Archive

Linux 4.4 released

Linux 4.4 has been released This release adds support for 3D support in virtual GPU driver, which allows 3D hardware-accelerated graphics in virtualization guests; loop device support for Direct I/O and Asynchronous I/O, which saves memory and increases performance; support for Open-channel SSDs, which are devices that share the responsibility of the Flash Translation Layer with the operating system; the TCP listener handling is completely lockless and allows for faster and more scalable TCP servers; journalled RAID5 in the MD layer which fixes the RAID write hole; eBPF programs can now be run by unprivileged users, and perf has added support for eBPF programs aswell; a new mlock2() syscall that allows users to request memory to be locked on page fault; and block polling support.

There are also new drivers and many other small improvements. Here is the full list of changes.

Review: Mint 17.3 may be the best Linux desktop distro yet

Linux Mint 17.3 is the final Mint 17 release and should put to rest any worries about Mint's plan to stick with Ubuntu LTS releases for its base. Mint has done what it set up to do, namely improve the Cinnamon desktop to the point that it not only matches, but in many places far exceeds the user experience found in other options like GNOME, and especially, Unity.

Indeed, it's hard to look at Mint 17.3 without comparing it to its upstream base. While Mint has been continually working hard on the desktop and cranking out release after release, Ubuntu has stagnated. If Ubuntu wants to leapfrog past some of its pain points, its developers would do well to look downstream. Mint's package management tools are simpler, more comprehensive, and easier to use than anything Ubuntu offers. Mint also manages to do all this without anything even remotely close to the resources Ubuntu enjoys.

Genode’s new TrustZone demo on the USB Armory

In their latest article, the developers of the Genode OS Framework document the long-winded way to their new ARM TrustZone demo on the USB Armory - an open source flash drive sized computer. This undertaking was motivated by the prospect to put Linux, which normally runs on the USB Armory, under the supervision of a significantly less complex Genode hypervisor. This construction enables shielding sensitive information like cryptographic keys from Linux by exposing them to Genode only and thereby drastically reduces the attack surface.

The article illustrates how the TrustZone technology is used to isolate Genode from Linux without compromising the rich feature set of Linux, and how both worlds can safely communicate with each other. Finally, the article provides you with all tools and information for easily bringing the demo to your own USB Armory.

Genode 15.11 puts emphasis on desktop computing

With the just released version 15.11, the Genode OS framework takes a big step towards desktop computing. On that account, its GUI and audio stacks have become much more modular, dynamic, and flexible. Moreover, the release features the port of Intel KMS from Linux, extends the support for the USB Armory and Xilinx Zynq-7000, and introduces new file-system infrastructure such as a VFS server.

In their release documentation, the Genode developers dedicate an entire section (including screenshots) to the ambition to use Genode as desktop OS. It turns out that the framework's existing component architecture solves a number of difficult problems in new and elegant ways. For example, the configuration of all types of components - be it low-level device drivers or high-level GUI components - can be edited live with a plain text editor. The changes become effective by merely saving a file. This works even for components that have no means or permissions to access a file system at all. Another interesting twist on classical GUI-integration features is Genode's new copy-and-paste mechanism that prevents the clipboard to be misused by malicious applications as a covert information channel while retaining the convenience of traditional clipboard mechanisms.

At a lower level, the desktop theme of the release is supported by the new Intel KMS driver ported from the Linux kernel. It allows the use of multiple displays, and screen resolutions can be switched on the fly. With nearly 70,000 SLOC of Linux kernel code, the porting was a major feat. This work continues the pattern of reusing Linux kernel code, which already enabled Genode to use the Intel wireless stack, the Linux USB stack, and the Linux TCP/IP stack as user-level components. The Intel KMS driver is interesting also in another respect: Since it is tightly coupled with the Intel GEM and DRM infrastructure of the Linux kernel, those subsystems had to be ported as well. So the driver may become a suitable starting point for the development of a future GPU multiplexer.

Thanks to the developer's continuous focus on making the framework fit for day-to-day computing, Genode is now used by a hand full of die-hard Genode enthusiasts as their primary OS. Still, many tasks are carried out via a guest OS in VirtualBox. But all of the circa 40 underlying components such as the kernel, device drivers, protocol stacks, and a growing number of applications are working nicely together and are stable and fast enough to get productive work done.

