The new AMD Turin CPU has implemented fixes for RSB Side Channel speculative attacks. Read my blog post at https://amitshah.net/2024/11/eraps-reduces-software-tax-for-hardware-bugs/ for info. Patches posted on lists too!

I have often complained that, even though thousands of developers are paid to work on the Linux kernel, there is not a single person whose job it is to write documentation for the kernel. The problem is wider than that, though: Alejandro Colomar, who has been maintaining the man pages collection for the last four years, can no longer afford to do it for free.

https://lwn.net/ml/all/4d7tq6a7febsoru3wjium4ekttuw2ouocv6jstdkthnacmzr6x@f2zfbe5hs7h5

Great news! In-person registration for LPC 2024 is reopened!

https://lpc.events/blog/current/index.php/2024/08/16/registration-is-now-reopened/

#linuxplumbers

#duckduckgo needs a better error message than

"There was an error displaying the search results. Please try again."

when its upstream is down. It's also weird to see the website load properly, not acknowledge any disruption in service, and still fail all searches...

@monsieuricon #redhat / #fedora changed to using "retrospectives" for those reports, which I like.

A few relevant quotes https://lwn.net/Articles/967420/ #LWN

Random, unordered, probably useless thoughts on today's apocalypxze...

Part of the success in getting this into Debian may be the result of there being no xz maintainer there. It is "maintained" by people whose attention is normally elsewhere doing occasional non-maintainer updates.

This code will have been running on the machines of a lot of distribution maintainers. If it has already been exploited, it could be that its real purpose has already been achieved and the real problem is now elsewhere. I sure hope somebody can figure out a way to determine if this backdoor has been used.

The multi-front nature of the attack, including multiple efforts to get the malicious code installed more widely more quickly, suggests we're not just dealing with a lone sociopath. I fear we'll never know who was really behind this, but I would sure like to.

There is surely more where this cam from.

Also if you're on F41 and/or think you might have installed the vulnerable xz anywhere, note that the exploit has not been fully analyzed and no one really knows what it could do. I'm currently reinstalling a couple of machines from scratch and have regenerated my SSH keys.

— Richard W.M. Jones

@msw *sigh* I see that the years pass but we're still struggling with the same problems.

Maybe, just maybe, the FLOSS movement should have considered a long time ago the need to sustainably compensate developers, rather than expect huge world changing projects to be a non compensated side gig...

https://flameeyes.blog/2011/03/28/software-is-ff-ree-just-as-long-as-nobody-cares-about-it/?mtm_campaign=social&mtm_kwd=mastodon

Microsoft ❤️ Open Source

#OpenSource #FreeSoftware #FOSS #OSS #Redis

https://web.archive.org/web/20240321093303/https://azure.microsoft.com/en-us/blog/redis-license-update-what-you-need-to-know/

Some of you know today as π-day.

But the real insiders know that today is the 30th anniversary of the 1.0 release of Linux.

I wanted to know simple daily Linux kernel CVE statistics just for fun, so wrote a script[1] and plotted the output.

$ ./vulns_stat.sh ./vulns/ 30 | ../gnuplot/plot.py --data_fmt table --type labeled-lines --xtics_rotate -90 cve_stat_30_days.png

[1] https://github.com/sjp38/lazybox/blob/master/cve_stat/vulns_stat.sh

#linux #kernel #cve #stat

A good time to remind everyone that we are remote-first and are hiring: http://jobs.frame.work

We’re seeking input from #FOSS maintainers as we design a fellowship program pilot. We want to test a support mechanism that addresses structural issues in the FOSS ecosystem, and support maintainers who work on open digital infrastructure in the public interest.

If you maintain open source projects, we would be very grateful if you could take ten minutes to respond to the survey:
https://survey.sovereigntechfund.de/968766

Please also repost and share with FOSS maintainers you know. Thanks!

@sj @paulmckrcu neat! I did not know that backstory

@sj yes indeed. I hope I mentioned how that was the right thing to do as well

@sj @paulmckrcu Wow, nice! Not only does this help the Korean community, it helps you learn about the phenomenal work done by Paul and the community, as well as writing great documentation. How much do you think you learned about RCU internals during this journey?