Other LWN stuff:
 Daily Updates
 Calendar
 Linux Stocks Page
 Book reviews
 Penguin Gallery

 Archives/search
 Use LWN headlines
 Advertise here
 Donate to LWN
 LWN Supporters
 Contact us

Recent features:
- RMS Interview
- 2001 Timeline
- O'Reilly Open Source Conference
- OLS 2001
- Gaël Duval
- Kernel Summit
- Singapore Linux Conference
- djbdns

Here is the permanent site for this page.

See also: last week's LWN.

Leading items and editorials

• The Ottawa Linux Symposium is back for the fourth time; this year's event will be happening on June 26 to 29. Stephen Tweedie is the keynote speaker, and the conference schedule shows a long list of interesting talks. Attendance at OLS is limited, and the show is about halfway sold out. Folks who are thinking about attending probably want to get signed up before too long.

• Registration has opened for the O'Reilly Open Source Convention, to be held in San Diego, California on July 22 to 26. Keynotes by Lawrence Lessig and Richard Stallman should be interesting, to say the least, and the technical program looks solid - especially in areas of traditional OSCON strength, such as Perl.

• One of the longest-running Linux events is Linux Kongress; the ninth Kongress is scheduled for September 4 to 6 in Cologne, Germany. The call for papers has gone out, with a deadline of June 14 for submission of initial abstracts.

• Looking a little further ahead, the fourth Linux.conf.au will be held in Perth, Australia on January 22 to 25, 2003.

One occasionally hears complaints that the LinuxWorld Conference & Expo (ah, yes, August 12 to 15, San Francisco), has wiped out the more community and developer oriented events. Certainly some of the traditional gatherings (Linux Expo, ALS) are hurting or dead. But a look at the above list shows that the technical Linux conference is alive and well.

This is more than a good thing. Glitzy trade shows have their value, but the Linux and free software communities have a strong need for events that bring together developers and users. No amount of email and IRC can take the place of in-person gatherings, discussions, and beer. Technical conferences make high-bandwidth communications possible, and, crucially, they help to knit a worldwide band of developers and users into a community.

So the continued health of international technical events is a good thing; let us hope it stays that way. Many of these events are heavily dependent on corporate and/or governmental sponsorship for their continued existence - development conferences are not able to bring in vast amounts of money through fancy exhibit floors and "visionary" keynotes from corporate marketing VP's. So far, many of the companies that work in the free software realm have understood that development conferences are an important part of the ecology that they depend on. With luck, this trend will continue.

Lindows, source, and preview releases. This story has come around more than once: a company builds a product using GPL-licensed software. As part of the development process, preliminary versions of the product are distributed to beta testers - without source. The company claims that the source release requirements do not apply to beta versions, and that all will be made well when the official release happens.

The company in the news this time around is Lindows.com, which is working toward the release of its "LindowsOS" distribution. For $99, it is possible to join the "Lindows Insiders" and get preview versions of LindowsOS now; the company, of course, wishes to get feedback from its "Insiders" on how to improve the product. All this makes sense so far - though many folks, doubtless, will balk at paying $99 for the privilege of helping a company find its bugs.

But, it was noticed that the LindowsOS preview release did not come with source. That is where people started to get upset. If a company hands some software to a person who has paid $99 to get it, it seems clear that the company is "distributing" the software. And the GPL is clear that, when you distribute GPL-licensed software, you must also make the source available.

Lindows's failure to make source available caused concern at the Free Software Foundation and elsewhere. Bruce Perens sent an open letter to Lindows CEO Michael Robertson asking him to live up to the GPL. This request was not an attempt to create difficulties for Lindows, contrary to the opinion seemingly held by some. It was, instead, an attempt by copyright holders to uphold the terms under which they released their code.

The simple fact is that labelling a release "beta" or "preview" does not somehow magically suspend the terms of the GPL. If you use code which is licensed under the GPL, you agree to those terms and are expected to live up to them. The GPL has no provision allowing the withholding of source for certain kinds of releases; if you are distributing the software, you are distributing it.

We exchanged some email with Mr. Robertson, and it would appear that this particular situation has been resolved:

I did have a chance to have a friendly chat with Bradley Kuhn and Eben Moglen of FSF. I told them that if they had concerns, we would do our best to address them. We changed our NDA after their input and put up the source code - even for this early, unstable version.

This appears to be one of many situations where calm discussions are far superior to any amount of flaming. Lindows, after all, is not out to rip off the free software community. The company is, instead, trying to build a product that, with luck, will greatly increase the adoption of Linux in the marketplace. It is in Lindows's interest to maintain good relations with the developer community, and the company knows it. Lindows has met its obligations for now; we're looking forward to see how well they do.

The EFF Pioneer Award winners. The Electronic Frontier Foundation has announced the winners of this year's Pioneer Awards. They are:

• Dan Gillmor, for his technology reporting,
• Beth Givens, for her privacy work, and
• the DeCSS authors, as personified by Jon Johansen, for bringing DVD playback to Linux systems.

Inside this LWN.net weekly edition:

• Security: Are 1024 bit RSA keys secure?; mod_python and fragroute releases
• Kernel: IDE cleanups questioned; VM patches in 2.5.
• Distributions: Sorcerer != Sorcerer GNU/Linux (or does it?); Bdale Garbee is the new Debian Leader.
• Development: Quixote 0.4.6, Google API, mod_python 2.7.7, two new Zopes, GTK#, FLTK 1.1.0b13, Gnumeric 1.0.6, CMU Common Lisp 18d, Parrot 0.0.5, PHP 4.2.0 rc4, Python 2.1.3 and 2.2.1.
• Commerce: HP to Provide U.S. Department of Energy Laboratory One of World's Fastest Supercomputers; Mammoth PostgreSQL released.
• Letters: iSCSI, patents, free lunches.

This Week's LWN was brought to you by:

• Jonathan Corbet, Executive Editor

See also: last week's Security page.

Security

News and Editorials

RSA Laboratories, Dan Bernstein himself and Bruce Schneier do not predict any immediate threat to the security of 1024 bit RSA keys based on this research. When choosing a key size, RSA Laboratories considers the table of proposed key sizes offered for discussion at NIST's key management workshop in November 2001 (PDF format) to still be "reasonable general guidelines".

CRYPTO-GRAM Newsletter. Bruce Schneier's CRYPTO-GRAM Newsletter for April is out. He looks at ways of thinking about security, corporate liability for security vulnerabilities, and more. "If security has a silly season, we're in it. After September 11, every two-bit peddler of security technology crawled out of the woodwork with new claims about how his product can make us all safe again. Every misguided and defeated government security initiative was dragged out of the closet, dusted off, and presented as the savior of our way of life."

Security Reports

mod_python 2.7.7 released. Version 2.7.7 of mod_python has been announced. "This release (as far as I could tell adequately) addresses the security issue whereby a module indirectly imported by a published module could then be accessed via the publisher." Upgrades are recommended.

Debian security update to xpilot. The Debian Project has sent out a security alert for xpilot regarding a buffer overflow vulnerability which could be remotely exploitable.

Squid vulnerable to a DNS server based attack. The vulnerability exists in Squid-2.x up to and including 2.4.STABLE4. "A malicous DNS server could craft a DNS reply that causes Squid to exit with a SIGSEGV." MandrakeSoft has released what appears to be the first security update from a distributor to fix the problem for ML 7.1, 7.2, 8.0, 8.1, 8.2, Corporate Server 1.0.1, and Single Network Firewall 7.2.

Webalizer is also vulnerable to a DNS server based attack because of a buffer overflow bug. This unofficial patch to fix the problem was posted on Bugtraq. This one sounds nasty. If reverse DNS lookups are enabled in webalizer, "an attacker with command over his own DNS service, has the ability to gain remote root acces to a machine."

Multiple vulnerabilities in the Melange chat system were reported by Leon Harris. "Melange is a chat system written in C and java which is freely available under GPL. It is quite a nice system, and has been my pleasure to work with it. It was also coded nearly five years ago, at a time when people were not quite so security conscious. Its author has indicated that he is not currently maintaining it, due to other commitments."

web scripts. The following web scripts were reported to contain vulnerabilities:

• Guestbook and xNewsletter from x-dev.de were reported to have multiple vulnerabilities including cross site scripting and "Arbitrary Command Execution under certain circumstances."

Proprietary products. The following proprietary products were reported to contain vulnerabilities:

• IBM Informix Web DataBlade SQL injection and related auto-decoding HTML vulnerabilities were reported by Simon Lodal. When contacted by LWN, IBM Informix Support stated that a fix is being tested and is expected to be released "soon."

