LWN Weekly Edition
Leading itemsSecurity
Kernel development
Distributions
Development
Linux in the news
Announcements
Letters to the editor
->Multipage format
This page
Previous weekFollowing week
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
LWN.net Weekly Edition for November 24, 2004The Linux Core ConsortiumLast week, Conectiva, Mandrakesoft, Progeny and Turbolinux announced the creation of the Linux Core Consortium (LCC), a project to create a common implementation of the Linux Standard Base (LSB) 2.0. According to the group's press release, the LCC plans to create this implementation by the first quarter of 2005. In addition to the four member companies, several organizations issued public statements of support, including Red Hat, Novell, Sun, HP, Computer Associates, the Free Standards Group and Open Source Development Labs.To get a little more information than was contained in the press release, we talked with Progeny's Ian Murdock, and touched base with Mandrakesoft's Gaël Duval and Novell's Bruce Lowry about the LCC. According to Murdock, the key message is that the LCC is "first and foremost about making the LSB stronger." He noted that the LSB is useful, but "implementation standards are always more powerful than paper standards." He was quick to point out that there were several differences between the LCC and the failed UnitedLinux effort:
Unlike UnitedLinux, which was a separate company set up to manage a
collaborative process...it's a loosely defined collaboration where partners
have equal representation and devote roughly equivalent resources [to the
project].
The LCC also isn't burdened with SCO as a member, which is a strong bonus in and of itself. Murdock also said that the LCC is an important goal for Progeny as well. "We can address both our Debian and RPM customers with that common core, which is obviously why we're interested in extending to RPM as well." He also said it was "a shame" that so much attention is focused on the difference between RPM and Debian packages, and that he'd like to see Debian directly involved in the LCC. We asked what it would take for another company to join the organization. Murdock indicated that the members were eager to have other companies join the LCC, and that they've invited Red Hat and Novell, but they haven't completely sorted out requirements. We asked Duval if there would be a monetary requirement for other organizations. He said no, at least at this time.
For now there is no monetary requirement, only an agreement to sign, but
this could change, for instance to avoid company who join just to get free
advertising while providing nothing in return. It's clear that we need only
motivated members in the LCC.
Both Murdock and Duval made it clear that the LCC would also welcome non-profit organizations like Debian, and they were also looking at a way to allow participation from individual developers. Murdock said that the LCC would have "more to say in the coming weeks."
It's not going to be the case where we do all the work ourselves and drop
it in the lap of the open source community and say "here you go." We have a
strong desire to involve the open source community, but it's too early to
say exactly what form that will take.
...we're trying to compliment existing efforts in the Linux Standards Base. The right way to go about that is to be open and inclusive, the end result will be nothing short of a Linux implementation standard built by the community and industry. If that's the result, then the result will be a Linux that is not owned by a single Linux company and that will be good for all involved. Of course, the LCC would have a stronger position if the two biggest players in the industry were involved. While Red Hat and Novell have made polite noises about the LCC, they haven't committed to it. We asked Lowry whether Novell's public statement of support would translate into more concrete action with regards to the LCC. According to Lowry:
We've offered moral support to the LCC for what they're working
toward, which is adoption of the LSB and standardization in the space to
encourage Linux application development. We're not commenting at this
point on whether we might ultimately join. It's something we'll keep an
eye on.
We also requested comment from Red Hat regarding its intentions towards the LCC, but have not received a reply in time for this article. Murdock said he can think of reasons why Red Hat and Novell might not choose to participate:
I can think of some reasons why they might not want to do that [make the
LSB stronger], namely that behind the words, that Linux standards are
important, at the end of the day they're trying to build their own
proprietary position which largely revolves around the ISV certifications
that they have...I suppose that any hesitance on their part represents a
sort of mismatch between what they're saying and what they're doing.
Many in the open source community were disappointed that the UnitedLinux consortium did not release a working product to the community. Instead, UnitedLinux was only available as source through the original vendors, rather than a working product anyone could download. Murdock said that the LCC would make available an installable version of the distribution that would be useful for developers, though he added it "won't be interesting to use on its own." As Murdock noted, an implementation of the LSB 2.0 standard would be much more useful and powerful than the standard on paper. We're eager to see the LCC's first release, and hope this goes a long way towards increasing interoperability between Linux distributions and providing a unified platform for software vendors and open source developers to write to.
De-worming the netWorms are a problem on the net. Even users of operating systems which tend not to be afflicted by this sort of malware are affected when worm-caused traffic clogs the net or brings down sites of interest. So everybody has an interest in finding ways to reduce the number of worm infections.Researcher Douglas Barnes has taken a look at the problem and come up with a new set of recommendations. His work is written up in this 50-page PDF document. We took a look at his work, with an emphasis on its implications for the free software community. The paper starts by pointing out that market forces have failed to put an end to the worm problem. Indeed, the characteristics of the software market tend to encourage the creation and use of vulnerable software. The company which wins in the market is the one which is able to get its product adopted first and establish the de facto standards. So manufacturers have a great incentive to emphasize features and time to market over security. Since moving away from buggy software can be difficult, software vendors tend not to pay much of a cost for security incidents which involve their products. The author notes that free software is a pleasant exception to this problem:
Open Source software is often developed by, or with substantial
participation from particularly security-conscious users. These
users have strong incentives to participate in initial development
in order to prevent having to rework the product later or create a
more secure "fork."
Open source does not directly address the problem of user flaws,
and particular projects can be as rushed and buggy as proprietary
software. However, because it is open and modifiable by anyone, it
is at least capable of responding to those users who are
concerned.
Some commenters (notably Bruce Schneier) have proposed that software vendors should be made legally liable for flaws in their products. At that point, they will have a strong motivation to take the time to get things right. Mr. Barnes, however, thinks that the liability approach will not work. Many quirks in the U.S. justice system make it hard to win a suit based on software flaws; these include the enforceability of "click-wrap" licenses, the notion that the vendor is not the real cause of security problems (the crackers are), and the interesting precedent that loss of data is not considered to be "physical harm." The potential harm to free software projects is also mentioned as a reason to avoid the litigation approach. So how is the worm problem to be solved? Mr. Barnes has three suggestions:
Establishing this sort of regulatory regime looks like an uphill battle, to say the least. That is likely to be a good thing; the imposition of a heavy-handed, low-clue regulatory agency upon the software industry could easily do more harm than good. But the community can - and does - benefit from these ideas already. Free software projects with the requisite funding have used bug bounties before; the original such bounty may well have been Donald Knuth's rewards to those who found bugs in TeX. Even in the absence of cash bounties, numerous white-hat researchers can be seen digging for security bugs in free software for the reputation benefits and the sheer fun of it. Perhaps groups like OSDL could consider offering bounties on security bugs in certain bodies of code as a way of encouraging this process. Free projects often have software quality standards as well, though they vary greatly from one project to the next. Peer review can help to find any of a number of obvious mistakes; in some projects, code is increasingly unlikely to be accepted if it is not seen as being up to certain standards. Many project could benefit from stronger standards, however, and from some sort of documentation of just what their standards are. The community has little sympathy for penalizing users for their software choices, certainly. Still, that approach can be seen in some corners. Firefox will nag at people who use a version known to have vulnerabilities. Hopelessly insecure packages become unsupported and unavailable from distributions, forcing users to find an alternative. But the community has put most of its effort into an alternative approach: making it as easy as possible to run a system without known vulnerabilities. Most modern distributions can be kept updated with little or no effort; it's almost harder not to patch them. So, perhaps, the free software community already has most of the tools it needs to contribute toward a worm-free net. No regulatory action required. All that is needed is to get the rest of the software community to catch up.
