There's been talk of this unauthenticated RCE vulnerability coming with a CVSS 9.9 rating but none of the technical details were publicly known until it was made public just now at the top of the hour. Simone Margaritelli discovered this vulnerability and has shared a write-up around this potentially very impactful Linux vulnerability.

This vulnerability, fortunately, doesn't affect the Linux kernel but rather CUPS... The print server commonly used on Linux systems and other platforms.

...

From Attacking UNIX Systems via CUPS, Part I:

"A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer)."

...

This remote code execution issue can be exploited across the public Internet via a UDP packet to port 631 without needing any authentication, assuming the CUPS port is open through your router/firewall. LAN attacks are also possible via spoofing zeroconf / mDNS / DNS-SD advertisements.

Besides CUPS being used on Linux distributions, it also affects some BSDs, Oracle Solaris, Google Chrome OS, and others.

As of writing there is no Linux fix available for this high profile security issue. In the meantime it's recommended to disable and remove the "cups-browsed" service, updating CUPS, or at least blocking all traffic to UDP port 631.

cross-posted from: https://lemmy.ndlug.org/post/1167059

COSMIC’s Alpha 2 release builds upon that work with functionality built out for Files, additional Settings pages, considerable infrastructure work for screen reader support+, and some highly requested window management features. System76 is ecstatic at the level of excitement and collaboration so far with alpha testers and early app & applet developers, and we look forward to seeing what comes from these new additions.

...

The second COSMIC alpha will be released on September 26th. Those participating in Alpha 1 on Pop!_OS can simply update through the COSMIC App Store to transition. This alpha will be followed by monthly alpha releases until all core features have been built out.

More coverage:

• COSMIC DE Alpha 2 Released, This is What’s New

• COSMIC Alpha 2 Released with Bluetooth Settings, Much-Improved File Manager

• Cosmic Desktop Alpha 2: BIG PROGRESS for a month of work!

COSMIC’s Alpha 2 release builds upon that work with functionality built out for Files, additional Settings pages, considerable infrastructure work for screen reader support+, and some highly requested window management features. System76 is ecstatic at the level of excitement and collaboration so far with alpha testers and early app & applet developers, and we look forward to seeing what comes from these new additions.

...

The second COSMIC alpha will be released on September 26th. Those participating in Alpha 1 on Pop!_OS can simply update through the COSMIC App Store to transition. This alpha will be followed by monthly alpha releases until all core features have been built out.

More coverage:

• COSMIC DE Alpha 2 Released, This is What’s New

• COSMIC Alpha 2 Released with Bluetooth Settings, Much-Improved File Manager

• Cosmic Desktop Alpha 2: BIG PROGRESS for a month of work!

Mozilla has overhauled its branding to pay homage to its Netscape roots and better distinguish the wider organization from its Firefox web browser. The most notable change is to the company’s logo: what was previously a sans-serif wordmark styled as “Moz://a” has been updated to correctly spell out the Mozilla name, featuring a new customized typeface and an M-shaped flag.

According to Mozilla, the flag symbolizes the brand’s “activist spirit.” That fits with the image that the Mozilla Foundation, which is leading the company, is attempting to build: describing itself as “a non-profit organization that promotes openness, innovation, and participation on the Internet” and regularly releasing privacy reports that investigate tech companies’ policy and security practices.

cross-posted from: https://lemmy.ndlug.org/post/1153465

In the second finding of the 2024 Tidelift state of the open source maintainer survey, we found that the more maintainers are paid, the more improvements they make to their projects.

...

In the previous finding, we reported that 60% of maintainers describe themselves as unpaid hobbyists, and 36% of maintainers describe themselves as paid (professional or semi-professional) maintainers, earning some or all of their income from their open source work.

...

When you break down the paid maintainers into professional (earning most or all of their income from their maintenance work) and semi-professional (earning some of their income from maintaining projects), it becomes clear that the amount of money a maintainer is making for their work has a large impact on the types of improvements they are able to make. Across nearly all major categories, professional maintainers are on average over 20 percentage points more likely to make key improvements to their projects than semi-professional maintainers.

...

In the previous study, 81% percent of professional maintainers earning most or all of their income from maintaining projects spend more than 20 hours a week maintaining their projects. This year, the percentage was nearly identical (82%).

Conversely, in last year’s survey, we found that the vast majority of unpaid hobbyists spend ten hours or less per week on their maintenance work (81%). This percentage also stayed consistent in this year’s survey, with 78% of unpaid hobbyist maintainers working ten hours or less per week.

...

We’ve heard from many maintainers that how they are paid for their work also matters. For many maintainers there is a huge difference between getting a one-time “airdrop” of money, perhaps right after a high profile incident where people are paying attention to their projects, compared to ongoing recurring income that they can count on. So this year for the first time we asked maintainers to tell us whether they would prefer to get predictable monthly income or a one-time lump payment.