Updates

Cross-site scripting vulnerability in Horde/IMP. Version 2.2.8 of IMP has been released, it fixes some vulnerabilities. "The Horde team announces the availability of IMP 2.2.8, which prevents some potential cross-site scripting (CSS) attacks. Site administrators should consider upgrading to IMP 3 (our first recommendation), but if this is not possible, IMP 2.2.8 should be used to prevent these potential attacks." (First LWN report: April 11, 2002).

This week's updates:

Previous updates:

• Debian (April 16, 2002)
• Caldera (April 16, 2002)

Format string exploits in libsafe Libsafe versions prior to 2.0-12 are vulnerable to format string exploits. "Libsafe protection against format string exploits may be easily bypassed using flag characters that are implemented in glibc but are not implemented in libsafe." The current version is libsafe 2.0-13. Steve Beattie pointed out that the Immunix FormatGuard tool is not vulnerable to these kinds of attacks. (First LWN report: March 28, 2002).

This week's updates:

• Mandrake (April 11, 2002)

rsync supplementary groups vulnerability. Ethan Benson reported that rsyncd fails to remove supplementary groups (such as root) from the server process after changing to the specified unprivileged uid and gid. "This seems only serious if rsync is called using "rsync --daemon" from the command line where it will inherit the group of the user starting the server (usually root)." (First LWN report:  March 14th, 2002).

This week's updates:

• Caldera (April 3, 2002)
• Conectiva (March 14, 2002)
• EnGarde (March 11, 2002)
• Mandrake (March 13, 2002)
• Mandrake (April 17th, 2002) (Mandrake 8.1/ia64)
• Red Hat (March 21, 2002)
• Slackware (March 12, 2002)

Resources

Keyed-Hash Message Authentication Code standard. The US NIST has published FIPS 198, The Keyed-Hash Message Authentication Code. FIPS 198 "became a [US] Federal standard on March 6, 2002 [...] The standard describes a keyed-hash message authentication code (HMAC), a mechanism for message authentication using cryptographic hash functions."

Linux security week. The Linux Advisory Watch publications from LinuxSecurity.com is available.

Events

Upcoming Security Events.

Date	Event	Location
April 18 - 19, 2002	The Twelfth Conference on Computers, Freedom & Privacy	(Cathedral Hill Hotel)San Francisco, California, USA
April 18 - 19, 2002	InfoSec 2002	UniNet IRC network (irc.uninet.edu) - channel #infosec
April 23 - 25, 2002	Infosecurity Europe 2002	Olympia, London, UK
May 1 - 3, 2002	cansecwest/core02	Vancouver, Canada
May 4 - 5, 2002	DallasCon	Dallas, TX., USA
May 12 - 15, 2002	2002 IEEE Symposium on Security and Privacy	(The Claremont Resort)Oakland, California, USA
May 13 - 14, 2002	3rd International Common Criteria Conference(ICCC)	Ottawa, Ont., Canada
May 13 - 17, 2002	14th Annual Canadian Information Technology Security Symposium(CITSS)	(Ottawa Congress Centre)Ottawa, Ontario, Canada
May 27 - 31, 2002	3rd International SANE Conference(SANE 2002)	Maastricht, The Netherlands
May 29 - 30, 2002	RSA Conference 2002 Japan	(Akasaka Prince Hotel)Tokyo, Japan
June 17 - 19, 2002	NetSec 2002	San Fransisco, California, USA

For additional security-related events, included training courses (which we don't list above) and events further in the future, check out Security Focus' calendar, one of the primary resources we use for building the above list. To submit an event directly to us, please send a plain-text message to lwn@lwn.net.

Section Editor: Dennis Tenney

LWN Resources
Security alerts archive

Secured Distributions:
Astaro Security
Castle
Engarde Secure Linux
Immunix
Kaladix Linux
NSA Security Enhanced
Openwall GNU/Linux
Trustix

Security Projects
Bastille
Linux Security Audit Project
Linux Security Module
OpenSSH

Security List Archives
Bugtraq Archive
Firewall Wizards Archive
ISN Archive

Distribution-specific links
Caldera Advisories
Conectiva Updates
Debian Alerts
Kondara Advisories
Esware Alerts
LinuxPPC Security Updates
Mandrake Updates
Red Hat Errata
SuSE Announcements
Turbolinux
Yellow Dog Errata

BSD-specific links
BSDi
FreeBSD
NetBSD
OpenBSD

Security mailing lists
Caldera
Cobalt
Conectiva
Debian
Esware
FreeBSD
Kondara
LASER5
Linux From Scratch
Linux-Mandrake
NetBSD
OpenBSD
Red Hat
Slackware
Stampede
SuSE
Trustix
turboLinux
Yellow Dog

Security Software Archives
munitions
ZedZ.net (formerly replay.com)

Miscellaneous Resources
CERT
CIAC
Comp Sec News Daily
Crypto-GRAM
LinuxLock.org
LinuxSecurity.com
Security Focus
SecurityPortal

See also: last week's Kernel page.

Kernel development

Note that Linus warns: "The TCQ stuff is definitely experimental, you should probably configure it out for now."

No 2.5.9 prepatches have been issued as of this writing.

The latest patch from Dave Jones is 2.5.8-dj1; it fixes a number of problems but Dave has not dug too deeply into the patch queue yet.

Guillaume Boissiere's latest 2.5 status summary was released on April 17.

The current stable kernel release is 2.4.18. The latest 2.4.19 prepatch from Marcelo (produced when he wasn't busy getting thrown out of the U.S.) is 2.4.19-pre7; it adds a very long list of new fixes and upgrades, but no major changes.

There were no 2.4 prepatches from Alan Cox this week.

The right way to clean up the IDE code. Working on the IDE subsystem seems to be a difficult and thankless task - especially if you are not always concerned about the troubles you create for some users. Martin Dalecki found himself on the firing line again after releasing his IDE 36 patch, which included the following:

Remove sector data byteswapping support. Byte-swapping the data is supported on the file-system level where applicable. Byte-swapped interfaces are supported on a lower level anyway. And finally it was used inconsistently

There was only one problem: some people use and rely on that byte swapping feature. Filesystems can handle byte swapping in some situations - especially with their own metadata - but sometimes it is necessary to deal with a disk where everything is swapped. In particular, it seems that disks from TiVo systems require swapping to be readable on a Linux box.

It can be dangerous to interfere with hackers trying to play with their TiVo systems.

Despite the complaining, nobody is standing up for the old byte swapping implementation. It only worked in the (slow) programmed I/O mode, and could, in especially unlucky situations, lead to disk corruption. This feature clearly needed to be fixed in some way. But a number of people would have rather seen a replacement be provided before the old implementation was yanked.

Linus, however, does not agree:

The fact is, many things are easier to fix afterwards. Particularly because that's the only time you'll find people motivated enough to bother about it. If you were to need to fix everything before-the-fact, nothing fundamental would ever get fixed, simply because the people who can fix one thing are not usually the same people who can fix another.

In other words, a better byte swapping implementation simply is not going to happen until somebody really has to do it.

This better implementation, in fact, will probably not live in the IDE subsystem, and, thus, will probably not be done by Martin. The consensus seems to be that full byte swapping belongs in the loopback driver, where it can be slotted in when needed. No implementations have been posted, but it should not be that difficult for somebody to do.

Where are the VM updates for 2.5?. Mike Fedyk asked:

Why haven't any of the -aa VM updates gone into 2.5? Especially after Andrew Morton has split it up this is surprising...

Given the amount of VM work that happened just before the 2.5 fork, and given that Andrea's changes are said to improve performance and stability in a number of ways, it is interesting that VM development seems to have stopped in 2.5. Appearances can be deceiving, though: Andrew Morton's buffer management and I/O work certainly affects memory management. Rik van Riel, William Lee Irwin, and others have gotten VM-related patches into 2.5. Nonetheless, not much VM work is happening in 2.5. Andrew Morton posted a few reasons why that might be, including:

• Not much work is happening with 2.5 VM. The VM hackers are mostly still working with 2.4; the job there is incomplete, and it provides a more stable platform for VM developments (such as Rik van Riel's reverse mapping (rmap) code).

• Other work, such as the buffer management changes, tends to conflict with extensive VM changes.

• The general direction of VM development in 2.5 is still unknown. For example, no decision has been made on the inclusion of rmap in 2.5. There isn't even a 2.5 rmap patch yet.

Andrea Arcangeli, meanwhile, would like to see his changes in 2.5:

The fact is that in all the feedback I got so far I didn't seen anything that surpasses my vm-33 updates, certainly not mainline without them, certainly not the rmap patch either, and this is why I'm assuming vm-33 is the right thing to merge at this point in time into both 2.4 and 2.5.

Andrea also states that he is done with 2.4 work unless a problem comes up.

Linus has not chimed in with his view of where the VM work should go, so there is really no way of knowing what might get merged when. This could be cause for a bit of concern. The 2.3/2.4 experience demonstrated, clearly, that VM changes should not be left to the end of a development cycle. VM work can take a very long time to stabilize, so any big changes should be in place well before one even begins to think about stable releases.

