Vue lecture

[$] LWN.net Weekly Edition for January 30, 2025

✇LWN
Par : corbet
Inside this week's LWN.net Weekly Edition:

  • Front: Go vendoring in Fedora; Rust 2024 edition; 6.14 Merge window; uretprobe(); FOSDEM keynote; Earthstar.
  • Briefs: Git security; Ubuntu discussion; LWN EPUBs; Facebook moderation; Quotes; ...
  • Announcements: Newsletters, conferences, security updates, patches, and more.

Incus 6.9 released

✇LWN
Par : jzb

Version 6.9 of the Incus container and virtual-machine management system has been released. Changes include a command to provide virtual machine memory dumps, ability to set network ACLs for instances on bridged networks, and more.

Emilia Pérez : 4 dates clés pour comprendre les polémiques autour du film de Jacques Audiard, nommé aux Oscars et aux César

Le dernier long-métrage de Jacques Audiard récolte une pluie de récompenses, depuis son couronnement au Festival de Cannes, avec le Prix du jury et le Prix d'interprétation féminine collectif. Mais ces dernières semaines, Emilia Pérez se trouve au cœur de nombreuses polémiques. On vous résume la situation autour de ce film, nommé aux Oscars et aux César 2025, en 4 dates clés.

Meilleure souris gamer : 5 modèles pour dominer vos parties

Avoir un PC suffisamment puissant ne fait pas tout. Si vous voulez briller en jeu, les périphériques, et en particulier la souris, peuvent considérablement améliorer votre skill. Dans ce guide, on vous aide à dénicher LA souris parfaite pour jouer comme un pro. Bon, on ne va pas vous mentir, il faudra quand même s'entraîner un peu si vous voulez vous rapprocher du niveau d’un Faker ou d’un ZywOo

LWN in EPUB format

✇LWN
Par : corbet
For years we have had occasional requests to be able to receive LWN in a format for ebook readers. It took a while, but we are now happy to announce that all of LWN's feature content is available, to subscribers at the "professional hacker" level and above, in the EPUB format. To obtain the weekly edition as an EPUB file, just click the "Download EPUB" link in the left column. There is a separate RSS feed for the EPUB format as well. Any other feature content can be turned into an ebook by appending /epub to its URL.

We will also be creating special EPUB books at times. As an example of what is possible, our complete coverage from Kangrejos 2024 and the 2024 Linux Storage, Filesystem, Memory Management, and BPF Summit are available to all readers.

There are surely places where our EPUB books can be improved; please feel free to drop us a note (at lwn@lwn.net) with suggestions.

Credential-leaking vulnerability in some Git credential managers

✇LWN
Par : daroc

Security researcher RyotaK has shared a series of vulnerabilities that all have to do with how Git interfaces with external credential managers. In short, while Git guards against newline characters (\n) being injected into a repository's URL, some programming languages also treat carriage return characters (\r) as being newlines. Adding a carriage return to a repository's URL can cause Git and the credential manager to disagree on how the URL should be parsed, ultimately resulting in Git credentials being sent to the wrong host. Malicious repositories could include Git submodules with malformed URLs, triggering the bug. Only password-based authentication with an external credential manager is vulnerable to this attack; SSH-based authentication remains secure. The Git project has chosen to consider this a vulnerability in Git, given the large amount of external software affected. The project has fixed the bug on its end by releasing updates for all supported versions that ban carriage returns in URLs entirely.

Affected software includes GitHub Desktop, Git LFS, and possibly other Git utilities:

Since Git itself doesn't use .lfsconfig file, specifying the URL that contains the newline character in .lfsconfig causes Git LFS to insert the newline character into the message, while bypassing [...] Git's validation.

[$] Offline applications with Earthstar

✇LWN
Par : daroc

Earthstar is a privacy-oriented, offline-first, LGPL-licensed database intended to support distributed applications. Unlike other distributed storage libraries, it focuses on providing mutable data with human-meaningful names and modification times, which gives it an interface similar to many non-distributed key-value databases. Now, the developers are looking at switching to a new synchronization protocol — one that is general enough that it might see wider adoption.

Ubuntu developer discussion moving to Matrix

✇LWN
Par : jzb

Ubuntu will be moving its "official realtime communications channels" from IRC to Matrix, beginning March 1, 2025, following a discussion on the ubuntu-devel mailing list.

"Official" communication, such as making realtime requests of privileged Ubuntu developer teams, could be expected to be actioned if requested on Matrix only. Similarly, you can consider your social responsibility to other developers in relation to your work in Ubuntu development to be fulfilled if you are present on that platform. And Canonical will follow in its requirement for its employed Ubuntu developers to be present on that agreed platform during their working hours.

Security updates for Wednesday

✇LWN
Par : jzb
Security updates have been issued by AlmaLinux (bzip2, gimp:2.8, keepalived, mariadb:10.11, mariadb:10.5, python-jinja2, and redis), Debian (iperf3, libtar, and pdns-recursor), Fedora (abseil-cpp, dotnet8.0, dotnet9.0, golang, libsoup3, and vaultwarden), Oracle (gimp:2.8, iperf3, keepalived, kernel, redis:7, and unbound), Red Hat (libsoup), SUSE (amazon-ssm-agent, go1.22, go1.23, iperf, java-21-openjdk, nginx, openvpn, and python311-asteval), and Ubuntu (kernel, libmicrodns, linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux, linux-azure, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi, linux, linux-azure, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-hwe-6.8, linux-ibm, linux-lowlatency, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-oracle, linux-oracle-6.8, linux-raspi, linux, linux-azure, linux-gcp, linux-oem-6.11, linux-raspi, linux-realtime, linux, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-oem-6.8, rsync, and tcpreplay).
❌