A followup on comment policyLast week, we posted a request for comments on a proposed policy change which would limit comment posting privileges to paying subscribers. One should not post an RFC if one is not prepared to get comments; we got over 150 (at last count) of them. As a result of our reading of these comments, the proposed policy change will probably not go into effect.While a wide variety of opinions was posted, there seems to be something close to a consensus on two points:
The overall sense we got from the posted comments is that silencing the non-subscribing commenters is an overreaction to a small problem and not warranted - or desirable - at this time. So we will not do it. There were various alternative ideas posted, some of which we will likely act upon in the relatively near future. These include:
There have been suggestions for active moderation of comments. Frankly, the editors of LWN have no time for, or interest in, running any sort of comment approval process. That process would be no fun at all, and there would be no way to do it without coming across as censors. Active moderation of comments can also increase the risk of legal hassles resulting from defamatory or infringing comments. Moderation by LWN's readers has also been raised as a possibility, though not everybody likes that idea. We could consider the introduction of a reader moderation or recommendation scheme, but that is likely to be further in the future. The programming requirements are higher, and our current server would be unlikely to handle the additional database load in any sort of graceful manner. Some other suggestions have been made. One was to publicly reveal the real-world identity of abusive posters. Problems with that approach are (1) we do not require readers to provide us with that information, and (2) even when we have it, revealing it would violate our privacy policy. We take that policy seriously, and will not be compromising it. Another idea was simply revoking comment privileges from abusive posters. The problem there is that, as long as LWN accounts are free, a blocked poster can simply create a new account and start over. This has been an interesting exercise, anyway. In the end, LWN exists for its readers; if we do not serve your needs, there is little point in our being here. So we greatly appreciate the time you all have taken to provide feedback on our ideas. Rest assured that this feedback has been heard, and that we will continue to work to make LWN the best that it can be.
Security Who gets CERT's attentionBackers of proprietary software have, at times in the past, resorted to claims that Linux and free software are the subject of more CERT advisories than other systems. Such claims have been strikingly absent recently. Since our detractors have apparently been too busy to tally up CERT's output this year, we've decided to do it for them. Here's the full list of CERT's 2004 "technical cyber security alerts":
Now, one can raise all sorts of complaints about this table. The logic that assigns the Mozilla vulnerability to Linux could also, easily, have charged it to Windows as well. The process by which CERT chooses vulnerabilities worthy of "cyber security alerts" is poorly understood. And so on. There are seven vulnerabilities in the Linux column - and that is seven too many. But that is far less than the count in the proprietary columns. The Windows vulnerabilities include many which affect a large percentage of users; instead, very few users were affected by most of the Linux problems. The CERT advisory count is a flawed measure at best, but, within its limits, it shows that things could be a lot worse.
New vulnerabilities bugzilla: remote vulnerability
cyrus-imap: multiple remote vulnerabilities
fchron: denial of service vulnerabilities
kernel: vulnerabilities in the smb file system
ProZilla: Multiple vulnerabilities
xorg-x11: integer overflows
Updated vulnerabilities apache: arbitrary code execution
apache2: denial of service
aspell: bounds checking problem
BNC: Buffer overflow vulnerability
bogofilter: denial of service
cdrecord: failure to drop privilege
ncompress: Buffer overflow
cyrus-sasl: remote buffer overflow
dhcp: format string vulnerability
ez-ipupdate: format string vulnerability
Filename disclosure vulnerability in fam
flim: insecure file creation
Foomatic: Arbitrary command execution in foomatic-rip
FreeRADIUS: denial of service
gaim: buffer overflow in MSN protocol
Gallery: cross-site scripting vulnerability
gtk2, gdk-pixbuf: buffer overflows
gettext: Insecure temporary file handling
ghostscript: symlink vulnerabilities
gimps: insecure installation
glibc: Information leak with LD_DEBUG
glibc: tempfile vulnerability in catchsegv script
gnome-vfs: backend script vulnerabilities
groff: insecure temporary directory
gtkhtml: malformed messages cause crash
gzip: insecure temporary files
imagemagick: buffer overflow vulnerability
ImageMagick: EXIF buffer overflow
imlib2: buffer overflows
iproute: local denial of service
iptables: missing initialization
kernel-utils: setuid vulnerability
libgd2: buffer overflows in PNG handling
libpng: multiple vulnerabilities
libxml2 - arbitrary code execution
libxml2: multiple buffer overflows
libxpm4: stack and integer overflows
logcheck: symlink vulnerability
lvm10: creates insecure temporary directory
Midnight Commander: extfs vfs vulnerability
mikmod: buffer overflow
mozilla products: arbitrary code execution and other vulnerabilities
mpg123: buffer overflow bug
mpg321: format string vulnerability
mysql: several vulnerabilities
netkit-telnet: invalid free pointer
netpbm: insecure temporary files
openssh: timing attack leads to information disclosure
openssl: der_chop script temp file vulnerability
OpenSSL: denial of service vulnerabilities
perl: insecure temp file creation
php: remotely exploitable memory errors
PostgreSQL: Insecure temporary file use in make_oidjoins_check
qt3: BMP image parser heap overflow
rp-pppoe, pppoe: missing privilege dropping
ruby: infinite loop
samba: remote DoS vulnerability
shadow: unauthorized modification of account information
sharutils: arbitrary code execution
sox: buffer overflow
SpamAssassin: Denial of Service vulnerability
SquirrelMail: cross-site scripting
Subversion: Remote heap overflow
sudo: environment variable sanitizing
File overwrite vulnerability in tar and unzip
tiff: buffer overflows
unarj: buffer overflow vulnerability
WordPress: HTTP response splitting and XSS vulnerabilities
wv: buffer overflow
XChat 2.0.x SOCKS5 Vulnerability
xine-lib: buffer overflows
xine-ui - insecure temporary file creation
xpdf: integer overflows
zgv: multiple buffer overflows
zip: arbitrary code execution
zlib: denial of service
Resources Rick's Rants: Linux virusesRick Moen has put together (and recently updated) a comprehensive FAQ on Linux and viruses. It includes a comprehensive list of Linux viruses and worms. "By and large, you can be hit at all only by being really dumb. By and large, you can suffer system (root) compromise from malware only by being mind-bogglingly dumb."
Page editor: Jonathan Corbet Kernel development Brief items Kernel release statusThe current 2.6 prepatch remains 2.6.10-rc2.Linus's BitKeeper repository continues to accumulate patches, though they are mostly of a bugfix nature. They include some x86 single-stepping fixes, a number of "sparse" annotations, the token-based memory management fix, a memory technology device (and JFFS2) update, a frame buffer device update, some user-mode Linux patches, some page allocator tuning, and a few architecture updates. The current patch from Andrew Morton is 2.6.10-rc2-mm3. Recent changes to -mm include a number of disk quota fixes, a big DVB update, and some fixes to make SELinux and reiserfs work together. The current ultra-stable patch from Alan Cox is 2.6.9-ac11. The current 2.4 kernel is 2.4.28; Marcelo seems in no hurry to start the 2.4.29 process. For those wanting an extra-hard 2.4 kernel, Solar Designer has released 2.4.28-ow1, which includes a number of security fixes.
Kernel development news Xen is comingXen is a free virtualization system designed to allow multiple virtual machines to be run on a single host system with high performance. The Xen system (version 2.0 was released recently) offers a number of interesting features, including flexible networking between virtual machines and the ability to transparently move virtual machines between physical hosts while they are running. Xen's authors claim that the performance hit from running under Xen is only "a few percent."Now that the 2.0 release is out, the Xen developers would like to merge their code into the mainline kernel. The bulk of this code adds the new Xen "architecture," which enables the kernel to run on the virtual machine provided by Xen itself. The architecture code is available from the Xen site for those who are interested. Another significant chunk is a set of drivers which provide Xen-hosted systems with network interfaces, file-backed block devices, and console devices. Inclusion of both of those patch sets should be relatively uncontroversial; they do not affect any code which is not actually built for the Xen architecture, and thus should not risk breaking anything. The final set, however, will have to be looked at more closely; these are the patches to the core kernel itself. Most of these patches make the kernel work with Xen's very different way of managing and allocating memory; they include a new sk_buff structure allocation function, a change to how /dev/mem works on the Xen architecture, and a new ptep_establish_new() function which optimizes the instantiation of new pages. Perhaps the most controversial change is a change in how the architecture-specific arch_free_page() function works: under Xen, this function might actually short out the rest of the page allocator functions and dispose of the page itself. This technique allows Xen to manage a single page pool for multiple virtual machines, but not everybody liked changing the interface to arch_free_page() in that way. That said, there appears to be no strong opposition to the inclusion of these patches. It would not be surprising to see them go into -mm sometime after 2.6.10 comes out.
