Linux Foundation’s Core Infrastructure Initiative Seeks Community Input On New Security-Focused Badge Program

By

-

August 18, 2015

The Core Infrastructure Initiative (CII), a project managed by The Linux Foundation that enables technology companies, industry stakeholders and esteemed developers to collaboratively identify and fund critical open source projects in need of assistance, today announced it is developing a new free Badge Program, seeking input from the open source community on the criteria to be used to determine security, quality and stability of open source software.

The first draft of the criteria is available on GitHub and is spearheaded by David A. Wheeler, an open source and security research expert who works for the Institute for Defense Analyses (IDA)…

LinuxCon Coverage: Think about Resilience

By

Amber Ankerholz

-

August 18, 2015

zemlin-2015 Tuesday morning’s keynote session at LinuxCon in Seattle began with Jim Zemlin (Executive Director at The Linux Foundation) announcing the 2015 recipients of Linux Training Scholarships. This year’s 14 recipients include:

RJ Murdok (age 15, United States). RJ is getting ready to start his freshman year of high school. Despite being legally blind, he’s been learning Linux for three years and submits bug reports in his spare time.

Eva Tanaskoska (age 22, Macedonia). Eva is an information security researcher at Zero Science Lab in Skopje. She is in the process of forming a CERT team at her university, where she mentors students on using Linux to perform penetration tests, forensic investigations, and incident response.

Kevin Barry (age 32, Ireland). Kevin holds a PhD in music and taught himself programming in his spare time. He hopes to become a Linux SysAdmin to move his music department to open source.

Zemlin also announced the Core Infrastructure Initiative’s Best Practices Badge Program. This is a voluntary program to demonstrate security mindset. It’s intended to engage the community to help create best practices for secure development. Feedback on the project is requested in the form of GitHub pull requests.

Bruce-Schneier Next up, Zemlin introduced Bruce Schneier (CTO, Resilient Systems), who presented his talk via Google Hangouts. Schneier began the presentation, called “Attacks, Trends and Responses,” with a discussion about the recent North Korean attack on Sony. He said the attack was surprising in a couple of significant ways. First, it was not an attack on a critical infrastructure but instead on a movie company. Second, the focus of the attack was not data theft but coercion.

Schneier said, “On the Internet today, attackers have the advantage.” He maintains that we are not actually fighting a cyberwar but are increasingly seeing war-like tactics and that technology broadly spreads these techniques.

According to Schneier, attribution of attacks is key, and countries are engaged in an arms race between attributing the attacks and hiding them. Schneier said that he is seeing more attribution of attacks and that it’s in the United States’ best interests to demonstrate that they can attribute them. However, he warned that attribution based on secret evidence is not trusted.

What’s needed, Schneier said, is “fast, flexible response” to attacks. “We need to think about resilience,” he said. “It’s going to be a complicated decade.”

For more from Bruce Schneier on the topic of security and response planning, see his previous interview with Linux.com.

Linux Foundation Announces 2015 Linux Training Scholarship Recipients

By

The Linux Foundation

-

August 18, 2015

The Linux Foundation, the nonprofit organization dedicated to accelerating the growth of Linux and collaborative development, today announced the recipients of its annual Linux Training Scholarship Program.

This is the fifth year Linux Foundation has hosted this program, which has awarded a total of 34 scholarships totalling more than $100,000 in free training to professionals who may not otherwise have access to these opportunities. More than 850 entries were received this year across seven categories…

Saving NTP: The Protocol That Keeps Time Across the Internet

By

ZDNet

-

August 18, 2015

NTP, the protocol that keeps time across the internet, was in danger of running out of money. The Linux Foundation’s Core Infrastructure Initiative (CII) has stepped up to keep it going.

We’re foolish. We live our lives on the internet and we take it for granted. We don’t realize that the internet is fragile as a Chihuly glass sculpture. As 2014 OpenSSL Heartbleed security security hole showed, vital internet infrastructure programs are being left unsupported.

KVM Forum Preview: KVM, QEMU and More

By

The Linux Foundation

-

August 18, 2015

logo kvmforum 0 This week, we kick off the 8th KVM Forum in Seatttle, Washington. With the exception of 2009, KVM Forum has been held every year since 2007, and it’s about more than just KVM — the open source hypervisor that is most often used together with oVirt or the OpenStack cloud computing platform. The conference covers KVM and QEMU (which provides hardware emulation to virtual machines), but it’s also open to talks about all layers in the open source virtualization stack. In particular, this year’s talks will also cover libvirt (virtual machine lifecycle management and a lot more), oVirt (datacenter virtualization), and OpenStack.

Daily keynote presentations will provide status reports on KVM (presented by Paolo Bonzini, Senior Principal Software Engineer, Red Hat), QEMU (Alexander Graf, Upstream Maintainer, SUSE), and Libvirt (Jiri Denemark, Red Hat).

The conference starts today with a joint hackathon in collaboration with the Xen project; KVM and Xen developers have been collaborating for a long time because Xen also uses QEMU as part of their userspace stack. Some Xen developers are also invited to QEMU Summit, an invitation-only event discussing organizational tasks for the QEMU project. And, after the hackathon and QEMU Summit, Xen and KVM will have a joint evening event as well. KVM Forum’s talk sessions will then start on Wednesday morning, lasting until Friday. The schedule is available online at sched.org.

