An inevitable part of the new-year ritual is the posting of predictions for
the coming twelve months. Your editor, having access to a moderately high
soapbox, feels it would be morally wrong to fail to make use of that
soapbox to make an absolute fool out of himself. To that end, here are a
few ideas for what we might see in the coming year. As always, these
predictions are offered in the hope that they will be useful, but they
carry NO WARRANTY regarding any correspondence with reality as experienced
in your timezone or as to whether they make sense at all.
Development
This will be the year for free desktop infrastructure. Yes, there
will be a long series of high-profile application releases, with
OpenOffice.org 2.0 being, arguably, at the top of the list. But 2005 will
be the year when projects like
HAL and
D-BUS stabilize and
see wide deployment, and when the reinvigorated X.Org development team
starts making some truly big strides. The kernel's support for
contemporary video cards will be rationalized and improved. Perhaps there
will even be a place for Mono. The convergence of all this new, low-level
support code, combined with increased cooperation between desktop projects
for low-level support, will build the base for the next generation of
amazing free desktop applications.
Free databases will see some high-profile deployments. The adoption
of free database management systems is still in an early stage. Things
will progress in 2005, to the point that some proprietary database vendors
will see the need to start competing directly against the free
alternatives. Perhaps 2005 is when we'll see some real free database FUD.
There will be no 2.7 kernel in 2005, despite the requests for such a
release from some quarters. The 2.6 process will continue to merge changes
at a staggering rate, and nothing will come along which is so disruptive
that it forces the creation of a new development series. The steady series
of complaints about the quality of the 2.6 mainline releases will force
some changes to the process - we may see more frequent releases or true
"release candidates" for wider testing. But the simple fact is that the
kernel developers - and the distributors who have the job of delivering
stable kernels to their customers - are happy with things as they are, and
will not be in a hurry to go back to the older way of doing things.
Commercial
Red Hat will find something to do with its cash pile. The company
currently has about $1 billion (almost half of its market
capitalization) in the bank - much of that cash is the result of a debt
sale one year ago. As Red Hat's management tries to push the company's
stock price back up, it will have to find something more productive to do
with that money. It would not be surprising to see an acquisition or two
happen in the near future.
The market for not-quite-enterprise distributions will grow. There
are no end of companies looking to gain the benefits of switching to Linux,
but who do not want to pay the hefty "enterprise Linux" price tag. Many of
these companies will realize that high-quality Linux can be had for less,
and will look to companies with credible support offerings. Companies like
Progeny, Ubuntu, and Specifix may be well placed to thrive in this market.
The UserLinux distributed support network model looks an awful lot like the
early Red Hat "support partner" program, and risks ending up the same way.
Embedded Linux will gain a higher profile, especially as a base for
a new round of "personal media player" gadgets. Expect some fireworks as
some of these devices - and their built-in DRM schemes - prove to be more
hackable than the entertainment industry would like.
Very few companies will buy Linux indemnification policies, making
life difficult for insurance vendors like OSRM.
Distributions
Debian will get a new stable release out, one way or another. Much
of the user base for stable Debian releases will, however, have moved on to
offshoot distributions like Ubuntu. There will be a new round of
soul-searching within the Debian Project over the value of its stable
distribution and what that distribution should be.
Community involvement in Fedora will increase, mostly through
outside maintenance of some non-core packages. Red Hat will maintain a
firm grip on important decisions, however. Don't expect to see an open
Fedora developers' conference in 2005.
Legal and political
Thanks to serious activism and the entry of several countries into the EU,
software patents will not be enacted in Europe in 2005. One thing
your editor has seen many times, however, is that the commercial forces
behind this kind of legislation do not ever give up. While their current
push looks to be headed for failure, the issue will remain, and the fight
will go on.
A new round of copyright legislation will hit the U.S. Congress.
The entertainment industry will attempt to strengthen its control and find
some sort of legislative solution to file sharing over increasingly
decentralized networks. Fair use activists will try again for copyright
and DMCA reform. Neither side is likely to get far. The entertainment
industry may get caught engaging in increasingly dirty denial of service
attacks on peer-to-peer networks and their users.
This one should be fairly obvious: 2005 will see the end of SCO.
The company's remaining cases will fall apart in court, and its cash will
run out. In retrospect, it will become clear that the SCO lawsuit has
actually been a good thing for free software: it has proved how clean our
code is now, made developers more aware of the potential for such lawsuits
in the future, and has made many large companies take a clear position in
the defense of free software. The next company that tries to extract
payments from the free software business world will find a climate which is
far less hospitable to that sort of litigation; for this reason, your
editor believes there will not be a new major intellectual property suit
related to Linux in the coming year.
In conclusion...
More people will notice that Linux users don't have spyware and adware
problems, which will be getting steadily worse on other platforms.
This issue, alone, will cause more people to look at free software. Many
will get their feet wet with Firefox and stop there, but others will take
the full plunge. As proprietary systems are turned into zombies which spam
and spy on their alleged owners, pure exasperation will push a new round of
Linux adoption.
Your editor expects many things to continue as they have been. An
increasing number of developers will work to create ever more powerful
applications. More and more people will awaken to the value of free
software, and they will look seriously at using it. Some people will even
figure out ways to make money from it. And, inevitably, Linux will
continue to be fun - even for a grumpy editor.
Comments (14 posted)
As the OpenOffice.org development team closes in on the 2.0 release, we
thought we'd take a look at the suite and see how the 2.0 version is
shaping up. Since OpenOffice.org 2.0 is still in development, it's to be
expected that some features do not work or work poorly, and that its stability isn't
at a level appropriate for a finished application. The 1.9.65 build of
OpenOffice.org certainly lives up to that expectation, and should only be
deployed for testing purposes.
We installed OpenOffice.org 1.9.65 from the snapshot builds page
on a SUSE 9.2 system. Unlike previous versions of OpenOffice.org,
version 1.9.x is being distributed in "native" installer format for
various systems. The Linux build is available as an RPM rather than the old
OpenOffice.org setup application.
One of the goals for the 2.0 release of OpenOffice.org is for the
application to start faster than previous releases. At this point in
development, the startup for OpenOffice 1.9.65 is not noticeably faster
than 1.1.3, however.
Let's start with the word-processing application, Writer. The sad fact is
that OpenOffice.org could be the best word processor ever invented -- but
if it fails to import Microsoft Word documents well, it will have a tough
time in the general market. This is also true of other OpenOffice.org
applications, so we spent a good deal of time testing Office compatibility.
To test out the Word and other Microsoft document import features, this
reporter searched for Microsoft Office documents on Google using the
"filetype" search feature. Writer is still better at importing Microsoft
Word documents than AbiWord, and 1.9.65 does a slightly better job of
importing Microsoft Office files than 1.1.3. There still seem to be a few
glitches. One Word document, for example, looked almost perfect, with the
exception of a bulleted list presented outside the page borders.
The interface for Writer has changed very little, so users who are familiar
with Writer already will be able to jump right in to the next
version. There are a number of noteworthy new features in Writer aside from
its Microsoft Word compatibility. This version of Writer allows an author
to count words in a selection, in addition to counting words in the entire
document. Nested table support has also improved in this version, which
will also help with importing complex Microsoft Word documents.
The Impress interface has changed quite a bit, with floating toolbars for
formatting and a tabbed interface to switch between views of the
document. This reporter likes the new interface a little more, but the
transitions between views are a bit jarring. The "slide sorter" view is
particularly nice if one needs to re-arrange a presentation quickly.
Calc looks and feels the same as its predecessor. It has undergone a few
improvements under the hood, however. In particular, Calc's limitation of
32,000 rows has been removed. Calc can now handle sheets with up to 65,536
rows, which is the same as Microsoft Excel. We tested this by importing a
CSV document with 59,621 rows. Calc had no problem importing this document
or saving it as a native OpenOffice.org file.
Calc is a bit better at importing Excel files with odd text formatting than
Gnumeric, but Gnumeric does still seem to have the edge
in supported functions. Calc fails several tests in Gnumeric's
testing files which test for Excel compatibility.
One of the big additions to OpenOffice.org 2.0 is a database application
like Microsoft Access. The OO.org Base application is, or should be, a nice
addition to the OpenOffice.org suite when it's complete. Unfortunately,
Base isn't very stable at the moment, and testing usually resulted in a
complete crash in a short time. The Table Wizard is very user-friendly, but
each time this reporter tried to create a database using the Wizard,
OpenOffice.org would crash at the final step.
Unfortunately, the entire suite is only as stable as its least-stable
component. When Base crashed, it brought down the entire suite in one fell
swoop. This is a bit of a design flaw, as a user with Writer, Calc and Base
open will have all applications crash simultaneously. This did give us a
chance to work with the document recovery wizard. At startup,
OpenOffice.org would try to recover all documents open at the time of the
crash. OpenOffice.org's recovery feature was fairly dependable, but this
reporter is looking forward to using it a little less often.
There are also a number of features that can be found throughout the
OpenOffice.org suite rather than any specific application. The native file
formats have changed to the OASIS Open
Document Format for Office Applications. OpenOffice.org applications
still support the older format, but new files are saved in the new format
by default unless the user changes default file format preferences. Users
have a great deal of flexibility in this area, including the ability to
save in Microsoft Office formats if they prefer.
OpenOffice.org 2.0 also has a document conversion wizard that allows the
user to convert older OpenOffice.org and Microsoft Office documents into
the new OpenOffice.org document formats. Rather than forcing the user to
convert documents one at a time, the wizard allows a user to convert all
documents in a directory at once. This feature isn't quite error-free just
yet.
We were also interested in OpenOffice.org 2.0's digital signatures
feature. Apparently, OpenOffice.org will allow the user to sign or verify
macros and documents in the new format. Unfortunately, this feature didn't
seem to be working in the 1.9.65 build.
From a test of the 1.9.65 build, it's pretty clear that the
OpenOffice.org project has a way to go before it's finished. However, this
release
does provide a pretty good overview of what to expect, and it does look
like 2.0 will be a formidable suite when finished.
For LWN readers who wish to participate in testing, or just see what else
is on the way, a feature
guide to 2.0 is available. According to the roadmap,
the OpenOffice.org project should be releasing a 2.0 beta some time this
month, with a final release tentatively planned for March of this year.
Comments (9 posted)
Much happens in the Linux world over the course of a year. 2004 saw
ongoing legal and political fights, new distributions, big releases of
major applications, a new mode for kernel development, and more. This
timeline is our attempt to separate out the most significant developments
of the year and present them in a concise and enjoyable format. It
continues an annual LWN tradition; it is the seventh in the series.
This is version 0.9 of the 2004 timeline.
If you find any remaining major omissions, please send them
to us at timeline@lwn.net; please do
not post errors or omissions as comments until after we have had a chance
to address them.
The development of the LWN.net Linux Timeline was supported by LWN
subscribers; if you like what you see, please consider subscribing to LWN.
As usual, the timeline is split up by month. We apologize that a "one big
page" version is not available at this time.
The LWN.net Linux timelines from the last six years are still available:
Comments (5 posted)
Page editor: Jonathan Corbet
Security
Numerous electrons have been expended on the recently-released
Honeynet report
(PDF) on the life expectancy of systems exposed to the Internet. That
report concluded that an unpatched Linux system would last, on the average,
for about three months before being compromised, while a Windows system had
a life expectancy measured in hours. That is an outcome which is certainly
welcome to those who are concerned about the security of Linux systems.
If you actually read the report, however, you'll find some interesting
things. The test, it would seem, was set up in a way designed to make the
Linux systems as easy as possible to compromise. Among other things:
- The Linux distributions installed were old: Red Hat Linux 7.2, SUSE
Linux 6.3, etc. The most current distribution installed was Fedora
Core 1, put on two boxes (neither of which was compromised)..