Should FUSE be merged?The Filesystems in User Space (FUSE) patch has been around for some time. FUSE acts as a kernel filesystem which turns around and passes all VFS requests out to a user-space daemon, which is expected to do something reasonable with them. There are numerous projects using FUSE to implement interesting filesystems in user space. The FUSE developers have now requested that FUSE be merged into the 2.6 kernel. They may yet get there, but some obstacles stand in the way.Linus started by complaining that FUSE was "too messy." Some of his impressions, it turns out, may have been based on a reading of old code. Some of the things he was complaining about were parts of the 2.4 version of the patch; they are not present in the version being put forward for inclusion. There is, however, one show-stopping problem which remains in the code. If the system's memory gets to be full of dirty pages which must be written to a FUSE filesystem, and the user-space process which implements that filesystem has been swapped out, the system can deadlock. It cannot clean up those dirty pages until they have been written to the backing store, it cannot write those pages until the user-space daemon has been paged in, and it cannot page in the daemon until the dirty pages are cleaned. The system comes to a screeching halt and the users reconsider the whole idea of user-space filesystems. The problem is most easily demonstrated through the use of shared writable mappings. With such mappings, user space can create vast numbers of dirty pages without the operating system knowing about it. Andrew Morton demonstrated that this is not just a theoretical problem; it can be made to happen on real systems. The problem can also be made to happen by simply writing too much data to the filesystem. All this led Linus to lecture on the topic:
Guys, there is a _reason_ why microkernels suck. This is an example
of how things are _not_ "independent". The filesystems depend on
the VM, and the VM depends on the filesystem. You can't just split
them up as if they were two separate things (or rather: you _can_
split them up, but they still very much need to know about each
other in very intimate ways).
In this case, the worst problems can be avoided by simply disallowing shared, writable mappings. That limitation will not, in fact, bother too many people; these mappings are not heavily used. It's also necessary to take steps like limiting the number of pages currently queued for writing out. This limit will affect users, in that it will reduce performance. It has been noted, however, that deadlocks tend to have an even worse impact on performance. In response to the above concerns (and others), the FUSE patches have been reworked. Among other things, the shared, writable mapping support has been split out into a separate, optional patch. There's no word on whether it will be merged, though Linus did suggest that it might:
I'm a sucker. Ask anybody. I'll accept the exact same patch that I
rejected earlier if you just do it the right way. I'm convinced
that some people actually do it on purpose just for the amusement
value ("Look, he did it _again_. What a doofus!")
Whether Andrew Morton is so gullible remains to be seen.
InfiniBand arrivesAfter a long period of development, the OpenIB Alliance has posted an initial set of patches for review. The current patch set is not proposed for inclusion, though the project has made it clear that merging into a not-too-distant 2.6 kernel is something they would like. The initial comments suggest that there may not be much opposition to that.The patch set is large, reflecting the complexity of the InfiniBand specification. At the bottom layer, a driver for Mellanox adapters is included with the patch set; it's some 9,000 lines of sparsely-commented code. The core "midlayer" manages InfiniBand ports and makes access to the fabric available for the upper layers. The midlayer also allows for user-space administration by facilitating the passing of "MADs" ("management datagrams") back and forth. The upper layers of the InfiniBand specification envision support for a number of features, including MPI (message passing interface, heavily used in clustered applications), SDP (socket direct protocol: a networking standard based on remote DMA), SRP (remote SCSI), and IP over InfiniBand using the classic socket interface. The current OpenIB patches concentrate on full IP (both IPv4 and IPv6) support; most of the other high-level protocols are not yet implemented. The comments on the InfiniBand code have been relatively minor, so far. The project's choices for device names (deeply nested names like /dev/infiniband/mthca0/ports/1/mad) will likely be changed. The project also went with dynamic device number assignment. This technique works well on systems running a tool like udev to create the device nodes, but it makes life difficult on systems where device nodes must be created manually by the administrator. For now, at least, plenty of such systems exist, so static device numbers are needed. The OpenIB drivers also rely on ioctl() calls for a number of administrative functions; questions were raised, but the current interface is not likely to be changed in any significant way. Perhaps the most surprising complaint, to many, was the objection to the dual GPL/BSD license carried by the OpenIB code. BSD-licensed code is not normally a problem in the kernel; it can be included in a larger, GPL-licensed program without any sort of infringement. The OpenIB code uses read-copy-update (RCU), however, and that usage brings an additional constraint. IBM holds a patent on RCU, and has licensed that patent for use with GPL-licensed code. As is the case with many of these patent licenses, BSD-licensed code is not covered. So the OpenIB developers may find themselves having to (1) drop the BSD license from their code, (2) stop using RCU, or (3) get some sort of special exemption from IBM. It appears that they will choose the second option. One issue which has not come up is concern over the licensing of the InfiniBand specification or any patents which may apply to it. The InfiniBand developers seem to have resolved those concerns through a combination of easing access to the specification and pointing out that the InfiniBand patent agreement is closely aligned with the agreements which apply to other standards, such as PCI. There may well be patented technologies lurking within the InfiniBand specification, but InfiniBand should not present a higher risk of patent difficulties than any other part of the kernel.
Which filesystem for Samba4?Andrew Tridgell has been hacking away on Samba 4 for a while now; that project has gotten to the point that he has started doing some performance testing. His first set of results looked like this (numbers in MB/sec):
These results show that all filesystems slow down when extended attributes are used. This matters for Samba 4 because Windows filesystems make heavy use of extended attributes. As Tridge put it:
The high cost of xattr support is a bit of a problem.... I hope we can
reduce the cost of xattrs as otherwise Samba4 is going to be
seriously disadvantaged when full windows compatibility is
needed. I'm guessing that nearly all Samba installs will be using
xattrs by this time next year, as we can't do basic security
features like WinXP security zones without them, so making them
perform well will be important.
The cause of the performance problems is not particularly mysterious. Most filesystems store extended attributes in a special data block, away from the rest of the associated file's metadata. So working with a file's extended attributes forces the filesystem to go out and read another block from the drive. The extra transfers and seeks take their toll on performance, as can be seen in the numbers above. A pointer to the solution can be seen there as well. The "xfs 2K inode" results were obtained by turning on the XFS large inode option. This option expands the size of the on-disk inode structure, making room for the extended attributes to be stored there. When the inode is read from the drive, the extended attributes come with it, and no separate I/O is required to work with them. When this option is enabled, the performance hit for using extended attributes with XFS is much reduced. It turns out that a large inode patch for ext3 has been in the works for a while; it has passed muster with the ext3 developers, but has not yet been pushed into the mainline. Tridge tried this patch and was pleased with the results:
Using a 256 byte inode on ext3 gained a factor of up to 7x in
performance, and only lost a very small amount when xattrs were not
used. It took ext3 from a very mediocre performance to being the
clear winner among current Linux journaled filesystems for
performance when xattrs are used. Eventually I think that larger
inodes should become the default.
First, however, the patch must be merged. With testimonials like this, that merger is likely to happen in the relatively near future. One interesting mystery remains, however: Tridge gets notably better results with 2.6.10-rc2-mm2 than what he gets with 2.6.10-rc2. As of this writing, nobody seems to have an explanation for why ext3 should perform that much better in the -mm kernel. Inquiring minds very much want to know, however, and Andrew Morton is working at finding out which patch makes the difference.
