We've just released a new version of GNU Guile, version 2.0.13, which is a security release for Guile (see the original announcement).
This handles a significant security vulnerability affecting the live REPL, CVE-2016-8606. Due to the nature of this bug, Guile applications themselves in general aren't vulnerable, but Guile developers are. Arbitrary Scheme code may be used to attack your system in this scenario. (A more minor security issue is also addressed, CVE-2016-8605.)
There is also a lesson here that applies beyond Guile: the presumption that "localhost" is only accessible by local users can't be guaranteed by modern operating system environments. If you are looking to provide local-execution-only, we recommend using Unix domain sockets or named pipes. Don't rely on localhost plus some port.
To give context, Guile supports a nice live-hacking feature where a user can expose a REPL to connect to, through Geiser or so on. This allows Guile users to hack programs even while programs are running.
When using the live hacking feature, the default in Guile has been to expose a port over localhost to which code may be passed. The assumption for this is that only a local user may write to localhost, so it should be safe. Unfortunately, users simultaneously developing Guile and operating modern browsers are vulnerable to a combination of an HTML form protocol attack and a DNS rebinding attack. How to combine these attacks is published in the article How to steal any developer's local database.
In Guile's case, the general idea is that you visit some site which presumably loads some JavaScript code (or tricks the developer into pressing a button which performs a POST), and the site operator switches the DNS from their own IP to 127.0.0.1. Then a POST is done from the website to 127.0.0.1 with the body containing Scheme code. This code is then executed by the Guile interpreter on the listening port.
The version we are releasing mitigates this problem by detecting incoming HTTP connections and closing them before executing any code.
However, there is a better long term solution, which is already available even to users of older versions of Guile: Guile supports Unix domain sockets in POSIX environments. For example, users may run the command:
guile --listen=/tmp/guile-socket
to open and listen to a socket at /tmp/guile-socket. Geiser users may then connect using M-x geiser-connect-local. This is considerably safer.
We hope that other program authors take heed of this lesson as well: many programs make use of localhost + port as a way of limiting connections. Unfortunately, in today's complex networked environment, this isn't a safe assumption. It's very difficult to predict what programs may provide a way of chaining requests to an application listening on localhost, and certainly difficult on a system where web browsers are involved. Take heed!
(This post originally appeared on the guile-users mailing list.)
We are delighted to announce GNU Guile release 2.1.4, the next pre-release in what will become the 2.2 stable series.
This release fixes many small bugs, adds an atomic reference facility, and improves the effectiveness of integer unboxing in the compiler. See the release announcement for full details and a download link.
We are delighted to announce the availability of GNU Guile 2.0.12, a maintenance release in the current stable 2.0 series.
This release packages together many bug fixes that have accumulated over the last two years while the Guile team was otherwise busy working on the upcoming 2.2 series and on building the Guix package manager and GNU system distribution.
See the release notes for a list of user-visible changes in this release and a download link.
We are delighted to announce GNU Guile release 2.1.3, the next pre-release in what will become the 2.2 stable series.
This release rewrites the ports facility to better support non-blocking concurrent input and output. See the newly rewritten "Input and Output" section of the manual for all details, and the release announcement for a download link.
We are chuffed to announce GNU Guile release 2.1,2, the next pre-release in what will become the 2.2 stable series. This release features unboxed arithmetic and dramatically faster build times, along with a number of small speed and memory improvements.
See the original announcement at https://lists.gnu.org/archive/html/guile-user/2016-02/msg00022.html for full details.
The schedule of GNU Guile's developer room at FOSDEM is now available on-line! It features 10 talks covering different projects including Guile-SSH, wisp, GNU Guix, and more. The Guile session will be followed by a session about the Lua programming language; a panel on the future of small languages will make the transition between the two.
FOSDEM takes place on January 30–31 in Brussels, Belgium, with the Guile session starting on Saturday morning. Hope to see you there!
GNU Guile will have its own developer room at FOSDEM 2016, which will take place in Brussels, Belgium, 30–31 January 2016.
Now is the time to submit a proposal for a talk in our devroom! We welcome all kinds of talks, be it about functional programming with Guile, experience reports on embedding Guile in your application, Web development with Guile, GNU Guix development, and more—Guile has very diverse use cases, and this devroom should reflect that.
We look forward to reading your proposal and to meeting you! :-)
We are delighted to announce GNU Guile release 2.1,1, the first pre-release in what will become the 2.2 stable series. This release features a new compiler and virtual machine that offer important performance improvements. It also removes all limitations on stack sizes: users are free to recurse to their hearts' content, using the stack as a data structure, as it was meant to be.
See the original announcement for full details.
We are pleased to announce GNU Guile release 2.0.11, the next maintenance release for the 2.0.x stable series.
This release fixes an embarrassing regression introduced in 2.0.10 in the C functions to access SRFI-4 vectors.
See the original announcement for details.
We are pleased to announce GNU Guile release 2.0.10, the next maintenance release for the 2.0.x stable series.
This release contains 253 commits by 11 people over 11 months.
In addition to many (long overdue!) bug fixes, this release brings new features, including an implementation of the SRFI-43 vector library and the SRFI-64 test suite API, some support for the new R7RS Scheme standard, and a GDB extension for Guile debugging.