The Linux Trace Toolkit is now available for the 2.5 kernel. LTT allows for detailed, dynamic tracing of the kernel; it can be invaluable for tracking down obscure, timing-related problems. LTT is shipped by some vendors (especially embedded Linux companies), but is not part of the standard kernel. Karim Yaghmour, author of LTT, would like to change that:

In the past, many have shown interest and support for LTT's inclusion in the standard kernel tree. I won't fill this mail with names, but Alan Cox, for instance, is one of them

LTT is a useful tool for looking inside the operation of the kernel. There is no word, of course, on whether it will eventually be merged into the mainline kernel; it remains, however, just one patch away.

Other patches and updates released this week include:

Kernel trees:

• Shawn Starr: 2.4.19-pre6-rmap-12i-xfs-shawn11. a combination of 2.4.19-pre6, the rmap patch, and XFS.

• Paul P Komkoff Jr: 2.4.19-pre5-ac3-s45. Includes some patches that maybe should not be there.

• J.A. Magallon: 2.4.19-pre7-jam1.

Core kernel code:

• Zlatko Calusic: port of sard I/O accounting patch to 2.5.8-pre3.

• Rik van Riel: helper macros for VM code.

• Robert Love: CPU affinity system calls for 2.4.

• Daniel Phillips: mm.h header splitup allowing some low-level macros to be changed to inline functions. "I didn't fix any of the mistakes that were exposed by compiling with the inlines, e.g., passing ulong to virt_to_phys instead of (void *). It's arguably better to observe firsthand the kind of cruft that the inlines are able to expose."

• Randy Dunlap: bounce and swap stats for 2.5.

• William Lee Irwin: per-zone pte_chain freelists.

• Eric W. Biederman, x86 boot enhancements: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, and 11.

Development tools:

• Yumiko Sugita, Linux Kernel State Tracer 1.0.

Device drivers

• Martin Dalecki: IDE subsystem cleanup patches: 32, 33, 34, 35, and 36.

• Jens Axboe: IDE tagged command queueing #4.

• Jeff Merkey: Dolphin PCI-SCI drivers for 2.5.7.

• Richard Gooch: devfs v210 (for 2.5.8) and devfs v199.13 (for 2.4.19-pre7).

• Rob Radez: watchdog driver updates.

• Greg Kroah-Hartman: Lineo's USB device implementation (discussed last week). Note that this support will likely be renamed "USB client," and Linus is unimpressed by the patch.

• Justin Gibbs: AIC7xxx driver 6.2.6 for 2.4.

• Michael Clark: SAFTE SCSI enclosure monitor.

Kernel building:

• Keith Owens: updates to kbuild 2.5.

Miscellaneous:

• Kernel Traffic for April 15 is available.

• Jari Ruusu: Loop-AES file/swap crypto package v1.6b.

Networking:

• Dmitry Kasatkin: Affix 0_99.

Ports:

• James Bottomley: NCR Voyager support, now with SMP support.

Section Editor: Jonathan Corbet

For other kernel news, see:

• Kernel traffic
• Kernel Newsflash
• Kernel Trap
• 2.5 Status

Other resources:

• L-K mailing list FAQ
• Linux-MM
• Linux Scalability Effort
• Kernel Newbies
• Linux Device Drivers

See also: last week's Distributions page.

Distributions

News and Editorials

Sorcerer != Sorcerer GNU/Linux (or does it?). On March 28 this column followed the birth of two forks of Sorcerer GNU/Linux (SGL) as the parent seemed to self-destruct. At that time SGL founder Kyle Sallee was lying low, not getting involved with either branch. Now he's back and there is once again a distribution at the old web site, this time called Sorcerer (dropping the GL). Sorcerer is not backward compatible with older releases of SGL. An initial version was made available for download and public testing on April 14, 2002.

Meanwhile, the fork previously identified as Sorcery is currently using the Sorcerer GNU/Linux moniker. There's a vote for a new name in progress. This young distribution, currently at version 0.1.3, has released spells for KDE 3.0 beta.

The third branch of this sorcerous triangle, originally identified as Lunar-Penguin, has also undergone a name change. It seems that Lunar-Penguin is actually a development group. Lunar-Linux is the group's first product. The latest ISO (codename: PETRO) was released April 9, 2002.

Distribution News

Bdale Garbee is the new Debian Leader. The election for the Debian Project Leader is over, and, according to the results page, the winner is Bdale Garbee. For those curious about what this could mean for Debian, here is Bdale's campaign platform.

Candidate Raphael Hertzog has posted a concession message congratulating Bdale and proposing moving forward on a number of his campaign issues anyway. It's an ambitious list of projects.

More Debian News. The Debian Weekly News for April 10 is out; covered topics include the Project Leader election, Woody boot floppy status, Debian Conference 2, the Woody release (scheduled now for May 1), the free status of the FDL, and more.

There has been a bit of a snag in the Woody release process. The "move postgresql from non-US to main" part of the "crypto-in-main" transition was harder than expected due to a library package rename. It's mostly done now, though.

Debian SID packages are available for the Midgard Application Server.

Debian-Med is an internal Debian project to support people in medical care. The goal of Debian-Med is to build a complete system for all tasks in medical care, using only free software. The latest Debian-Med news introduces the new web site, along with a German translation, and mentions some of the project's goals for the near future.

Mandrake Linux Community Newsletter - Issue #38. The Mandrake Linux Community Newsletter for April 10, 2002 looks at Mandrake in the news; the latest activities at MandrakeClub and contains 8.2 software updates; among other things.

For an informative update on Mandrake's participation in CeBIT read "MandrakeSoft at CeBIT - the REAL story". "Now, believe it or not, in spite of all the the "liquid" and "two-legged" temptations, we really got a lot of work done in Hanover!"

Red Hat Linux Bug Fixes. Red Hat has released a bug fix for the GNU C Library. Updated packages are available which fix several bugs that have been discovered in glibc.

Slackware-current 8.1-Beta2 !!. A new version of Slackware Linux is under way. The announcement for Slackware-current 8.1-Beta2 slipped out quietly in the change log, and was subsequently announced on UserLocal.com. There is a lengthy list of changes for this week, including a big GNOME update leading to the beta2 announcement.

LinuxQuestions.org launches Slackware Forum. LinuxQuestions.org has announced a new Slackware Forum.

Unofficial SuSE FAQ. The Unofficial SuSE FAQ is compiled from the SuSE Linux English language mailing list and tries to provide answers to Frequently Asked Questions (FAQ). This is an unofficial document, maintained voluntarily. It has been recently revised to include KDE related lists.

Turbolinux Releases Second Linux Server OS for IBM eServer iSeries. Turbolinux, Inc. announced a Turbolinux 7 Server for IBM eServer iSeries, a fully supported Linux distribution for iSeries. This latest release is based on the 64-bit kernel and also includes IBM's Java 1.3.1 and an ODBC driver for connectivity to OS/400's DB2/400 database.

Minor Distribution updates

2-Disk Xwindow System. The 2-Disk Xwindow System has released v1.4rc09 with minor bug fixes.

Blue Linux. Blue Linux (or BlueEDU) has released v1.0RC2 with minor bug fixes.

CRUX. CRUX has released v0.9.3 with major feature enhancements.

Embedded Coyote Linux. The Fury IP Load Balancer, the next product that will use the Embedded Coyote Linux core has been branched off of the base ECL tree. This project's goal is to design and implement an IP load balancing solution as an alternative to products such as Cisco's Local Director or F5's BIG-IP. More information will be posted on the product homepage.

A new authentication system known as CLAD (Coyote Linux Authentication Daemon) has been written to provide a more robust authentication system from Embedded Coyote Linux products. Currently, the PPTP support in Wolverine is being used to test this new authentication facility.

Gibraltar. Gibraltar has released v0.99.3a with minor feature enhancements.

Mindi Linux. Mindi Linux has released v0.62 with minor feature enhancements.

Vine Linux 2.5 released. Version 2.5 of Vine Linux has been released. "Project Vine officially released the latest version of their Red Hat based stability-oriented Japanese distribution, Vine Linux 2.5, which is their first major release including 2.4 (2.4.18) kernel." (Thanks to Maya Tamiya.)

Distribution Reviews

Red Hat 7.3 beta: A Product Review (Linux Journal). Linux Journal reviews the beta version of Red Hat Linux version 7.3 (Skipjack). "My personal interest in Skipjack arose mainly because this release includes a test version of KDE 2.99, which is really KDE 3.0 Release Candidate 3. I was so excited about this release because there have been claims of great performance improvements. In fact, the final version of KDE 3.0 was announced on April 3."