Patches and updates Kernel trees
Core kernel code
Development tools
Device drivers
Filesystems and block I/O
Memory management
Architecture-specific
Security-related
Benchmarks and bugs
Miscellaneous
Page editor: Jonathan Corbet Distributions News and Editorials MEPIS Linux on the RiseA quiet revolution is taking place on the home desktop market and it's called MEPIS Linux. Launched in early 2003 by Warren Woodford, this relatively little-known Debian-based project has probably converted more Windows users to Linux than any other Linux distribution before. Its recipe for success is simple: a combination of superb hardware auto-configuration, continuous and painless upgradeability of applications, easy graphical installation, instant network configuration, including mixed Windows-Linux networks with Samba, and inclusion of browser plugins, Java and popular multimedia codecs. In a word, MEPIS Linux is instantly usable after installation without any post-install tweaking.The success of MEPIS has been given further credibility by two recent events. The first one was a comprehensive review at DesktopLinux.com, linked by many Linux news sites, where Michael C. Barnes, the long skeptical technology writer, declared the distribution to be "the best free desktop Linux". The second event was the launch last week of Point & Click Linux!, a new book for Linux beginners written by none other than Robin "Roblimo" Miller of NewsForge fame. The book revolves around SimplyMEPIS 2004, which accompanies the book on a CD. The publishers are clearly appealing to non-technical computer users many of whom are probably dissatisfied with Windows, but reluctant to learn something new: "Robin's book will show you the benefits of switching to Linux immediately," goes the sales pitch. "Your computer will run faster and more reliably than you ever believed possible. Surfing the net will no longer be an exercise in paranoia. And you'll discover a whole new world of powerful, free software that can run rings around the programs available for Windows." MEPIS Linux comes in two editions - SimplyMEPIS and ProMEPIS. SimplyMEPIS is a single-CD desktop-oriented distribution designed for novice users. The latest version is 2004.4, which is available for free download from the distribution's mirrors. ProMEPIS is everything that can be found in SimplyMEPIS, plus development tools and server applications. The first release of ProMEPIS has just entered a non-public beta testing period, although the developers have promised to provide public betas starting with the next release. Installing SimplyMEPIS is a very pleasant affair. The installation CD boots into a full graphical desktop, effectively acting as a live CD. However, this functionality is just an added bonus, because MEPIS Linux is a full Linux distribution designed to be installed on a hard disk. This is where MEPIS differs from traditional live CDs, such as Knoppix, which was designed as a portable OS on a CD, with a hard disk installation script added as an after-thought. MEPIS, on the other hand, wants to occupy a partition on a hard disk to really shine, although it is still good to know that it is just as capable of converting any PC with a CD-ROM drive into an instant Linux workstation. The installation is performed from within a "MEPIS Installation Center", a graphical installer with partition selection (and resizing with QTParted), file system formatting (with ext3 or ReiserFS), GRUB configuration, and user setup. Everything else is autoconfigured by the installation script. On reboot, the user is presented with a graphical GRUB menu that provides a choice between 2.4 and 2.6 kernels, as well as Windows (if present on the hard disk) and Memtest. The kernel choice has been retained since the beta testing phase when some users reported hardware problems while booting the 2.6 kernel, although all was fine when their hardware was handled by the 2.4 kernel. By default, the system boots into the KDM login manager with KDE as the only desktop choice. The default KDE look has been somewhat customized to include more popular icons on the taskbar, as well as a "quick launcher" linking to some power user tools, such as Konsole, System Guard, KDE Control Center and MEPIS utilities. There is also an icon for Smb4K - an SMB share browser for KDE. Otherwise the default KDE desktop is somewhat unimaginative, which is probably why a MEPIS Beautification Project was launched by the MEPISLovers.com user community. MEPIS includes a number of custom-built graphical applications to ease system management and perform certain administrative and user-level tasks. We have already mentioned the "MEPIS Installation Center", but there is also a "MEPIS System Center" and "MEPIS User Utilities". These are simple graphical tools that give users options to configure certain devices, such as mouse, monitor, network interfaces (including wireless network cards), set up apt sources, and rename their computers. While seasoned Linux users are unlikely to give them more than a curious glance, for novice users utilities like these can make a difference between a successful adoption of a Linux operating system and a return to Windows after a brief and frustrating spell with a Linux distribution. To further ease the conversion process, MEPIS also includes two low-level utilities called "meauto" and "mefstab", which handle removable USB/Firewire devices and dynamically auto-update the fstab file and create relevant desktop icons. Package management can be performed either on the command line with apt-get, or through one of the graphical utilities, such as KPackage or Synaptic. The developers of MEPIS insist that there should never be a need to re-install the operating system, as upgrades (both on-line and from a local media) are fully supported. MEPIS maintains its own online repository of tried and tested DEBs, while packages from the vast Debian repository are also available for installation (some caution might be in order, though). Out of the box, MEPIS includes a working Java Runtime Environment, Flash Player, RealPlayer 10, as well as MPlayer plugin with QuickTime support. All of them are available to both Mozilla (the default browser) and Konqueror, but rumor has it that, by popular demand, Firefox will replace Mozilla as the default browser in the upcoming ProMEPIS release. Although MEPIS Linux is not perfect (there are reports that the latest SimplyMEPIS fails to boot on certain low-end motherboards), its developers deserve praise for creating a solid product to help less technical users to get up to speed with Linux. Combined with the above-mentioned book, SimplyMEPIS provides an excellent introduction to the world of Libre Software. Perhaps a gift idea for this Christmas?
Distribution News Debian GNU/LinuxThe second release candidate of the debian-installer is available for testing. This is expected to be the final release of the installer for Debian 3.1 (sarge).There are currently three "real-life" Bug Squashing Parties announced for this weekend in Frankfurt (Germany), Sydney (Australia) and Cambridge (United Kingdom). Additionally developers from Latin America have proposed to do a virtual BSP to fix more RC bugs than all the others. Happy Bug Squashing to all.
Fedora CoreA beta version of a guide for using Apache and SELinux on Fedora Core 3 is out. See the announcement for where to send feedback.An update of the Final Fedora Core 2 Unofficial FAQ has been announced.. Fedora Core 3 updates: sound-juicer (enable HAL support, bug fixes), system-config-users (check for running processes of a user about to be deleted (#132902)), rhgb (should fix the problem where rhgb blocks the boot process when X fails), redhat-menus-3.7.2.2fc3 (adds additional file types to the list of file types associated with the OpenOffice.org application suite), redhat-menus-3.7.1.1.fc3 (fixes the missing evolution icon bug (#rh138282)) and system-config-display (fixes tracebacks experienced by some users with dual head support). Fedora Core 2 updates: system-config-users (check for running processes of a user about to be deleted (#132902)).
Lineox Releases Enterprise Linux 4.0 BetaLineox Enterprise Linux 4.0 (LEL) Beta is built from Red Hat Enterprise Linux 4.0 (RHEL) Beta 2 sources. Some source files were modified by a set of scripts and the whole build process is script based. The purpose of this beta is to check that all the needed changes are made and they are made correctly.
MIPS Technologies' Highest-Performance 32-Bit Processor Core Families Supported by MontaVista LinuxMontaVista Software has announced that MontaVista(R) Linux(R) Professional Edition 3.1 (Pro) supports the MIPS32(R) 24K(TM) and 4KE(TM) core families.
MandrakelinuxMandrakelinux updates: clamav (upgrade to clamav 0.80), kdeutils (corrects a problem with kfloppy and udev) and qt3 (corrects a problem with fullscreen mode on x86_64).
Trustix Secure LinuxTrustix Secure Linux has released a bug fix advisory for amavisd-new, anaconda, courier-imap, ppp, setup, spamassassin, swup, tftp-hpa, and tsl-utils.
Distribution Newsletters Gentoo Weekly NewsletterThe Gentoo Weekly Newsletter for the week of November 22, 2004 is out. This week you'll find information about the Gentoo 2004.3 x86 release on DVD, documentation updates and extensions, Portage CVS, and more.
Mandrakelinux Community NewsletterThe Mandrakelinux Community Newsletter for November 22, 2004 covers the release of Mandrakelinux 10.1 Official, Ucopia and Mandrakesoft mobility grant, a regional bank with 9 offices running on Mandrakelinux, and more.
