Open-source News

Benchmarking The Linux Mitigated Performance For Retbleed: It's Painful

Phoronix - Thu, 07/14/2022 - 02:30
Yesterday Retbleed was made public as a new speculative execution attack exploiting return instructions. While the "good" news is Retbleed only impacts prior generations of AMD and Intel processors, the bad news is the mitigated performance impact on Linux is quite severe. Since yesterday I have been benchmarking the newly-merged Linux patches on various Intel and AMD processors affected by Retbleed. It's very bad if you are on an affected processor.

Benchmarking The Linux Mitigated Performance For Retbleed: It's Painful

Phoronix - Thu, 07/14/2022 - 02:30
Yesterday Retbleed was made public as a new speculative execution attack exploiting return instructions. While the "good" news is Retbleed only impacts prior generations of AMD and Intel processors, the bad news is the mitigated performance impact on Linux is quite severe. Since yesterday I have been benchmarking the newly-merged Linux patches on various Intel and AMD processors affected by Retbleed. It's very bad if you are on an affected processor.

The Echo Command - Linux Journal

Google News - Thu, 07/14/2022 - 00:56
The Echo Command  Linux Journal

Jamie Thomas: What is the OpenSSF

The Linux Foundation - Wed, 07/13/2022 - 22:56

Jamie Thomas is the General Manager, Systems Strategy and Development at IBM and is also the OpenSSF Board chair. She sat down with Alan Shimel of TechStrong TV during OpenSSF Day in Austin to share about OpenSSF and how the open source community is rallying together to increase the resilience of open source software. 

You can watch the full interview or read the transcript below. But, since we are all busy, I have pulled together some of the key points Jamie made from the interview:

OpenSSF is focused on a proactive posture. How do we prevent these kinds of events? And so to do that, we think there’s a number of things we have to do: 

  • First and foremost is education, of course, in terms of basic security education for developers.
  • Another key tenant is how do you put automation on steroids? So the automation and best practices that are reflected in that automation that open source projects can consume? How do you get that out to the most critical projects, and then provide some support for the long tail projects
  • It’s also about working, frankly, with other industry consortia as well as the government. In Particular, we’ve been working with the US government in the OpenSSF to define what are some actions that are really going to make a difference. 
  • And I think critical to all of this is getting collaboration across the different insights from the governing body, which includes a lot of technology firms, as well as commercial firms. Like there’s a lot of financial firms actually involved in the governing body. What are the key elements that we really need to address first. So getting those priorities set, and then having an execution agenda and really getting something done in the short term, I think is really going to be important for this group?

In the world of cybersecurity, you often learn that no one pays attention to a lot of things unless there’s a huge compelling event. And that’s what log4j was. So while it was not desired, it was helpful in that vein. . . So coming out of all of the meetings that we’ve had, the collaboration that we’ve had across the industry, it is going to be imperative that we execute, and that the things that we have identified as top priorities that we make measurable progress on those projects this year. That’s the importance of this OpenSSF day here today in Austin, which is allowing us, with a key set of stakeholders, to start to share perspectives of the projects that are underway, and how others can engage in those projects. And how, once again, working together, we can actually make a difference. 

 Working together, we can actually make a difference. 

We are turning the corner on a new level of commitment around security, there’s always been a commitment in open source around innovation, around feature function. I mean, that’s what’s driven open source and allowed it to be so successful. And for others, other corporations like IBM, we take an enormous advantage out of that, right, we’ve all gotten a huge advantage in productivity out of that. But now, it’s really about turning the focus a little bit more, getting that focus on security, so that we can use open source and continue to have that productivity, but with confidence as we go forward.

How do we make it easy for the maintainers of these open source projects? How do we make it easy for the contributors, because without doing that, it will not have the consumption by developers at large.