Review of Gentoo Linux 1.0 (OS News). OS News checks out Gentoo, a source based Linux distribution. "After the basic configuration had finished, I rebooted and, with a single command "emerge kde", Gentoo fetched off the web KDE and all its dependancies (XFree, assosiated libraries etc). And then, I left the machine compiling everything from source (with the optimization flags on), and I went to sleep. The time was already 1 AM. Next morning, the compilation had finished and I was ready to really use the machine as a workstation."

Linux for the masses (MSNBC). MSNBC reviews the Lycoris Desktop/LX. "I found one of the OS's most interesting features is Lycoris' network browser. It's a browser operated version of Windows' network mapping, a great idea for any Linux distribution that's trying to appeal to users of the world's most popular operating system. It also doesn't hurt that to delete unwanted items you move them to a 'trash can'. Everyone can relate to that."

Redmond Linux (RadSoft.net). RadSoft.net is running a short letter praising Lycoris Desktop/LX. "Grand total: 26 minutes. She installed an operating system and an office suite, patched them, learned the basics of the GUI, and was able to start using the office suite in less than half an hour."

OEone HomeBase Offers Computing, Simplified (Open For Business). Here is a review of the OEone Homebase distribution. "For the most part, OEone erred on the side of stability by including older, better tested versions of its key packages such as XFree86 (4.0.3) and Mozilla (0.9.3). On the other hand, HomeBase uses the recent Linux 2.4.17 kernel, which was a very good choice considering some of the problems with the early 2.4-series kernels."

The future of Xandros: Installation is nice, more features expected (NewsForge). NewsForge test drives Xandros Desktop 1.0. "The hardware support was particularly impressive, figuring out the identity of all the off-brand equipment on my test box on the very first try. Up until that moment, the only other operating system that was able to pull that off was Windows. If the installer is as reliable at detecting name brand hardware as it was with my bargain basement system, then Linux users will have a good option for hardware detection, which was once a Linux pipe dream."

Section Editor: Rebecca Sobol

Please note that not every distribution will show up every week. Only distributions with recent news to report will be listed.

Distribution Lists:
LWN List
DistroWatch
ibiblio
Linux.com
LinuxLinks
LDP English-language GNU/Linux distributions on CD-ROM
Woven Goods

See also: last week's Development page.

Development projects

News and Editorials

The Quixote design goals are:

• "To allow easy development of Web applications where the accent is more on complicated programming logic than complicated templating."
• "To make the templating language as similar to Python as possible. The aim is to make as many of the skills and techniques learned from writing regular Python code applicable to the task of writing Web applications."
• "No magic. When it's not obvious what to do in a certain case, Quixote refuses to guess."

Quixote is plugged into a web server via the CGI directory, it can use CGI, FastCGI, SCGI, and mod_python.

Versions 0.4.5 and 0.4.6 of Quixote have been released recently, both are mainly bugfix releases. See the CHANGES file for information on the latest features.

Quixote is licensed under the CNRI (Corporation for National Research Initiatives) Open Source license agreement.

Education

SEUL/Edu Report #68. The April 15, 2002 edition of the SEUL/edu Linux in education report is out. Topics include software for managing grade books, an open lesson plan site known as LessonForge, LinuxFund winter grants, and several new free educational software releases.

The SEUL/Edu Report is now also available in Spanish.

Embedded Systems

Embedded Linux Newsletter. The LinuxDevices.com Embedded Linux Newsletter for April 11 is available, with the usual roundup of happenings in the embedded Linux community.

Optimizing Embedded Linux (Dr. Dobb's). Todd Fischer illustrates how to tune an embedded Linux application on Dr. Dobb's Embedded Systems site.

Mail Software

New Mail Filters. The Milter.org site lists a few new mail filtering utilities, j-chkmail and Smtpblock.

Web-site Development

Google API Released, Full of SOAPy Goodness (use Perl). Google has released an API to their search engine using SOAP.

mod_python 2.7.7 released. Version 2.7.7 of mod_python has been announced. "This release (as far as I could tell adequately) addresses the security issue whereby a module indirectly imported by a published module could then be accessed via the publisher." Upgrades are recommended. (Thanks to Giorgio Zoppi.)

Midgard installation notes for Debian. Installation instructions that detail the installation of Midgard on the sid version of Debian GNU/Linux have been announced. (Thanks to Henri Bergius.)

Zope 2.4.4 beta 2 and Zope 2.5.1 beta 2. Two new versions of Zope have been released, stable version 2.4.4 beta 2 and development version 2.5.1 beta 2. See the CHANGES files for version 2.4.4 beta 2 and version 2.5.1 beta 2 for all of the details.

Installing mod_perl without superuser privileges (O'Reilly). Stas Bekman shows how to install mod_perl on O'Reilly's perl.com site. "As you have seen from my previous articles, mod_perl enabled Apache consists of two main components: Perl modules and Apache itself. While installing Apache without root privileges is easy, one should know how to install Perl modules in a nonsystem-wide location. In this article, I'll demonstrate ways to complete this task."

The NemeinRCS revision control library for Midgard. The NemeinRCS revision control library has been released for download. "NemeinRCS is a revision control library for the Midgard application server. NemeinRCS can be used for adding revision control capabilities for custom administration interfaces and content management tools built using the Midgard framework." (Thanks to Henri Bergius.)

Web Services

Universal Description, Discovery, and Integration Part 1 (O'Reilly). Tyler Jewell and David Chappell introduce UDDI on O'Reilly's onJava site. "UDDI -- Universal Description, Discovery and Integration -- is a key Web services technology. In this series of excerpts from Java Web Services, you'll learn how to program UDDI services. Part one here provides a basic understanding of UDDI and how Java works with it."

Documentation

LDP Weekly News. The April 16, 2002 edition of the LDP Weekly News features new HOWTO documents on Game Servers, Russian Tea (yes, the kind you drink), and a new Linux Cookbook.

Miscellaneous

A Fast Start for openMosix. Dr. Moshe Bar recently announced the creation of openMosix, a new Open Source project. The project has attracted a team of volunteer developers from around the globe and is off to a very fast start. openMosix, is an extension of the Linux kernel.

Application Links
GIMP
Mozilla
Galeon
High Availability
ht://Dig
mnoGoSearch
MagicPoint
Wine
Worldforge
Zope

Open Source Code Collections
Berlios
Freshmeat
OpenSourceDirectory
Savannah
Le Serveur Libre
SourceForge
Sweetcode

Desktop Development

Audio Applications

WaveSurfer 1.3.1 released. Version 1.3.1 of the WaveSurfer sound visualization and manipulation tool is available. The changes include documentation updates and bug fixes.

Web Browsers

Mozilla Independent Status Reports. The MozillaZine Independent Status Reports page lists a number of new developments including updates to the Optimoz, mozdev, and Beonex projects.

Desktop Environments

The People of KDE: Lukàs Tinkl. This week's People of KDE features Lukàs Tinkl, co-maintainer of kde-i18n, among other things.

KDE Print: Developer Tutorial Now Available. KDE.News has an announcement for a tutorial on using the KDEPrint module. "The tutorial is intended for application developers who wish to make use of KDEPrint within their applications."

Hey, Mom, I did GNOME!. Now you can see who's working on GNOME by checking out the gnome-stats project.

First C++ interfaces for Bonobo (Gnotices). A new C++ interface has been announced for Bonobo. "The gtkmm team have released a first version of libbonobouimm, with a working example. So C++ coders should soon have a sensible way to work with the whole GNOME toolkit."

Games

Tetris meets the Java bean (IBM developerWorks). Scott Clee shows how to implement the Tetris game using Java beans. "IBM Software Engineer -- and gamer at heart -- Scott Clee provides a simple way to take the Tetris game model and wrap it up as a reusable Java bean component. Once the game elements have been broken down into Java objects, they can be reassembled to form the complete game model bean, enabling it to be plugged into virtually any Tetris GUI."

GUI Packages

First Public Release of GTK#. The first public release of Gtk#, the C# language binding for the Gtk+ toolkit, has been announced. "Right now, all we're sure it does is run a Hello World app and a simple Button pressing demo app. We invite you to kick the tires and send us lots of bug reports, if you are the type that likes to adopt technologies long before they do much of anything useful."

FLTK version 1.1.0 b13 released. A new version of FLTK, the Fast Light ToolKit, is available. See the CHANGES file for information on what's new.

Multimedia

Ogg video CODEC released under the LGPL. The VP3 open source video CODEC has been released under the LGPL. The CODEC is to be integrated into the Ogg Vorbis framework, volunteers are needed.

Office Applications

AbiWord Weekly News #87. Issue #87 of the AbiWord Weekly News is out. Topics include the 0.99.5 release of AbiWord, a nifty plot of active and fixed bugs, and more.

Kernel Cousin GNUe #24. Kernel Cousin GNUe issue #24 is out with all of the latest developments from the GNU Enterprise project.