- These systems had a number of services installed; some of those
(i.e. SMB) are not necessarily something one would enable on systems
directly connected to the net.
- The systems were set up with easily guessed passwords as well.
Of the four Linux systems which were compromised, two of them fell to
brute-force password guessing. This episode may be a good lesson in why
choosing good passwords is still important, but it has nothing to do with
Linux security.
The report authors note that the expected lifetime of Linux systems has
increased - an interesting development, given that the net has not exactly
become a friendlier place. The authors guess, as usual, that the relative
popularity of Windows makes it a more attractive target. They also note,
however, that default Linux installations have become more secure over
time. Certainly much effort has gone toward that end; it is nice to see
that it is having an effect.
Comments (6 posted)
New vulnerabilities
debmake: insecure temp directories
| Package(s): | debmake |
CVE #(s): | CAN-2004-1179
|
| Created: | December 23, 2004 |
Updated: | January 5, 2005 |
| Description: |
debmake contains a script that can make insecure temporary directories.
This can be used by a symlink attack to create and overwrite arbitrary files. |
| Alerts: |
|
Comments (none posted)
htmlheadline: insecure temporary files
| Package(s): | htmlheadline |
CVE #(s): | CAN-2004-1181
|
| Created: | January 3, 2005 |
Updated: | January 5, 2005 |
| Description: |
Javier Fernández-Sanguino Peña has discovered multiple insecure uses
of temporary files that could lead to overwriting arbitrary files via
a symlink attack. |
| Alerts: |
|
Comments (none posted)
kdelibs: unwanted email origination
| Package(s): | kdelibs |
CVE #(s): | |
| Created: | January 5, 2005 |
Updated: | January 5, 2005 |
| Description: |
The Konqueror browser (via kdelibs) contains a vulnerability which can cause it to send email without the user's interaction or consent. See this bug report for details. |
| Alerts: |
|
Comments (none posted)
kernel: 32bit emulation privilege escalation
| Package(s): | kernel |
CVE #(s): | CAN-2004-1144
|
| Created: | December 23, 2004 |
Updated: | January 5, 2005 |
| Description: |
The 2.4 Linux Kernel on the AMD64 platform has a
missing argument checking vulnerability that can allow
a local attacker to gain root privileges. |
| Alerts: |
|
Comments (none posted)
LinPopUp: buffer overflow in message reply
| Package(s): | linpopup |
CVE #(s): | CAN-2004-1282
|
| Created: | January 4, 2005 |
Updated: | January 10, 2005 |
| Description: |
Stephen Dranger discovered that LinPopUp contains a buffer overflow in
string.c, triggered when replying to a remote user message. A remote
attacker could craft a malicious message that, when replied to using
LinPopUp, would exploit the buffer overflow. This would result in the
execution of arbitrary code with the privileges of the user running
LinPopUp. |
| Alerts: |
|
Comments (none posted)
netkit-telnet-ssl: format string vulnerability
| Package(s): | netkit-telnet-ssl |
CVE #(s): | CAN-2004-0998
|
| Created: | December 23, 2004 |
Updated: | January 5, 2005 |
| Description: |
telnetd-ssl has a format string vulnerability that may be
exploitable for executing arbitrary code. |
| Alerts: |
|
Comments (none posted)
pcal: buffer overflows
| Package(s): | pcal |
CVE #(s): | CAN-2004-1289
|
| Created: | January 5, 2005 |
Updated: | January 5, 2005 |
| Description: |
Two buffer overflows have been found in the pcal utility; they could be exploited by a hostile calendar file to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
PHProjekt: PHP code execution
| Package(s): | phprojekt |
CVE #(s): | |
| Created: | January 5, 2005 |
Updated: | January 5, 2005 |
| Description: |
PHProject, prior to version 4.2-r2, has a vulnerability wherein a remote attacker can define a global variable and execute arbitrary PHP code. |
| Alerts: |
|
Comments (none posted)
shoutcast server: buffer overflow
| Package(s): | shoutcast-server |
CVE #(s): | |
| Created: | January 5, 2005 |
Updated: | January 5, 2005 |
| Description: |
The shoutcast server contains a remotely exploitable buffer overflow vulnerability; upgrading to version 1.9.5 fixes the problem. |
| Alerts: |
|
Comments (none posted)
tetex: insecure temp files
| Package(s): | tetex |
CVE #(s): | |
| Created: | December 23, 2004 |
Updated: | January 5, 2005 |
| Description: |
The xdvizilla script can create insecure temporary files and directories,
allowing a symbolic link attack that can overwrite arbitrary files. |
| Alerts: |
|
Comments (none posted)
xpdf: buffer overflow
| Package(s): | xpdf |
CVE #(s): | CAN-2004-1125
|
| Created: | December 23, 2004 |
Updated: | April 1, 2005 |
| Description: |
xpdf has a
potential buffer overflow problem caused by insufficient input validation.
A specially crafted PDF file can allow an
attacker to execute code with privileges of the xpdf user. |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
a2ps: input validation error
| Package(s): | a2ps |
CVE #(s): | CAN-2004-1170
CAN-2004-1377
|
| Created: | November 26, 2004 |
Updated: | December 19, 2005 |
| Description: |
The GNU a2ps utility fails to properly sanitize filenames, which can be
abused by a malicious user to execute arbitrary commands with the
privileges of the user running the vulnerable application. More
information at Security
Focus. |
| Alerts: |
|
Comments (none posted)
cdrecord: failure to drop privilege
| Package(s): | cdrecord |
CVE #(s): | CAN-2004-0806
|
| Created: | September 8, 2004 |
Updated: | February 21, 2005 |
| Description: |
The cdrecord utility, which is installed setuid on some distributions, fails to drop privilege before running a user-specified program. |
| Alerts: |
|
Comments (none posted)
cups: multiple vulnerabilities
| Package(s): | cups |
CVE #(s): | CAN-2004-1267
CAN-2004-1268
CAN-2004-1269
CAN-2004-1270
|
| Created: | December 17, 2004 |
Updated: | February 9, 2005 |
| Description: |
cups has a denial of service vulnerability in the lppasswd utility
and a remote code execution vulnerability in the hpgltops filter. |
| Alerts: |
|
Comments (none posted)
cyrus-sasl: remote buffer overflow
| Package(s): | cyrus-sasl |
CVE #(s): | CAN-2004-0884
|
| Created: | October 7, 2004 |
Updated: | March 16, 2005 |
| Description: |
cyrus-sasl has a vulnerability involving a buffer overflow
in the digestmda5.c file. A remote attacker may be able
to compromise the system. Also, a local user may be able to
exploit a vulnerability by using the SASL_PATH environment
variable. |
| Alerts: |
|
Comments (none posted)
dhcp: format string vulnerability
| Package(s): | dhcp |
CVE #(s): | CAN-2004-1006
|
| Created: | November 4, 2004 |
Updated: | July 13, 2005 |
| Description: |
Dhcp has a format string vulnerability in the log functions of dhcp 2.x
that may be exploited via a malicious DNS server. |
| Alerts: |
|
Comments (none posted)
ethereal: multiple vulnerabilities
| Package(s): | ethereal |
CVE #(s): | CAN-2004-1139
CAN-2004-1140
CAN-2004-1141
CAN-2004-1142
|
| Created: | December 20, 2004 |
Updated: | January 13, 2005 |
| Description: |
There are multiple vulnerabilities in versions of Ethereal earlier than
0.10.8, including:
- Bug in DICOM dissection discovered by Bing could make Ethereal crash
(CAN-2004-1139).
- An invalid RTP timestamp could make Ethereal hang and create a large
temporary file (CAN-2004-1140).
- The HTTP dissector could access previously-freed memory
(CAN-2004-1141).
- Brian Caswell discovered that an improperly formatted SMB could
make Ethereal hang (CAN-2004-1142).
|
| Alerts: |
|
Comments (none posted)
Filename disclosure vulnerability in fam
| Package(s): | fam |
CVE #(s): | CAN-2002-0875
|
| Created: | August 19, 2002 |
Updated: | January 5, 2005 |
| Description: |
"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible. |
| Alerts: |
|
Comments (none posted)
Foomatic: Arbitrary command execution in foomatic-rip
| Package(s): | foomatic |
CVE #(s): | CAN-2004-0801
|
| Created: | September 20, 2004 |
Updated: | May 31, 2006 |
| Description: |
There is a vulnerability in the foomatic-filters package. This
vulnerability is due to insufficient checking of command-line parameters
and environment variables in the foomatic-rip filter. This vulnerability
may allow both local and remote attackers to execute arbitrary commands on
the print server with the permissions of the spooler. |
| Alerts: |
|
Comments (none posted)
FreeRADIUS: denial of service
| Package(s): | freeradius |
CVE #(s): | CAN-2004-0938
CAN-2004-0960
CAN-2004-0961
|
| Created: | September 22, 2004 |
Updated: | February 2, 2005 |
| Description: |
FreeRADIUS (through version 1.0.1) suffers from several denial of service vulnerabilities in its packet reception code. |
| Alerts: |
|
Comments (none posted)
gaim: buffer overflow in MSN protocol
| Package(s): | gaim |
CVE #(s): | CAN-2004-0891
|
| Created: | October 25, 2004 |
Updated: | February 11, 2005 |
| Description: |
A buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows
remote attackers to cause a denial of service (application crash) and
possibly execute arbitrary code via an "unexpected sequence of MSNSLP
messages" that results in an unbounded copy operation that writes to the
wrong buffer. |
| Alerts: |
|
Comments (none posted)
Gallery: cross-site scripting vulnerability
| Package(s): | Gallery |
CVE #(s): | CAN-2004-1106
|
| Created: | November 8, 2004 |
Updated: | January 17, 2005 |
| Description: |
Jim Paris has discovered a cross-site scripting vulnerability in
Gallery. By sending a carefully crafted URL, an attacker can inject and
execute script code in the victim's browser window, and potentially
compromise the users gallery. |
| Alerts: |
|
Comments (none posted)
gtk2, gdk-pixbuf: buffer overflows
| Package(s): | gdk-pixbuf gtk2 |
CVE #(s): | CAN-2004-0753
CAN-2004-0782
CAN-2004-0783
CAN-2004-0788
|
| Created: | September 15, 2004 |
Updated: | February 25, 2005 |
| Description: |
The gdk-pixbuf and gtk2 libraries contain vulnerabilities in their handling of BMP and XPM files which can lead to denial of service and, potentially, code execution attacks. |
| Alerts: |
|
Comments (none posted)
gettext: Insecure temporary file handling
| Package(s): | gettext |
CVE #(s): | CAN-2004-0966
|
| Created: | October 11, 2004 |
Updated: | March 1, 2006 |
| Description: |
gettext insecurely creates temporary files in world-writeable directories
with predictable names. A local attacker could create symbolic links in
the temporary files directory, pointing to a valid file somewhere on the
filesystem. When gettext is called, this would result in file access with
the rights of the user running the utility, which could be the root user. |
| Alerts: |
|
Comments (1 posted)
ghostscript: symlink vulnerabilities
| Package(s): | ghostscript |
CVE #(s): | CAN-2004-0967
|
| Created: | October 20, 2004 |
Updated: | September 28, 2005 |
| Description: |
The ghostscript package (prior to version 7.07.1-r7) contains several scripts which are vulnerable to symlink attacks. |
| Alerts: |
|
Comments (none posted)
glibc: Information leak with LD_DEBUG
| Package(s): | glibc |
CVE #(s): | CAN-2004-1453
|
| Created: | August 17, 2004 |
Updated: | May 26, 2005 |
| Description: |
Silvio Cesare discovered a potential information leak in glibc. It allows
LD_DEBUG on SUID binaries where it should not be allowed. This has various
security implications, which may be used to gain confidential information.