See the original announcement at https://lists.gnu.org/archive/html/guile-devel/2014-03/msg00041.html for more details.
Last week was Guile 2.0's third anniversary. Guile 2 was a major milestone for Guile and so, like in previous years, we organized a birthday potluck---a hack fest where Guilers brought their freshly cooked dishes.
This year again we got a variety of fine dishes. Here's the menu:
This has been another pleasant potluck. Thanks to all the participants, and happy birthday Guile 2!
There will be two exciting Guile-related projects going on as part of GSoC this year:
See the initial discussion for details.
Happy hacking!
We are pleased to announce GNU Guile release 2.0.9, the next maintenance release for the 2.0.x stable series.
This release represents 347 commits by 15 people over 4 months.
In addition to a number of bug fixes and portability improvements, this release brings new features, including an implementation of SRFI-41 streams and SRFI-45 promises, additional keyword parameters for procedures that open files, new HTTP client procedures, improvement to the numerics code, and bindings for the sendfile libc function.
See the original announcement at http://lists.gnu.org/archive/html/guile-devel/2013-04/msg00133.html for more details.
February the 16th marked the second anniversary of Guile 2.0. Guile 2 was a major upgrade to Guile's performance and expressiveness as a language, and has become a pleasant foundation for its users.
To celebrate, we organized a little birthday hack-feast -- a communal potluck of programs that Guilers brought together to share with each other. Like last year, many people took on the challenge to come up with a dish, in one month.
Well, there you have it. We hope you enjoy digesting these programs as much as we enjoyed writing them, and we hope to see you at our table next year.
Happy birthday, Guile 2!
We are pleased to announce GNU Guile 2.0.7, the next maintenance release of the 2.0.x stable series.
As usual, this release brings many bug fixes along with new features such as support for SRFI-105 curly infix expressions and per-port reader options, nested futures for parallel computations, and functional setters for SRFI-9 records.
See the original announcement at http://lists.gnu.org/archive/html/guile-devel/2012-11/msg00211.html for more details.
We are pleased to announce GNU Guile 2.0.6, the next maintenance release of the 2.0.x stable series.
This release provides many bug fixes, as well a new features: the introduction of a new common-subexpression elemination (CSE) pass in the compiler, improved effect analysis and new optimizations in the compiler's partial evaluator (peval), new functions in the web modules, localized number output with (ice-9 format), and more.
See the original announcement at http://lists.gnu.org/archive/html/guile-devel/2012-07/msg00036.html for more details.
Today is the first anniversary of GNU Guile 2.0 [0]. To celebrate it, several hackers several hackers took on the challenge to come up in one week with a neat hack:
• Ian Price quickly came up with GDBM bindings, written with Guile’s dynamic foreign function interface (FFI): <http://lists.gnu.org/archive/html/guile-user/2012-02/msg00020.html>.
• Nala Ginrut wrote BIG, for “Bash Inner Guile”, which extends Bash with the ability to evaluate Scheme expressions: <http://lists.gnu.org/archive/html/guile-user/2012-02/msg00026.html>.
• Mike Gran polished his port of GNU Zile to Guile: <http://lists.gnu.org/archive/html/guile-user/2012-02/msg00033.html>.
Shortly after, he released a new version, along with an implementation of Tetris in Scheme that uses GNU Guile-Ncurses: <http://lists.gnu.org/archive/html/guile-user/2012-02/msg00041.html>.
• Ludovic Courtès brought Guile-GCC, which allows GCC to be extended in Guile: <http://gcc.gnu.org/ml/gcc/2012-02/msg00323.html>.
Happy birthday Guile 2.0, and happy GNU hacking!
[0] http://lists.gnu.org/archive/html/guile-devel/2011-02/msg00173.html
[1] http://lists.gnu.org/archive/html/guile-user/2012-02/msg00019.html
GNU Guile 2.0.5 was just released, to fix the incorrect binary interface information (SONAME) found in libguile in 2.0.4. It does not contain other changes.
Please be sure to upgrade to 2.0.5 if you already installed 2.0.4.
We apologize for the inconvenience.
We are pleased to announce GNU Guile 2.0.3, the fourth maintenance release of the 2.0.x stable series.
This release provides many bug fixes, including better portability and an improved compatibility with version 1.8, garbage-collection-related performance improvements, and some new features such as a better random state seed, functional file system traversal procedures, and syntax parameters.
See the original announcement at http://lists.gnu.org/archive/html/guile-devel/2012-01/msg00521.html for more details.
The manual of GNU Guile 2.0 has been published under ISBN 978-1-906966-15-7 by Network Theory, Ltd, a UK-based publisher, and is now available from any good bookstore! See http://www.network-theory.co.uk/guile/manual/ for more details.
It is a paperback of the Guile 2.0.3 reference manual, covering almost all the aspects of using Guile from Scheme and C, its modules, as well as its internals, and a discussion of the project's history and rationale.
The book is fairly impressive: 918 pages, 1.4 kg (3.0 lb), reflecting 15 years of work by more than 20 writers.
If you were looking for a present for your beloved, this is surely a good candidate. :-)
Thanks to Brian Gough for making it possible!