LWN.net's Journal
 
 [Most Recent Entries] [Calendar View]

Wednesday, April 1st, 2020

    Time Event
    2:55p
    Security updates for Wednesday
    Security updates have been issued by Debian (apng2gif, gst-plugins-bad0.10, and libpam-krb5), Fedora (coturn, libarchive, and phpMyAdmin), Mageia (chromium-browser-stable, nghttp2, php, phpmyadmin, sympa, and vim), openSUSE (GraphicsMagick, ldns, phpMyAdmin, python-mysql-connector-python, python-nltk, and tor), Red Hat (advancecomp, avahi, bash, bind, bluez, buildah, chromium-browser, cups, curl, docker, dovecot, doxygen, dpdk, evolution, expat, file, gettext, GNOME, httpd, idm:DL1, ImageMagick, kernel, kernel-rt, lftp, libosinfo, libqb, libreoffice, libsndfile, libxml2, mailman, mariadb, mod_auth_mellon, mutt, nbdkit, net-snmp, nss-softokn, okular, php, podman, polkit, poppler and evince, procps-ng, python, python-twisted-web, python3, qemu-kvm, qemu-kvm-ma, qt, rsyslog, samba, skopeo, squid, systemd, taglib, texlive, unzip, virt:8.1, wireshark, and zziplib), Slackware (gnutls and httpd), and SUSE (glibc, icu, kernel, and mariadb).
    3:00p
    Stable kernel updates
    Stable kernels 5.6.1, 5.5.14, and 5.4.29 have been released with the usual set
    of important fixes. Users should upgrade.
    3:06p
    OpenWRT code-execution bug puts millions of devices at risk (Ars Technica)
    Ars Technica reports
    on the recently disclosed OpenWrt package verification vulnerability. The
    headline may be a bit overwrought, though. "These code-execution
    exploits are limited in their scope because adversaries must either be in a
    position to conduct a man-in-the-middle attack or tamper with the DNS
    server that a device uses to find the update on the Internet. That means
    routers on a network that has no malicious users and using a legitimate DNS
    server are safe from attack.    " It also assumes that people actually
    update their routers, which seems unlikely in most cases in the real world.
    4:03p
    [$] Three candidates vying to be DPL
    The annual Debian project leader (DPL) election is well underway at this point;
    voting begins in early April and the outcome will be known after the polls
    close on April 18. Outgoing DPL Sam Hartman posted a lengthy
    "non-platform" in the run-up to the election, which detailed the highs and
    lows of his term, perhaps providing something of a roadmap, complete with
    pitfalls, for potential candidates—Hartman is not running again this
    time. When the nomination period completed,
    three people put their hats
    into the ring    : Jonathan Carter, Sruthi Chandran, and Brian Gupta.
    Their platforms have been posted and there have been several threads on the
    debian-vote mailing list with questions for the candidates; it seems like a
    good time to look in on the race.
    5:21p
    New 4.0 LTS releases for LXD, LXC and LXCFS
    The LXD system container and virtual manager, LXC container runtime, and
    LXCFS FUSE filesystem projects have released version 4.0 LTS. LTS versions
    of these intertwined projects are released every 2 years and receive 5
    years of security and bugfix support.
    10:43p
    [$] Reworking StringIO concatenation in Python
    Python string objects are immutable, so changing the value of a string
    requires that a new string object be created with the new value. That is
    fairly well-understood within the community, but there are some
    "anti-patterns" that arise; it is pretty common for new users to build up a
    longer string by repeatedly concatenating to the end of the "same" string.
    The performance penalty for doing that could be avoided by switching to a
    type that is geared toward incremental updates, but Python 3 has
    already optimized the penalty away for regular strings. A recent thread on the python-ideas
    mailing list explored this topic some.

    << Previous Day 2020/04/01
    [Calendar]     		Next Day >>

LWN.net   About LJ.Rossia.org