in new account welcome to lwn.net lwn.net is a reader supported news site dedicated to producing the best coverage from within the linux and free software development communities . see the lwn faq for more information and please consider subscribing to gain full access and support our activities . postgresql 9.6 improves synchronous replication and more development posted oct 14 2016 18 05 utc fri by corbet the postgresql project released version 9.6 on september 29th . this new major release has an assortment of new goodies for postgresql fans including parallel query and phrase search new options for synchronous replication remote query execution using foreign data wrappers crosstab data transformations in psql and more . together with version 9.6 the community released a completely rewritten version of the pgadmin database graphical interface . we ll explore multiple synchronous replicas foreign data wrapper changes crosstabs and the new pgadmin here . full story comments none the 4.9 merge window closes kernel posted oct 15 2016 20 10 utc sat by corbet linus has released 4.9 rc1 and closed the merge window for this release one day earlier than some might have expected . my own favorite small detail under the hood happens to be andy lutomirski s new virtually mapped kernel stack allocations . they make it easier to find and recover from stack overflows but the effort also cleaned up some code and added a kernel stack mapping cache to avoid any performance downsides . the virtually mapped kernel stack work was covered here in june . there were 14 308 non merge changesets pulled for this release meaning that 4.9 will be by far the busiest development cycle ever . comments none posted lwn.net weekly edition for october 13 2016 posted oct 13 2016 0 55 utc thu the lwn.net weekly edition for october 13 2016 is available . inside this week s lwn.net weekly edition front a tale of two conferences ; color spaces ; openssl after heartbleed . security spam reduction with greylisting ; new vulnerabilities in apache bind ffmpeg freeimage ghostscript ... kernel the 4.9 merge window continues ; on kernel maintainer scalability . distributions supporting uefi secure boot in debian ; freebsd fedora ... development an update on input ; dontbug gdb kexi ... announcements fsf seeks nominations for free software awards google code in 2016 and google summer of code 2017 software patents drm ... read more celebrating open standards around the world announcements posted oct 14 2016 19 04 utc fri by ris opensource.com celebrates world standards day on october 14 . whether in the world of software where without standards we would have been unable to connect the world through the internet and the world wide web or the physical world where standards make nearly everything you buy easier more useful and safer the world would be a difficult place to navigate without standards . and critical to the useful of standards is making them available to all in an accessible free format unencumbered by legal or other hurdles . comments 5 posted an update on input front posted oct 11 2016 21 20 utc tue by jake peter hutterer gave an update on the input stack at the 2016 x.org developers conference xdc . a lot has been accomplished but there is naturally more to do especially as more and more quirky or buggy input hardware is released . but overall hutterer painted a picture of a mature subsystem that is largely feature complete at this point . full story comments 32 friday s security advisories security posted oct 14 2016 16 05 utc fri by ris arch linux has updated gdk pixbuf2 denial of service . debian has updated freeimage two vulnerabilities . debian lts has updated libxfixes integer overflow . fedora has updated dbus f24 code execution and xen f24 ; f23 three vulnerabilities . opensuse has updated compat openssl098 leap42 .1 multiple vulnerabilities derby 13.2 information leak libreoffice leap42 .1 code execution php5 leap42 .1 multiple vulnerabilities go1 .4 sph for sle12 denial of service systemd leap42 .1 denial of service and unzip 13.2 two vulnerabilities . oracle has updated kernel 4.1.12 ol7 ; ol6 stack corruption . red hat has updated mariadb galera rhosp9 ; rhelosp7 for rhel7 ; rhelosp6 for rhel7 ; rhelosp5 for rhel7 ; rhelosp5 for rhel6 sql injection privilege escalation . suse has updated xen sle12 ; sles11 sp2 multiple vulnerabilities . ubuntu has updated linux ti omap4 12.04 three vulnerabilities . comments none posted supporting uefi secure boot in debian distributions posted oct 10 2016 14 57 utc mon by corbet the debian project can be accused of many things but jumping too quickly on leading edge technology is not one of them . that can be seen in among other things the fact that there is still not a version of the distribution that supports the uefi secure boot mechanism . but as ben hutchings explained during his 2016 kernel recipes talk such support is in the works and it will be implemented in a uniquely debian like manner . full story comments 18 kde celebrates 20 years development posted oct 14 2016 13 39 utc fri by corbet kde.news notes the 20th anniversary of the kde project . in the 20 years since then so much has happened . we released great software fought for software freedom and empowered people all over the world to take charge of their digital life . in many ways we have achieved what we set out to do 20 years ago a consistent nice looking free desktop environment and more . for those feeling nostalgic there is a new version of the kde 1.1.2 desktop ported to contemporary systems . comments 5 posted openssl after heartbleed front posted oct 6 2016 21 56 utc thu by corbet rich salz and tim hudson started off their linuxcon europe 2016 talk by stating that april 3 2014 shall forever be known as the re key the internet date . that of course was the day that the heartbleed vulnerability in the