Planet Debian
-
Dirk Eddelbuettel: myman 0.13.0 on CRAN: Another wave!
Another new version of our still-new-ish package myman reached CRAN this morning, and has been built for r2u and on r-universe . The matching Python package has also been updated. The package offers twenty two hundred eighty four “My man …” posts by Kevin Kruse made on bsky during the summer of 2026. Each wave picked at one particular public persona. This…
-
Vasudev Kamath: Releasing debvulns with needrestart and kernel vulnerability handling
After quite some time, I picked up debvulns again to implement what I mentioned in my previous post : exporting reboot required status and identifying services that need a restart. Additionally, I wanted to ensure kernel vulnerabilities are not marked as fixed unless the running kernel matches or exceeds the fixed version. Both features are now live in…
-
Vincent Bernat: Network lab with QEMU
To experiment with network stuff, I was using UML -based network labs . Many alternatives exist, like GNS3 , Netkit , Marionnet or Cloonix . All of them are great viable solutions but I still prefer to stick to my minimal home-made solution with UML virtual machines. Here is why: I didn’t want to use disk images . They take a lot of space and they have to…
-
Birger Schacht: Status update, September + October 2026
Debian Related Work Uploaded fuzzel 1.15.0+ds-1 to unstable Uploaded foot 1.28.0-1 to unstable Uploaded swayimg 5.6-1 and 5.7-1 to unstable Uploaded wdisplays 1.3.0-1 to unstable Orphaned usbguard with version 1.1.4+ds-5 and usbguard-notifier with version 0.1.0-4 The orphaning of usbguard and usbguard-notifier is because I don’t use those packages anymore…
-
Samuel Henrique: Distributary: my artwork proposal for Debian 14 "forky"
In hydrology, a distributary is a channel that forks away from a river and flows on to the sea, the opposite of a tributary. Debian is the river much of the Linux world forks from, so for a release called forky, that is my proposal for its artwork: one river, many forks. All generated by code. A small Python program grows the river by the rules of real…
-
Ludovic Rousseau: New version of PyKCS11: 1.5.21
I just released a new version of PyKCS11 , a Python wrapper above the PKCS#11 API. See PyKCS11 introduction or PyKCS11’s documentation . The project is registered at Pypi: https://pypi.org/project/PyKCS11/ Changes: 1.5.21 - October 2026, Ludovic Rousseau getMechanismList() : do not return mechanism 0x1D (debug code introduced by mistake in release 1.5.19)…
-
Russell Coker: Links October 2026
Julia Curlee wrote an informative article about serving as a CIA agent in the White House as a trans woman [1] . Bruce Schneier and Kasra Rafi wrote an interesting article about AIs and mathematical research, they won’t break crypto any time soon [2] . Otto wrote an interesting and informative blog post about the issues related to “AI” and software…
-
Ludovic Rousseau: New version of PySCard: 2.3.2
I just released a new version of pyscard . PySCard is a Python module adding smart cards support (PC/SC) to Python. The PySCard project is available from: PyPI github I removed the distribution from sourceforge. Use PyPI instead. On PyPI you wil get a red alert "Incomplete provenance" for the source code file pyscard-2.3.2.tar.gz . This is because I…
-
Matthew Garrett: Getting Google Cast on my Soundbar
I have a Samsung Q800A soundbar. It ships with built-in support for the Apple Airplay protocol, but I’m not really an Apple kind of guy so that’s never been particularly helpful for me. So, instead, I have a Chromecast Audio plugged into it via TOSLINK, and that works fine - except for the fact that there’s no way to explicitly pick TOSLINK as the audio…
-
Russell Coker: More Furilabs FLX1s
In April I got my Furilabs FLX1s basically working [1] . Below is a post I wrote about the FLX1s before it broke at the start of September, there was a problem with the display controller and it would randomly go into a messed up mode that wasn’t readable but also changed a bit in relation to button presses etc so the phone was still working. Also I could…
-
Russell Coker: Fuel Should be More Expensive
The Current Situation Before the US and Israel started attacking Iran at the end of February the petrol prices in Australia were around $1.70/L, which for American readers is roughly equivalent to $US4.64/Gal. By the 11th of March the prices were around $2.19/L. Over the same time period Diesel went from around $1.77/L to $2.40/L. The 11th of March prices…
-
Russell Coker: Radxa Rock 5A RK3588S
At the end of last year I paid $177.40 for a Radxa ROCK 5A GREEN RK3588S, 8-core CPU SBC, HDMI with 8K Output, WiFi 6 Support and Gigabit Ethernet, Single Board Computer [1] from AliExpress. I got the version with 8G of RAM as 4G didn’t seem enough and I didn’t feel like paying for the 16G or 32G versions. The prices excluding postage are $106, $130, $203…
-
Reproducible Builds (diffoscope): diffoscope 336 released
The diffoscope maintainers are pleased to announce the release of diffoscope version 336 . This version includes the following changes: [ Chris Lamb ] * Drop Recommends: guix from the diffoscope-minimal package. (Closes: #1114739) You find out more by visiting the project homepage .
