The most important events of 2019

The final selection of the most important and notable events of 2019:

• Richard Stallman left post of president of the Open Source Foundation.
• IBM company swallowed up RedHat.
• Standardization WebAssembly. promotion WebAssembly as a platform for universal use. WASI for using WebAssembly outside the browser. binaryAST to speed up JavaScript loading.
• IBM, Google, Microsoft and Intel formed alliance for the development of open data protection technologies.
• W3C and WHATWG organizations deal develop common HTML and DOM specifications.
• Return on the issue of supporting multiple init systems in Debian and holding general vote on init systems in Debian.
• Microsoft company опубликовала public specifications and made exFAT patents available for royalty-free use on Linux. Paragon Software Company opened your exFAT driver code.
• Python и Firefox switched to new release generation cycles.
• Implementation of DNS-over-HTTPS support in Firefox и Chrome (association of providers came forward vs DoH).
• HTTP/3 support Chrome и Firefox, Assistance with resumes writing module with HTTP/3 support for nginx.
• Chrome and Firefox switch to marking pages opened via HTTP with an insecure connection indicator.
• Firefox: Incident with all Firefox add-ons disabled due to Mozilla certificate expiration. Enable tracker blocking by default in Firefox. Development of a new mobile browser Firefox Preview.
  Renewal work on integrating Tor support into Firefox. Completed work on removing XBL (XML Binding Language) components from Firefox; many built-in interfaces have been redone (viewing certificates, address bar, about:config, etc.). Launched Firefox Send service. Folding Test Pilot program and Firefox Screenshots service.
  No, thanks Mozilla from implementing some restrictions from the new Chrome manifesto.

• Chrome: promotion third edition of the manifesto, incompatible with uBlock Origin. Включение blocker of inappropriate advertising. Disconnecting Flash. Stop displaying “https://” and “www.” in the address bar. promotion SXG and AMP for delivering verified copies of web pages from other sites. Gain isolation between sites. Toughening rules for posting add-ons in the Chrome Web Store.
• TLS: Mozilla, Cloudflare and Facebook proposed TLS extension for delegation of short-lived certificates. The ACME protocol developed by the Let's Encrypt project approved as an Internet standard.
• KDE и Mozilla switched to Matrix for developer communication. GTK instead of mailing lists goes over to the Discourse platform.
• Hardware: Opening microarchitecture MIPS R6 (MIPS Open). IBM Company opened Power processor architecture. Western Digital has unveiled the WD SweRV RISC-V processor. Intel develops open firmware ModernFW. Google develops OpenTitan, a platform for creating trustworthy chips. Google, SiFive and WD founded alliance to promote open chips and SoCs.
• Patents: Patent action против GNOME Foundation. Initiative on protecting open source software from patent trolls. Attempt formation patent pool for collecting royalties for the use of AV1 and VP9 codecs.
• Litigation: Renewal litigation between Google and Oracle related to Java and Android. Suit vs Adblock Plus. Victory VMware in a GPL violation case. Rambler said your rights on Nginx.
• Conflicts: Systemd on Debian stayed without a maintainer. Termination dstat development. Removal Gem package as a sign of protest. Closing access to Jonathon F. PPA repositories. Appeal Do not change the GTK theme in distributions. GNU Project Maintainers were made against Stallman's sole leadership.
• Licenses: CockroachDB DBMS goes over for a proprietary license. Oracle changes license for Java SE builds. Redis Labs Company translated modules from the Commons Clause to their own non-free license. The license used by the MongoDB project is SSPL recognized invalid on Fedora Linux. The license for CUPS has changed from GPLv2 and LGPLv2 to Apache 2.0. Chef was a completely open project.
• New forks: glimpse - GIMP fork, Glaber - Zabbix fork, notqmail - fork of qmail.
• Network infrastructure: RIPE singled out last free IPv4 block. Initiatives DNS flag day 2019 by termination support for problematic DNS implementations and DNS flag day 2020 to solve problems with IP fragmentation when processing large DNS messages.
  Facebook has opened platform for the rapid deployment of LTE networks. BGP route leak led to a massive disruption of connectivity on the Internet.

• Microsoft Open Initiatives: System mimalloc memory allocation, subsystem WSL2 с modified Linux kernel unification .NET 5 platforms with support for Linux and Android, Quantum Development Kit for the development of quantum algorithms, C++ standard library, platform .NET Core 3.0 with WinUI and Windows Forms. Microsoft joined to OpenJDK development. Microsoft Edge browser will support Linux.
• Machine learning: spleeters to separate music and voice.
  Mozilla develops machine translation system. Microsoft has opened SPTAG machine learning library. Synthesis animations using neural networks. Release TensorFlow 2.0. CodeSearchNet for searching and analyzing code. NVIDIA SPADE (GauGAN) for synthesizing landscapes from sketches. StyleGAN to generate faces.