Gnumeric 1.0.6 released. Version 1.0.6 of the Gnumeric spreadsheet has been announced. This version features lots of bug fixes.

Programming Languages

BASIC

It BASICally Works (use Perl). The Perl Parrot compiler now supports BASIC. "Yep, we have a full-featured BASIC interpreter for Parrot in CVS."

Caml

Caml Weekly News. The April 16, 2002 edition of the Caml Weekly News looks at iox-1.00 b3, the Cryptokit library for OCaml, a re-implemented Queue module, Caml data structures, and more.

The Caml Hump. This week's new Caml Hump entry is the Coq proof assistant, which is used for the solution of mathematical proofs.

Java

Create native, cross-platform GUI applications (IBM developerWorks). Kirk Vogen writes about portable Java GUI design on IBM's developerWorks. "The Java language has flourished in the server-side and applet spaces, but when it comes to end-user applications, it isn't usually a player. But it doesn't have to be this way. Using Linux, the GNU Compiler for Java, and the Standard Widget Toolkit, you can create fast, native GUI applications programmed in the Java language."

Jython Tips for Python Programmers O'Reilly). Noel Rappin introduces Jython on O'Reilly's ONLamp site. "For somebody already familiar with Python, the greatest attraction of using Jython is the ability to use any of the wide range of existing Java libraries and tools while being able to still use Python as the programming language."

Lisp

CMU Common Lisp version 18d released. Version 18d of CMU Common Lisp has been announced. This version adds support for the OpenBSD/x86 platform, and features many new improvements.

Perl

Parrot 0.0.5 Released Into the Wild (use Perl). Version 0.0.5 of the Perl 6 Parrot compiler has been released. New features include Perl Scalar support, array and hash types, an EMACS editing mode, support for BASIC, a regular expression compiler, and more.

PHP

PHP 4.2.0 rc4. PHP version 4.2.0 release candidate 4 has been announced. This version features experimental support for Apache 2.0.35, and lots of bug fixes. PHP 4.2.0 is scheduled for release on April 22.

PHP Weekly Summary for April 15, 2002. The April 15, 2002 PHP Weekly Summary is out. Topics include forking of the GD library, EXIF headers, a fix for ZE2 and OpenSSL, a new DOM-XML extension, PHP 4.2.0 RC 3, a fix for Apache 2, and more.

Python

Python 2.1.3 released. The Python Software Foundation has announced the release of Python 2.1.3. "'We're happy to offer this maintenance release. This is not the latest and greatest version of Python, but it introduces several important improvements for people who prefer to continue running Python 2.1,' said Guido van Rossum, creator of Python and president of the Python Software Foundation." (Thanks to Stephan R.A. Deibel.)

Python Software Foundation Announces Python 2.2.1. The Python Software Foundation announced the release of version 2.2.1 of the Python programming language and standard libraries.

Dr. Dobb's Python-URL! for April 15. The Dr. Dobb's Python-URL! is available, with all the weekly Python news and links for the week of April 15.

The Daily Python-URL. New this week on the Daily Python-URL, are articles on Zeo 1.0 final, Zope lessons, the Python foundry Wiki, Pyrex, the sociology of language evolution, extending Jython, and more.

Ruby

The Ruby Garden. This week's Ruby Garden looks at constructor initialization, type checking, iterator variable reuse, argv security issues, and more. The April 15, 2002 edition of the Ruby Garden's Ruby Weekly News features Ruby/Google 0.1.0, REXML 2.1.2, and SOAP4R 1.4.3.

Scheme

The latest Scheme News. MJ Ray has sent us the latest Scheme News. Topics include a new Scheme Request for Implementation, reaffirming the IEEE language standard, several new Scheme modules, and more.

Tcl/Tk

Dr. Dobb's Tcl-URL! for April 16. The Dr. Dobb's Tcl-URL! is available with all the weekly Tcl news and links for the week of April 16.

XML

What's New in XSLT 2.0 (O'Reilly). Evan Lenz explores the new features in XSLT version 2.0. "In this article, we'll take a look at some of the new features specific to XSLT 2.0, as outlined in the latest working draft. Again, this assumes that you are familiar with the basics of XSLT/XPath 1.0."

SOAP::Lite 0.55 Released (use Perl). Paul Kulchenko has released SOAP::Lite version 0.55.

Integrated Development Environments

GNUstep Weekly Editorial. The April 4, 2002 GNUstep Weekly Editorial covers AppTalk 0.1.0 for integration of StepTalk scripting into applications, and mentions the GSFTP user application.

Miscellaneous

MLton Standard ML compiler. Version 20020410 of the MLton Standard ML compiler has been released. This version adds Cygwin/Windows support, and is SML 97 compliant.

Section Editor: Forrest Cook

See also: last week's Commerce page.

Linux and Business

HP to Provide U.S. Department of Energy Laboratory One of World's Fastest Supercomputers. The Department of Energy's Pacific Northwest National Laboratory announced that it has ordered an 8.3TF Linux-based supercomputer from Hewlett Packard Company to be installed in the Molecular Science Computing Facility in the William R. Wiley Environmental Molecular Sciences Laboratory, a DOE scientific user facility at PNNL.

PNNL will be posting job openings for senior kernel programmers to work on this new supercomputer. The jobs.pnl.gov site should have the listings starting April 20, 2002.

Mammoth PostgreSQL released. Command Prompt has announced the release of "Mammoth PostgreSQL," a commercially-supported version of the PostgreSQL database.

Linux Stock Index for April 12 to April 16, 2002.
LSI at closing on April 12, 2002 ... 23.80
LSI at closing on April 16, 2002 ... 24.57

The high for the week was 24.93
The low for the week was 23.80

Press Releases:

Open Source Products

• Linux Labs (ATLANTA): Linux Labs Releases Advanced Browser For Wireless Palm OS(R) Platform; New Linux-based Browser Fills Palm OS(R) Void.

• Synopsys, Inc. (MOUNTAIN VIEW, Calif.): Synopsys Releases OpenVera 2.0 Language With New Assertions; OpenVera 2.0 Incorporates Intel's ForSpec Language and Gains Tool Support from Electronic Design Automation (EDA) Vendors.

Distributions and Bundled Products

• Red Hat, Inc. (RALEIGH, N.C.): Red Hat Delivers Stronghold Enterprise Web Server.

• TimeSys Corporation (PITTSBURGH): TimeSys(TM) Releases Complete Embedded Linux(R) Solutions for Two Embedded Planet PowerPC-Based Boards.

• Turbolinux, Inc. (SAN FRANCISCO): Turbolinux Releases Second Linux Server OS for IBM eServer iSeries.

Proprietary Products for Linux

• Central Command, Inc. (MEDINA, Ohio): Central Command Releases Vexira Antivirus for Linux Servers and Workstations, Comprehensive, Scalable Virus Protection.

• NEON Systems (SUGAR LAND, Texas): NEON Systems Wins IBM's Support for Its Commitment to Linux on eServer zSeries.

• NetBrowser Communications, Inc. (SAN RAMON, Calif.): NetBrowser Partners With Cyclades to Embed e-Guardian(R) Agent.

• Silicon Metrics Corporation (AUSTIN, Texas): Silicon Metrics' Industry-Leading Cell Library Characterization Tool Provides One-Day Characterization at Hitachi.

• Symantec Corp. (CUPERTINO, Calif.): Symantec to Develop First Enterprise-Level Firewall for IBM eServer iSeries Linux Offering.

• Xi Graphics, Inc. (DENVER): Xi Graphics Releases Drivers for 3Dlabs GVX1 Pro Graphics Card; Accelerated-X(TM) Summit v2.1 Support Available for Linux and Solaris.

Linux PC Hardware

• Bivio Networks (PLEASANTON, Calif.): Bivio Networks Breaks $50K Price Barrier With Gigabit Speed, Carrier Class, Multi-Service Router; The Bivio 1000-AX Redefines Industry's Price / Performance Benchmark.

Products and Services Using Linux

• Open Clustering (Surrey, UK): Open Clustering's Samurai Blade Server Facts (or 10 Reasons Why Our Product Kicks Butt).

Products With Linux Versions

• Aestiva (TORRANCE, Calif.): Aestiva Knowledge Base 3.0 - Puts Knowledge On the Web.

• DataMirror (NASHVILLE, Tenn.): DataMirror Wins iSeries 2002 Editors' Choice Apex Award.

• Digi International (MINNETONKA, Minn.): Digi International Adds SSHv2 Feature To PortServer TS Products; New Features Provide Secure Network Serial Connectivity At Lowest Price-Per-Port.

• Intel Corporation (TOKYO): Intel Software Improves Performance of Applications Across PC, Server and Wireless Architectures.

• Mentor Graphics Corporation (WILSONVILLE, Ore.): Mentor Graphics HDL Designer Series 2002.1 Speeds Creation and Analysis of Complex Chip Designs.