Alan Shimel 0:06
Hey, everyone, we’re back here live at the Linux Foundation’s Open Source Summit here in Austin, Texas. And as we mentioned earlier, today is is a day of, I don’t know if you want to call it daughter-sister foumdations or satellite conferences, the main event really starts tomorrow. But there’s several important foundations who are holding conferences today. One of which, and kind of the one kind of the nearest to me is the Open Source Security Foundation. OpenSSF. And we are really happy to be joined by Jamie Thomas, who is the governing chair or the chair of the governing board. Jamie, welcome to our show. Thanks for joining us. So, look, when you’re not busy running, or being Chair of the Board for OpenSSF you have a day job as well. If you want to share with our audience feel free.

Jamie Thomas 1:05
Well, first of all, Alan, thanks for having me. I’m really pleased to be here to talk about OpenSSF. But I am a general manager at IBM responsible for systems development and delivery as well as IBM’s enterprise security program. And enterprise security, of course, is how I got involved in this particular topic.

Alan Shimel 1:22
Absolutely. And that look, that is a world and job unto itself. And we could probably do a few hours on that. But we’re going to focus on on OpenSSF today. So, you know, for most of our audience is familiar, we’ve covered,we’ve had the pleasure of speaking with Brian from OpenSSF a few times. It was a nice idea I think when it was first conceived about yes, we need to do something about security, about the security of open source tools specifically.

Alan Shimel 1:53
And then kind of all hell broke loose. You know, sometimes, sometimes things just work like that. Right? History runs in currents. So we started the OpenSSF. And then we had this spate of supply chain security issues and the whole SBOM thing with the White House. And then like kind of the cherry on top was log4j, it was around when January or December of last year. And that’s really, I guess, accelerated has it accelerated. Maybe you had big plants to begin with. Talk to us a little bit about kind of the whole OpenSSF and how it all came together. And what’s happened?

Jamie Thomas 2:33
Well, I think it was very fortuitous that the industry did come together last year with the Linux Foundation to create a new governing body around open source security called the OpenSSF. Because as you say, not long after that we had this industry compelling event log4j and realized the industry had already had we’d already had Solarwinds that year before, which also ruined our holiday in December. We had Kaseya, we had a number of these big supply chain attacks.

Jamie Thomas 3:00
But the difference I would say in log4j is just the predominance of the asset in code. It had been out there for over 20 years, it was a very utilized, a very popular piece of code. And so it affected a lot of software.

Jamie Thomas 3:14
So one of the things that you realize when this kind of thing happens, it’s not just about your fidelity of being able to identify it and get it patched. But for all those downstream consuming organizations, how fast do they roll out these patches, because we’re talking about a huge amount of affected software. So I think that there’s nothing like a true test of your governing body. And this was actually a real test run of what we needed to do in OpenSSF. And, of course, it garnered a lot of tension from the US government and other entities that we can we can talk more about.

Alan Shimel 3:48
Sure. Okay. So let’s talk a little bit about the charter or the mission of the OpenSSF. And it’s something I brought up to you off camera, which is okay. Log4J, let’s make that the poster child for a second. So log4j is basically this open source component, if you will, right, that many, many, many, many, many applications have incorporated into their package, if you will, into their source code. And it’s not, look, I’m not blaming the log4j developers or anything. There was a defect, I don’t even want to you know, it became a vulnerability but there’s a defect, while software has defects that we haven’t even found yet. But nevertheless, this one kind of went public and then we saw exploits with it and in the wild and such as the world of security we both live in. What is the chart is that what OpenSSS is about to prevent, or not prevent, but deal with future log4j kinds of events?

Jamie Thomas 4:55
Well, I think first and foremost, OpenSSF is focused on a proactive posture. Right. So how do we prevent these kinds of events? And so to do that, we think there’s a number of things we have to do. First and foremost is education, of course, in terms of basic security education for developers.

Jamie Thomas 5:14
Another key tenant is how do you put automation on steroids? So the automation and best practices that are reflected in that automation that open source projects can consume? How do you get that out to the most critical projects, and then provide some support for the long tail projects, if you will?

Jamie Thomas 5:31
It’s also about working, frankly, with other industry consortia as well as the government. Particularly we’ve been working with the US government in the OpenSSF to define what are some actions that are really going to make a difference. And I think critical to all of this is getting collaboration across the different insights from the governing body, which includes a lot of technology firms, as well as commercial firms. Like there’s a lot of financial firms actually involved in the governing body. What are the key elements that we really need to address first. So getting those priorities set, and then having an execution agenda and really getting something done in the short term, I think is really going to be important for this group?