An attacker can gain the list of symbols a SUID application uses and their
locations and can then use a trojaned library taking precedence over those
symbols to gain information or perform further exploitation. |
| Alerts: |
|
Comments (1 posted)
glibc: tempfile vulnerability in catchsegv script
| Package(s): | glibc |
CVE #(s): | CAN-2004-0968
|
| Created: | October 21, 2004 |
Updated: | November 14, 2005 |
| Description: |
The catchsegv script in the glibc package has a symlink vulnerability
that may allow a local user to overwrite arbitrary
files with the permissions of the user that is running the script. |
| Alerts: |
|
Comments (none posted)
gnome-vfs: backend script vulnerabilities
| Package(s): | gnome-vfs |
CVE #(s): | CAN-2004-0494
|
| Created: | August 4, 2004 |
Updated: | February 21, 2005 |
| Description: |
Several scripts packaged with gnome-vfs, using its "extfs" capability, have security flaws. These scripts tend not to be used on many systems, but their presence can still be a threat. |
| Alerts: |
|
Comments (none posted)
groff: insecure temp file
| Package(s): | groff |
CVE #(s): | CAN-2004-1296
|
| Created: | December 20, 2004 |
Updated: | January 17, 2005 |
| Description: |
Javier Fernández-Sanguino Peña discovered that the auxiliary scripts
"eqn2graph" and "pic2graph" created temporary files in an insecure
way, which allowed exploitation of a race condition to create or
overwrite files with the privileges of the user invoking the program. |
| Alerts: |
|
Comments (1 posted)
groff: insecure temporary directory
| Package(s): | groff |
CVE #(s): | CAN-2004-0969
|
| Created: | November 1, 2004 |
Updated: | February 9, 2006 |
| Description: |
Recently, Trustix Secure Linux discovered a vulnerability in the groff
package. The utility "groffer" created a temporary directory in an
insecure way, which allowed exploitation of a race condition to create
or overwrite files with the privileges of the user invoking the
program. |
| Alerts: |
|
Comments (none posted)
gtkhtml: malformed messages cause crash
| Package(s): | gtkhtml |
CVE #(s): | CAN-2003-0133
CAN-2003-0541
|
| Created: | April 14, 2003 |
Updated: | April 18, 2005 |
| Description: |
GtkHTML is the HTML rendering widget used by the Evolution mail reader.
GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug
when handling HTML messages. Alan Cox discovered that certain malformed
messages could cause the Evolution mail component to crash. |
| Alerts: |
|
Comments (none posted)
imlib: buffer overflows in image decoding
| Package(s): | imlib |
CVE #(s): | CAN-2004-1026
|
| Created: | December 6, 2004 |
Updated: | January 13, 2005 |
| Description: |
Pavel Kankovsky discovered that several overflows found in the libXpm
library also applied to imlib. He also fixed a number of other potential
flaws. A remote attacker could entice a user to view a carefully-crafted
image file, which would potentially lead to execution of arbitrary code
with the rights of the user viewing the image. This affects any program
that makes use of the imlib library. |
| Alerts: |
|
Comments (none posted)
imlib2: buffer overflows
| Package(s): | imlib2 |
CVE #(s): | CAN-2004-0802
CAN-2004-0817
|
| Created: | September 8, 2004 |
Updated: | October 26, 2005 |
| Description: |
The imlib2 library contains buffer overflows in the BMP handling code. |
| Alerts: |
|
Comments (none posted)
iptables: missing initialization
| Package(s): | iptables |
CVE #(s): | CAN-2004-0986
|
| Created: | November 1, 2004 |
Updated: | February 11, 2005 |
| Description: |
Faheem Mitha noticed that the iptables command, an administration tool for
IPv4 packet filtering and NAT, did not always load the required modules on
its own as it was supposed to. This could lead to firewall rules not being
loaded on system startup. This caused a failure in connection with rules
provided by lokkit at least. |
| Alerts: |
|
Comments (none posted)
kerberos5: execution of arbitrary code by authenticated user
| Package(s): | kerberos5 |
CVE #(s): | CAN-2004-1189
|
| Created: | December 21, 2004 |
Updated: | February 15, 2005 |
| Description: |
There is a buffer overflow in the password history handling code of
libkadm5srv which could be exploited by an authenticated user to execute
arbitrary code on a Key Distribution Center (KDC) server. |
| Alerts: |
|
Comments (none posted)
kernel: IGMP and scm_send vulnerabilities
| Package(s): | kernel |
CVE #(s): | CAN-2004-1016
CAN-2004-1137
|
| Created: | December 14, 2004 |
Updated: | January 4, 2005 |
| Description: |
Paul Starzetz has discovered a new pair of kernel vulnerabilities. The IGMP code suffers from input validation and integer overflow vulnerabilities which could be remotely exploitable, and the socket function __scm_send() has a local denial of service vulnerability. |
| Alerts: |
|
Comments (none posted)
kernel-utils: setuid vulnerability
| Package(s): | kernel-utils |
CVE #(s): | CAN-2003-0019
|
| Created: | February 7, 2003 |
Updated: | January 21, 2005 |
| Description: |
The kernel-utils package contains several utilities that can be used to
control the kernel or machine hardware. In Red Hat Linux 8.0 this package
contains user mode linux (UML) utilities.
The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was
incorrectly shipped setuid root. This could allow local users to control
certain network interfaces, add and remove arp entries and routes, and put
interfaces in and out of promiscuous mode.
All users of the kernel-utils package should update to these packages that
contain a version of uml_net that is not setuid root.
Alternatively, as a work-around to this vulnerability issue the following
command as root:
chmod -s /usr/bin/uml_net |
| Alerts: |
|
Comments (none posted)
libgd2: buffer overflows in PNG handling
| Package(s): | libgd2 |
CVE #(s): | CAN-2004-0990
CAN-2004-0941
|
| Created: | October 29, 2004 |
Updated: | June 28, 2006 |
| Description: |
Several buffer overflows have been discovered in libgd's PNG handling
functions.
If an attacker tricked a user into loading a malicious PNG image, they
could leverage this into executing arbitrary code in the context of
the user opening image. Most importantly, this library is commonly
used in PHP. One possible target would be a PHP driven photo website
that lets users upload images. Therefore this vulnerability might lead
to privilege escalation to a web server's privileges.
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and
earlier may allow remote attackers to execute arbitrary code via malformed
image files that trigger the overflows due to improper calls to the
gdMalloc function. |
| Alerts: |
|
Comments (none posted)
libpng: multiple vulnerabilities
Comments (1 posted)
libtiff: buffer overflow
| Package(s): | libtiff |
CVE #(s): | CAN-2004-1308
|
| Created: | December 22, 2004 |
Updated: | May 19, 2005 |
| Description: |
The libtiff image manipulation library contains several exploitable buffer overflows. |
| Alerts: |
|
Comments (none posted)
libxml2 - arbitrary code execution
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0110
|
| Created: | February 26, 2004 |
Updated: | August 19, 2009 |
| Description: |
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml2 uses special
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that
parses remote resources and allows them to influence the URL, then this
flaw could be used to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
libxml2: multiple buffer overflows
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0989
|
| Created: | October 28, 2004 |
Updated: | August 19, 2009 |
| Description: |
libxml2 prior to version 2.6.14 has multiple buffer overflow
vulnerabilities, if a local user passes a specially crafted
FTP URL, arbitrary code may be executed. |
| Alerts: |
|
Comments (none posted)
libxpm4: stack and integer overflows
| Package(s): | libxpm4 |
CVE #(s): | CAN-2004-0687
CAN-2004-0688
|
| Created: | September 16, 2004 |
Updated: | February 14, 2005 |
| Description: |
There are several stack and integer overflow bugs in
the libXpm code of XFree86 that may be used for a denial of service. |
| Alerts: |
|
Comments (none posted)
lvm10: creates insecure temporary directory
| Package(s): | lvm10 |
CVE #(s): | CAN-2004-0972
|
| Created: | November 1, 2004 |
Updated: | July 25, 2005 |
| Description: |
Trustix Secure Linux discovered a vulnerability in a supplemental script of
the lvm10 package. The program "lvmcreate_initrd" created a temporary
directory in an insecure way, which could allow a symlink attack to create
or overwrite arbitrary files with the privileges of the user invoking the
program. |
| Alerts: |
|
Comments (none posted)
Midnight Commander: extfs vfs vulnerability
| Package(s): | mc |
CVE #(s): | CAN-2004-0494
|
| Created: | September 2, 2004 |
Updated: | January 5, 2005 |
| Description: |
Midnight Commander has a vfs vulnerability with shell quoting
in extfs perl scripts. |
| Alerts: |
|
Comments (none posted)
mikmod: buffer overflow
| Package(s): | mikmod |
CVE #(s): | CAN-2003-0427
|
| Created: | June 16, 2003 |
Updated: | June 16, 2005 |
| Description: |
Ingo Saitz discovered a bug in mikmod whereby a long filename inside
an archive file can overflow a buffer when the archive is being read
by mikmod. |
| Alerts: |
|
Comments (none posted)
mozilla products: arbitrary code execution and other vulnerabilities
| Package(s): | mozilla firefox thunderbird |
CVE #(s): | CAN-2004-0902
CAN-2004-0903
CAN-2004-0904
CAN-2004-0905
CAN-2004-0908
|
| Created: | September 20, 2004 |
Updated: | January 13, 2005 |
| Description: |
Several vulnerabilities exist in the Mozilla web browser and derived
products, the most serious of which could allow a remote attacker to
execute arbitrary code on an affected system. See the CERT advisory for details. |
| Alerts: |
|
Comments (none posted)
mpg123: buffer overflow bug
| Package(s): | mpg123 |
CVE #(s): | CAN-2004-0805
|
| Created: | September 16, 2004 |
Updated: | January 11, 2005 |
| Description: |
The mpg123 audio playing utility has a buffer overflow
bug that may allow arbitrary execution of code. |
| Alerts: |
|
Comments (none posted)
mpg321: format string vulnerability
| Package(s): | mpg321 |
CVE #(s): | CAN-2003-0969
|
| Created: | January 6, 2004 |
Updated: | March 28, 2005 |
| Description: |
A vulnerability was discovered in mpg321, a command-line mp3 player,
whereby user-supplied strings were passed to printf(3) unsafely. This
vulnerability could be exploited by a remote attacker to overwrite
memory, and possibly execute arbitrary code. In order for this
vulnerability to be exploited, mpg321 would need to play a malicious
mp3 file (including via HTTP streaming). |
| Alerts: |
|
Comments (none posted)
MPlayer: multiple overflows
Comments (none posted)
mysql: several vulnerabilities
| Package(s): | mysql |
CVE #(s): | CAN-2004-0835
CAN-2004-0836
CAN-2004-0837
|
| Created: | October 11, 2004 |
Updated: | April 6, 2005 |
| Description: |
Several problems have been discovered in MySQL. Oleksandr Byelkin noticed
that ALTER TABLE ... RENAME checks CREATE/INSERT rights of the old table
instead of the new one. (CAN-2004-0835) Lukasz Wojtow noticed a buffer
overrun in the mysql_real_connect function. (CAN-2004-0836) Dean Ellis
noticed that multiple threads ALTERing the same (or different) MERGE tables
to change the UNION can cause the server to crash or stall. (CAN-2004-0837) |
| Alerts: |
|
Comments (none posted)
nasm: Buffer overflow vulnerability
| Package(s): | nasm |
CVE #(s): | CAN-2004-1287
|
| Created: | December 20, 2004 |
Updated: | May 4, 2005 |
| Description: |
Jonathan Rockway discovered that NASM-0.98.38 has an unprotected
vsprintf() to an array in preproc.c. This code vulnerability may lead
to a buffer overflow and potential execution of arbitrary code. |
| Alerts: |
|
Comments (4 posted)
netkit-telnet: invalid free pointer
| Package(s): | netkit-telnet |
CVE #(s): | CAN-2004-0911
|
| Created: | October 4, 2004 |
Updated: | March 28, 2005 |
| Description: |
Michal Zalewski discovered a bug in the netkit-telnet server (telnetd)
whereby a remote attacker could cause the telnetd process to free an
invalid pointer. This causes the telnet server process to crash, leading
to a straightforward denial of service (inetd will disable the service if
telnetd is crashed repeatedly), or possibly the execution of arbitrary code
with the privileges of the telnetd process (by default, the 'telnetd'
user). |
| Alerts: |
|
Comments (none posted)
netpbm: insecure temporary files
| Package(s): | netpbm |
CVE #(s): | CAN-2003-0924
|
| Created: | January 19, 2004 |
Updated: | December 29, 2004 |
| Description: |
netpbm is graphics conversion toolkit made up of a large number of
single-purpose programs. Many of these programs were found to create
temporary files in an insecure manner, which could allow a local
attacker to overwrite files with the privileges of the user invoking a
vulnerable netpbm tool. |
| Alerts: |
|
Comments (1 posted)
nfs-utils: denial of service
| Package(s): | nfs-utils |
CVE #(s): | CAN-2004-1014
|