• Project code is open: Google has opened sandboxed for creating sandbox environments, ClusterFuzz to identify errors and Adiantum for fast storage encryption. Cloudflare опубликовал distributed random number generator. Netflix has opened code for the interactive computing environment Polynote. Intel опубликовал library for noise reduction and image filtering.
  Facebook has opened Hermes JavaScript engine code. BMW opened system distributed rendering RAMSES. Amazon prepared open edition of Elasticsearch. opendrop - open implementation of Apple AirDrop. Opened code for industrial CRM/BPM/ERP system BGERP. NSA published Ghidra reverse engineering toolkit. Cryptographic library EverCrypt.

• Programming languages: Perl 6 renamed in Raku. New languages V, Flow9,
  P++ (strongly typed PHP dialect).

  Nim 1.0. GCC 9. Python 3.8. LLVM 8/9. Java SE 12/13. Jakarta EEMore. Go 1.12/1.13
  PHP 7.4.Perl 5.30.

• System components: systemd 241, 242, 243, 244. systemd-homed to manage portable home directories. Glibc 2.29/2.30.
• Virtualization and containers: Hypervisor NVMM from the NetBSD project. Hypervisors Intel Cloud Hypervisor and Amazon Firecracker written in Rust. Distribution ClonOS for deploying virtual server infrastructure based on FreeBSD. The Linux 5.3 kernel includes a hypervisor ACRN. Hermitux - unikernel, binary compatible with Linux.
• BSD: Divisions FreeBSD base system into packages. Translate FreeBSD on "ZFS on Linux". Removal GCC from the FreeBSD core. FreeBSD 12.1. New distributions FuryBSD и SecBSD. Hyperbola transformed to a fork of OpenBSD. OpenBSD 6.5/6.6. Formation package updates for the OpenBSD stable branch. Git compatible Got version control system from OpenBSD.

  DragonFlyBSD 5.6.

• Distributions: Red Hat Enterprise Linux 8.0 (8.1). Debian 10. Fedora 30/31. Ubuntu 19.04/19.10.

  Continuously updated edition CentOS Stream. ELISA Project on developing a Linux environment for highly reliable systems. Trident goes over from the BSD TrueOS system to Void Linux. Closing Russian Fedora project. Development of Scientific Linux 8 rolled up in favor of CentOS.
  Development of Fedora Atomic Host discontinued in favor of the project Fedora Core OS. Termination support for 32-bit x86 systems in Ubuntu.

• Mobile platforms: webOS Open Source Edition 2, Android 10, LineageOS 16, EdgeX 1.0.
  First batch of the Librem 5 smartphone and preparation of the PinePhone smartphone. Merger open project Mer and proprietary OS Sailfish. Platform Mozilla WebThings.

• DBMS: PostgreSQL 12, MariaDB 10.4. Opened VictoriaMetrics DBMS code. BlazingSQL, which uses the GPU for acceleration. Dqlite, a distributed variant of SQLite.
• Custom environments and graphics: GTK+ renamed in GTK. Xfce 4.14,KDE 5.15/5.16/5.17, GNOME 3.32/3.34. LXQt 0.14. MATE 1.22.

  wayland 1.17, weston 7.0.
  Red Hat intends to stop developing the X.Org server. New shader compiler for AMD GPUs from Valve. AMD has opened Caudron framework for rapid prototyping of 3D applications. Blender 2.80. xrdesktop for using GNOME and KDE in virtual reality headsets.

• Codecs: Intel has opened AV1 video encoder optimized for on-the-fly transcoding. Xiph and Mozilla develop rav1e, an AV1 encoder in Rust.
  Google has opened libgav1, decoder for AV1 format. VideoLAN and FFmpeg develop AV1 decoder dav1d.

• Linux kernel enhancements: 5.0, 5.1, 5.2, 5.3, 5.4.
  Prepare USB 4.0 drivers, development framework for writing secure drivers in Rust and adoption to the experimental VPN WireGuard branch. Transferring subsystems to Android (project on using the standard (without modifications) Linux kernel in Android).