Whenever possible, similarly-themed talks are placed back-to-back in the afternoon, so that people do not have to switch rooms. For example, there will be sessions about the QEMU “block device” (storage) layer, sessions about the virtio paravirtual devices, sessions about Network Function Virtualization, and so on. A new feature this year is tutorials; we have one a new testing harness (Avocado) with support for virtualization tests and one on the Coccinelle semantic patching tool.

KVM-group A tradition that we’ve upheld for a few years is to leave some space in the last day for talks related to the higher levels of the stack (above QEMU). Usually these are called the “management layers”; they store configuration for the virtual machines, start and dispatch commands to the low-level layers, and orchestrate tasks spanning multiple host machines. In contrast, KVM and QEMU are the programs that actually do the work of running a virtual machine, but they are generally stateless and have a very limited view of what happens outside a particular VM. (This is by design: isolated components can also be secured more easily). Around half of the Friday talks will cover libvirt and oVirt.

In addition to the hackathon, face-to-face interaction is stimulated by “birds of a feather” (BoF) sessions and informal hallway gatherings. BoFs start at 5:30pm, after the talks, and usually go on until people leave for dinner. Because we co-locate with other Linux Foundation conferences, the hallway track is a unique occasion to meet people.

KVM Forum wraps up on Friday, August 21st. Before everyone leaves, we will take a group photo, and a leader from each BoF will summarize the topics that were discussed. Then, it will be time to say goodbye — until KVM Forum 2016!

(Guest blog contributed by Paolo Bonzini.) Paolo-Bonzini

IBM Launches LinuxONE at LinuxCon, Announces Open Mainframe Project

By

IT World

-

August 18, 2015

At LinuxCon, IBM announced the launch of LinuxONE, which it calls the most secure server line in the industry. LinuxONE comprises two Linux servers: LinuxONE Emperor and LinuxONE Rockhopper.The two servers come with software and services from IBM. IBM claims LinuxONE Emperor, based on the IBM z13, is the world’s most advanced Linux system with the fastest processor in the industry, a system clearly aimed at large enterprise customers and organizations.

Danish Meteorological to Install First Cray in Iceland

By

insideHPC

-

August 18, 2015

Today Cray announced that the Danish Meteorological Institute (DMI) has purchased a Cray XC supercomputer and a Cray Sonexion 2000 storage system. Through an arrangement with the Icelandic Meteorological Office (IMO), the system will be installed at the IMO datacenter in Reykjavik, Iceland for year-round power and cooling efficiency.

Opera 32 Beta for Linux Features Bookmark Tree View and Password Sync

By

Softpedia

-

August 18, 2015

Opera32 Opera developers have released the next 32 Beta upgrade for the Opera web browser, and it marks the beginning of another development cycle. Now that all the platforms have reached feature parity, we expect to see the new version land on Linux, Windows, and Mac OS X.

Opera has been rebased on Chromium a while back, and the support for Linux took almost a full year to arrive. In any case, Opera for Linux is now a citizen with equal rights and all the features…

Don’t Be a Rock Star Developer: Be Willie Nelson

By

Amber Ankerholz

-

August 18, 2015

re-linux In an entertaining afternoon talk at LinuxCon North America, titled “Mamas Don’t Let Your Babies Grow Up To Be Rock Star Developers,” Rikki Endsley (Community Evangelist, Red Hat) discussed why the “rock star developer” label has outlived its usefulness and how Willie Nelson can be seen as a model for open source development.

Endsley cited a keynote presentation given at PyCon 2015 by Jacob Kaplan-Moss. In that talk, Kaplan-Moss drew parallels between his coding skills and his running skills. He described himself as performing in the middle of the pack as a marathon runner, which made him pretty average — like most people. And, he claimed to be an average programmer as well — not a rock star — although people sometimes assume otherwise because of his association with the Django project.

Inspired by Kaplan-Moss’s talk, Endsley said using the term “rock star” when recruiting developers is unfortunate because it’s hard to define and means very different things to different people. The definition depends, for one thing, on your generation: It could mean anyone from Elvis Presley to Joan Jett to Justin Bieber. For another thing, the term narrows your audience and won’t even appeal to someone who prefers another style of music. And, the rock star label may not always be seen in a positive light — it may instead invoke images of biting the head off a bat or trashing hotel rooms.

In fact, Endsley said, if you’re using the term rock star in recruiting, it might be time to rethink your hiring requirements.

Endsley suggested that it’s time to change the standard and instead encourage developers to be more like Willie Nelson, whose career has spanned decades. Nelson, in true open source fashion, is known for helping others succeed, for moving in and out of roles, and for learning new skills.

Other characteristics that make the Willie Nelson (open source) model of development preferable to the rock star model are:

Being accessible and contributing at a local level
Leading and inspiring others
Collaborating with diverse people and groups
Never giving up

In response to a follow-up question, Endsley explained that team leaders and project managers could encourage developers to follow the Willie Nelson model of open source development by recognizing the achievements and contributions of all team members and by finding new ways to measure those contributions based on something other than popularity or media attention.

Google Delays Project Ara Modular Smartphone Pilot Until 2016

By

ZDNet

-

August 18, 2015

Google has scrapped plans to test Project Ara in Puerto Rico and postponed tests until next year. Google’s Advanced Technology and Projects (ATAP) group, the team behind Project Ara, announced the roadmap for its Lego-inspired smartphone pilot had changed yesterday, nixing the original plan to start selling the devices from food trucks in Puerto Rico in the second half of this year.