| Created: | December 1, 2004 |
Updated: | May 15, 2005 |
| Description: |
The NFS statd server contains a denial of service vulnerability which is easily exploited by a remote attacker. |
| Alerts: |
|
Comments (none posted)
openssl: der_chop script temp file vulnerability
| Package(s): | openssl |
CVE #(s): | CAN-2004-0975
|
| Created: | November 11, 2004 |
Updated: | July 19, 2005 |
| Description: |
The der_chop script in openssl has a temp file vulnerability that may allow
an attacker to overwrite arbitrary files with the permissions that
the script is running under. |
| Alerts: |
|
Comments (1 posted)
OpenSSL: denial of service vulnerabilities
Comments (1 posted)
perl information leak
| Package(s): | perl |
CVE #(s): | CAN-2004-0452
|
| Created: | December 21, 2004 |
Updated: | January 11, 2005 |
| Description: |
A race condition and possible information leak has been discovered in
Perl's File::Path::rmtree(). This function changes the permission of files
and directories before removing them to avoid problems with wrong
permissions. However, they were made readable and writable not only for the
owner, but for the entire world, which opened a race condition and a
possible information leak (if the actual removal of a file/directory failed
for some reason). |
| Alerts: |
|
Comments (none posted)
php: remotely exploitable memory errors
| Package(s): | php |
CVE #(s): | CAN-2004-0594
|
| Created: | July 14, 2004 |
Updated: | February 7, 2005 |
| Description: |
Stefan Esser has issued an advisory regarding a
remotely exploitable hole in PHP (through version 4.3.7). If the
memory_limit feature is in use (as it should be, to prevent denial
of service attacks), allocation failures can be forced at highly
inopportune times, and those failures can be exploited to execute arbitrary
code. The exploit is described as "quite easy," and it can be done
regardless of whether Apache1 or Apache2 is in use. Upgrading to PHP 4.3.8 fixes the
problem; yesterday's PHP 5.0 release also contains the fix (but the
final release candidate did not). |
| Alerts: |
|
Comments (none posted)
php: multiple vulnerabilities
Comments (1 posted)
ProZilla: Multiple vulnerabilities
| Package(s): | ProZilla |
CVE #(s): | CAN-2004-1120
|
| Created: | November 23, 2004 |
Updated: | February 1, 2005 |
| Description: |
ProZilla contains several exploitable buffer overflows in the code handling
the network protocols. A remote attacker could setup a malicious server
and entice a user to retrieve files from that server using ProZilla. This
could lead to the execution of arbitrary code with the rights of the user
running ProZilla. |
| Alerts: |
|
Comments (none posted)
qt3: BMP image parser heap overflow
| Package(s): | qt3/qt3-non-mt/qt3-32bit/qt3-static |
CVE #(s): | CAN-2004-0691
CAN-2004-0692
CAN-2004-0693
|
| Created: | August 19, 2004 |
Updated: | May 15, 2005 |
| Description: |
A heap overflow in the qt3 BMP image format parser in Qt versions prior to 3.3.3 may allow remote code execution. |
| Alerts: |
|
Comments (none posted)
rp-pppoe, pppoe: missing privilege dropping
| Package(s): | rp-pppoe, pppoe |
CVE #(s): | CAN-2004-0564
|
| Created: | October 4, 2004 |
Updated: | November 15, 2005 |
| Description: |
Max Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet
driver from Roaring Penguin. When the program is running setuid root
(which is not the case in a default Debian installation), an attacker
could overwrite any file on the file system. |
| Alerts: |
|
Comments (none posted)
ruby: infinite loop
| Package(s): | ruby |
CVE #(s): | CAN-2004-0983
|
| Created: | November 8, 2004 |
Updated: | May 15, 2005 |
| Description: |
The upstream developers of Ruby have corrected a problem in the CGI
module for this language. Specially crafted requests could cause an
infinite loop and thus cause the program to eat up cpu cycles. |
| Alerts: |
|
Comments (none posted)
samba: integer overflow vulnerability
| Package(s): | samba |
CVE #(s): | CAN-2004-1154
|
| Created: | December 16, 2004 |
Updated: | July 19, 2005 |
| Description: |
Samba has an integer overflow vulnerability
that may allow an authenticated remote user to
execute arbitrary code on the Samba server. |
| Alerts: |
|
Comments (none posted)
sharutils: arbitrary code execution
| Package(s): | sharutils |
CVE #(s): | CAN-2004-1772
|
| Created: | October 1, 2004 |
Updated: | April 26, 2005 |
| Description: |
sharutils contains two buffer overflows. Ulf Harnhammar discovered a buffer
overflow in shar.c, where the length of data returned by the wc command is
not checked. Florian Schilhabel discovered another buffer overflow in
unshar.c. An attacker could exploit these vulnerabilities to execute
arbitrary code as the user running one of the sharutils programs. |
| Alerts: |
|
Comments (none posted)
sox: buffer overflow
| Package(s): | sox |
CVE #(s): | CAN-2004-0557
|
| Created: | July 28, 2004 |
Updated: | February 21, 2005 |
| Description: |
Sox suffers from buffer overflows in its WAV file handling; these overflows could conceivably be exploited by way of a malicious sound file. |
| Alerts: |
|
Comments (none posted)
SpamAssassin: Denial of Service vulnerability
| Package(s): | spamassassin |
CVE #(s): | CAN-2004-0796
|
| Created: | August 9, 2004 |
Updated: | August 11, 2005 |
| Description: |
SpamAssassin contains an unspecified Denial of Service vulnerability. By
sending a specially crafted message an attacker could cause a Denial of
Service attack against the SpamAssassin service. |
| Alerts: |
|
Comments (none posted)
Subversion: Remote heap overflow
| Package(s): | subversion |
CVE #(s): | CAN-2004-0413
|
| Created: | June 11, 2004 |
Updated: | March 7, 2005 |
| Description: |
Subversion has a remote Denial of Service vulnerability
that may allow a server that runs svnserve to execute
arbitrary code. See this advisory for more information. |
| Alerts: |
|
Comments (none posted)
sudo: environment variable sanitizing
| Package(s): | sudo |
CVE #(s): | CAN-2004-1051
|
| Created: | November 17, 2004 |
Updated: | May 15, 2005 |
| Description: |
Versions of sudo prior to 1.6.8p2 fail to properly sanitize the environment prior to running shell scripts; this failure can be exploited by a sudo user to subvert scripts and obtain shell access. See the 1.6.8p2 announcement for more information. |
| Alerts: |
|
Comments (none posted)
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip |
CVE #(s): | CAN-2001-1267
CAN-2001-1268
CAN-2001-1269
CAN-2002-0399
|
| Created: | October 1, 2002 |
Updated: | April 10, 2006 |
| Description: |
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability. |
| Alerts: |
|
Comments (1 posted)
tiff: buffer overflows
| Package(s): | tiff |
CVE #(s): | CAN-2004-0803
|
| Created: | October 13, 2004 |
Updated: | April 12, 2005 |
| Description: |
The tiff library contains several buffer overflows which may be exploited
by way of maliciously-crafted image files. See this advisory for more information. |
| Alerts: |
|
Comments (none posted)
unarj: buffer overflow vulnerability
| Package(s): | unarj |
CVE #(s): | CAN-2004-0947
|
| Created: | November 11, 2004 |
Updated: | February 2, 2005 |
| Description: |
The unarj uncompression utility has a buffer overflow vulnerability
from handling long file names in an archive. An attacker can
cause unarj to crash or execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
vim: modeline problems
| Package(s): | vim |
CVE #(s): | CAN-2004-1138
|
| Created: | December 15, 2004 |
Updated: | February 24, 2005 |
| Description: |
A new set of modeline-related vulnerabilities has been discovered in versions of vim prior to 6.3-r2. These vulnerabilities could conceivably be exploited by a local user to obtain the privileges of another user. |
| Alerts: |
|
Comments (none posted)
wv: buffer overflow
| Package(s): | wv |
CVE #(s): | CAN-2004-0645
|
| Created: | July 14, 2004 |
Updated: | February 10, 2005 |
| Description: |
wv, a viewer for MS Word files, contains a buffer overflow which may be exploited by a suitably-crafted file. Version 1.0.0-r1 fixes the problem. |
| Alerts: |
|
Comments (none posted)
XChat 2.0.x SOCKS5 Vulnerability
| Package(s): | xchat |
CVE #(s): | CAN-2004-0409
|
| Created: | April 19, 2004 |
Updated: | November 15, 2005 |
| Description: |
XChat is vulnerable to a stack overflow that may allow a remote attacker to
run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a
remote exploit. Users would have to be using XChat through a SOCKS 5
server, enable SOCKS 5 traversal which is disabled by default and also
connect to an attacker's custom proxy server. This vulnerability may allow
an attacker to run arbitrary code within the context of the user ID of the
XChat client. |
| Alerts: |
|
Comments (none posted)
xine-lib: arbitrary code execution
| Package(s): | xine-lib |
CVE #(s): | CAN-2004-1187
CAN-2004-1188
CAN-2004-1300
|
| Created: | December 21, 2004 |
Updated: | January 25, 2005 |
| Description: |
Several buffer overflows have been discovered in xine-lib, the video/audio
codec library for Xine frontends (xine-ui, totem-xine, kaffeine, and
others). If an attacker tricked a user into loading a malicious RTSP stream
or a stream with specially crafted AIFF audio or PNM image data, they could
exploit this to execute arbitrary code with the privileges of the user
opening the audio/video file. See this advisory
for more information. |
| Alerts: |
|
Comments (none posted)
xine-lib: buffer overflows
| Package(s): | xine-lib |
CVE #(s): | CAN-2004-1379
|
| Created: | September 22, 2004 |
Updated: | April 10, 2006 |
| Description: |
xine-lib (through version 1_rc6) contains buffer overflows in the subtitle parsing and DVD sub-picture decoder code. |
| Alerts: |
|
Comments (none posted)
xine-ui - insecure temporary file creation
| Package(s): | xine-ui |
CVE #(s): | CAN-2004-0372
|
| Created: | April 6, 2004 |
Updated: | April 27, 2006 |
| Description: |
Shaun Colley discovered a problem in xine-ui, the xine video player
user interface. A script contained in the package to possibly remedy
a problem or report a bug does not create temporary files in a secure
fashion. This could allow a local attacker to overwrite files with
the privileges of the user invoking xine. |
| Alerts: |
|
Comments (none posted)
xorg-x11: integer overflows
| Package(s): | xorg-x11 |
CVE #(s): | CAN-2004-0914
|
| Created: | November 18, 2004 |
Updated: | September 12, 2005 |
| Description: |
The X.Org libXpm library has several integer overflow vulnerabilities
An attacker can modify XPM images to execute malicious code. |
| Alerts: |
|
Comments (none posted)
xpdf: integer overflows
| Package(s): | xpdf kpdf cupsys |
CVE #(s): | CAN-2004-0888
CAN-2004-0889
|
| Created: | October 21, 2004 |
Updated: | February 18, 2005 |
| Description: |
Several xpdf integer overflow vulnerabilities can be exploited via a
mal-formed PDF document. Similar vulnerabilities can be found in kpdf and
in cupsys which share code. Additional information can be found in this KDE security advisory. |
| Alerts: |
|
Comments (none posted)
xzgv integer overflows
| Package(s): | xzgv |
CVE #(s): | CAN-2004-0994
|
| Created: | December 21, 2004 |
Updated: | January 12, 2005 |
| Description: |
Luke "infamous41md" discovered multiple vulnerabilities in xzgv, a picture
viewer for X11 with a thumbnail-based selector. Remote exploitation of an
integer overflow vulnerability could allow the execution of arbitrary
code. |
| Alerts: |
|
Comments (none posted)
zip: arbitrary code execution
| Package(s): | zip |
CVE #(s): | CAN-2004-1010
|
| Created: | November 5, 2004 |
Updated: | February 2, 2005 |
| Description: |
HexView discovered a buffer overflow in the zip package. The overflow is
triggered by creating a ZIP archive of files with very long path
names. This vulnerability might result in execution of arbitrary code with
the privileges of the user who calls zip. This flaw may lead to privilege
escalation on systems which automatically create ZIP archives of user
supplied files, like backup systems or web applications. |
| Alerts: |
|
Comments (1 posted)
zlib: denial of service
| Package(s): | zlib |
CVE #(s): | CAN-2004-0797
|
| Created: | August 25, 2004 |
Updated: | June 10, 2005 |
| Description: |
Versions 1.2.x of the zlib library contain an error handling vulnerability which can enable denial of service attacks. |
| Alerts: |
|
Comments (none posted)
Resources
David A. Wheeler's latest article in the "Secure Programmer" series
looks
at how to call components from an application in a secure way, on IBM
developerWorks. "
Application programs typically make calls to other
components, such as the underlying operating system, database systems,
reusable libraries, Internet services (like DNS), Web services, and so
on. This article explains how to prevent attackers from exploiting those
calls to other components by discussing the use of only secure components,
passing only valid data, making sure the data will be correctly
interpreted, checking return values and exceptions, and protecting data as
it flows between applications and components."