Besides the main focus on desktop computing, the release is not short of other areas of improvement. Xilinx Zynq-7000 has been added to the supported platforms, TrustZone on the USB Armory received a lot of attention, and a new VFS server makes Genode's file-system infrastructure much more flexible. Those and many more topics are covered by the detailed release documentation.

Open letter to Jolla community: through the tough times

From the Jolla Blog:

Many of you have been rightfully asking, where did our tablet money go? Below is an analysis of it in a simple graph. Big part of the tablet project went to Sailfish OS software development (more than 50% of project costs). As I have said in earlier blogs, hardware is the easy part, software is the king (and the beast).

Overall, as I also explained in a recent TechCrunch interview, the alternative OS is a really big and challenging agenda. But I still believe it is moving ahead, yet very slowly. The primary challenge for us is that our agenda might be somewhat forward leaning, and we need to wait until the world catches up with this vision that other OSs are heavily needed to create an alternative for Android. The interest for our agenda is just now emerging. I firmly believe that companies and consumers will soon realize that the world really needs options in mobile OSs. We've already had many interesting discussions with potential new partners about using Sailfish OS in their own projects. I'm looking forward to announcing the results of these talks soon.

I wonder how the story would have been different if Sailfish OS were free software and had a strong community to aid in software development.

Some good news, some bad news about digital rights

The bad news:

For months, privacy advocates have asked Congress to kill or reform the Cybersecurity Information Sharing Act, a bill that they say hides new government surveillance mechanisms in the guise of security protections. Now the Senate has shot down a series of attempts to change the legislation’s most controversial measures, and then passed it with those privacy-invasive features fully intact.

The good news:

The new rules for exemptions to copyright's DRM-circumvention laws were issued today, and the Librarian of Congress has granted much of what EFF asked for over the course of months of extensive briefs and hearings. The exemptions we requested - ripping DVDs and Blurays for making fair use remixes and analysis; preserving video games and running multiplayer servers after publishers have abandoned them; jailbreaking cell phones, tablets, and other portable computing devices to run third party software; and security research and modification and repairs on cars - have each been accepted, subject to some important caveats.

A history of modern init systems

The subject of process management, supervision and init(8) for Unix-like systems is one plagued by a large degree of ahistoricity and "pop culture" explanations. This leads to a lot of confusion and misunderstanding surrounding feature sets and how one formulates the problems surrounding reliable process management on Unix in general, making it a ripe topic for demagogues of all persuasions.

The purpose of this article is to set the record straight on the history of attempts to create "modern" init systems, where we define "modern" somewhat broadly as anything that tries to improve the classical BSD and System V styles of initialization and service management.

Genode 15.08 runs on top of the Muen separation kernel

The Genode project announced the version 15.08 of their OS framework. The most prominent topics of the current release are the use of Genode as day-to-day operating system by their developers and the added ability to run Genode-based systems on top of the Muen separation kernel.

Where monolithic kernel architectures represent one extreme with respect to kernel complexity, separation kernels mark the opposite end. The code complexity of monolithic OS kernels such as Linux is usually counted in terms of millions of lines of code. In stark contrast, modern microkernels such as NOVA and seL4 are comprised of only ten thousand lines of code. Separation kernels go even a step further by reducing the code complexity to only a few thousand lines of code. How is that possible? The answer lies in the scope of functionality addressed by the different types of kernels. The high complexity of monolithic kernels stems from the fact that all major OS functionalities are considered as being in the scope of the kernel. In particular, device drivers and protocol stacks account for most of the code in such kernels. Microkernels disregard such functionalities from the scope of the kernel by moving them to user-level components. The kernel solely retains the functionality that is fundamentally needed to enable those components to work and collaborate. In order to accommodate a wide range of workloads, microkernels typically provide interfaces to user land that enable the dynamic management of low-level resources such as memory, devices, and processing time. Genode's designated role is to supplement microkernels with a scalable and secure user-level OS architecture. In contrast to microkernels, separation kernels disregard dynamic resource management from their scope. All physical resources are statically assigned to a fixed set of partitions at system-integration time and remain unchanged over the lifetime of the system. The flexibility of microkernels is traded for the benefit of further complexity reduction. Their low complexity of just a few thousand lines of code make separation kernels appealing for high-assurance computing. On the other hand, their static nature imposes limitations on their application areas.