• Plesk, Inc. (CHANTILLY, Va.): Plesk, Inc., Announces New Spanish Language Support and Partnership.

• SlickEdit Inc. (MORRISVILLE, N.C.): SlickEdit Announces Availability of Next Generation Editing Environment.

Linux At Work

• Acucorp, Inc. (SAN DIEGO): Customer Selects Acucorp for IBM S/390 Mainframe Server Migration Project.

Books & Documentation

• O'Reilly (Sebastopol, CA): "Building Java Enterprise Applications, Vol. 1: Architecture" Released by O'Reilly.

Partnerships

• Emulation and Verification Engineering (EVE) (PARIS): EV Engineering Joins The OpenVera Catalyst Program.

• NextHop Technologies Inc. (MOUNTAIN VIEW, Calif.): NextHop Technologies Teams with IBM to Advance PowerNP Network Processor.

• Sybase, Inc. (DUBLIN, Calif.): Sybase Invited to Join Prestigious eclipse.org Board.

Investments and Acquisitions

• Caldera International, Inc. (LINDON, Utah): Caldera International, Inc. and Tarantella, Inc. Agree On Early Redemption of Promissory Note and Stock Repurchase.

• Sendmail, Inc. (EMERYVILLE, Calif.): Sendmail, Inc. Raises $14 Million in An Oversubscribed Funding Round Led by Morgan Stanley Venture Partners; Investment Underlines 50% Revenue Growth in 2001.

• Webb Interactive Services, Inc. (DENVER): Webb Interactive Services, Inc. Announces Completion of Unit Financing And Jabber Capital Restructuring.

Personnel & New Offices

• Red Hat, Inc. (RALEIGH, N.C.): Red Hat Names CEO Matthew Szulik Chairman of the Board; Leading Educator Marye Anne Fox Joins Board.

Events

• Jabber, Inc. (DENVER): Announcing JabberConf Europe 2002: The Connecting Place for Jabber Technology and Business in Europe.

• KSAJ, Inc. (DARIEN, Conn.): Penton Media's Security Matters To Debut at Internet World Spring 2002 in Los Angeles; Security Experts On Show Floor To Reveal Tips On Securing Data.

• VA Software Corp. (): ADVISORY/VA Software Presents New Rules, New Tools: Enabling Collaborative Software Development At SD Expo 2002.

Other

• CompuServe (COLUMBUS, Ohio): CompuServe Announces Launch of CompuServe 7.0 with Netscape Gecko browser.

Section Editor: Rebecca Sobol.

See also: last week's Linux in the news page.

Linux in the news

Recommended Reading

Linux geeks play Hollywood politics (News.com). Linux geeks Jeff Gerhardt and Doc Searls are forming a lobbying group called GeekPAC that would try to convince lawmakers to consider developers when they draft laws concerning technology. "In recent years, attempts to crack down on illegal copying by outlawing some technologies have outraged developers, but few technologists have had the time or political wherewithal to challenge proposed legislation. The most high-profile law so far has been the 1998 Digital Millennium Copyright Act, which has landed one developer in jail and led to countless threats of enforcement against other programmers."

Microsoft learns a lesson from competition (CNN). This article claims Microsoft is learning lessons from open source. "Dana Hayter, a lawyer with Howard Rice in San Francisco who specializes in intellectual property law, says Microsoft is likely more worried about the competitive threat of open source software.
"I think the biggest problem (the GPL) has created is the potential to erode revenue from people who are in the business of distributing proprietary software," Hayter said."

Microsoft Attacks Free Software Developers with New License (FSF). The Free Software Foundation has published an article that explains the perils of Microsoft's new "Royalty-Free CIFS Technical Reference License Agreement".

"Microsoft has veiled this attack in the trappings of a 'gift'. Microsoft agrees to grant royalty-free permission to use and exercise their CIFS patents in Free Software, but only to a limited set of developers. Under the guise of fulfilling its obligations under the anti-trust settlement, Microsoft has singled out developers and companies who choose copyleft licenses (such as GPL and LGPL). Software distributors of copylefted software are forbidden from exercising the patents royalty-free, and thus are effectively forbidden from exercising the patents at all under copyleft."

Microsoft anti-GPL fine print threatens competition (Register). The Register is carrying a look at Microsoft's new CIFS licensing and how it may affect Samba. "The main problem for the Samba team is that while the open source version has been specifically designed to be interoperable with the Microsoft's SMB implementation without copying Microsoft's code, the new license references software patents implemented in CIFS, which some observers speculate Samba may inadvertently infringe upon."

The Microsoft penalty that isn't (News.com). Bruce Perens has written an article on News.com concerning Microsoft's recent licensing maneuvers. "In its antitrust settlement with the Justice Department and nine states, Microsoft promised to publish technology that would allow competing products to interoperate with Windows. But Microsoft has sidestepped the penalty by crafting a technology license that excludes the company's only viable competitor."

Economist backs Microsoft foes' case (News.com). News.com is running an article that discusses the testimony given by several experts in the Microsoft antitrust case. "'The case is about the illegal defense of a monopoly in the face of a threat that might have eliminated the monopoly power, not about the creation of a monopoly,' Shapiro testified. He also focused on how the technologies that posed a threat to Microsoft's Windows monopoly had changed dramatically since the case was brought in May 1998. "

FDA Validation a Threat to Free/OSS? (LinuxMedNews). LinuxMedNews looks at the possible threat to open source software from a recently changed FDA software validation document. "Arnaud Le Breton wrote in asking about the 'regulatory aspects' of medical open source especially in view of the FDA's recent revised document 'General Principles of Software Validation: Final Guidance for Industry and FDA Staff'".

Go with the GPL - Or Else (os Opinion). OsOpinion is running an article concerning reasons to chose a GPL compatible license. "Usually, even avid GPL proponents will support software with other GPL-compatible licenses if you choose not to use the GPL. However, if your license is not GPL-compatible, developers may create a competing product so they can take advantage of GPL'ed code."

Open source debated at AEI-Brookings (UPI). Newsalert is carrying this UPI article covering this open source debate. "James Bessen, founder and director of Research on Innovation -- a non-profit organization that promotes research on technological innovation -- says that part of the problem in the debate over open source development is the media portrayal of the "false dichotomies" of the competing sides. He believes that the portrayal of serious business interests (embodied by proprietary code products like Windows) vs. youthful idealism (represented by Linux and other OSS products)-- or "industrial strength products" vs. "hacker code" -- does not reflect the reality of the situation."

Open source subject to fiery debate (CNN). Can open source and proprietary software coexist? CNN covers a recent conference at which panelists debated the issue. "But audience member Richard Stallman, president of the Free Software Foundation, nearly stole the panel's thunder as he grabbed a microphone during the question and answer period and attempted to commandeer the conference to address what he described as mischaracterizations the panel made about the free software movement. Stallman had not been invited as a panelist."

Linux kernel captain deported (vnunet). Here's a vnunet.com article on 2.4 maintainer Marcelo Tosatti's expulsion from the U.S. for trying to do work with a tourist visa. "Tosatti acknowledged that the deportation was perfectly reasonable. 'I didn't have correct documentation so they had a reason to do it,' he said"

Munich considering a switch to Linux (Heise Online). Heise Online reports that the city of Munich, Germany is looking into the possibility of switching 10,000 PCs from Microsoft software to Linux. The main concerns of the study are information privacy and recurring license fees. See the original article in german, or view an English translation. (Thanks to Andreas Lauser.)

Judge sets hearing for e-book trial (News.com). The ElcomSoft/DMCA case is slowly grinding its way through the U.S. court system. News.com reports that U.S. District Court Judge Ronald Whyte has announced a hearing on May 6 to set a trial date for the case.

The making of de facto standards (ZDNet). ZDNet looks at efforts by IBM and Microsoft to push the UDDI, SOAP and WSDL protocols. "IBM and Microsoft have been widely recognized as the driving forces behind these protocols that, for the most part, were hatched in the labs of one or both companies. However, not one of these protocols has yet received the imprimatur of either the Internet Engineering Task Force (IETF) or the World Wide Web Consortium (W3C), the two standards-setting bodies for the Internet and Web."

FSF asks Lindows: 'Where's the Source?' (NewsForge). The Free Software Foundation wants to know why no source code was included with the LindowsOS sneak preview. "Robertson does not deny that the source code for LindowsOS isn't included in either of the two beta releases. 'It's a work in progress. We're hopeful our first release will happen around the middle of the year. When we release an official version, all the GPL pieces will be properly distributed.'"

The Case Against the DMCA (Linux Journal). Linux Journal has published an article on the history of the DMCA bill and its many negative effects. "This now infamous piece of legislation violates our basic rights of free speech and fair use. Not only does this evil piece of legislation violate our rights; it also stifles technological growth."