Comments (4 posted)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current 2.6 kernel is 2.6.10, which was
released by Linus on
December 24. There are CIFS and DVB updates
since -rc3, along with the usual pile of fixes. For those of you just
tuning in, 2.6.10 as a whole includes a new kernel events notification
mechanism, switchable I/O schedulers (and a new CFQ scheduler as well),
in-kernel cryptographic key management, DVD+RW and CDRW packet writing
support, ext3 block reservation and online resizing support, big updates
for many kernel subsystems, and a handful of security fixes. The
long-format
changelog (1.5MB) has all the details.
Linus's BitKeeper repository, as of this writing, contains the four-level
page table patch (see below), a VIA PadLock crypto engine driver, a
new SKB allocation function (see below), ACPI hotplug support, the full
InfiniBand patch set (covered here last
November), a big direct rendering manager (DRM) rework, a new and
simplified file readahead mechanism, a set of user-mode Linux patches, a
big set of input patches, a new set of "sparse" annotations, an NFS update,
an iptables update, support for the Fujitsu FR-V architecture, in-inode
extended attribute support for ext3, some SELinux scalability improvements,
and lots of fixes.
The current prepatch from Andrew Morton is 2.6.10-mm1. Recent additions to -mm include
some software suspend improvements, a PCMCIA update, a number of
NUMA-related cleanups, and a reiser4 update.
The current 2.4 prepatch remains 2.4.29-pre3, dating back to
December 22.
Comments (1 posted)
Kernel development news
After 2.6.9-ac its clear that the long 2.6.9 process worked very
badly. While 2.6.10 is looking much better its long period meant
the allegedly "official" base kernel was a complete pile of
insecure donkey turd for months. That doesn't hurt most vendor
users but it does hurt those trying to do stuff on the base kernels
very badly.
-- Alan Cox
Not all 2.6.x kernels will be good; but if we do releases every 1
or 2 weeks, some of them *will* be good. The problem with the -rc
releases is that we try to predict in advance which releases in
advance will be stable, and we don't seem to be able to do a good
job of that. If we do a release every week, my guess is that at
least 1 in 3 releases will turn out to be stable enough for most
purposes. But we won't know until after 2 or 3 days which releases
will be the good ones.
-- Ted Ts'o
Comments (3 posted)
As expected, one of the first things to be merged into Linus's BitKeeper
repository after the 2.6.10 release was the four-level page table patch.
Two weeks ago, we
noted that
Nick Piggin had posted an alternative patch which changed the organization
initially created by Andi Kleen. It was not clear, then, which version of
the patch would go in. In the end, Nick's changes to the four-level patch
were accepted.
Thus, in 2.6.11, the page table structure will include a new level, called
"PUD," placed immediately below the top-level PGD directory. The new page
table structure looks like this:
The PGD remains the top-level directory, accessed via the
mm_struct structure associated with each process. The PUD only
exists on architectures which are using four-level tables; that is only
x86-64, as of this writing, but other 64-bit architectures will probably
use the fourth level in the future as well. The PMD and PTE function as
they did in previous kernels; the PMD is absent if the architecture only
supports two-level tables.
| Architecture | Bits used |
| PGD | PUD | PMD | PTE |
| i386 | 22-31 | |
| 12-21 |
| i386 (PAE mode) | 30-31 | |
21-29 | 12-20 |
| x86-64 | 39-46 |
30-38 |
21-29 |
12-20 |
|
Each level in the page table hierarchy is indexed with a subset of the bits
in the virtual address of interest. Those bits are shown in the table to
the right (for a few architectures). In the classic i386 architecture,
only the PGD and PTE levels are actually used; the combined twenty bits
allow up to 1 million pages (4GB) to be addressed. The i386 PAE mode
adds the PMD level, but does not increase the virtual address space (it
does expand the amount of physical memory which may be addressed, however).
On the x86-64 architecture, four levels are used with a total of 35 bits
for the page frame number. Before the patch was merged, the x86-64
architecture could not effectively use the fourth level and was limited to
a 512GB virtual address space. Now x86-64 users can have a virtual address
space covering 128TB of memory, which really should last them for a little
while.
Those who are curious about how x86-64 uses its expanded address space may
want to take a look at this explanation
from Andi Kleen.
The merging of this patch demonstrates a few things about the current
kernel development model. Prior to 2.6, such a fundamental change could
never be applied during a "stable" kernel series; anybody needing the
four-level feature would have had to wait a couple more years for 2.8. The
new way of kernel development, for better or for worse, does bring new
features to users far more quickly than the old method did - and without
the need for distributor backports. This patch is also a clear product of
the peer review process. Andi's initial version worked fine, and could
certainly have been merged into the mainline. The uninvited participation
of another developer, however, helped to rework the patch into a less
intrusive form which brought minimal changes to code outside the VM core.
The end result is an improved kernel which can take full advantage of the
hardware on which it runs.
Comments (none posted)
The post-2.6.10 mainline kernel contains a set of patches designed to help
with the merging of the Xen virtual architecture. One of them is an
enhancement to the networking API which could have uses beyond Xen.
The "socket buffer" (SKB) is the core kernel data structure used to
represent packets as they pass through the system. The SKB API has been
described for 2.4 in LDD2; this interface has
changed little since then. SKB structures are allocated in various ways by
the networking layer; the Xen patches add a new way:
struct sk_buff *alloc_skb_from_cache(kmem_cache_t *cache,
unsigned int size, int gfp_mask);
This function will allocate an SKB of the given size from the slab
cache provided. It assumes that the cache will provide a chunk of
memory of sufficient size for the buffer - and various bits of overhead
imposed by the SKB structure itself.
The new allocation function might speed things slightly for network drivers
which allocate large numbers of buffers of the same size - though the
existing allocation interfaces are already pretty fast. Xen has an
interesting use for this capability, however: fast networking between
virtual machines. By using the slab cache, Xen can ensure that every
packet is allocated a one-page buffer. When that packet is sent to another
virtual machine, the associated page can be unmapped from the source system
and mapped into the address space of the destination. It is, in other
words, a fairly straightforward zero-copy networking scheme. As a side
benefit, the Xen monitor benefits from the knowledge that the pages in
question have been used for network packets - since the contents of the
packet could be read by third parties while it is in transit, there is no
real point in worrying about zeroing out the data afterward.
Comments (2 posted)
In early December, this page
covered Christoph Lameter's
efforts to speed up the page fault mechanism by reducing lock contention.
That work speeds things significantly on multiprocessor systems, but is of
little help to uniprocessor users. That is not true of Christoph's other
page fault work, which can benefit users on all systems.
Christoph notes that, once
the locking issues are taken care of, the most expensive part of the page
fault handler is the code which zeroes anonymous pages before handing them
to the faulting process. He has concluded that, in some situations,
performance can be significantly improved by clearing those pages ahead of
time and having them ready when the page fault happens. Just zeroing pages
ahead of time is not particularly helpful - it is mostly an exercise in
moving work around to different places in the system. But, if (1) the
zeroing of pages can be made more efficient, and (2) the workload is
of the right type, things can be made quite a bit faster.
What is the right kind of workload? For the purposes of this patch set,
the best workload is one which allocates whole pages, but then only touches
parts of them. If those pages are already cleared, there is no need to
load an entire page into the processor cache when it is faulted in. The
improved cache behavior, along with the speedup in fault handling itself,
can yield big improvements. Some figures posted by Christoph show an
almost 4x improvement in the page fault rate in the right conditions. As
it turns out, many applications fit this profile, so "the right conditions"
should not be all that rare.
There are four parts to the prezeroing patch set. The first patch extends the page
allocation mechanism to make it explicitly handle requests for zeroed
memory. There is a new __GFP_ZERO allocation flag which tells
alloc_pages() (and thus functions like __get_free_page() and
kmalloc()) to return zeroed memory. Many places in the
kernel which clear their own pages have been fixed to request zeroed memory
instead. With only this patch applied, the kernel's code is cleaned up a
bit, but no performance improvements result - the __GFP_ZERO flag
just causes a call to clear_page() in the page allocator.
The second patch changes the
prototype of the clear_page() function to:
void clear_page(void *page, int order);
With the new interface, clear_page() can zero higher-order pages.
This change is an important part of the patch set: pages are most
efficiently zeroed if they can be done in larger groups. Often, the setup
cost is a big part of the total; the value of prezeroing pages is much
reduced if it can only be done one page at a time.