openssl library was disclosed . a lot has happened with openssl since that day to the point that salz said this should be the last talk he gives that ever mentions that particular vulnerability . in the last two years the project has recovered from heartbleed and is now more vital than ever before . full story comments 18 guile security vulnerability w listening on localhost port development posted oct 13 2016 18 07 utc thu by ris christopher allan webber looks at a security vulnerability in guile . guile applications are generally not vulnerable but arbitrary scheme code may by used to attack the systems of guile developers . there is also a lesson here that applies beyond guile the presumption that localhost is only accessible by local users can t be guaranteed by modern operating system environments . if you are looking to provide local execution only we recommend using unix domain sockets or named pipes . don t rely on localhost plus some port . comments 22 posted lwn.net weekly edition for october 6 2016 posted oct 6 2016 0 00 utc thu the lwn.net weekly edition for october 6 2016 is available . inside this week s lwn.net weekly edition front high dynamic range displays ; why kernel development uses email . security cloudflare tor and eliminating captchas ; new vulnerabilities in chromium clamav libav systemd ... kernel the 4.9 merge window opens ; android explicit fencing . distributions dnf update considered harmful ; qubes os endless os ... development creating a kernel build farm ; fontforge project mortar plasma 5.8 postgresql 9.6 ... announcements moss supports open source projects new osi affiliate member llvm cauldron videos arduino ... read more ubuntu 16.10 yakkety yak released distributions posted oct 13 2016 16 39 utc thu by ris ubuntu 16.10 yakkety yak has been released . under the hood there have been updates to many core packages including a new 4.8 based kernel a switch to gcc 6 and much more . the flavors kubuntu lubuntu ubuntu gnome ubuntu kylin ubuntu mate ubuntu studio and xubuntu have also been released . ubuntu 16.10 will be supported for 9 months . full story comments 10 why kernel development still uses email kernel posted oct 1 2016 21 19 utc sat by corbet in a world full of fancy development tools and sites the kernel project s dependence on email and mailing lists can seem quaintly dated if not positively prehistoric . but as greg kroah hartman pointed out in a kernel recipes talk titled patches carved into stone tablets there are some good reasons for the kernel community s choices . rather than being a holdover from an older era email remains the best way to manage a project as large as the kernel . full story comments 68 thursday s security updates security posted oct 13 2016 16 33 utc thu by ris arch linux has updated crypto information disclosure . fedora has updated bash f23 code execution chromium f23 multiple vulnerabilities freeimage f24 ; f23 code execution mingw freeimage f24 ; f23 code execution perl dbd mysql f24 denial of service and python pillow f23 memory disclosure . mageia has updated libass three vulnerabilities and ruby encrypted ciphertext duplication . opensuse has updated flash player 13.2 ; 13.1 multiple vulnerabilities irssi leap42 .1 13.2 three vulnerabilities python suds jurko leap42 .1 symbolic link attack from 2013 systemd 13.2 denial of service tiff leap42 .1 multiple vulnerabilities and tiff 13.2 denial of service . red hat has updated flash plugin rhel5 6 multiple vulnerabilities . suse has updated firefox sle11 sp3 4 multiple vulnerabilities and flash playerqemu sle12 sp1 multiple vulnerabilities . ubuntu has updated libdbd mysql perl 14.04 12.04 three vulnerabilities and quagga 16.04 14.04 12.04 two vulnerabilities . comments none posted lwn.net weekly edition for september 29 2016 posted sep 29 2016 1 12 utc thu the lwn.net weekly edition for september 29 2016 is available . inside this week s lwn.net weekly edition front gtk version numbering ; vulkan driver anatomy ; opentype 1.8 and style attributes . security the trouble with new tls version numbers ; new vulnerabilities in bash firefox imagemagick openssl ... kernel 4.8 development statistics ; a low level hibernation bug hunt . distributions arc ; rip kristoffer h. rose ubuntu yakkety yak firefox os ... development systemd programming 30 months later ; mit license ... announcements kde advisory board lenovo laptops ... read more apache openoffice 4.1.3 released development posted oct 13 2016 16 05 utc thu by corbet the long awaited openoffice 4.1.3 release is out . apache openoffice 4.1.3 is a maintenance release incorporating important bug fixes security fixes updated dictionaries and build fixes . all users of apache openoffice 4.1.2 or earlier are advised to upgrade . full story comments 13 systemd programming 30 months later development posted sep 27 2016 14 11 utc tue by corbet some time ago we published a pair of articles about systemd programming that extolled the value of providing high quality unit files in upstream packages . the hope was that all distributions would use them and that problems could be fixed centrally rather than each distribution fixing its own problems independently . now 30 months later it seems like a good time to see how well that worked out for nfs utils the focus of much of that discussion . did distributors benefit from upstream unit files and what sort of problems were encountered full story comments 64 security advisories for wednesday security posted oct 12 2016 15 56 utc wed by ris centos has updated kernel c7 stack corruption tomcat c7 multiple vulnerabilities and tomcat6 c6 multiple vulnerabilities . debian has updated ghostscript multiple vulnerabilities . fedora has updated ca certificates f24 certificate update nsd f24 denial of service and openssl f23 multiple vulnerabilities . gentoo has updated bind multiple vulnerabilities .