Opposing Hollings bill makes for strange bedfellows (NewsForge). NewsForge looks at the opposition to the CBDTPA. "Financial analysts are already warning major stockholders that their investments in the electronics industry are going in the tank unless the Hollings bill is killed."

Companies

Apunix Uses Mandrake Linux for Large-Scale Kiosk Deployment (MandrakeBizCases). Apunix Computer Services used Mandrake Linux 7.2 in the development, deployment, and continued use of a network of 160 kiosks for TravelCenters of America. "In September 2000, Apunix and TravelCenters of America (TA), the largest TravelCenter network in the United States, deployed the highly successful TravelCenters' RoadKing ClubTM Kiosk Program. These 160 Mandrake Linux-based kiosks have been running trouble-free since their installation."

Netscape, not IE, put on new CompuServe (News.com). Netscape is bundled with CompuServe 7.0. "However, the decision for CompuServe to embrace Netscape, also an AOL subsidiary, could further divide the Internet company's tenuous partnership with Microsoft. For years, the pair existed in an amicable quid-pro-quo arrangement where AOL would use IE as its default browser in exchange for Microsoft bundling AOL into its Windows operating system. Last summer, that arrangement dissolved, sending the tech rivals back to their respective corners."

Gateway Launches Ad Campaign Against Copyright Bill (Yahoo). Here's a Reuters article on Yahoo showing that the technology industry is starting to wake up to the CBDTPA problem. "The country's fourth-largest computer maker is taking to the airwaves in a bid to rally consumers against a copyright-protection bill that would prevent computers from playing pirated movies and music. Starting Wednesday night, computer maker Gateway Inc. will launch a radio and TV ad campaign urging consumers to visit its Web site to download free music and learn more about a copyright debate that so far has been dominated by Washington lobbyists and corporate lawyers."

Google Begins Making DMCA Takedowns Public (Linux Journal). Linux Journal looks at Google's response to DMCA censorship. "Failing to act in response to a DMCA takedown letter is not against the law. "They can always choose not to take advantage of the safe harbor," Seltzer said. However, only by complying with the letter and taking pages out of their index can Google escape a possible copyright infringement lawsuit."

IBM Australia migrating to Linux (ZDNet). IBM's Australian staff are being moved to Linux servers for file and printer sharing, according to ZDNet. "IBM's Linux business manager, Geoff Lawrence, told ZDNet Australia that the company commenced consolidating 96 IBM Intel-based file and print servers to 55 Linux machines in February 2002, the deployment of which will be completed in July. The migration also includes one IBM Unix backup server running IBM AIX and Tivoli Storage Manager."

What's an 'ICE Box' and what's inside one? (LinuxDevices). Linux NetworX announced a new appliance-like device that is used for managing rack-mounted Linux clusters, called the ICE Box. Join LinuxDevices.com for a tour inside the ICE Box. "As cluster systems scale from dozens, to hundreds, and even thousands of nodes, management becomes exponentially complex and requires significant effort. To simplify this effort, Linux NetworX has developed Integrated Cluster Environment (ICE), a complete cluster management solution that consists of the ClusterWorX management software and the ICE Box hardware appliance."

CEO out at Ellison's Net-device firm (News.com). News.com reports that CEO Gina Smith is leaving the Larry Ellison-backed New Internet Computer Company. "Smith, a former technology reporter for ABC News and CNET, was chosen by Ellison in February 2000 to head the company, of which he is chairman and majority owner. The company's namesake product is a $199 Linux-based Web-surfing device that lacks a hard drive, storing the operating system and other software on a CD and in flash memory."

CEO of Red Hat to Take Position as Chairman of Board. The Raleigh, N.C. News & Observer reports on some changes in the Red Hat corporate organization. "Red Hat will announce today that Chief Executive Matthew Szulik will take over as chairman of its board, a spot currently held by company co-founder Bob Young."

Red Hat CEO named chairman (News.com). News.com talks about Red Hat's naming of Matthew Szulik as chairman of the board. "Szulik faces the challenge of turning Linux, an open-source operating system that is licensed for free, into a profitable business--a task all the more daunting given that it competes with Microsoft's dominant Windows operating system."

Red Hat To Ship Secure Web Server (TechWeb). Here's a look at Red Hat's Stronghold Enterprise, an open-source Web server based on Apache and featuring enhanced security, performance, and development tools.

Sendmail nabs funding, expands (News.com). News.com covers Sendmail's recent funding and its new calendaring products. "Sendmail's e-mail software has at its heart the open-source project of the same name. The calendar software, though, is a proprietary product Sendmail licensed from an undisclosed company, Anderson said."

Business

Loki: A promising plan gone terribly wrong (LinuxAndMain). LinuxAndMain looks at the failure of Loki Software. "In January 2001, [Scott] Draeker fired Lance Colvin, his now-former best friend who had been with the company for two years, and who had loaned the company more than $200,000, his mother even sometimes loaning Loki money so that it could make payroll. Some former employees pointed to this event as an indication that the situation might have been more ominous than could be explained by mere incompetence."

Reviews

Running MS-Office on Linux (Register). The Register test drives CodeWeavers' Crossover Office for Linux. "Whereas MS Word ran quite well, we're warned that the Office Assistant is nowhere near ready for prime time. But of course I had to play with it (see screen shot above). And yes, Clippy somehow managed to reboot my machine -- something I personally haven't done in weeks. This appears to have been in swift retaliation for shutting him off. All right; fair is fair."

Running Windows apps on Linux (ZDNet). ZDNet looks at ways of running Windows applications on Linux. "We found CrossOver Office surprisingly easy to install and configure, and the performance of MS Office apps was comparable to performance under Windows. While there are still nits to pick with the product (font rendering, for example), CrossOver Office is easy to use, fast, and cheap ($59), and thus more likely than other Windows-on-Linux solutions to make corporate migration to Linux on the desktop a practical alternative."

Lindows launch edges closer (IT-Director). IT-Director reports on the latest release of Lindows. "Temporarily free of its court wrangle with Microsoft, Lindows this week released a second preview version of its operating system."

WYSIWYM (What You See Is What You Mean) (Linux Journal). Linux Journal reviews LyX, the GUI front end to the venerable LaTeX typesetting system. "Although LyX can be used to write small notes and memos, it really shines when a user is making complex documents. Its ability to add sections automatically to the table of contents as they are created, and to do section and list numbering, saves a lot of time and strain."

Ogg Vorbis offers first handheld player (News.com). News.com reports on TheKompany's release of tkcPlayer for Sharp's Linux-based Zaurus handheld computer.

Aspire to Crudeness: Special Ogg Vorbis Issue (Linux Journal). Linux Journal's Don Marti reviews ogg123, a command line Ogg-Vorbis audio file player. "I can't stand having a background application I rarely if ever touch use some of the pixels I paid for. The closest player to being cool is the command-line player ogg123, but I don't want to start an xterm for it. It's supposed to be an audio player and has no reason to get in my eyes -- just my ears."

Mozilla poised for revival (News.com). Here's a review of the newest Mozilla browser. "As Mozilla.org readies the long-awaited 1.0 browser, speculation has swirled over the prospects of a renewed browser battle with Microsoft, whose Internet Explorer now dominates the Web."

Apache graduates to Version 2.0 (CNN). CNN.com reviews Apache version 2.0. "'From what I'm hearing, the performance improvements are significant,' said Dan Kusnetzky, vice president of systems software with research company IDC, noting the benefits of its multithreading support. 'They rethought the architecture and added additional benefits of security and allowed some clever additions of different modules so you could get better performance.'"

Resources

58-node Linux Cluster benchmark results. IBM has published a paper (in PDF format) on cluster benchmarks for a 58 node eServer Cluster 1300. "This paper presents the results of a benchmark test conducted on a 58-node Cluster 1300 system, simultaneously running eight instances of e-Business Trade 2 benchmark tests on Redhat Linux. This all-IBM solution mounted in only three racks supported 800,000 users, serving an unprecedented 12,547 requests/sec with an average response time of 0.27 sec/request."

Interviews

An interview with Jason Hunter (IBM developerWorks). IBM's developerWorks features an interview with Jason Hunter. "If you were following JavaOne a few weeks back, you probably heard about how Sun and the Apache Software Foundation have resolved their difficulties over the way open source software could participate in the Java community process but if you were like the majority of Java developers, the precise issues were probably a bit of a mystery. To clear things up, and find out exactly what these changes will mean for open source developers and the Java community, developerWorks caught up with Apache's representative on the Java Community Process, Jason Hunter, and asked him to explain what's going on."

Miscellaneous

Rice University Studying the Sociology of the Linux Community (Linux Journal). Linux Journal looks into a survey currently being conducted by the Jones School of Management at Rice University in Houston, Texas. "So take a few minutes to complete this survey; all of the information will remain confidential and is for academic use. And if you need another motivator, one of the last questions on the survey asks for your favorite Linux group or organization, and five from the final results will receive $100 donations."