The kscrubd patch is where
things start to get interesting. This patch expands the zone
structure so that it can keep track of pages which are known to be clear.
Requests for zeroed pages are satisfied from this list when possible. A
new kernel thread (actually, a set of per-node threads) wakes up
occasionally and clears pages for future allocation. This thread does not
normally scrub zero-order (single) pages, but can be configured to do so
(via /proc) if desired.
The kscrubd patch also implements a linked list of "zero drivers," being
functions which can be called upon to zero pages efficiently. There are no
such drivers in this patch, so all pages are zeroed with a call to
clear_page(), which, as a comment in the code notes, can be hard
on the processor's cache. It would be nicer if pages could be zeroed
without the cache impacts. The
fourth patch shows how this can be done - at least, on Altix systems.
It adds a driver for the Altix block transfer engine which can zero memory
directly without the processor's involvement - at least, when relatively
large chunks of memory are involved. Drivers for other hardware have not
yet been posted, but it would not be surprising to see them begin to appear
after the prezeroing code has been merged.
And that could happen soon:
Linus, having been convinced by Christoph's results, has requested that this set of patches be merged
soon. So prezeroing could even find its way into the kernel prior to the
2.6.11 release. (Update: the __GFP_ZERO patch was merged
just as LWN was being published).
Comments (6 posted)
Patches and updates
Kernel trees
Core kernel code
Development tools
Device drivers
Filesystems and block I/O
Memory management
Networking
Architecture-specific
Security-related
Page editor: Jonathan Corbet
Distributions
News and Editorials
Continuing with our review series of distributions for AMD64 processors, the
next product we tested was the 64-bit edition of
Mandrakelinux
10.1. Unlike the previous three distributions (see
Debian on AMD64,
Fedora Core 3 on AMD64 and
Gentoo Linux on AMD64),
Mandrakelinux 10.1 for X86-64 is not readily available for download, and
even the Silver-level members of Mandrakeclub were only given access to the
ISO images some 6 weeks after the official release on November 10th, 2004.
That said, we noticed that, just before Christmas, the x86_64 directory on
Mandrakelinux mirrors was populated with RPM packages together with a small
installation ISO image, so rather than asking Mandrakesoft for a review
copy, we opted for a network install instead. As always, the boxed edition
of Mandrakelinux 10.1 for X86-64 is available from
Mandrakestore ( €119.00).
First, the system specifications: AMD64 3500+ processor (2.2GHz), K8N Neo2
(Socket939) mainboard from Micro-Star International, 2 GB of DDR SDRAM, 2 x
120 GB Maxtor hard disks, Plextor PX-712A DVD/CD rewritable drive, and
NVIDIA GeForce4 Ti 4600 graphics card. The monitor was a standard 19 inch
LCD from Mozo International.
We downloaded the 4.5 MB install.iso image from a mirror site. Although
the ISO was in the /official/10.1/x86_64/ directory, it turned out to be
just a generic installation image with no built-in specifications that
would indicate its architectural affinity. After detecting and loading the
correct network card module and confirming that DHCP should indeed be
activated (other options included static IP and ADSL), the installer asked
to specify the installation method (FTP, HTTP, NFS or hard disk). It
continued with a request to type in a preferred FTP/HTTP server and a
correct path to the install directory. Since the installer itself does not
include a list of available mirrors, you need to look up the information
before starting the installation. After the usual partitioning and package
selection screens, the installer was ready to begin downloading and
installing the new operating system.
From this point on, the installation proceeded without much human
interaction. As with previous three distributions, we chose a complete
workstation with GNOME and KDE, as well as a handful of server
applications. The local mirror delivered the packages at the maximum
available connection speed which meant that the installation completed in
less than two hours. After a few more screens helping to configure the boot
loader, X server, security settings, adding users and specifying the root
password, we were presented with an option to update the system with
security and bug fix updates.
And this is were we spotted the first bugs, or more precisely, some amusing
geographical anomalies. This time, the installer did supply a list of
available update servers, neatly arranged by countries in which the servers
were located. However, only a dozen or so countries were on the list, while
the remaining update servers, be they in Brazil, Hungary or Japan, were all
listed under "United States"! The next geographical mishap happened on the
survey page, where we decided to let Mandrakesoft have our hardware data.
But when we got to the drop-down list from which to select our country of
residence, we noticed that a number of big populous countries, such as
China or Japan, were not listed at all, while Antarctica or Pitcairn (a
tiny Pacific Ocean island of less than 50 inhabitants) did appear on the
list. Since our country of residence wasn't listed, we pretended to be
descendants of those famous mutineers on HMS Bounty and registered Pitcairn
as our country of residence.
Of course, these are no showstopper bugs, just something for the
Mandrakelinux developers to polish before 10.2. However, worse was to come.
The first surprise came after logging into KDE, which greeted us with a
desktop background that proudly proclaimed "Mandrakelinux 10.1 Community".
Community!? But we had pointed the installation sources at the "Official"
directory, so how come we ended up with the Community edition? We rushed to
check the "mandrakelinux-release" RPM file, which confirmed that what we
installed was indeed the "Community" edition, despite it having been placed
in the "Official" directory (the same RPM package in the official/i586
directory correctly indicated the "Official" status of the i586 branch). A
quick question on the expert mailing list brought dead silence - a marked
difference from our earlier experiences with the Debian mailing lists and
Gentoo forums, where questions were answered and problems solved with much
more enthusiasm.
After coming to grips with the fact that nobody really knew what edition of
Mandrakelinux we had installed, the next logical step was getting product
updates. Based on experiences with Fedora, SUSE and other distributions, we
expected to find a "Update" icon somewhere in the KDE system tray and we
weren't disappointed; there it was - the "Mandrakelinux Updates Applet". A
double-click brought up a dialog, which... well, before turning this
experience into a long story, let's just say that, after having made the
effort to configure the applet and register for an update account, we still
weren't able to get any updates - that's because this is a paid service,
only available to Silver-level members of Mandrakeclub. It would have been
nice if the applet had informed us about this fact beforehand, but it
wasn't the case.
Surely, there is another way to get updates - through the good old Update
module of the Mandrakelinux Control Center. Unfortunately, this turned out
to be another frustrating experience - no matter how many times we tried to
configure the update sources, the application kept displaying an error
message claiming that it could not find any available mirrors, most likely,
it said, because our installed architecture was not supported by
Mandrakelinux updates. But upon examining several mirrors, the update
directory for x86_64 was available and populated with RPM packages, so why
the misleading message?
And this is what we thought was possibly the biggest problem with today's
Mandrakelinux - because of the distribution's increasingly commercial
nature, we were often unable to determine whether a particular feature was
disabled in order to make the user join a premium service, or whether it
was deliberately crippled so that the user doesn't easily find a way around
the club membership net. Either way, the experience was not pleasant. Of
course, there is always a possibility that these were just bugs. But if
that were the case, there were already too many of them, even before
starting to use the distribution proper.
Eventually we found a way to configure the application to get updates - by
resorting to the command line and using the "urpmi.addmedia" command.
Unfortunately, by that time we started having serious doubts about the
quality of this distribution, where lack of attention to detail and various
"joined the club" tricks seemed to be the order of the day. In a way,
Mandrakelinux 10.1 started to resemble LindowsOS 4, which installed a bunch
of flashing and rotating icons of various other Lindows products into the
system tray, all screaming "buy, buy, buy". Not quite as bad, but close
enough for discomfort.
In all fairness, once we got through these early troubles, the
distribution turned out to be a pleasant product. The hardware
autodetection was flawless, the applications we tested behaved as expected,
and Mandrakelinux Control Center is a friendly utility for most general
configuration tasks. Like in Fedora Core, many 32-bit applications and
libraries were installed on the system alongside the 64-bit ones - the
32-bit libraries (referred to as lib*) are in /lib, while the 64-bit
libraries (referred to as lib64*) are in /lib64. On the download server,
the two branches are stored in two separate directories - main and main32;
the main directory lists a total of 3,875 packages, while the main32
directory lists 573 packages, including OpenOffice.org and MPlayer.
Interestingly, the popular PLF site
hosting third-party Mandrakelinux packages now has an x86_64 directory with
over 100 RPM packages, including many multimedia applications and codecs
which cannot be legally shipped with Mandrakelinux.
Is Mandrakelinux 10.1 (X86-64) worth €119? As we did not test the
commercial edition of the product, we cannot really answer the question,
but the FTP edition has given us enough warning signs to put any
recommendations on hold. Frankly, it is hard to see how Mandrakelinux will
compete with other 64-bit distributions on the market, especially with the
likes of Fedora, but also Debian or Gentoo, which are free of cost and
available for download immediately after release (or continuously updated).
Additionally, all three of them have more up-to-date packages
(Mandrakelinux 10.1 ships with GNOME 2.6 and KDE 3.2.3), fewer bugs
(especially when compared to Fedora Core 3), and more responsive mailing
lists and user forums, actively monitored by the distributions' developers.
Mandrakelinux 10.1 X86-64 is not a bad product, but it is marred by lack of
polish and some unnecessary commercial tricks.
Comments (14 posted)
Distribution News
Mandrakesoft has announced the availability of both Corporate Server and
Corporate Desktop. These two Linux systems have received specific
development efforts to make them "enterprise-ready". The two products
feature longer development cycles and a 5-year maintenance span.
Full Story (comments: 1)
The fourth maintenance update for Debian 3.0 ("woody") is out. This update
consists almost exclusively of security fixes; click below for the full
list of changes.
Full Story (comments: 31)
Wichert Akkerman
reports that the arch and
subversion repositories have been moved to the host. A few notable changes
are listed in the announcement.
Another Bug Squashing Party has been announced for January 7 - 9, 2005. "As
there are currently a lot RC bugs with low complexity again there is
clearly enough to do, even for people that are not experienced in that kind
of work. And of course there should be always some people around in the IRC
channel that are able to help, sponsor upload, etc."
Comments (none posted)
Gentoo has announced that the Gentoo Apache Herd will release a refresh of
all packages for the Apache httpd daemon and related modules on Saturday
January 8, 2005. Click below for more information.
Full Story (comments: none)
Summaries and logs of both the December 7 and December 21 Community Council
Meetings are available (click below). "
The second meeting covered
the creation of new country/region teams. People interested in starting or
working within an official Ubuntu Country team should contact Matthias
Urlichs [and optionally Mako]. You should especially consider doing this if
you've been active in doing country or language specific work for Ubuntu
and are interested into finding ways to integrate this work in the larger
Ubuntu community."
Full Story (comments: none)
Astaro Corporation has
announced
that
Astaro Security Linux was named
PC Magazine's Best Business Security Solution and Editors' Choice in the
publication's year-end edition.
Comments (none posted)
Vincenzo Ciaglia provides some helpful suggestions for using the Linux
Netwosix Bugzilla. Click below for additional information.
Full Story (comments: none)
Three new
urpmi sites for Mandrakelinux
users are now available:
www.urpmi-addmedia.org,
www.linuxfordummies.org/addmedia and
www.ianmacgregor.net/addmedia.
A problem in udev existed where a user
would not be able to use a firewire camera because the required device was
never created. This update forces udev to pre-create the device allowing
the use of firewire cameras. New packages are available for Mandrakelinux
10.1 and Mandrakelinux 10.1/X86_64.
Comments (none posted)
Fedora Core 2 updates:
rpm (fixes an issue
with building packages containing dangling symlinks, introduced by a glibc
glob() change),
pcmcia-cs (fixes bug
#135508, silencing a warning message on cardmgr startup).