Alan Shimel 6:14
Well, look, a lot of people look at what you guys have done, and you’ve gotten stuff done, right? There’s been a tremendous groundswell of support. And granted, log4j didn’t hurt you in that regard. But there are others. But there’s been a tremendous groundswell, right, there’s been a I think, about $30 million raised right, between some of the biggest names in tech kicking in here. There’s been the White House and CISA involvement. So it’s certainly, for a relatively new foundation, it has really garnered a lot of, I don’t want to say market share, but a lot of publicity, a lot of attention.

Alan Shimel 7:02
Now, of course, the question is, okay, how does this translate to rubber meets the road? How do we prevent the next slide? I don’t know if we can prevent the next log4j. But how do we minimize that?

Jamie Thomas 7:14
minimize the impact Exactly. Because I would say, if you look at what happened with log4j, the level of preparedness was not there. So how do you get it remediated fast? And how do you identify it? How do you help the open source projects be more effective. In this case, it was of course tied to the Apache Foundation. But not only that, how did the commercial entities then take advantage of that patch and act expeditiously to benefit the clients?

Jamie Thomas 7:45
So I think there’s a real opportunity here. In the world of cybersecurity, you often learn that no one pays attention to a lot of things unless there’s a huge compelling event. And that’s what this was. So while it was not desired, it was helpful in that in that vein, so coming out of all of the meetings that we’ve had, the collaboration that we’ve had across the industry, is going to be imperative that we execute, and that the things that we have identified as top priorities that we make measurable progress on those projects this year. And I think that’s the importance of this OpenSSF day here today in Austin, which is allowing us, with a key set of stakeholders, to start to share perspectives of the projects that are underway, and how others can engage in those projects. And how, once again, working together, we can actually make a difference.

Jamie Thomas 8:36
I think this on this ongoing level of engagement, making sure that we have the right stakeholders engaged, is going to be important to make progress. And as you know, in the world of open source, the nice thing about OepnSSF is we do have the ability to hire critical roles that can focus on this full time. Because the nature of open source typically is that it’s a it’s a volunteer army. Right? And there’s 1000s and 1000s of volunteers out there. But then how do we help with these resources, enable those volunteers to be more effective.

Alan Shimel 9:10
And frankly, that’s been one of, I think, the key ingredients to the Linux Foundation’s formula for success is, you know, herding. It’s a bit like herding cats herding the open source community, it’s vast, the 1000s, hundreds of 1000s, millions, but you need a few full timers who are, this is their day job, right? This is their this is what they do.

Alan Shimel 9:36
Jamie, I want to talk a little bit for people who are watching this now at home. Or maybe, you know, recorded later on. They weren’t here. They didn’t get what was happening, especially today, which is kind of you know, the OpenSSF’s day. Give them if you don’t mind a little bit of maybe a synopsis of what they’re missing.

Jamie Thomas 9:58
Well, we just got started of course, so we have a little bit more to go today, of course, in terms of the actual kickoff of OpenSSF Day. But I think what I see is real commitment, particularly from the presenters I’ve seen so far, a commitment that they’ve all personally made and outside of their day jobs, frankly, to make a difference in security for open source software. And that’s really the key here.

Jamie Thomas 10:23
Are we turning the corner on a new level of commitment around security, there’s always been a commitment in open source around innovation, around feature function. I mean, that’s what’s, loved it, you know, that’s what’s driven open source and allowed it to be so successful. And for others, other corporations like IBM, we take an enormous advantage out of that, right, we’ve all gotten a huge advantage in productivity out of that. But now, it’s really about turning the focus a little bit more, getting that focus on security, so that we can use open source and continue to have that productivity, but with confidence as we go forward. And I’ve really been, I’ve been impressed with all the speakers today and their personal commitment to this topic. And, and that’s really impressive. And I think we’ll see that for the rest of the day as well.