Ubuntu Traffic #12Ubuntu Traffic #12 for November 12, 2004 is out. This issue looks at Python IDE, Maintaining Debian Packages in Warty, Documentation Licensing, Pressed CDs Update, Automated Installers, Hoary Install CDs Available, X.Org Packages for Hoary, Community Council Meeting and Conference Sponsorships, AltGr On PowerPC Notebooks, Separating Mozilla/OpenOffice.org Language Packs, and Security Advisories.
DistroWatch WeeklyThe DistroWatch Weekly for November 22, 2004 features Berry Linux with several additional articles for your enjoyment.
Newsletters and articles of interest Into the World of Damn Small Linux (OSNews)OSNews takes a look at Damn Small Linux 0.8.4 and talks with DSL founder John Andrews. "DSL's main target is to run off business card CDs and/or USB keys (below 64 MBs of space). John is constantly trying to improve the space arranged in the distro so it never ends up being more than 50 MBs (compressed). This way, Linux can be demonstrated easily, fast and without any risk, to new users. Moreover, John told us that he has heard of others running DSL on a 486DX machine with only 16 MBs, with X11, proving DSL to be an excellent choice for older machines."
My workstation OS: Mepis Linux (NewsForge)This NewsForge article extols the virtues of Mepis Linux. "I began using Linux in 2001 with Mandrake, but I wanted to try other distributions. I spent time with Peanut Linux, SUSE, Ark, Onebase, and Debian. And then it happened: On my neverending quest for the perfect distribution I discovered Mepis. It has not left my desktop since I installed it. Although I have tried several distros since, I haven't found one that pleases me more than Mepis."
Distribution reviews Review: CentOS 3.3 is a good Red Hat server alternative (NewsForge)NewsForge takes a quick look at CentOS. "According to the Web site of its developers, the cAos Foundation, "The goal [of CentOS] is to reproduce RHEL in a freely distributable form that complies in full with RedHat's redistribution requirements. It is designed for people who need an enterprise class OS without the cost of certification or the RedHat brand name." To a large extent, it succeeds."
Page editor: Rebecca Sobol Development BASE, the Basic Analysis and Security EngineThe BASE project (Basic Analysis and Security Engine) is a tool for network security monitoring:
This application provides a web front-end to query and analyze the alerts coming from a SNORT IDS system.
BASE is a web interface to perform analysis of intrusions that snort has detected on your network. It uses a user authentication and role-base system, so that you as the security admin can decide what and how much information each user can see. It also has a simple to use, web-based setup program for people not comfortable with editing files directly.
To understand BASE, one must first look at SNORT, an open-source Network Intrusion Detection System. The SNORT description says:
Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
BASE uses its web-based interface to make access to the intrusion monitoring data simple. See the BASE screenshots (big and slow) to see how the system is used for monitoring network traffic, zooming in on interesting activity, and generating statistical reports. Base has been written by a relatively small group of developers and translators. Base is licensed under the GNU General Public License (GPL). It runs on many Unix variants as well as Windows. The software is written in Perl, PHP, Tcl, and the Unix Shell. The BASE project summary has more general information. Version 1.0 of BASE was announced this week: "This release includes many bug fixes over previous releases of BASE and ACID. It also is the first release to include the Flow-Portscan preprocessor patch. It also has support for multiple languages, with 11 languages included in the package. It also has a fully functional user authentication and role-basing system." Security administrators should find BASE and SNORT to be useful tools for monitoring their networks. The software is available for download here.
System Applications Database Software PostgreSQL 8.0.0 Beta 5 Now AvailableVersion 8.0.0 Beta 5 of the PostgreSQL database has been released. "Its been almost 4 weeks since Beta4, and alot of work, involving alot of bug fixes, and documentation improvements, to the source tree, we have just released our 5th Beta of 8.0.0. All of our major Open Items have now been completed, and we're slowly entering the final stages, involving alot of testing and documentation changes."
PostgreSQL Weekly NewsThe November 22, 2004 edition of the PostgreSQL Weekly News is out with the week's latest PostgreSQL database articles and resources.
Introducing Slony (O'ReillyNet)O'Reilly is running an introductory article on Slony, a database replication package. "Slony is an experimental new feature intended to introduce powerful replication to PostgreSQL. It's a complicated problem, though. Elein Mustain introduces the Slony project, its aims, and the goals of Slony-I, the first milestone."
Interoperability Samba 3.0.9 Available for DownloadStable version 3.0.9 of Samba is out. "This is the version that production Samba servers should be running for all current bug-fixes. There have been several important issues fixes since the 3.0.8 release."
Printing New hpnpf is availableA new release of hpnpf, an alternate backend for driving PostScript printers using the HP PJL language, is available. "After some bug fixes today it additionally supports raw printing of PCL data."
Web Site Development Magnolia 2.0 CMS released (SourceForge)Version 2.0 of Magnolia, a cross-platform content management system (CMS), has been announced. "The Magnolia 2.0 CMS combines an outstanding GUI, great usability, web-based deplyoment and J2EE enterprise strength. It is the first open source CMS using JSR-170, the "Java Content Repository API."
Cross-Language Remoting with mod_perlservice (O'Reilly)Michael Collins looks at mod_perlservice on O'Reilly. "Mod_perlservice is a cool, new way to do remoting -- sharing data between server and client processes -- with Perl and Apache. Let's start by breaking that crazy name apart: mod + perl + service."
Desktop Applications Audio Applications Audacity 1.2.3 releasedVersion 1.2.3 of Audacity us available. "Audacity 1.2.3 is a new stable version of the free Audacity sound editor. This release fixes a bug that interfered with long recordings on some Windows systems, and another bug that causes random crashes on Mac OS X. It also includes several updated translations, and some other minor bug fixes and improvements."
Desktop Environments Around the Planet (GnomeDesktop)GnomeDesktop.org has an Around the Planet summary that includes: "Happenings from the past week broadcast on PlanetGNOME..."
KDE CVS-Digest (KDE.News)The November 19, 2004 edition of the KDE CVS-Digest has been published. Here's the content summary: "Kicker rewrite merged into HEAD for further testing. New Kontact summary plugin for dates and holidays. kttsd adds support for Festival 2.0 MultiSyn voices. KDevelop has a new Ruby source code debugger."
Desktop Publishing New LGPL font: Essays 1743 1.0 (GnomeDesktop)GnomeDesktop.org has an announcement for a new font. "I've released another LGPL font, Essays 1743, based on the typeface used in a 1743 English translation of Montaigne's Essays.
Electronics Open Collector ReleasesThe latest new electronics applications on Open Collector include VTracer 1.4 (a Verilog Testbench developer aid), and a new release of the fpga4fun FPGA tutorials, projects and boards project.
Financial Applications CK-ERP v.0.10.1 released (SourceForge)Version 0.10.1 of CK-ERP has been announced. This release adds a new vendor relationship management module. "CK-ERP is an open source accounting/ERP/CRM system that runs on top of phpGroupWare. It comprises 18 modules - Admin, Contact Management, Customer Relationship, Vendor Relationship, Ledger, Bank Reconciliation, Inventory, Service, AP, AR, PO, SO, Quotation, POS for Cashier, POS for Manager, HR, Staff Self Service and Payroll. Operating platform can either be LAMP or LAPP."
Games Cyphesis 0.3.6 ReleasedVersion 0.3.6 of Cyphesis, a small to medium scale server for WorldForge games, has been released. Changes include a cleaver tool for butchering pigs, an axe tool for chopping down trees, packaging improvements, and more.
GUI Packages Initial release of the Lit Window LibraryThe wxWidgets site mentions the first release of the Lit Window Library. "The first public release of Hajo Kirchoff's Lit Window Library (for C++) is now available at from LitWindow itself. The goal of The Lit Window Library is to speed up C++ GUI coding by a factor of 10. It greatly reduces the amount of work needed to code user interface requirements. This is not just another "better widgets" library. The library introduces two new, different concepts to UI coding: a data abstraction layer (reflections) and rule-based programming."