Fedora Core 3 updates: selinux-policy-targeted (fix for postgres
startup scripts), pcmcia-cs (fixes bug
#135508, silencing a warning message on cardmgr startup), mysql (work around SELinux restriction and
other bug fixes).
Comments (none posted)
A few packages have been updated this week in
Slackware current. Upgraded packages
include cvs, python, perl, libxml, and several others. See the
slackware-current change log for complete details.
Comments (none posted)
New Distributions
Hikarunix is a Live Linux CD
dedicated to Go. It's designed for Go players of all levels and it fits on
a pocket-sized miniCD so it can go almost anywhere. Installation to a
harddrive is also supported.
Comments (1 posted)
WhiteHat Knoppix (WHoppix) is a knoppix 3.6 remaster designed to be a
standalone penetration testing toolkit. Heavily modded by muts, WHoppix
includes a full set of penetration testing tools and a huge repository of
exploits (Framework 2.2, Packetstorm and Securityfocus exploit archives).
Full Story (comments: none)
Distribution Newsletters
The December 28 Debian Weekly News is out; this week's topics include
documenting transitional packages, the upcoming stable update, rewriting
GFDL-licensed documentation, and more.
Full Story (comments: none)
The Debian Weekly News for January 4, 2005 covers an announcement by Martin
Michlmayr that Jörg Jaspert has been appointed as an additional Debian
account manager, the stable point release, the new arch and subversion
server, Mozilla trademark restrictions, the Debian Eyecatcher Project, the
origin of the Debian swirl, and several other topics.
Full Story (comments: 4)
The December 29 edition of the Gentoo Weekly Newsletter celebrates the
second anniversary of the GWN. There is also a look at the major Gentoo
Linux events of 2004.
Full Story (comments: none)
The Gentoo Weekly Newsletter for the week of January 3, 2005 is out. This
edition looks at the last 1000 days on Gentoo forums, the website redesign
mailing list, with an update on the Gentoo Documentation Project and more.
Full Story (comments: none)
The
Ubuntu Traffic #14 covers IRC and mailing list activity through
November 27, 2004. Threads covered include Live CDs for PPC (And More!),
Downgrading From Hoary, Ubuntu Merchandise, Documentation Team Update, More
On Language Packs, Dropping Support For the Mozilla Suite, Encrypted Home
Directories, Apt Authentication, Concerns With Sudo, Archive Layout, and
Ubuntu Security Notifications.
Comments (none posted)
The
fifteenth
issue of Ubuntu Traffic is out. This issue, still catching up with
early December, looks at UTF-8 support, cooperation with the Debian
Project, and several other topics.
Comments (none posted)
The
DistroWatch
Weekly for January 3, 2005 is out. "
Happy New Year! You are
reading the first issue of DistroWatch Weekly in 2005, in which we'll go
back in history and reveal how DistroWatch started, then provide a few
figures about visitors' interest over the past year, and introduce a
handful of new distributions. Happy reading!"
Comments (none posted)
Minor distribution updates
cAos has
announced
a pre-release of cAos Linux Core 2.0 for the IA-32 platform. "
This
release identifies the stabilization of the ABI in, and a feature freeze
of, the core OS. Members of the community are invited to install and test
this new distribution core."
Comments (none posted)
GnomeDesktop
reports the
release of
Flash Linux
0.3.3. There is a list of new features
here.
Comments (none posted)
LBA-Linux R2 has been
released. "
The new version, LBA-Linux R2, offers many
completely new features, including integrated office software and encrypted
directories for each user. The R2 release also incorporates all security
updates released since the first LBA-Linux distribution was published in
May 2004."
Comments (none posted)
Newsletters and articles of interest
NewsForge
talks
with Martin Michlmayr. "
In this interview, Martin Michlmayr, the
Debian project leader, talks about Sarge, the next release of Debian
GNU/Linux. One of the most significant improvements in Sarge over Woody,
the last stable Debian release, is in the new user-friendly
installer. Others include the addition of Apache 2.0.52, GNOME 2.8, KDE
3.2, and XFree86 4.3. Debian supports 11 hardware architectures. According
to Michlmayr the system is very stable, and only some infrastructure issues
need to be addressed before the release."
Comments (none posted)
If you have been giving away Knoppix CDs to your friends you might want to
also point them to this site.
Knowing Knoppix, The first guide to Knoppix for the complete
beginner. "
Knoppix is an astoundingly clever product. It runs
Linux completely from CD. There is no need to install. It bypasses all the
software already installed on your PC or laptop. It automatically detects
the hardware in your computer, such as video card, sound card, networking,
the lot (subject to suitable hardware). When you've finished using Knoppix,
simply restart. Your computer will return to your regular system, and it
will behave as if nothing has happened. Knoppix is Free Software and open
source under the terms of the GNU General Public Licence (GPL)."
Comments (1 posted)
Farrell J. McGovern writes about
building a custom Linux distribution in this NewsForge article.
"
Most derivative distros are based upon Red Hat, Debian, or
Slackware. Of them, Slackware is the oldest. I started using Slackware in
1993, and therefore I was very familiar with it. Slackware is easy to
modify. The package system is simple to work with and build packages
for. It has an unencumbered init script structure, and you can install
software from source without worrying about breaking dependency
databases. Plus, Slackware author Patrick Volkerding does a good job of
keeping the even older versions of the software up-to-date with security
revisions."
Comments (none posted)
Here's another look at
creating your own Linux distribution. "
There are many advantages
to compiling and configuring every piece of your system. First of all, you
can enable specific optimizations and configurations for your platform and
processor architecture. Secondly, you can unselect default features you
don't want and select features you need that are not enabled by
default. You can go one step further and search the Net for unofficial
patches that add, modify, or correct some features. You can even make your
own modifications to the source code of the applications. One joke some of
my friends and I have is to hard code our names in place of the original
name of an application, thus having a "MyName Web server" instead of an
"Apache Web server," for example."
Comments (none posted)
Distribution reviews
OSNews
reviews
SimplyMepis 2004.06 with KDE 3.2.3. "
This review is kind of split:
it is a review of SimplyMepis 2004.06, but it is also a look at a tested
and proven implementation of KDE from a Gnome-user perspective. I am fully
aware that SimplyMepis 2004.06 has KDE 3.2.3, an already outdated version
of the KDE desktop. I still chose this distribution, mainly because I was
interested in the small hype around Mepis Linux."
Comments (16 posted)
Joe Barr
reviews
Xandros Desktop OS 3 Deluxe Edition, on NewsForge. "
The one word
that pops up in my mind most often when I think of my experience with
Xandros 3.0 Deluxe is elegance. Power and polish in harmony. It won't be
the "just right" distro for some, but for a whole lot of others it just
might be the one that leads them from the Land of Oppressive Proprietary
Software to the Land of Linux and Freedom."
Comments (none posted)
Nauman Munir Afzal
explains why he likes Lycoris Desktop/LX, on NewsForge. "
I have
been trying out different Linux distros for quite some time now, in search
of the perfect one. The biggest problem I found was the user-unfriendliness
of Linux, not to mention the unfamiliarity, as I'm migrating from
Windows. Lycoris's biggest plus is the user-friendliness and ease that it
offers, and its similarity to Windows XP is another big advantage. Using
Desktop/LX has been a great experience."
Comments (none posted)
Page editor: Rebecca Sobol
Development
The
Gambas project
(Gambas Almost Means BASic), is a BASIC language interpreter and
development environment that was written by Benoît Minisini.
The project was started in February of 2002, according to
the
change log.
The code has been released under version 2 of the GNU General Public
License.
The project aims to resemble, and improve upon, the capabilities of Microsoft's Visual Basic.
The Gambas
introduction
goes into more detail:
I want to clear up any misunderstanding immediately. Gambas does not try to be compatible with Visual Basic, and will never be. I'm convinced that its syntax and internals are far better than the one's of its proprietary cousin ;-)
I took from Visual Basic what I found useful : the Basic language, the development environment, and the easiness to quickly make programs with user interfaces.
The
Differences From VB document has a lot of information that is useful for VB developers who are interested in using Gambas.
There is a Gambas
visual introduction document which provides a nice tour of the project.
The
features section of the introduction explains the architecture
of Gambas in more detail, and the
FAQ document answers common questions and has some installation
information.
Version 1.0 of Gambas was released
this week,
quickly followed by version 1.0.1, which has fixes for a few
newly discovered bugs.
One piece at a time,
open-source developers are building Linux equivalents of the various
Windows desktop components, Gambas is well positioned to fill the
Visual Basic slot. It should be useful for luring a few Windows
users who like the 'cartoon programming' method of software
development over to Linux.
Comments (11 posted)
System Applications
Audio Projects
The
latest changes from the
Planet CCRMA audio utility packaging project include
a bunch of new packages for Fedora Core 3, a small
list of failed builds for Fedora Core 3 with a request for assistance,
and more.
Comments (none posted)
Database Software
Version 1.5.2 of the
Firebird database
is out. See the
release notes for change information.
Comments (none posted)
Release Candidate 3 of PostgreSQL 8.0.0 is available.
"
Baring *any* coding changes (documentation != code) over the next
week or so, we *hope* that this will the final Release Candidate before
Full Release, with that being aimed for the 15th (or earlier)."
Full Story (comments: none)
The December 28, 2004 edition of the PostgreSQL Weekly News
is online with the latest PostgreSQL database information.
Full Story (comments: none)
The January 4, 2005 edition of the PostgreSQL Weekly News
is available with the latest PostgreSQL database resources and events.
Full Story (comments: none)
Libraries
Version 3.5.3 of FreeImage, a library for supporting the PNG, BMP, JPEG,
TIFF and other image formats,
is available.
"
Release 3.5.3 is a maintenance release that is worth the try :
the library has been updated with the new zlib (1.2.2), libpng (1.2.8) and libtiff (3.7.1) libraries. This means better performance and less
bugs !"
Comments (none posted)
Version 0.4.0 of liblrdf, lightweight RDF library with special support
for LADSPA (audio effect) plugins, is out. Changes include SWIG support and
better generic id creation.
Full Story (comments: none)
Mail Software
Version 0.93.3 of Bogofilter, a spam filter, is out.
"
The 0.93.3 release of bogofilter brings with it two significant
changes. First bogoutil now supports multiple options for working
with the Berkeley DB database environment. "bogoutil --help" lists
the following options:..."
Full Story (comments: none)
Networking Tools
Version 1.4.2 of Click, a modular router, is available.
"
A Click router is an interconnected collection of modules called elements; elements control every aspect of the routers behavior, from communicating with devices to packet modification to queueing, dropping policies and packet scheduling. Individual elements can have surprisingly powerful behavior, and its easy to write new ones in C++. You write a router configuration by gluing elements together with a simple language."
Full Story (comments: none)
Peer to Peer
Version 0.4.0 of the XBT client
is out with numerous changes and bug fixes.
"
This client is an
implementation of the BitTorrent peer to peer file sharing protocol in C++.
It's designed for low CPU- and RAM usage, an easy-to-use interface and high
download speeds. Both Linux (source only) and Windows versions are available."
Comments (none posted)
Printing
Version 1.1.23 of CUPS
has been announced.
"
CUPS 1.1.23 is a bug fix release which fixes two security vulnerabilities reported by Daniel J. Bernstein. The new release also contains other minor bug and documentation fixes that are not security related."
Comments (none posted)
Web Site Development
Version 1.5.0 of IRM
has been announced.
"
IRM is a Web-based asset and problem tracking system built for IT departments
and helpdesks. It keeps detailed information, both hardware and software,
about each computer, as well as a complete history of all work requests ever
placed. The IRM development team is proud to announce the release of IRM
1.5.0, the first release of a new line of development for IRM, both in terms
of the code produced, the development process, and the frequency of releases."