-
Enrico Zini: Sandboxing pre-commit
pre-commit is a tool that is often a prerequisite for contributing to Python upstream projects. It installs as a git pre-commit hook and runs various checks on commit, using tools installed in a set of virtualenvs that it automatically manages. In other words, it is a Remote Code Execution engine running with the permissions of your own user, and with read…
-
Russell Coker: CEO Impersonation Fraud
In discussion about my post on banks and phones [1] questions were asked about CEO impersonation (link to an article on the security blog Krebs on Security about it) [2] . CEO fraud (or more generally executive fraud) is a subset of Business Email Compromise fraud which allegedly loses Australian businesses $84M/year [3] . The numbers vary a lot depending…
-
Otto Kekäläinen: Debcraft v1.0 released: Easy, fast and secure way to build Debian packages
Debcraft is a tool that automates most of the repetitive and error-prone steps related to Debian packaging. It makes it easy to build .deb packages from source without having to manually prepare build environments. It clearly shows what changed in the build artifacts between two builds, automates parts of importing new upstream versions, and can…
-
Russell Coker: Banks and Phones
The Problem For years there have been ongoing issues with SMS being used as a security mechanism for important things including financial services. The problem with this is that access to a phone number is not very well secured, the business model of phone stores is based on having a price of service that doesn’t allow the amounts of money spent on security…
-
Amin Bandali: Living healthier
Earlier this week I had a coaching session with Protesilaos , where we focused on health and wellness. I took some notes during our call, which I expand on here, and share with Prot's permission. I've been paying more serious attention to my health this year, and our discussion was in the context of me striving to live a healthier life. These notes are…
-
Reproducible Builds (diffoscope): diffoscope 335 released
The diffoscope maintainers are pleased to announce the release of diffoscope version 335 . This version includes the following changes: [ Chris Lamb ] * Support the dumppdf binary being called dumppdf.py on the host system. * Update copyright years. * Fix a silly "prepend" typo. You find out more by visiting the project homepage .
-
Steinar H. Gunderson: Decompilation patterns, part 18: Signed division
As promised, the last one (for now?), and this one blew my mind the first time I saw it: var_v0 = sp4014; if ((s32) sp4014 < 0) { var_v0 = sp4014 + 0x7FF; } temp_s1 = 0x800 - (sp4014 - (((s32) var_v0 >> 0xB) << 0xB)); There's actually two things going on here. First, the compiler is faking a signed division using shifting (which rounds down) as a building…
-
Steinar H. Gunderson: Decompilation patterns, part 17: Loop rotation
Occasionally, you'll see code like this (after initial cleanup): var_v0_2 = crc & 0x80000000; do { if (var_v0_2 != 0) { crc = (crc << 1) ^ 0x1EDC6F41; } else { crc <<= 1; } var_a0 += 1; var_v0_2 = crc & 0x80000000; } while (var_a0 < 8U); The thing with var_v0_2 is unnatural. GCC sometimes does these loop rotation tricks, seemingly to save registers (don't…
-
Thadeu Lima de Souza Cascardo: Restricting device memory usage on Linux 7.3
Linux cgroups has been used for a while to group processes and control their access to certain system resources. One of those resources is memory, through the use of memcg. That control is dynamic, allowing for cgroups to setup a minimal and a maximal amount of memory, as well as low and high thresholds, which will control the reclaim process. But what…
-
Russell Coker: Cixin Liu is a Bad Person
The Chinese author Cixin Liu [1] is most known for his book The Three Body Problem and it’s sequels. One of the main plot elements in the book is that every species in the universe is cool with genocide and willing to commit genocide as a preemptive strike against any star system found to contain intelligent life. It’s not unreasonable to think that some…
-
Steinar H. Gunderson: Decompilation patterns, part 16: Tail reduplication
We're nearing the end soon, I promise. Here's one that I see all the time: ... } else { var_t0_5 = temp_a0_3 - 0x140; var_a2_5 = 0xA0 - temp_a3_5; goto block_45; } } else { var_t0_5 = 0xA0 - temp_a0_3; var_a2_5 = temp_a3_5 - 0x118; block_45: var_v0_3 = var_t0_5 + 0xA0; var_v1_4 = var_a2_5 + 0x78; } So, eh, what's that goto doing there? What happened was…
-
Dirk Eddelbuettel: myman 0.12.0 on CRAN: Two new waves!
Another new and exciting version of our still-new package myman reached CRAN this morning, and has been built for r2u and on r-universe . The matching Python package has also been updated. The package offers twenty one hundred eighty four “My man …” posts by Kevin Kruse made on bsky during the summer of 2026. Each wave picked at one particular public…
-
Ludovic Rousseau: New version of pcsc-lite: 2.5.3
I have just released a new version of pcsc-lite 2.5.3 . pcsc-lite is a Free Software implementation of the PC/SC (also known as WinSCard) API for Unix systems. It provides an API for using smart cards and smart card readers. Changes: 2.5.3: Ludovic Rousseau 18 October 2026 pcscd.service : preserve card sessions across polkit restarts correctly decode all…
-
Steinar H. Gunderson: Decompilation patterns, part 15: Redundant if-for
Yet another way of writing for loops: var_a2_4 = ... if (var_a2_4 < 0x78) { ... do { ... var_a2_4 += 1; } while (var_a2_4 < 0x78); } This extra if is merely there because the compiler wasn't able to prove that the variable didn't start below the bound, so it can't rewrite the while-do to a do-while without that extra check. So the rewrite still reads: for…