Usable GUI Design: A Quick Guide for F/OSS Developers (GnomeDesktop)GnomeDesktop.org points to a useful article on open-source user interface design. "Free and open source software is often criticised for being less usable than its commercial equivalent. Good user interface design isn't some magical thing that FOSS developers can't do for themselves, however. Benjamin Roe has written a short article describing five key points of good interface design that any developer can use in their projects."
Imaging Applications Caliph 0.9.13 and Emir 0.8.5 released (SourceForge)New releases of Caliph and Emir have been announced. "Recently a major update on Caliph and Emir was released. Caliph & Emir are MPEG-7 based Java prototypes for digital photo and image annotation and retrieval supporting graph like annotation for semantic metadata and content based image retrieval using MPEG-7 descriptors."
Second preview of GIMP 2.2 (GnomeDesktop)The second pre-release of the GIMP version 2.2 has been announced. "Unless major problems show up, the GIMP 2.2.0 release is supposed to follow later this month." See the NEWS document for change details.
Instant Messaging XChat 2.4.1 ReleasedVersion 2.4.1 of XChat, a multi-platform IRC client, is available. This release features bug fixes, performance improvements, and more, see the changelog file for details.
Music Applications BEAST/BSE v0.6.3 announcedVersion 0.6.3 of BEAST/BSE, the BEdevilled Audio SysTem and the Bedevilled Sound Engine, has been released. "Outstanding new features include support for skins, many sample file formats, MIDI file import abilities, an improved piano roll widget, the track editor which allows for easy selection of synthesisers or samples as track sources, loop support in songs, mixer support, unlimited Undo/Redo capabilities and MIDI automation."
liblo 0.15 announcedVersion 0.15 of liblo, an implementation of the Open Sound Control protocol for POSIX systems, has been released. "This release adds some OSX compatibility fixes from Taybin Rutkin, support for OSC multipath pattern matching courtesy of Daniel Holth's pattern matcher and I've added bundle i/o."
Soundtank 1.0.1 releasedVersion 1.0.1 of Soundtank, an application that allows LADSPA plugins to be used as a software synthesizer, is out. "Release 1.0.1 contains many useability improvements, including the ability to refer to object controls & data ports by their names as well as their indexes."
Office Suites KOffice 1.3.5 Released (KDE.News)KDE.News has the announcement for version 1.3.5 of the KOffice office suite. "The KOffice team is happy to bring you the fifth bugfix release of KOffice. KOffice 1.3.5 features a new language (Breton), the PDF import filter includes a stronger security fix and there are also a few fixes for the OpenOffice.org Impress Export Filter."
PDA Software PalmDB 1.3.6 releasedVersion 1.3.6 of PalmDB, a "Pure Python library to read/write/modify Palm PDB and PRC format databases", is available.
Web Browsers Mozilla 1.8 Alpha 5 Released (MozillaZine)Version 1.8 Alpha 5 of the Mozilla browser has been announced. "This latest alpha version of the Mozilla Application Suite features around 600 bug fixes."
Miscellaneous Pooter 3.0 is outVersion 3.0 of Pooter, a multi-platform personal information manager, has been released.
Languages and Tools Caml Caml Weekly NewsThe November 16-23, 2004 edition of the Caml Weekly News is online with a new round of Caml language articles.
Java Java theory and practice: Going atomic (IBM developerWorks)Brian Goetz covers atomic variables under JDK 5.0 on IBM developerWorks. "Until JDK 5.0, it was not possible to write wait-free, lock-free algorithms in the Java language without using native code. The addition of the atomic variable classes in java.util.concurrent changes that situation. Follow along with concurrency expert Brian Goetz as he explains how these new classes have enabled the development of highly scalable nonblocking algorithms in the Java language."
Dynamic Delegation and Its Applications (O'ReillyNet)Lu Jian examines the Proxy pattern on O'Reilly. "Proxy, introduced in Java 1.3, offers an interesting way to provide an interface's implementation at runtime, but there's more that can be done. Lu Jian shows how bytecode manipulation can be used to provide dynamic delegation, allowing you to provide runtime implementations of interfaces, abstract classes, and even concrete classes."
Perl This Week on perl5-porters (use Perl)The November 1-9, 2004 edition of This Week on perl5-porters is available. here's the content summary: "In this beginning of November, the porters have discussed about regression tests, using new functions from the C library when they're found, the roadmap for perl 5.10, optimisations, signals, and other miscellaneous topics."
PostScript AFPL Ghostscript 8.33 beta releaseBeta release 8.33 of AFPL Ghostscript has been announced. "This is the fourth testing release of our development tree toward the 8.50 major release. We believe this to be a candidate for release quality; we expect to follow it shortly with the first stable release."
BarcodeWriter 1.1 releasedStable version 1.1 of BarcodeWriter is available. "A few times I have needed to implement routines that output Adobe PostScript for the purpose of printing barcodes in several different languages. Recently this has provoked me to cook up the following routine that implements the printing of barcodes entirely within level 2 PostScript. This means that the entire process of converting the input string into the printed output is performed by the printer itself, thus avoiding the need to reimplement the barcode generation process whenever your language needs change."
Python Python 2.4 rc1 is outRelease candidate 1 of Python 2.4 has been announced. "Notable changes in rc1 include a handful of bug fixes, including a thread shutdown race bug." See A.M. Kuchling's What's New in Python 2.4 document for details.
python-dev SummaryThe October 1-15, 2004 edition of the python-dev Summary is online with coverage of activity on the python-dev mailing list.
PyCLIPS beta 1.0_06 released (SourceForge)Beta version 1.0_06 of PyCLIPS has been announced. "PyCLIPS is a Python module to interface the CLIPS expert system shell library. This new release contains many fixes and enhancements, as the test suite is becoming more complete and users give their feedback about the module. An upgrade is suggested for everyone who regularly uses PyCLIPS since many serious errors have been corrected."
gnome-python 2.9.0 (unstable)Unstable version 2.9.0 of gnome-python, the Python language bindings to the GNOME developer platform libraries, are out. "This release contains some internal reorganisations in the modules, as previously announced in pygtk list."
gnome-python-extras 2.9.0 (unstable)Unstable version 2.9.0 of the gnome-python-extras have been announced. "This is a companion release to gnome-python 2.9.0, containing the modules that were removed from it due to wrapping libraries not part of the GNOME Developer Platform."
urwid 0.8.4 releasedVersion 0.8.4 of urwid, a curses-based UI library for Python, is out. Changes include better Cyrillic support, new screenshot functionality, improved input debugging, and more.
Dr. Dobb's Python-URL!The November 22, 2004 edition of Dr. Dobb's Python-URL! is out with a new collection of Python article links.
Ruby Extending Ruby with C (O'ReillyNet)Garrett Rooney explains how to extend Ruby in an O'Reilly article. "High-level languages such as Perl, Python, and Ruby are very effective for application development, but linking them to existing C libraries is tedious, isn't it? Not really. As Garrett Rooney demonstrates, writing Ruby bindings for C libraries is easier than you might think."
Build Tools make: The Evolution and Alternatives (O'ReillyNet)Andy Oram and Robert Mecklenburg discuss the make utility on O'Reilly. "The make utility is an enticing servant, always there and always accommodating. Like the indispensable sidekicks found in many novels and movies, make starts out as the underappreciated supplicant to whom you throw a few odd jobs, and then gradually takes over the entire enterprise."
Page editor: Forrest Cook Linux in the news Recommended Reading European software patents not pending (ZDNet)Here's a ZDNet UK column praising Poland for its role in blocking software patents in Europe. "We're big enough not to need the US: instead, US software will labour under the extra inconvenience and cost of licensing agreements, while European software will be free to be developed and distributed as we see fit. If the US wants to give us a monopoly on free and open-source software, then we'll have to cope as best we can."