Alan Shimel 11:12
I’m gonna come back to it that to you in one second. I want to touch on something else, though. And that and that is this look, I’ve been in security for 25 going on 30 years. Well, security 25, IT 30 plus years. And, I, you know, if I had a nickel for every survey I read that said security is one of the top three priorities of IT, or the CIO, or an organization, I’d be a rich, rich person right now. But as like I always said their arms were too short to reach their pockets oftentimes. And it wasn’t until something bad happened like a log4j. You know, some incident. Yeah, Code Red. And I could go through a whole history of the things that people trying to get religion, right.

Alan Shimel 12:00
Excuse me, sometimes it takes that for them to get religion. I don’t, I don’t know why. I hope I always hope that it changes that people finally do start taking it seriously. I think for the OpenSSF though, the important thing to remember, especially in our audience, this is a fact we give them all the time, today’s applications, they are 75% 80% open source components added kind of stitched together with maybe 20- 25% of you know, sort of original code, if you will.

Alan Shimel 12:35
And so if someone’s not watching the store on those open source components, whether they’re artifacts or scripts or whatever. Your it’s only a matter of time. It’s not if, it’s when right. And so that’s why I think this is such a vital, it’s such a vital function, this Foundation. Something needed to happen. Yeah. And this is a perfect place for it. And we I step off the soapbox, you mentioned a couple of speakers anything stand out to you or that you can kind of clue our audience and tell

Jamie Thomas 13:11
I think other than the commitment of there’s a keen focus on making it easy for the developers, right? How do we make it easy for the maintainers of these open source projects? How do we make it easy for the contributors, because without doing that, it will not have the consumption by developers at large, right. And I know this, even inside a corporation, we have the same challenge, really, it’s all about codifying the best practices in an automation framework. And, you know, whatever that is for your organization, that’s going to be critical. And that’s why it’s so critical for these open source projects.

Jamie Thomas 13:45
You know, I think that with the right approach, we will make a difference. But it also, as you said, require stakeholders involved to continue to educate their organizations about why is it important, because all of us actually have the ability to increase the number of contributors we have on these projects, to contribute our expertise. And that’s going to be very important. I think that we as the governing body and other organizations really create a sustaining promise around open source. So it’s not just what the OpenSSF is doing itself. But how we enable that to be successful in the long run. Because we’re all getting the advantage from open source, and, like IBM we of course, it’s IBM plus our company, Red Hat, it has a little bit to do with open source. But those kinds of efforts and keeping that keen focus are going to be very, very important as we go forward.

Alan Shimel 14:38
There’s no doubt about it. It also goes back to what we said before is, look there’s a new lock log4j kind of horizon out there every day where there is so you’re not going to prevent them. You’ve you’ve got to put in your response. You’ve got to have your protocols in place.

Jamie Thomas 14:59
I will tell you that It, you know, I have a window into cyber operations, which is my job every day at IBM. And we’re getting over 100 billion events a day. So that gives you kind of the context for what you got to deal with and landscape. And product security, of course, is one of those triggers. If it’s not, if you’ve got malware, if you got issues, they’re going to be one of your events, right? So it’s a little bit of a reflection on our responsibility to enable effective cyber operations for organizations. I mean, we have a huge responsibility. But we have a huge opportunity here. And I think I want to make heroes out of developers for really worrying about security. That’s kind of one of the goals.

Alan Shimel 15:41
You know, look, you’re preaching to the choir here, because, you know, I started devops.com in 2013, 2014. And I did it because, as a security person, I thought it was the best thing that happened in security. If we can get developers security, aware, security conscious, that’s half the battle. And, you know, for a long time it was it was an uphill battle. Let me say that. But this whole notion of what we call DevSecOps and making security for developers, it’s really gone mainstream. Right. And I think part of that is realizing is developers, security is everyone’s responsibility is a very overused thing.

Alan Shimel 16:24
Developers are not security people, but I’ve never met a developer in my life who says, I’d like to develop insecure software, right. I want to use an old version of an open source, you know, component that has some known vulnerabilities. None of them want to, we don’t have pride in our work. It’s just we need to make it easier for them to do, and I think that’s something OpenSSF can really help with.

