crypt-CBC, polkit, postgresql14, postgresql15, sqlite3, thunderbird, tomcat10, and udisks2), and Ubuntu (linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-intel-iotg-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx, linux-oracle, linux-raspi, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-6.14, linux-gcp, linux-hwe-6.14, linux-raspi, linux-realtime, linux-realtime-6.14, linux, linux-aws, linux-aws-6.8, linux-gcp, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oracle, linux-oracle-6.8, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-azure, linux-fips, linux-fips, linux-aws-fips, linux-gcp-fips, linux-gke, linux-hwe-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-raspi, linux-gke, linux-kvm, linux-oem-6.14, linux-realtime, linux-intel-iot-realtime, linux-realtime, linux-raspi-realtime, openldap, and udisks2).
Reçu avant avant-hierLWN

Python: The Documentary

Par :jzb
28 août 2025 à 21:46

Attendees at EuroPython had the chance to preview part of Python: The Documentary during a keynote panel. The full film, created by CultRepo, is now available on YouTube:

This is the story of the world's most beloved programming language: Python. What began as a side project in Amsterdam during the 1990s became the software powering artificial intelligence, data science and some of the world's biggest companies. But Python's future wasn't certain; at one point it almost disappeared.

This 90-minute documentary features Guido van Rossum, Travis Oliphant, Barry Warsaw, and many more, and they tell the story of Python's rise, its community-driven evolution, the conflicts that almost tore it apart, and the language's impact on... well... everything.

The video of the keynote is also available.

[$] Changing GNOME technical governance?

Par :jake
28 août 2025 à 09:01
The GNOME project, which recently celebrated its 28th birthday, has never had a formal technical governance; progress has been driven by individuals and groups that advocated for—and worked toward—a particular goal in an ad hoc fashion. Longtime GNOME contributor Emmanuele Bassi would like to see that change by adding cross-project teams and a steering committee for the project; to that end, he gave a talk (YouTube video) at GUADEC 2025 in late July on his idea to establish some technical governance for the project. He also put together a blog post with his notes from the talk. The audience reaction was favorable, so he has followed up on the GNOME discussion forum with an RFC on governance to try to move the effort along.

Security updates for Thursday

Par :jake
28 août 2025 à 09:01
Security updates have been issued by AlmaLinux (aide, firefox, kernel, and mod_http2), Debian (chromium and unbound), Fedora (mod_auth_openidc), Oracle (fence-agents and kernel), SUSE (ignition, jetty-minimal, kernel, libmozjs-128-0, matrix-synapse, postgresql13, postgresql15, postgresql16, and postgresql17), and Ubuntu (kernel).

Rosenzweig: Dissecting the Apple M1 GPU, the end

Par :jzb
27 août 2025 à 17:25

Alyssa Rosenzweig has written a blog post about her work to help ship a "great driver" for the Apple M1 GPU that supports OpenGL, Vulkan, and enables gaming with Proton.

We've succeeded beyond my dreams. The challenges I chased, I have tackled. The drivers are fully upstream in Mesa. Performance isn't too bad. With the Vulkan on Apple myth busted, conformant Vulkan is now coming to macOS via LunarG's KosmicKrisp project building on my work.

Satisfied, I am now stepping away from the Apple ecosystem. My friends in the Asahi Linux orbit will carry the torch from here.

Rosenzweig indicates her next project will be working on Intel's Xe-HPG graphics architecture. LWN covered her talk on Apple M1/M2 GPU drivers in October 2024.

[$] The tangled web of XSLT browser support

Par :jzb
27 août 2025 à 17:03

The Extensible Stylesheet Language Transformations (XSLT) language is used by web browsers to style XML content to make it easily readable; XSLT is part of the HTML living standard that is maintained by the Web Hypertext Application Technology Working Group (WHATWG). Only a small fraction of web sites serve content that requires web browsers to support XSLT, in part because major browser implementations have neglected the technology over the past 25 years. Now, it seems, they would like to rid themselves of it entirely. A plan to disable XSLT in Blink (Chrome's rendering engine) and a pull request by a Google Chrome developer to remove mentions of the specification from the HTML standard have been met with opposition, but arguments in favor of XSLT have proven ineffective.

GhostBSD 25.02 released

Par :jzb
27 août 2025 à 15:25

The GhostBSD project has released version 25.02 of the FreeBSD-based desktop operating system. This release brings GhostBSD up to date with FreeBSD 14.3, includes enhancements for the Software Station package management application, and introduces an "OS X-like" desktop environment based on GNUstep called Gershwin:

This early preview includes:

  • GNUstep-based desktop environment with familiar OS X-style interface
  • Seamless integration with GhostBSD tools through wrappers for installer, Software Station, Backup Station, and Update Station
  • Support for running non-GNUstep applications alongside GNUstep apps
  • Several included GNUstep applications to get you started

LWN covered GhostBSD in June 2024.

