Zack’s Kernel News
Zack’s Kernel News
Chronicler Zack Brown reports on the latest news, views, dilemmas, and developments within the Linux kernel community.
Recently, the kernel.org servers were cracked by attackers who were able to gain root-level access. The attackers then inserted trojan horses into the source releases for certain Linux kernel release candidates (-rc releases). This attack caused a lot of work for the kernel. org system administrators and resulted in a number of discussion threads on the linux-kernel mailing list, considering ways to avoid similar security compromises in the future.
In one thread, Junio C Hamano, the Git maintainer, asked the kernel folks if there were any special Git features they wanted, that might increase the security of a Git archive that involved many contributors (e.g., the Linux kernel). He suggested providing the ability to cryptographically sign all pushes, as well as having Git produce more output on certain types of failure modes. Linus Torvalds replied, saying he liked the idea of increased verbosity; but, about cryptographic signatures, he said:
"I realize that cryptographic signatures sound very important right now, but in the end, *real* trust comes from people, not from signatures. Realistically, I checked a few signatures this time around due to the kernel.org issues, but at the same time, the thing that made me trust most of it was just looking at commits and the email messages. The unconscious and non-cryptographic 'signature' of a person acting like you expect a person to act."
"Technical measures can be subverted, and I think we should also think about the social side. Every time somebody mentions a signature,I want to also mention 'human readability', because I think that matters as much, if not more."
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
KDE Plasma 5.27 Beta is Ready for Testing
The latest beta iteration of the KDE Plasma desktop is now available and includes some important additions and fixes.
-
Netrunner OS 23 Is Now Available
The latest version of this Linux distribution is now based on Debian Bullseye and is ready for installation and finally hits the KDE 5.20 branch of the desktop.
-
New Linux Distribution Built for Gamers
With a Gnome desktop that offers different layouts and a custom kernel, PikaOS is a great option for gamers of all types.
-
System76 Beefs Up Popular Pangolin Laptop
The darling of open-source-powered laptops and desktops will soon drop a new AMD Ryzen 7-powered version of their popular Pangolin laptop.
-
Nobara Project Is a Modified Version of Fedora with User-Friendly Fixes
If you're looking for a version of Fedora that includes third-party and proprietary packages, look no further than the Nobara Project.
-
Gnome 44 Now Has a Release Date
Gnome 44 will be officially released on March 22, 2023.
-
Nitrux 2.6 Available with Kernel 6.1 and a Major Change
The developers of Nitrux have officially released version 2.6 of their Linux distribution with plenty of new features to excite users.
-
Vanilla OS Initial Release Is Now Available
A stock GNOME experience with on-demand immutability finally sees its first production release.
-
Critical Linux Vulnerability Found to Impact SMB Servers
A Linux vulnerability with a CVSS score of 10 has been found to affect SMB servers and can lead to remote code execution.
-
Linux Mint 21.1 Now Available with Plenty of Look and Feel Changes
Vera has arrived and although it is still using kernel 5.15, there are plenty of improvements sure to please everyone.