Alan Shimel 16:55
Anyway, I know you’re busy as heck, I want to thank you for coming down and hanging out with us a little bit. To you, Brian, the whole OpenSSF team, keep up the great work well, we’re expecting big things. No pressure. We’re expecting big things from you guys. You really make make a difference.

Jamie Thomas 17:11
Thank you, Alan. I’m really pleased to be here today and immerse myself in this topic and get to know many of the players that are here today. And thanks. Thanks for the opportunity to chat. No problem.

Alan Shimel 17:20
Just before we leave real quickly, the OpenSSF website. I think it’s openssf.org. So go check it out. If you’re not here in person, I believe it is virtual, as well. We love to see you as part of it in support the OpenSSF. We’re gonna take a break here in Austin. We’ll be back in a bit.

The post Jamie Thomas: What is the OpenSSF appeared first on Linux Foundation.

SODA Foundation Announces 2022 Data & Storage Trends Survey

The Linux Foundation - Wed, 07/13/2022 - 21:56

To address evolving Data and Storage needs throughout the industry, SODA Foundation, in partnership with Linux Foundation Research, is once again conducting a survey to provide insights into challenges, gaps, and trends for data and storage in the era of cloud native, edge, AI, and 5G. The results will serve to guide the SODA Foundation technical direction and ecosystem. With this survey, we seek to answer:

  • What are the data & storage challenges faced by end users?
  • What are the key trends shaping the data & storage industry?
  • Which open source data & storage projects are users interested in?
  • What cloud strategies are being adopted by businesses?

Through new insights generated from the data and storage community, end users will be better equipped to make decisions, vendors can improve their products, and the SODA Foundation can establish new technical directions — and beyond!

Please participate now; we intend to close the survey in August.

Privacy and confidentiality are important to us. Neither participant names, nor their company names, will be displayed in the final results. 

This survey should take no more than 15 minutes of your time. 

To take the 2022 SODA Foundation Data & Storage Trends Survey, click the button below in your choice of English, Chinese, and Japanese.

Take Survey [EN] Take Survey [民意调查] Take Survey 調査 BONUS

As a thank you for participating in this research, once you have completed the survey, a code will be displayed on the confirmation page, which can be used for a 25% discount on any Linux Foundation training course or certification exam listed in our catalog: https://training.linuxfoundation.org/full-catalog/ 

PRIVACY

Your name and company name will not be displayed. Reviews are attributed to your role, company size, and industry. Responses will be subject to the Linux Foundation’s Privacy Policy, available at https://linuxfoundation.org/privacy. Please note that members of the SODA Foundation survey committee who are not LF employees will review the survey results. If you do not want them to have access to your name or email address in connection with the survey, please do not provide your name or email address.

VISIBILITY

We will summarize the survey data and share the learnings later this year on the SODA website. In addition, we will produce an in-depth survey report which will be shared with all survey participants.

ABOUT SODA FOUNDATION

The SODA Foundation is an open source project under the Linux Foundation that aims to foster an ecosystem of open source data management and storage software for data autonomy. SODA Foundation offers a neutral forum for cross-project collaboration and integration and provides end-users with quality end-to-end solutions. We intend to use this survey data to help guide the SODA Foundation and its surrounding ecosystem on important issues.

PARTNERS

We are grateful for the support of our many survey distribution partners, including:

  • China Electronics Standardization Institute (CESI)
  • China Open Source Cloud League (COSCL)
  • Chinese Software Developer Network (CSDN)
  • Cloud Computing Innovation Council of India (CCICI)
  • Cloud Native Computing Foundation (CNCF)
  • Electronics For You (EFY)
  • IEEE Bangalore Section
  • Japan Data Storage Forum (JDSF)
  • Mulan Project
  • Open Infra Foundation (OIF)
  • Storage Networking Industry Association (SNIA)
QUESTIONS

If you have questions regarding this survey, please email us at survey@sodafoundation.io or ask us on Slack at https://sodafoundation.io/slack/

Sign up for the SODA Newsletter at https://sodafoundation.io/

The post SODA Foundation Announces 2022 Data & Storage Trends Survey appeared first on Linux Foundation.