GPL 3 to Take on IP, Patents (eWeek)eWeek takes a look at the GNU General Public License version 3. ""[The GPL] is now serving beyond what we would have said was its projected life," Moglen said. Software and the industry have changed radically over the past 10 years, "so there's a certain amount of cleaning up to do that simply has to do with settling the license into the contemporary environment," he said. Any changes made to the GPL will need to confront some difficult issues. For example, patent defense clauses will be a big topic of concern for GPL 3, Moglen said, and talks will center on the use of copyrights to retaliate against patent law. "We perceive some difficulty and enormous complexity in the fact that the GPL is a worldwide license and the global law of patents is not uniform," he said."
Trade Shows and Conferences Andrew Morton's Speaker Notes from SDForum (Groklaw)Groklaw has published Andrew Morton's notes from his talk at SDForum. "Andrew Morton saw Groklaw's coverage of the "Linux is not forking like Unix" article, and he has now graciously provided his speaker's notes from SDForum, on the theme of "the interface between open source software development and the software-using business world." He says, "It's very close to what was said." I know, knowing you like I do, that you will enjoy it much more than any third-party report about what he allegedly said. I found it fascinating reading, and I'm happy I can share it with you now."
Linux makes first appearance at Italy's PC Professionale Conference (NewsForge)NewsForge reports on the GNU/Linux debut at Italy's PC Professionale Conference. "WPC is one of the most important IT conferences in Italy, as it focuses on bringing to Italian developers the latest information on the future of IT from a Microsoft Windows-centric point of view. The 2004 edition was held in Milan last week, and for the first time in the history of this event, the sponsors held a second conference during the first three days in the same place: the PC Professionale Conference. Through this second conference, GNU/Linux and free and open source software (FOSS) in general reached an audience that was accustomed to very different solutions for their computing needs."
XML 2004: After Declaring Victory, What's Next? (O'Reilly)Kendall Grant Clark covers the XML 2004 conference on O'Reilly. "A broad industry consensus has formed around the idea that the era of core XML specification-making is over, but that a great deal of work remains to be done. In fact, a triumphalist mood has captured the core XML developer community lately, especially here in DC. I keep hearing keynote speakers, Microsoft evangelists, and other assorted luminaries ask why the press hasn't sent the "we won!" message more clearly. But more about that later on."And, if that's not enough coverage of the conference, see the article XML 2004: From the Exhibition Floor by Simon St. Laurent.
Companies Microsoft issues warning about Linux lawsuits (Reuters)Reuters reports from a talk by Steve Ballmer in Singapore. "Linux violates more than 228 patents, Microsoft Chief Executive Steve Ballmer said at the company's Asian Government Leaders Forum in Singapore on Thursday. He did not provide any details on the alleged violations, which the Linux community disputes. 'Someday, for all countries that are entering the WTO (World Trade Organisation), somebody will come and look for money owing to the rights for that intellectual property,' he added."
Sun invites outside involvement with Java 6 (News.com)News.com examines Sun's open-source process for work performed on version 6.0 of the Java 2 Standard Edition (J2SE). ""When we started doing API design with others in the JCP, our APIs got a lot better. We're trying to apply more of that principle to the J2SE source code itself," Hamilton said. "Having more eyes looking at it will improve the product over time." The move is the latest adjustment to Sun's long-running attempt to balance the openness of Java with the risks of letting outsiders hold sway. Sun's first Java foe was licensee Microsoft, which added Windows-specific features to Java in a way that undermined the software's primary benefit of letting the same program run on any computer."
Linux Adoption The real cost of open source (FCW)Federal Computer Week has posted a look at Linux adoption in the U.S. government; it includes a half-hearted attempt to show that Linux may be more expensive and the obligatory Laura DiDio quotes. "NASA officials see another cost benefit for the agency's internal application development activities: They can consult diverse IT and subject matter experts in-house and in the greater scientific community, all of whom contribute to new applications in the collaborative tradition of open-source software development."
Bill Gates no longer needed (Le Matin)Le Matin reports (in French) that the Swiss state of Geneva plans to switch to free software by 2009. "'We want to guarantee our independence,' explains Jean-Marie Leclerc, general manager of the State Center for Technology and Information. 'This is not directed against Microsoft, it is just a matter of not depending upon a single company. Moreover, one cannot imagine an open administration without adopting open systems!'" (editor's translation). There is also an editoral column supporting the decision. (Merci à Frédéric Schütz).
Linux at Work Linux helps kids, brings hope, in Hawaii (NewsForge)NewsForge covers Scott Belford and other members of the Hawaii Open Source Education Foundation. ""One by one, I began converting them to Xandros," Belford says. "It is seamless. Kids come in having no idea what Linux is. They sit down and click on the icon for Internet, or word processing to do schoolwork, and suddenly the 'broken computers' are working." HOSEF also supplied staff members who previously didn't have computers with which to do their work with Linux computers. Belford admits he was experimenting on them. "If you don't tell somebody they can't do it, they don't know. One is running SUSE, one is Mandrake, and two are on Xandros. I haven't offered any training -- they each do their work with spreadsheets, word processing, and Internet.""
Interviews Microsoft Director of Windows Product Management Talks Firefox (MozillaZine)MozillaZine comments on a BetaNews interview with Microsoft's Gary Schare, Director of Windows Product Management. "He also says that "the Mozilla guys have had a bit of a free ride" regarding backwards compatibility, claiming that Microsoft does not have the luxury of releasing upgrades that drop support for browser add-ons and break compatibility with non-standard websites (curiously, this did not stop them from dropping support for Netscape plug-ins with the release of IE 5.5 Service Pack 2). Reponding directly to a question about the release of Firefox 1.0, Share repeats the usual rhetoric that Microsoft is "happy to have even more developers adding value onto the Windows platform"."
Resources Open Source Licenses Are Not All the Same (O'ReillyNet)O'ReillyNet delves into open source licenses. "One of the most significant developments in the software and web development community in the past few years has been the increased use of open source software. It's vital for any programmer, web designer, or other computer professional to understand that open source licenses are not all the same. The differences between licenses can have a big impact on how you may use or distribute the software."
Reviews Linux MIDI: A Brief Survey, Part 2 (Linux Journal)Dave Phillips looks at MIDI sequencers on Linux Journal. "New-school MIDI musicians are more software-based, using softsynths and plugins in place of racks of external gear. Modern sequencers also are expected to support audio tracks that can be synchronized with MIDI tracks. The audio/MIDI sequencer is now the rule: MIDI-only sequencers still are available, but they have become the exception."
Page editor: Forrest Cook Announcements Non-Commercial announcements Torvalds, Widenius, and Lerdorf against software patentsLinus Torvalds, Michael Widenius and Rasmus Lerdorf have written an appeal to the EU Council against software patents in Europe. "At first sight, a patent appears to protect an inventor but the actual implications may be the opposite, dependent upon the field. Copyright serves software authors while patents potentially deprive them of their own independent creations. Copyright is fair because it is equally available to all. A software patent regime would establish the law of the strong, and ultimately create more injustice than justice."
Freedesktop.org returns to the netThe Freedesktop.org site was recently compromised, it's back online and the admin log explains what happened. "As you may have noticed, freedesktop.org sort of got compromised a few days back. By 'sort of', I do, of course, mean 'totally'. Adam Conrad noticed a few thousand bounces in his inbox courtesy of being on www-data, and that they were all for spams being sent as www-data. Whoops. We started hunting for an insecure formmail.pl, but when we took a look at lsof and discovered an IRC proxy running, we decided it was something more insidious. From there, the machine got killed to all access but ours, and we started tracking down the point of entry. It turned out that it was compromised via a hole in TWiki, but no news was to be found on the TWiki site about this hole, nor was there a new release." (Thanks to Maximilian Attems.)
Eclipse Foundation Welcomes AldonThe Eclipse Foundation has announced the joining of Aldon. "Aldon brings significant enterprise change management and lifecycle process automation experience to the Eclipse Foundation. Aldon Lifecycle Manager and Aldon Lifecycle Manager for iSeries Team Repository plug-ins support complex multi-tier, Web-centric and Service-Oriented Architectures (SOA), as well as application development across Windows, UNIX, Linux, OpenVMS, z/OS, i5OS and OS/400 operating environments."
