Vue normale
Security updates for Wednesday
How LWN is faring in 2025
The conclusion of the FSF board review
The review examined board members Ian Kelling, Geoffrey Knauth, Henry Poole, Richard Stallman, and Gerald Sussman. The process generated detailed philosophical and policy discussions between board members and the FSF's global associate members on topics ranging from the firmness of the Free Software Definition, developments in machine learning, to the board's president position.
[$] Better debugging information for inlined kernel functions
Modern compilers perform a lot of optimizations, which can complicate debugging. Song Liu and Thierry Treyer spoke about a potential improvement to BPF Type Format (BTF) debugging information that could partially combat that problem at the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit. They want to add information on selectively inlined functions to BTF in order to better support tracing tools. Treyer participated remotely.
[$] The mystery of the Mailman 2 CVEs
Many eyebrows were raised recently when three vulnerabilities were announced that allegedly impact GNU Mailman 2.1, since many folks assumed that it was no longer being supported. That's not quite the case. Even though version 3 of the GNU Mailman mailing-list manager has been available since 2015, and version 2 was declared (mostly) end of life (EOL) in 2020, there are still plenty of users and projects still using version 2.1.x. There is, as it turns out, a big difference between mostly EOL and actually EOL. For example: WebPros, the company behind the cPanel server and web-site-management platform, still maintains a port of Mailman 2.1.x to Python 3 for its customers and was quick to respond to reports of vulnerabilities. However, the company and upstream Mailman project dispute that the CVEs are valid.
Albertson: Future of OSL in Jeopardy
I am writing to inform you about a critical and time-sensitive situation facing the Open Source Lab. Over the past several years, we have been operating at a deficit due to a decline in corporate donations. While OSU's College of Engineering (CoE) has generously filled this gap, recent changes in university funding have led to a significant reduction in CoE's budget. As a result, our current funding model is no longer sustainable and CoE needs to find ways to cut programs.Earlier this week, I was informed that unless we secure $250,000 in committed funds, the OSL will be forced to shut down later this year.
[$] LWN.net Weekly Edition for May 1, 2025
- Front: Mailman 2 vulnerabilities; AI in Debian; __nonstring__; Cache-aware scheduling; Freezing filesystems; Socket-level storage; Debugging information; LWN in 2025.
- Briefs: Debian election; Kali Linux key; OpenBSD 7.7; Firefox 138.0; GCC 15.1; Meson 1.8.0; Valgrind 3.25.0; FSF review; OSI retrospective; Mastodon; Quotes; ...
- Announcements: Newsletters, conferences, security updates, patches, and more.
Security updates for Thursday
[$] Custom out-of-memory killers in BPF
Celebrating 20 Years of the OASIS Open Document Format
The Document Foundation is celebrating the 20th anniversary of the ratification of the Open Document Format (ODF) as an OASIS standard.
Two decades after its approval in 2005, ODF is the only open standard for office documents, promoting digital independence, interoperability and content transparency worldwide. [...]
To celebrate this milestone, from today The Document Foundation will be publishing a series of presentations and documents on its blog that illustrate the unique features of ODF, tracing its history from the development and standardisation process through the activities of the Technical Committee for the submission of version 1.3 to ISO and the standardisation of version 1.4.
Redis is now available under the AGPLv3 open source license (Redis blog)
I'll be honest: I truly wanted the code I wrote for the new Vector Sets data type to be released under an open source license. Writing open source software is too rooted in me: I rarely wrote anything else in my career. I'm too old to start now. This may be childish, but I wrote Vector Sets with a huge amount of enthusiasm exactly because I knew Redis (and my new work) was going to be open source again.I understand that the core of our work is to improve Redis, to continue building a good system, useful, simple, able to change with the requirements of the software stack. Yet, returning back to an open source license is the basis for such efforts to be coherent with the Redis project, to be accepted by the user base, and to contribute to a human collective effort that is larger than any single company. So, honestly, while I can't take credit for the license switch, I hope I contributed a little bit to it, because today I'm happy. I'm happy that Redis is open source software again, under the terms of the AGPLv3 license.
Since last year's license switch, though, the Valkey project has sprung up as a fork under the original 3-clause BSD license.
Security updates for Friday
[$] Flexible data placement
Kernel prepatch 6.15-rc5
So it all feels like things are just continuing to go well this release. Let's hope I didn't jinx it by saying so."
Security updates for Monday
Two stable kernels released—with build fixes only
[$] Injecting speculation barriers into BPF programs
A new AUTOSEL release
Unlike the previous version that relied on word statistics and older neural network techniques, AUTOSEL leverages modern large language models and embedding technology to provide significantly more accurate recommendations.