DXVK 1.10.2 Released With Many Game Fixes, Performance Optimizations

Phoronix - Wed, 07/13/2022 - 21:53
DXVK 1.10.2 has been released as the newest version of this Direct3D 9/10/11 implementation atop the Vulkan API that is most notably used with Proton for Steam Play to enjoy Windows games on Linux...

Open Mainframe Project Announces Schedule for the 3rd Annual Open Mainframe Summit on September 21-21 in Philadelphia, PA

The Linux Foundation - Wed, 07/13/2022 - 21:45

 The first-ever in-person Summit will focus on security, training, AI, Linux on Z and Cloud Native  and will be accessible online for attendees around the world

SAN FRANCISCO, July 13, 2022 The Open Mainframe Project, an open source initiative that enables collaboration across the mainframe community to develop shared tool sets and resources, announces the schedule for the 3rd annual Open Mainframe Summit, which will be in-person in Philadelphia, PA, and streaming online for global attendees. This year’s theme focuses on security, which is top of mind for every company that uses mainframes.

Critical enterprise systems are more connected than ever, which means vulnerabilities have increased. In fact, according to The Essential Holistic Security Strategy, a recent report by Forrester Consulting, commissioned by Open Mainframe Project Silver Member BMC, 81 percent of organizations surveyed are prioritizing the integration of security functions and improving security detection and response.

This year will highlight security as it relates to all aspects of mainframes and beyond including cloud native services, automation, software supply chain management and more. The Summit will also highlight projects such as Zowe and COBOL, education and training topics that will offer seasoned professionals, developers, students and thought leaders an opportunity to share best practices and network with like-minded individuals.

Some of the security sessions include:

Additionally, David Wheeler, Open Source Supply Chain Security Director at the Linux Foundation, will also give a keynote.  

Other highlights include:

See the full conference schedule here.

Open Mainframe Project would like to thank this year’s Open Mainframe Summit planning committee including Alan Clark, CTO Office and Director for Industry Initiatives, Emerging Standards and Open Source at SUSE; Donna Hudi, Chief Marketing Officer at Phoenix Software; Elizabeth K. Joseph, Developer Advocate at IBM; and Michael Bauer, Staff Product Owner at Broadcom, Inc.

Early bird pricing ($500 US) for in-person attendees ends on July 15. Registration for academia is $50 for in-person and $15 for a virtual pass. Register here.

Open Mainframe Summit is made possible thanks to Platinum Sponsors Broadcom Mainframe Software, IBM, and SUSE and Gold Sponsors BMC, Micro Focus and Vicom Infinity, a Converge Company. For information on becoming an event sponsor, click here by August 5. 

Members of the press who would like to request a press pass to attend should contact Maemalynn Meanor at maemalynn@linuxfoundation.org.

About the Open Mainframe Project

The Open Mainframe Project is intended to serve as a focal point for deployment and use of Linux and Open Source in a mainframe computing environment. With a vision of Open Source on the Mainframe as the standard for enterprise class systems and applications, the project’s mission is to build community and adoption of Open Source on the mainframe by eliminating barriers to Open Source adoption on the mainframe, demonstrating value of the mainframe on technical and business levels, and strengthening collaboration points and resources for the community to thrive. Learn more about the project at https://www.openmainframeproject.org.

About The Linux Foundation

Founded in 2000, the Linux Foundation and its projects are supported by more than 2,950 members. The Linux Foundation is the world’s leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects are critical to the world’s infrastructure including Linux, Kubernetes, Node.js, ONAP, Hyperledger, RISC-V, and more. The Linux Foundation’s methodology focuses on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.

The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see its trademark usage page: www.linuxfoundation.org/trademark-usage. Linux is a registered trademark of Linus Torvalds.

###

A

O

The post Open Mainframe Project Announces Schedule for the 3rd Annual Open Mainframe Summit on September 21-21 in Philadelphia, PA appeared first on Linux Foundation.

Pages