Muen as a representative of separation kernels is special in two ways. First, whereas most separation kernels are proprietary software solutions, Muen is an open-source project. Second, the kernel is implemented in the safe SPARK programming language, which is able to formally verify the absence of implementation bugs such as buffer overflows, integer-range violations, and exceptions. Thanks to the close collaboration between the Muen developers and the Genode community, the assurance of the Muen separation kernel can now be combined with the rich component infrastructure provided by Genode. From Genode's perspective, Muen is another architecture for their custom base-hw kernel. In fact, with Genode on Muen, a microkernel-based system is running within the static boundaries of one Muen partition. This way, the component isolation enforced by the base-hw kernel and the static isolation boundaries enforced by Muen form two lines of defense for protecting security-critical system functions from untrusted code sandboxed within a Genode subsystem.

The second major theme of the current release is the use of Genode as the day-to-day operating system by its developers. Since the beginning of June, one of the core developers is exclusively working with a Genode/NOVA-based system. The key element is VirtualBox with its powerful guest-host integration features. It allows for an evolutionary transition from Linux-centric work flows to the use of native Genode applications. Network connectivity is provided by the Intel wireless stack ported from the Linux kernel. File-system access is based on NetBSD's rump kernels. For using command-line based GNU software directly on Genode, the Noux runtime environment comes in handy. The daily use of Genode as general-purpose OS motivated many recent developments, ranging from the management of kernel memory in NOVA, over new system monitoring facilities, SMP guest support in VirtualBox, to user-facing improvements of the GUI stack. These and many more topics are covered by the comprehensive release documentation.

Haiku: introducing the launch_daemon

A significant new development as Haiku continues pushing towards a stable release.

Since the switch to our package manager, there was no longer a way to influence the boot process at all. The only file you could change was the UserBootscript which is started only after Tracker and Deskbar; the whole system is already up at this point.

The launch_daemon gives the power back to you, but also allow software you install to automatically be started on system boot as well. You can also even prevent system components from being started at all if you so wish.

A summary of features:

Furthermore, it allows for event based application start, start on demand, a multi-threaded boot process, and even enables you to talk to servers before they actually started.

Read the full article for a detailed description.

GNU Hurd 0.6 released

It has been roughly a year and a half since the last release of the GNU Hurd operating system, so it may be of interest to some readers that GNU Hurd 0.6 has been released, along with GNU Mach 1.5 (the microkernel that Hurd runs on), and GNU MIG 1.5 (the Mach Interface Generator, which generates code to handle remote procedure calls). New features include procfs and random translators, cleanups and stylistic fixes, some of which came from static analysis, message dispatching improvements; integer hashing performance improvements, a split of the init server into a startup server and an init program based on System V init, and more.

Alternative patent licensing groop for HEVC

HEVC Advance, another patent licensing group, completely independent from MPEG LA, has announced its existence, but not its licensing fees. The uncertainty and potential costs may hinder acceptance of MPEG's next generation HEVC coding format, also known as h.265.

This is good news for Google, who has just released another RC for their VP9 codec and for Xiph.org, who are finalizing their Daala.

ActiveX in South Korea to be scrapped soon

The Korean government has finally announced its plans to start removing the troublesome ActiveX software from public websites later this month in order to create a more user-friendly Internet environment.

For long, this tech-savvy country has been stuck in a time warp with its slavish dependence on Internet Explorer.

ActiveX is an ancient piece of technology that is still prominent in South Korea. It has its multiple problems that sometimes bring down the whole banking system or the public service system every year. The good news is that it will finally be over according to this news.

Google Code shuts down

Google has announced the end of its project hosting service.

As developers migrated away from Google Code, a growing share of the remaining projects were spam or abuse. Lately, the administrative load has consisted almost exclusively of abuse management. After profiling non-abusive activity on Google Code, it has become clear to us that the service simply isn’t needed anymore.

New project creation is already disabled on March 12. On August 24 the site will go read-only, to be completely shut down by Janury 25, 2016. Project data is promised to be available as tarball download throughout 2016.