Linux 5.9: Checkpoint/Restore and Scheduler Improvements

• Checkpoint/Restore Of Unprivileged Processes Sent In For Linux 5.9

  Linux 5.9 is bringing another feature that's long been baking and of interest to a growing number of stakeholders... checkpoint/restore functionality of unprivileged processes. With Linux 5.9 all the pieces should be in place for allowing checkpoint/restore of processes not running as root. This saving and restoring of processes can be used for functionality like container migration, moving workloads in HPC environments, or for the Java JVM to speed-up startup time. The Linux kernel has supported checkpoint/restore of processes but only as root until now.

• Linux 5.9 Continues Working On A Variety Of Scheduler Improvements

  Among the many pull requests sent in for the Linux 5.9 merge window by longtime developer Ingo Molnar are the usual assortment of scheduler improvements. [...] - The deadline scheduler is now capacity-aware and has seen other improvements too. - UClamp performance improvements for this utilization clamping functionality. - Cleanups to the energy/power-aware scheduling.

Remembering Thomas Gilliard (satellit)

I’m sad to report that Thomas Gilliard (satellit), who was a valued member of the QA team for many years, passed away last week. His wife contacted me with the news. Thomas was a regular and reassuring presence at QA and blocker review meetings and ran many thousands of tests since he first joined the team in 2009. He was particularly dedicated to testing our Sugar builds. We’ll miss him. Also: Implementation of varlink support for libnmstate – GSoC’20 nmstate project

Programming Leftovers

• RcppCCTZ 0.2.8: Minor API Extension

  RcppCCTZ uses Rcpp to bring CCTZ to R. CCTZ is a C++ library for translating between absolute and civil times using the rules of a time zone. In fact, it is two libraries. One for dealing with civil time: human-readable dates and times, and one for converting between between absolute and civil times via time zones. And while CCTZ is made by Google(rs), it is not an official Google product. The RcppCCTZ page has a few usage examples and details. This package was the first CRAN package to use CCTZ; by now at least three others do—using copies in their packages which remains less than ideal.

• Kafka Monthly Digest – July 2020

  In this 30th edition of the Kafka Monthly Digest, I’ll cover what happened in the Apache Kafka community in July 2020.

• GDScript progress report: New GDScript is now merged

  As some of you might be aware, the refactor that I have been working on lately is now merged into the master branch. This is the work explained in previous progress reports.

• An open source solution for continuous testing at scale

  In Sogeti's most recent World Quality Report, software testing ranked No. 1 in terms of its contributions to business objectives and growth, making it a key enabler for business digitalization. Despite this, the software testing industry still reports major pain points related to test maintenance, automation, tooling, and skills. Most of the tooling in common use lacks capabilities, is too complex to integrate, provides insufficient intelligence, or is too difficult to use. Cerberus Testing provides a solution to these problems. It is a test automation solution built by retail companies to support digitalization initiatives and focuses on usability, scalability, and integration of the test lifecycle process.

• Use your favorite programming language to provision Infrastructure as Code

  As you navigate the world of IT and technology, there are some terms you come across repeatedly. Some of them are hard to quantify and may take on different meanings as time goes on. "DevOps" is an example of a word that seems (to me) to change depending on the person using it; the original DevOps pioneers might not even recognize what we call DevOps today. If you're a software developer, "Infrastructure as Code" (IaC) may be one of those terms. IaC is using the same software-development practices you'd use to write user-facing features to declare the infrastructure that applications run on. This often means using tools like Git or Mercurial for version control and Puppet, Chef, or Ansible for configuration management. At the infrastructure-provisioning layer, the most common technology is CloudFormation (for AWS specifically) or Terraform as an open source alternative for creating hybrid-cloud resources for your applications to run on. Explore the open source cloud Understanding clouds Free online course: Developing cloud-native applications with microservices architectures What is hybrid cloud? eBook: Building a hybrid cloud strategy What is Kubernetes?

Security: Ransom, Patches and Back Doors

       

• Dozens of NGOs hit by hack on US fundraising database

  A major ransomware attack has affected dozens of international NGOs and their records of private donations, but details of the hit on a US fundraising platform are scarce, and two weeks after being warned some aid groups are yet to notify their donors or the public. International aid groups – and their private donors – are among those whose data was hacked in a security breach at online service provider Blackbaud. Names, addresses, and records of individual donations were compromised by hackers, who were paid an undisclosed ransom to return the data and delete any copies.  World Vision, Save the Children, and Human Rights Watch are among the large nonprofits impacted by the breach, and media reports suggest at least 200 customers of US-based Blackbaud were involved, although the company has not provided a list of affected clients. Alan Bryce, an official at the Charity Commission – the legal regulator in England and Wales – told The New Humanitarian that, as of 4 August, 63 UK-based charities had notified them after being affected by the ransomware attack. Bryce suggested NGOs were likely to tighten up procedures following the incident, in which hackers gained control of client data on Blackbaud’s systems and locked the company out until payment was made. “Charities who have suffered cybercrime go on to revise their IT security, their training programmes, or their website security,” he said. “Do not wait until it is too late for your charity.”

• The fixes to the Linux BootHole fixes are in

  The first release of patches to the Linux BootHole came with a show-stopping problem. The fixed machines wouldn't boot. For the most part, that problem has been solved.

• GRUB2 Boot Failure Issues Fixed in Debian and Ubuntu, Update Now

  The recent GRUB2 updates that patched some serious security vulnerabilities also caused boot failure issues for some users, so fixes for these regressions have started appearing for some distros, including Debian and Ubuntu. Last week, I was reporting on the BootHole vulnerability (and some other seven flaws) found in the GRUB2 bootloader, which is used by almost all GNU/Linux distributions out there. The issues opened up systems using Secure Boot to attacks, allowing local attackers to bypass UEFI Secure Boot restrictions and execute arbitrary code. Due to a highly coordinated effort between the security researchers who discovered the vulnerability and Linux OS maintainers, most GNU/Linux distributions were able to provide patches for their users. However, for some, these patches broke the Secure Boot implementation and left people with unbootable systems.

       

• IoT Security Vulnerabilities are Ubiquitous: How To Secure Your Router and Your Linux System Now

  Luckily, there are various measures that Linux users can take to secure their wireless routers and protect their systems - most notably, conducting a Linux firmware replacement. This article will explore the benefits of “flashing” your wireless router with alternative open-source firmware, and will introduce some great alternative firmwares and single-purpose OSes that you may wish to look into. [...] Recent security research has made it clear that router manufacturers are dropping the ball on security - a discouraging trend in the industry that needs to change. However, given this unfortunate reality, it is imperative that users assume responsibility for securing their wireless routers.