Scalix Joins Open Source Development LabsThe Open Source Development Labs (OSDL) has announced that Scalix Corporation, provider of a Linux email and calendaring platform, has joined OSDL and will participate in the Lab's Data Center Linux and Desktop Linux working groups.
Stratus Joins Open Source Development LabsOpen Source Development Labs has announced its newest member, Stratus Technologies, Inc. ""Stratus relies on a Linux operating system that runs on our fault-tolerant products designed for the continuous uptime requirements of telecommunications central offices," said Ali Kafel, Stratus vice president, Telecommunications Sales. "We're looking forward to joining OSDL's Carrier Grade Linux and Data Center Linux working groups to combine our Linux development expertise with other OSDL members.""
OSDL's response to Ballmer's patent claimsOSDL has released a brief statement (click below) in response to Steve Ballmer's claims that Linux violates Microsoft patents.
Commercial announcements Linspire Supports Latest Windows Media VersionsLinspire, Inc. has announced support for versions 8 and 9 of the Windows Media Player. "Previously, Windows Media files would typically work on users' machines only if they found and installed unlicensed codecs online then patched them into their operating system. In contrast, Linspire licensed the codecs directly from Microsoft, then made substantial changes to make the Windows Media code work on Linux>-based systems. The engineering required porting the complete Windows CE Windows Media code to Linux."
The Lawyers are comingA law firm called Morris, Manning & Martin, LLP has announced that it is available to help companies deal with their "open source issues." "For example, businesses that modify Open Source code for internal use may be surprised that seemingly innocuous actions may initiate distribution requirements, which could force them to give away their customized software for free, or at a modest cost, to their competitors." This company also runs OSLawBlog, claimed to be a weblog on open source legal issues; many visitors may be more struck by its obnoxious advertisements than the legal reasoning to be found there, though.There will be more where these folks came from.
MontaVista Linux Powers New NTT DoCoMo 3G PhonesMontaVista has announced that its MontaVista Linux platform is being used for the NTT DoCoMo 3G mobile phones. "These MontaVista Linux-based phones include the N900iL and the N901iC, both developed by NEC Corporation (TSE: 6701), and the P901i from Panasonic Mobile Communications Co., Ltd., a subsidiary of Matsushita Electric Industrial Co., Ltd. (TSE: 6752)."
NEC Launches New Linux-Based Fault Tolerant ServerNEC Solutions America has announced their latest Linux-based fault tolerant server. "The Express5800/320Lb hardware dual-modular architecture ensures continuous system operation in the case of a hardware failure. The NEC Fault Tolerant Linux operating system was built on the 2.4.18 Linux kernel, enabling any Linux application running on that kernel to run in fault tolerant mode with no modification to the software."
Novell Reports Financial ResultsNovell, Inc. has announced the financial results for its fourth fiscal quarter and for 2004 to date. The company seems to be making money from its Linux efforts. "During the fourth fiscal quarter 2004, Novell recognized revenue of $12 million associated with its SUSE(R) LINUX business. Recognized revenue from subscriptions to SUSE LINUX Enterprise Server in the quarter was $7 million, a sequential increase of 68% from the third fiscal quarter 2004. Sales of subscriptions to SUSE LINUX Enterprise Server (SLES) totaled 21,000 units in the quarter."
Sun Wah Linux Limited at CELF, TokyoSun Wah Linux Limited has announced its participation in the recent Tokyo Consumer Electronics Linux Forum. "Sun Wah Linux Limited is the first company in China that has participated in the Consumer Electronics Linux Forum (CELF) Tokyo Technical Jamboree event, which was held by all the CELF member companies all over from Japan and other countries such as Europe and US end of October. Their participation represented their first step toward understanding Linux for use in consumer electronic (CE) products."
TimeSys Offers Free Linux Board Support PackagesTimeSys Corporation has announced: "the availability of free 2.6-based Linux Board Support Packages (BSPs) for PowerPC and x86 architectures. Written under the GNU General Public License, BSPs from TimeSys include a certified Linux kernel, more than 100 root filesystem packages and device drivers in a single downloadable, installable image."
TransGaming Announces Linux Support for Half-Life 2TransGaming Technologies has announced Linux support for the video game Half-Life 2. "On the heels of its commercial debut, TransGaming's Cedega product will run Half-Life 2 on the Linux operating system, right out-of-the-box. Half-Life 2 is the anxiously awaited sequel to Valve's debut title that won more than 50 game-of-the-year awards."
VA Linux Releases VA Balance, a Load BalancerVA Linux has announced the release of their VA Balance Load Balancer product. "VA Balance consists of UltraMonkey, a scalable open source load balancing software, and VA Core, a GNU/Linux system based on Debian; both are developed by VA Linux. VA Balance is a fully integrated solution. The control-configuration-monitoring framework provided by VA Core and the special UltraMonkey load balancing software optimized for VA Core are tightly linked and provide an effective and robust load balancing solution ideal for local area networks."
New Books "Knoppix Hacks" Released by O'ReillyO'Reilly has published the book Knoppix Hacks by Kyle Rankin.
Point and Click Linux!Prentice Hall PTR has published the book Point & Click Linux! by Robin Miller.
Resources On Line Version of Agustin's Linux Manual ReleasedThis press release announces the availability of an online version of Agustin's Linux Manual, by Agustin Velasco. "This is a four volume book with over 200 pages of Linux documentation. This manual is centered on Mandrake Linux, but much of the material is worthwhile for any version of Linux. The manual contains a good amount of screen shots to help the readers as they follow step by step procedures."
Upcoming Events Linux Day 2004 in FlorenceThe Florence Linux User Group has announced the fourth Florentine Linux Day, coincident with the nationwide Italian Linux Day on November 27. Click below for the details (in Italian).
Linux Bangalore 2004 -- Call for Volunteers (KDE.News)KDE.News has a Call for Volunteers for the Linux Bangalore 2004 KDE booth. The event will take place in Bangalore, India on December 1-3, 2004. "Ideally this booth will contain more than Taj, myself and my laptop. This is where you come in."
Open Source Initiatives in California GovernmentLUGOD has announced an upcoming presentation. "On Tuesday, December 7th from 6:30pm to 9:00pm, the Linux Users' Group of Davis, in Davis California, will host a free presentation on the use of Open Source software in California government. Bill Fell and Harry Ng from the California Air Resources Board will be joined by Allen Lung from the Franchise Tax Board as they discuss how the Linux operating system, Apache web server, and other completely free, community-developed tools are being used, and developed, in state government."
Ottawa Linux Symposium 2005 call for papersThe OLS 2005 call for papers has gone out; if you would like to speak in Ottawa, you have until February 1 to get a proposal in.
Speakers Confirmed for the SELinux SymposiumThe SELinux Symposium has announced speakers for the first Security-Enhanced Linux (SELinux) Symposium. The symposium is scheduled for March 2-4, 2005 in Silver Spring, Maryland.
XTech 2005, Gilbane Conference to Co-locate in AmsterdamIDEAlliance has announced the XTech 2005 conference. "XTech 2005 (formerly XML Europe) will be held in conjunction with the Gilbane Conference on Content Management. Both conferences will take place 24-27 May, 2005, at the Amsterdam RAI Centre, Amsterdam, Netherlands."
ILC 2005 Call for ContributionsA Call for Contributions has gone out for the International Lisp Conference 2005. "The conference will take place from June 19 to 22, 2005 at Stanford University."
Events: November 24, 2004 - January 19, 2005
Software announcements This week's software announcementsHere are the software announcements, courtesy of Freshmeat.net. They are available in two formats:
Page editor: Forrest Cook Letters to the editor Vendor Lock-In Misplaced
Sir:
licensing suggestion
In this article:
Page editor: Jonathan Corbet
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