An overwhelming majority of maintainers prefer to receive predictable monthly income, with 81% choosing that option.

In the second finding of the 2024 Tidelift state of the open source maintainer survey, we found that the more maintainers are paid, the more improvements they make to their projects.

...

In the previous finding, we reported that 60% of maintainers describe themselves as unpaid hobbyists, and 36% of maintainers describe themselves as paid (professional or semi-professional) maintainers, earning some or all of their income from their open source work.

...

When you break down the paid maintainers into professional (earning most or all of their income from their maintenance work) and semi-professional (earning some of their income from maintaining projects), it becomes clear that the amount of money a maintainer is making for their work has a large impact on the types of improvements they are able to make. Across nearly all major categories, professional maintainers are on average over 20 percentage points more likely to make key improvements to their projects than semi-professional maintainers.

...

In the previous study, 81% percent of professional maintainers earning most or all of their income from maintaining projects spend more than 20 hours a week maintaining their projects. This year, the percentage was nearly identical (82%).

Conversely, in last year’s survey, we found that the vast majority of unpaid hobbyists spend ten hours or less per week on their maintenance work (81%). This percentage also stayed consistent in this year’s survey, with 78% of unpaid hobbyist maintainers working ten hours or less per week.

...

We’ve heard from many maintainers that how they are paid for their work also matters. For many maintainers there is a huge difference between getting a one-time “airdrop” of money, perhaps right after a high profile incident where people are paying attention to their projects, compared to ongoing recurring income that they can count on. So this year for the first time we asked maintainers to tell us whether they would prefer to get predictable monthly income or a one-time lump payment.

An overwhelming majority of maintainers prefer to receive predictable monthly income, with 81% choosing that option.

Element is launching the world’s first communications platform based on the upcoming Matrix 2.0 release. The result is blazing performance which outperforms the mainstream alternatives - across a decentralised system that enables self-hosting and end-to-end encryption - as well as open standard interoperability to revolutionise real time communication between large organisations.

Built on Matrix 2.0, Element X now rivals the performance of centralised consumer messaging apps, empowering organisations to address the shadow IT issues caused by consumer-grade messaging apps in the workplace.

The new Element communications solution consists:

• Element X, our next-gen app with an array of new features
• Element Call fully integrated into Element X, for native Matrix-encrypted voice and video
• Element Server Suite, our backend hosting solution for powerful admin control and Matrix 2.0 performance

GNOME 46.5 is now available as the fifth maintenance update to the GNOME 46 desktop environment series with more bug fixes and improvements.

...

GNOME 46.5 is here five weeks after the GNOME 46.4 release and fixes smartcard logins, adds user permissions to new Wi-Fi connections for restricted users, fixes the showing of pending PAM messages on the login screen, and fixes the “Locate Pointer” accessibility option when the “Reduce Animation” option is turned on.

It also fixes several issues in the Mutter window and composite manager, including drag and drop between X11 and Wayland clients, drag and drop from grabbing pop-ups, EGLDevice support, frozen cursor on some hybrid machines, tablet input in maximized windows, frozen cursor after suspend, using modifiers on multi-GPU setups, propagating tablet device removals to clients, and touch window dragging with pointer lock enabled.

Linus Torvalds Speaks on the the divide between Rust and C Linux developers an the future Linux. Will things like fragmentation among the open source community hurt the Linux Kernel? We'll listen to the Creator of Linux.

For the full key note, checkout: Keynote: Linus Torvalds in Conversation with Dirk Hohndel

The Register's summary: Torvalds weighs in on 'nasty' Rust vs C for Linux debate

COSMIC Alpha 2 is landing on September 26th. Repositories will be tagged with the new release for distribution packagers.

Pop!_OS 24.04 Alpha 2 ISO's will also be available for download! #COSMICdesktop #COSMICDE

I've been using a Framework 13 laptop as my main/only computer for a little over 18 months now.

This is essentially a very personal review. I've broken it down into a summary of My Framework, a short Laptop Autobiography, then The Good, The Bad, The Ugly, and The Rest. If you're impatient then skip to the end with the Bottom Line.

...

Where I'm critical of Framework in this post it's not because I want them to fail. They're a hardware startup that's proven their ability to ship good products, and I know how crushingly tough that is. I'm hopeful that they'll continue to grow into a mature hardware company with a strong maintenance track record, and demonstrated mature in-house development processes. I hope in a few years to write a follow-up post with even more "Good" points and barely a concern.

In the meantime, I'd encourage almost everyone to consider a Framework for their next laptop - but first read up on whatever features matter most for you.

A new app was added to GNOME Circle: Binary by @fizzyizzy05@tech.lgbt! https://apps.gnome.org/Binary/

Binary makes working with numbers of different bases (like binary or hexadecimal) a breeze. No more counting binary digits on your fingers!

Congratulations! 🎉