Zack’s Kernel News
Zack’s Kernel News
Chronicler Zack Brown reports on the latest news, views, dilemmas, and developments within the Linux kernel community.
Recently, the kernel.org servers were cracked by attackers who were able to gain root-level access. The attackers then inserted trojan horses into the source releases for certain Linux kernel release candidates (-rc releases). This attack caused a lot of work for the kernel. org system administrators and resulted in a number of discussion threads on the linux-kernel mailing list, considering ways to avoid similar security compromises in the future.
In one thread, Junio C Hamano, the Git maintainer, asked the kernel folks if there were any special Git features they wanted, that might increase the security of a Git archive that involved many contributors (e.g., the Linux kernel). He suggested providing the ability to cryptographically sign all pushes, as well as having Git produce more output on certain types of failure modes. Linus Torvalds replied, saying he liked the idea of increased verbosity; but, about cryptographic signatures, he said:
"I realize that cryptographic signatures sound very important right now, but in the end, *real* trust comes from people, not from signatures. Realistically, I checked a few signatures this time around due to the kernel.org issues, but at the same time, the thing that made me trust most of it was just looking at commits and the email messages. The unconscious and non-cryptographic 'signature' of a person acting like you expect a person to act."
"Technical measures can be subverted, and I think we should also think about the social side. Every time somebody mentions a signature,I want to also mention 'human readability', because I think that matters as much, if not more."
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
News
-
GNOME 43 To Bring Some Exciting New Features
GNOME 43 is getting close to the first alpha development release and it promises to add one particular feature that should be exciting to several users.
-
KaOS 2022.06 Now Available With KDE Plasma 5.25
The newest iteration of KaOS Linux not only adds the latest KDE Plasma desktop but sets LibreOffice as the default.
-
Manjaro 21.3.0 Is Now Available
Manjaro “Ruah” has been released and includes the latest Calamares installer, GNOME 42, and much more.
-
SpiralLinux is a New Linux Distribution Focused on Simplicity
A new Linux distribution, from the creator of GeckoLinux, is a Debian-based operating system with a focus on simplicity and ease of use.
-
HP Dev One Linux Laptop is Now Available for Pre-Order
The System76/HP collaboration Dev One laptop, geared toward developers, is now available for pre-order.
-
NixOS 22.5 Is Now Available
The latest release of NixOS with a much-improved package manager and a user-friendly graphical installer.
-
System76 Teams up with HP to Create the Dev One Laptop
HP and System76 have come together to develop a new laptop, powered by Pop!_OS and aimed toward developers.
-
Titan Linux is a New KDE Linux Based on Debian Stable
Titan Linux is a new Debian-based Linux distribution that features the KDE Plasma desktop with a focus on usability and performance.
-
Danielle Foré Has an Update for elementary OS 7
Now that Ubuntu 22.04 has been released, the team behind elementary OS is preparing for the upcoming 7.0 release.
-
Linux New Media Launches Open Source JobHub
New job website focuses on connecting technical and non-technical professionals with organizations in open source.