[$] The need to reliably preserve our community history

Par :corbet
27 août 2025 à 13:05
The Internet is a wonderful thing; it allows anybody to look up information of interest. Included in all of that is the history of the free-software development community; how we got to where we are says a lot about why things are the way they are and what might come next. So the takeover of Groklaw rings a loud alarm; we have been reminded that history stored on the Internet is an ephemeral thing and cannot be expected to remain available forever.

Security updates for Wednesday

Par :jzb
27 août 2025 à 13:05
Security updates have been issued by Debian (node-cipher-base), Fedora (keylime-agent-rust and libtiff), Oracle (aide, kernel, mod_http2, pam, pki-deps:10.6, python-cryptography, python3, python3.12, and thunderbird), SUSE (cheat, ffmpeg, firebird, govulncheck-vulndb, postgresql17, tomcat, tomcat10, tomcat11, ucode-intel-20250812, and v2ray-core), and Ubuntu (binutils, gst-plugins-base1.0, gst-plugins-good1.0, and linux-raspi-realtime).

[$] Shadow-stack control in clone3()

Par :corbet
26 août 2025 à 07:16
Shadow stacks are a control-flow-integrity feature designed to defend against exploits that manipulate a thread's call stack. The kernel first gained support for hardware-implemented shadow stacks, for the x86 architecture, in the 6.6 release; 64-bit Arm support followed in 6.13. This feature does not give user space much control over the allocation of shadow stacks for new threads, though; a patch series from Mark Brown may, after many attempts, finally be about to change that situation.

Security updates for Tuesday

Par :corbet
26 août 2025 à 07:13
Security updates have been issued by Debian (ffmpeg, firebird3.0, and luajit), Fedora (chromium, python3-docs, and python3.13), Oracle (aide, firefox, glibc, libxml2, and tomcat), Red Hat (aide, git, kernel, kernel-rt, libarchive, pam, python-cryptography, python3, python3.12, and webkit2gtk3), SUSE (cmake3, ffmpeg-4, kernel, kubernetes1.18, libqt4, minikube, net-tools, pam, postgresql16, proftpd, python-urllib3, python311, python312, python36, tomcat10, tomcat11, and webkit2gtk3), and Ubuntu (nginx).

New restrictions on Android app sideloading

Par :corbet
26 août 2025 à 05:01
Google has announced a new set of restrictions on the ability of users to install apps on their own devices:

Starting next year, Android will require all apps to be registered by verified developers in order to be installed by users on certified Android devices. This creates crucial accountability, making it much harder for malicious actors to quickly distribute another harmful app after we take the first one down. Think of it like an ID check at the airport, which confirms a traveler's identity but is separate from the security screening of their bags; we will be confirming who the developer is, not reviewing the content of their app or where it came from.

PyCon US 2025 recap and recordings

Par :jzb
25 août 2025 à 15:29

The PyCon team has announced that all PyCon US 2025 recordings are now available on its YouTube channel.

We had an amazing and diverse group of community members join us for PyCon US 2025, attending from 58 different countries! By the numbers, we welcomed a total attendance of 2,225 Pythonistas to the David L. Lawrence Convention Center. We couldn't be more grateful for all who supported the Python ecosystem and helped make PyCon US 2025 a huge success.

See the LWN conference index for coverage of some of the talks from PyCon US 2025.

[$] Linux's missing CRL infrastructure

Par :daroc
25 août 2025 à 14:52

In July 2024, Let's Encrypt, the nonprofit TLS certificate authority (CA), announced that it would be ending support for the online certificate status protocol (OCSP), which is used to determine when a server's signing certificate has been revoked. This prevents a compromised key from being used to impersonate a web server. The organization cited privacy concerns, and recommended that people rely on certificate revocation lists (CRLs) instead. On August 6, Let's Encrypt followed through and disabled its OCSP service. This poses a problem for Linux systems that must now rely on CRLs because, unlike on other operating systems, there is no standardized way for Linux programs to share a CRL cache.

Report: the state of commercial open source

Par :corbet
25 août 2025 à 08:54
The Linux Foundation, in cooperation with a couple of other groups, has announced the publication on the intersection of businesses and commercial open-source software (deemed "COSS"). Everything, it seems, is great, and COSS companies make a lot of money for their investors.

Even more encouraging, COSS project communities continue along healthy growth paths after the company receives venture funding. In essence, highly valued COSS companies tend to cultivate more vibrant, diverse, and integral open source ecosystems, reinforcing the idea that business value and community value are tightly coupled in successful COSS models.
❌