  Major changes in the kernel: file system encryption mechanism Adiantum, BinderFS file system, seccomp lock handlers in user space, mode ext4 works in a case-insensitive way,

  io_uring asynchronous I/O interface, ability to use NVDIMM as RAM, support for scalable monitoring of very large file systems via fanotify, ability to configure Zstd compression levels in Btrfs, new cpuidle TEO handler, implementation of system calls to solve the 2038 problem, ability to boot from device devices -mapper without initramfs, SafeSetID LSM module, support for combined live patches,

  drivers for GPU Mali 4xx/ 6xx/7xx, device-mapper module dm-dust, Sound Open Firmware support for DSP, BFQ performance optimization, PSI (Pressure Stall Information) subsystem,

  support for Intel Speed ​​Select power management technology, pidfd_open system call, the ability to use IPv4 addresses from the 0.0.0.0/8 subnet, nftables hardware acceleration, HDR support in the DRM subsystem, ACRN hypervisor integration,

  experimental exFAT driver, mode "lockdown"to limit root user access to the kernel, fs-verity mechanism for monitoring file integrity, the ability to use CIFS for the root partition, iocost input/output controller, EROFS FS, dm-clone module for replication of external devices, virtiofs FS for exporting directories to guests systems, support for AMD Navi 12/14, AMD Arcturus, AMD Renoir, Intel Tiger Lake and Zhaoxi GPUs.

• Hacks: Matrix, https://www.opennet.ru/opennews/art.shtml?num=50673 Picreel and Alpaca Forms, Stack Overflow, Pale Moon, Momnero, HackerOne, Webmin, NASA, vandalism on Stallman's website.
• Malicious activity in repositories and directories:
  Docker Hub hack. Break PHP repository PEAR and modification of the package manager.
  Malicious add-ons Mozilla directory, Google Play.
  Атака malicious ransomware of Git repositories in GitHub, GitLab and Bitbucket services. Break Canonical repositories on GitHub. 73 repositories with backdoors on GitHub.
  Injecting malicious code into a Ruby package Strong_password, NPM package bb builder, npm package dependency PureScript, Python libraries in PyPI, Ruby libraries bootstrap-sass и rest client, Android applications for working with the camera.

• Cryptocurrencies: Blockchain platform TON (Telegram Open Network) and suspense placement of Telegram cryptocurrency. Critical vulnerability in Ethereum. Vulnerability in Zcash, which allowed the generation of new funds. Break Monero cryptocurrency website. Double waste funds in Ethereum Classic.
• Attack methods:
  • Атака to determine the memory state of processes using the page cache.
  • Technique bypass Widevine L3 DRM protection.
  • KNOB attack, allowing you to intercept encrypted Bluetooth traffic.
  • Атака on microphones of voice control systems using a laser.
  • Атака using malicious Thunderbolt devices.
  • Growth attacks related to seizure of control over DNS.
  • Атака to various TLS implementations.
  • Атака to a network of OpenPGP cryptographic key servers.
  • Possibility interfere with TCP connections made through VPN tunnels.
  • Атака on frontend-backend systems, allowing you to wedge into third-party requests
  • Атака CPDoS, which allows you to make pages served via a CDN unavailable.
  • Minerva — ECDSA key recovery technique.
  • NetCAT — remote detection of keys pressed in an SSH session.
  • DoS attacks to reduce the performance of the Tor network;
  • More efficient collision detection method for SHA-1.
• Vulnerabilities in processors. Problems with Intel chips: MDS, SPOILER, Zombieload 2, plundervolt. Intel and AMD: SWAPGS. AMD:
  AMD SEV.

• Vulnerabilities in firmware, protocols and isolated chips: BMC controllers, WiFi firmware Marvell Avastar, TPM Fail, HSM modules, Qualcomm TrustZone, intel sgx, WPA3 and EAP-pwd (1, 2), Broadcom WiFi chips, QualPwn (Qualcomm Wi-Fi)
• Vulnerabilities: Local root vulnerabilities in the Linux kernel (SCTP, AF_ALG, USB, i915, v4l2, marvell, fbdev). Remote DoS vulnerabilities in the Linux kernel (RDS, UDP, rtlwifi) and FreeBSD. Packet-of-death on Linux and FreeBSD.
  Four critical vulnerabilities в postal server Exim, which led to mass attacks.

  Remote vulnerabilities in php-fpm, WordPress, WhatsApp, SQLite (+ attack via WebSQL in Chrome) OpenSSL, NPM, Go, Unbound, endless stream of vulnerabilities in Ghostscript, Dovecot, KDE, Proftpd, Squid, Magento, SDL, GraphicsMagick, Vim, MyBB, PharStreamWrapper (Drupal, Joomla and Typo3), APT, pacman, Drupal, LibreOffice and OpenOffice, SCP.

  Dangerous local vulnerabilities in runc and LXC (Docker) systemd-journald, ld.so и libc in OpenBSD, Xen,
  vhost net, QEMU, Docker, snap and flatpak, snapD.

During the year, 1687 news (790 main, 897 mini) were published on OpenNET, on which 148862 comments were left.

Source: opennet.ru