LWN also received a letter from Professor Dholakia asking for our help in publicizing this survey. So we reiterate LJ's request that you take a few minutes to fill out the survey.

Experience the impossible. Linuxmag.nl is running a humorous article on a visit by Tux the penguin to the Microsoft corporate offices. "Not wasting any time, I immediately crawled behind the first keyboard I could put my hands, eh, wings on. And guess what, the password I found underneath the keyboard works. Now I can adjust my security privileges, and get some work done." (Thanks to Armijn.)

Section Editor: Forrest Cook

See also: last week's Announcements page.

Announcements

Resources

Spanish language Linux Administration course. A spanish language Linux administration course will be held online, and in Bogotá, Columbia from April 20, 2002 through September, 2002.

An e-book on Smarandache Manifolds. A book by Howard Iseri on the geometry of Smarandache Manifolds is available for download (7MB, PDF format).

Events

Linuxfest 2002. The Linuxfest 2002 will be held on April 20, 2002 in Bellingham, Washington, and will feature User Friendly cartoonist Illiad and Lycoris CEO Joseph Cheek.

iParty v4.0. The iParty v4.0 Linux Installation Party will be held on April 19, 20, and 21, 2002 in Castellon, Spain.

Registration Open for O'Reilly Open Source Convention. Registration is now open for the 2002 O'Reilly Open Source Convention. Creators, practitioners, and hackers come together once again at the Sheraton Hotel and Marina in sunny San Diego, California, July 22 - 26, 2002.

Damian Conway in Seattle (use Perl). Perl Guru Damian Conway will be present, in an online way, at the April-June SPUG meetings in Seattle, WA.

Open Source CMS Conference Midgard presentation. Henri Bergius presented a talk on Midgard at the Open Source CMS Conference. The talk is available online in PDF and RealPlayer formats.

Linux-Kongress 2002 Call For Papers. A call for papers has been issued for the Linux-Kongress 2002 conference that is to be held from September 4-6, 2002 in Cologne, Germany

Second Call for Papers for YAPC::Europe::2002 (use Perl). Use Perl has an announcement for a second call for papers for the YAPC::Europe::2002 conference. The conference will be held this fall in Munich.

JabberConf Europe 2002. JabberConf Europe 2002 will be held on June 12-14 in Munich, Germany.

Events: April 18 - June 13, 2002.

Date	Event	Location
April 22 - 26, 2002	Software Development Conference and Expo	(San Jose Convention Center)San Jose, CA
April 24 - 27, 2002	Federal Open Source Conference (CANCELLED)	(Ronald Reagan Building)Washington DC
April 29 - 30, 2002	Samba eXPerience 2002	(Hotel Freizeit)Göttingen, Germany
May 2 - 4, 2002	The International Forum of Free Software	Porto Alegre, Brazil
May 5 - 10, 2002	NetWorld+Interop	Las Vegas
May 13 - 16, 2002	O'Reilly Emerging Technology Conference	Santa Clara, CA., USA
May 18 - 22, 2002	The 13th Annual Borland Conference(BorCon)	(Anaheim Convention Center)Anaheim, CA
May 19 - 24, 2002	XML Europe 2002 Conference & Exposition	(Princesa Sofia Inter Continental)Barcelona, Spain
May 25 - 26, 2002	Magdeburger Linuxtag 2002	(Building 22 (W) University of Magdeburg)Magdeburg, GERMANY
May 27, 2002	Linux@work	Copenhagen
May 28, 2002	Linux@work	Oslo
May 29, 2002	Linux@work	Stockholm
May 30, 2002	Linux@work	Helsinki
June 3 - 6, 2002	Embedded Systems Conference - Chicago	(Donald E. Stephens Convention Center)Rosemont, IL
June 4, 2002	Linux@work	Paris
June 5, 2002	Linux@work	Brussels
June 6, 2002	Linux@work	Amsterdam
June 6 - 9, 2002	LinuxTag 2002	(Exhibition Center)Karlsruhe, Germany
June 9 - 14, 2002	2002 USENIX Annual Technical Conference	Monterey, CA
June 11, 2002	Linux@work	Frankfurt
June 12, 2002	Linux@work	Zurich
June 12 - 14, 2002	JabberConf Europe 2002	Munich, Germany
June 13, 2002	Linux@work	Milan

Additional events can be found in the LWN Event Calendar. Event submissions should be sent to lwn@lwn.net in a plain text format.

Section Editor: Forrest Cook.

Software Announcements

The Alphabetical List and Sorted by license

Our software announcements are provided courtesy of FreshMeat

See also: last week's Letters page.

Letters to the editor

From:	 Richard Stallman <rms@gnu.org>
To:	 letters@lwn.net
Subject: iSCSI and patents
Date:	 Mon, 15 Apr 2002 16:00:45 -0600 (MDT)

Dear Editor

Tom Wu in a letter on April 1 takes issue that the statement that SRP
"appears to be covered" by three patents.  However, when we look at
his version of the facts, it is not entirely different.  Wu tells us
that Lucent "has not asserted" a claim, but that doesn't mean it won't
do so later.  Lucent could be hanging back so that SRP will be
accepted a standard, and planning to attack its users once they are
hooked, much as Unisys did with GIF format.  Phoenix says its patent
"may" apply to SRP.  Unless we have reason to be sure it does not,
that is reason aplenty to consider SRP a booby trap.

Wu clearly wants his work on SRP to be a contribution to human
knowledge and available for unrestricted use.  The tragedy of software
patents is that they don't allow him to contribute: his work can be
privatized by others, and there is nothing he can do to protect it
from patents.

In his wish for his contribution to be of service, he faces the
temptation to believe that it is safe, so he argues that a mere
possibility (rather than a likelihood) of a patent problem is not
cause for real alarm.  Believe this at your peril!  A chance that
patents cover a protocol is like a chance that food has salmonella:
don't find out by eating it!

Of course, any protocol might perhaps be patented, just as any piece
of food might perhaps be poisoned; safety is never guaranteed.  But
when you see a specific reason to doubt the safety of a particular
piece of food, you wouldn't risk it.  Likewise, if a protocol is
menaced by a known patent, it must not be part of a standard.  We must
speak with a firm voice, telling the iSCSI committee that SRP must be
optional and no more.  We must insist on free standards also for web
services, and for every area of computing.  Any company that wants to
be a friend of the free software community should take a clear stand
for patent-free standards.

Please take a look at www.programming-freedom.org and www.ffii.org,
and please join the campaign against software patents--in Europe,
and elsewhere.


Sincerely

Richard Stallman
Founder of the Free Software Movement (www.gnu.org/why-free.html)
Initiator of the GNU/Linux operating system
  (http://www.gnu.org/gnu/the-gnu-project.html)

From:	 bryanh@giraffe-data.com (Bryan Henderson)
To:	 letters@lwn.net
Subject: The right to the fruits of one's ideas
Date:	 Wed, 17 Apr 2002 00:25:07 +0000

A letter in the April 11 LWN talks about the need for private property
and the moral right of a free person to profit from his
labor or inventions to the full extent that the market will bear.

The writer says

  Patents, copyrights and trade secret protections are a cornerstone
  of modern Western civilization.  ... The founders of the United
  States felt the issue was sufficiently important to put it in the
  Constitution."

Because the US Constitution is usually associated with its guarantees
of individual rights, this statement could be misleading.  The reference
is to a part of the Constitution that defines the powers of Congress, not
that defines rights of citizens.  It reads,

  The Congress shall have the power...  To promote the progress of
  science and useful arts, by securing for limited times to authors
  and inventors the exclusive right to their respective writings and
  discoveries;

What this means is that Congress can, where it sees fit, create
patents and copyrights and such.  It doesn't mean Congress has to
create patents or that anyone has a right to one.  In fact, in "for a
limited time," it goes exactly the other way -- preserving the right
of people to sponge off other peoples' work.

People like Richard Stallman who hate what intellectual property law
has become don't think there should be no (private) intellectual
property.  They just don't think it should be distributed the way it is
today.

For example, if a patent allows an inventor just enough exclusive use
that inventing the thing and telling the world about it are
worthwhile, but beyond that allows everyone free use of the invention,
it's done it's job to "promote the progress of science and useful
arts."  It isn't necessary for the inventor to get rich off his great
idea.

-- 
Bryan Henderson                                    Phone 408-621-2000
San Jose, California

From:	 Dan Stromberg <strombrg@nis.acs.uci.edu>
To:	 lwn@lwn.net
Subject: RAND
Date:	 Thu, 11 Apr 2002 08:03:31 -0700

IMO, the biggest problem with RAND licensing isn't that it's
unreasonable to exclude Free Software as it does (I don't