Comments (none posted)
Version 2.0.0 of MidCOM, the Midgard
Components Framework, is out.
"
The Midgard Project has released the final stable version of the Midgard
Components Framework 2.0, now based on the filesystem, not on the Database.
Significant performance improvements come out of this."
Full Story (comments: none)
Version 3.2.29 of the
mnoGoSearch
web site search engine has been released. It features bug fixes
and performance improvements. See the
Change History
document for details.
Comments (none posted)
GnomeDesktop
mentions
the release of Drivel 1.3.0, a LiveJournal blog posting tool.
"
This marks the first
release with support for posting to Blogger and Movable Type journals, giving
GNOME users an integrated tool for accessing both of these systems while
maintaing the smooth interface, syntax highlighting, and spell-checking that
LiveJournal users have enjoyed for months.
As this is a development release, testing and bug reports would be very
much appreciated."
Comments (none posted)
Desktop Applications
Audio Applications
Version 0.9beta22 of Ardour, a multi-track audio recorder,
is available.
"
With over a
hundred notable new items, and only a handful of bug fixes between
this and 0.99, this is a significant release of Ardour."
Full Story (comments: none)
New versions of Ceres and Snd-ls are out.
Ceres is a sonogram display and sound effects application, Snd-ls
is a sound editor.
Full Story (comments: none)
Business Applications
Stable version 1.10 of OpenPSA has been announced, it features major
improvements to all of the component modules.
"
OpenPSA is a free web-based
package for managing consultancies and software companies. It includes
project management, hour reporting, help desk, group calendar, document
management and customer relationship management."
Full Story (comments: none)
Data Visualization
Version 5.1.18 of Grace, a WYSIWYG 2D plotting tool for the X Window
System and M*tif,
has been announced. The parser now supports
concatenation of quoted strings and numerical expressions, and some
bugs have been fixed.
Comments (none posted)
Desktop Environments
Dropline Gnome 2.8.2
has been announced.
"
After a long delay, an RC and a lot of bug squashing we are finally ready to
put our names on this first official release of Dropline GNOME as a community
project."
Comments (none posted)
The following new GNOME software has been announced in the last two weeks:
Comments (none posted)
The December 24, 2004 edition of the
KDE CVS-Digest
is out with the following content summary:
"
Kexi has a new Reports module. KPDF adds a presentation mode. KJSEmbed adds KScript which allows applications to use Javascript as scripting language. Umbrello adds entity relationship diagrams."
Comments (none posted)
The December 31, 2004 edition of the
KDE CVS-Digest
is online, here's the content summary:
"
Krita implements pasting, layers and autogradient. media kioslave now handles cameras. KGeography adds more maps. Special year end retrospective of the KDE development effort."
Comments (none posted)
The following new KDE software has been announced in the last two weeks:
Comments (none posted)
Release Candidate 3 of the
Xfce lightweight desktop environment
is out.
"
The third Release Candidate, which provides several bugfixes over the second Release Candidate, is a lightweight desktop environment with several features not found in the Xfce 4.0 series, including a brand new session manager, keyboard shortcut and desktop menu graphical editors, multihead support, "kiosk mode" support, a desktop menu plugin for the panel, CUPS and BSD-LPR printing support, and a new icon theme."
Comments (none posted)
Electronics
The
latest releases
from the
gEDA project include
new versions of gaf, Gerber Viewer, and some hardware projects that
were built with the gEDA tools including
The GNU Software Radio.
Comments (none posted)
The latest new electronics applications on
Open Collector include FreePCB 0.943, I2C2P 20041227, Electric 8.01, and more.
Comments (none posted)
Financial Applications
Version 2.4.7 of SQL-Ledger, a web-based accounting system,
has been released.
Changes include string formatting for transaction printing,
bug fixes, and more.
Comments (none posted)
Fonts and Images
Version 0.99 of the
Open Clip Art Library is available.
"
This version contains 3104 unique clip art submissions with
an emphasis on the past holiday season."
Comments (none posted)
Graphics
Version 2.5 of
Gnofract4D, a Python-based
fractal image generator, is out. This version adds
support for hypercomplex numbers.
Comments (none posted)
Interoperability
Issues
number 254 and
number 255 of Wine Traffic are online with the latest Wine project
happenings.
Comments (none posted)
Music Applications
Version 0.6.4 of BEAST/BSE, the BEdevilled Audio SysTem
and the Bedevilled Sound Engine music composition system, is out.
"
This new development series of BEAST comes with a lot of the internals
redone, many new GUI features and a sound generation back-end separated
from all GUI activities."
Full Story (comments: none)
Version 0.7.1pre2 of Muse, a MIDI and audio sequencer application,
has been released.
Changes include the inclusion of the new SimpleDrums 0.2 softsynth,
bug fixes, and more.
Comments (none posted)
Version 0.88 of Sfront, a translator for converting MP4-SA files
into C programs that generate audio, is out.
"
this release
keeps sfront networking in sync with the IETF
Internet-Drafts that define RTP MIDI (the RTP
payload format for MIDI)."
Full Story (comments: 1)
Web Browsers
GnomeDesktop.org
celebrates the
second birthday of Epiphany. "
We have set ambitious goals for
the next stable release, Epiphany 1.6, that will coincide with GNOME
2.10. To whet your appetite a little: if all goes according to plan, the
Bookmarks menu in 1.6 will be able to dynamically show topic submenus and
subdivisions, based on the topics the bookmarks belong to. We are
soliciting the help of interested coders, designers, documentation writers,
bug triagers and translators from the community to help us get there. The
1.6 roadmap shows the plans and indicates their progress."
Comments (none posted)
Miscellaneous
Version 3.1 of Pooter, a Personal Information Manager (PIM) is out.
"
As well as a continuation of the development of a cross platform version, the
3.1 release has additional versions for Gnu/Linux only. One uses the Simple
Look and Feel Program (Slaf) to provide a choice that includes KDE and Gnome,
the other uses the Charva windowing toolkit for a version that runs in a
terminal emulator or even without XWindows."
Full Story (comments: none)
Languages and Tools
Caml
The December 28, 2004 edition of the Caml Weekly News is online
with a new round of Caml language articles.
Full Story (comments: none)
The Caml Weekly News for December 28, 2004 through January 4, 2005
is online with a new summary of Caml language development activity.
Full Story (comments: none)
Java
O'Reilly has compiled
a collection of popular articles from the ONJava site in 2004.
Comments (none posted)
Ashwin Jayaprakash
discusses code debugging in Java 1.5.
"
Test-driven development sometimes sounds better than it turns out to be.
Early decisions to tightly couple functional parts of your system can make it
a lot less amenable to testing than it ought to be. As Ashwin Jayaprakash
shows, J2SE 5.0's generics make working with abstract classes and interfaces
easier than it used to be, which encourages loose coupling and facilitates
testing."
Comments (none posted)
Timothy M. O'Brien
explores Jakarta Commons in an O'Reilly article.
"
The Jakarta Commons has a wide-ranging collection of handy classes that can
save you the trouble of reinventing the wheel yet again. In this new series,
Tim O'Brien looks at some of the more overlooked parts of the Commons and
what you can do with them."
Comments (none posted)
Daniel H. Steinberg
looks at Jini on O'Reilly.
"
This is not just another article championing a niche technology; it is a tempered rant on why Jini could be seen as central to the future health of Java. We can draw many lessons from the success of web services and from Apple's (soon to be renamed) Rendezvous technology, and we can find many opportunities on the desktop, in the enterprise, and on devices. Everywhere you see a JVM, picture a Jini-enabled device."
Comments (none posted)
Lisp
A
2004 Lisp Timeline has been assembled, take a look
to see what progress was made in the Lisp arena over the past year.
Full Story (comments: none)
Version 0.8.18 of Steel Bank Common Lisp has been released.
"
This version features improvements to shared objects and FFI, support
for Solaris 10, and several bug fixes."
Full Story (comments: none)
Version 1.0.0 of CL-PPCRE is available.
"
This version doesn't add new features, but recognizes
that the system is stable enough for general usage.
CL-PPCRE is a Perl-compatible, fast, portable regular expression
library written in Common Lisp. The library also supports a
sexp-based syntax for specifying regular expressions."
Full Story (comments: none)
Perl
The December 7-20, 2004 edition of
This Fortnight in Perl 6 is online with the latest Perl 6 news.
Comments (none posted)
Geoff Broadwell continues his series on building a 3D engine in Perl
with
part two.
"
This time, I'll discuss rotating and animating the view, SDL event and keyboard handling, and compensating for frame rate variations. As a bonus, I'll demonstrate some real-world refactoring, including a conversion from procedural to (weakly) object-oriented code."
Comments (none posted)
PHP
The
PHP site has a
new note on PHP security that PHP users should read.
"
A recent Web Worm known as NeverEverSanity exposed a mistake in the input validation in the popular phpBB message board application. Their highlighting code didn't account for double-urlencoded input correctly. Without proper input validation of untrusted user data combined with any of the PHP calls that can execute code or write to the filesystem you create a potential security problem."
Comments (none posted)
Python
Version 1.0.1 of Axon is out with new documentation.
"
Axon is a collection of pure python modules from the Kamaelia project
which allow you to build concurrent systems in a compositional manner
using communicating python generators. Components are python generators
are augmented by inbox and outbox queues (lists) for communication in a
CSP like fashion."
Full Story (comments: none)
The December 25, 2004 edition of Dr. Dobb's Python-URL! is online.
Full Story (comments: none)
The December 30, 2004 edition of Dr. Dobb's Python-URL!
is out with the week's Python language news.
Full Story (comments: none)
The November 11-15, 2004 edition of the python-dev Summary
is out with the summary of the python-dev mailing list
traffic for that period.
Full Story (comments: none)
Version 0.8.6 of Urwid, the curses-based UI library for Python,
is out.
"
This version of Urwid changes the default foreground and background for
areas of the screen with no attributes. You may need to AttrWrap(..)
some of your widgets for your program to look the same."
See below for the full list of changes.
Full Story (comments: none)
Scheme
Jonathan Bartlett
works with linked lists under Scheme in an IBM developerWorks article.
"
Singly linked lists are a powerful abstraction that allow programmers to represent numerous types of data; extending those lists to handle arbitrary data types can offer effective tools for processing data. In this article, we look at these processes and examine the Lisp variation Scheme, an easy-to-use list-oriented language that delivers list-manipulation capabilities without the complexities of C."
Comments (none posted)
XML
Version 0.9.1 of the Python-based
Amara XML Toolkit is out with bug fixes and other improvements.
Comments (none posted)
John E. Simpson continues his series on XML and GIS with
part two.
"
In Part 1 of this "XML Tourist" feature, I discussed some basic ingredients of a Geographic Information System (GIS) and introduced you to an XML-based, web-delivered application for representing GIS data: the Geography Markup Language, or GML. This month, we'll delve deeper into GML itself--starting with a brief further look into what distinguishes a true GIS from other tools for rendering two- or three-dimensional spaces on a computer monitor."
Comments (none posted)
Manish Verma
explains SPML on IBM developerWorks.
"
Gain a basic understanding of what Service Provisioning Markup Language (SPML) is and how it works. After an explanation of SPML's role in the management of the identity lifecycle, this article guides you through an actual working SPML scenario, using OpenSPML. Along the way, the author explains the architecture and design of SPML. Ultimately, you learn to appreciate the usefulness of this technology, and are equipped to participate in the implementation of the standard."
Comments (none posted)
Cross Assemblers
Version 0.13.0 of
gputils,
a collection of tools for Microchip PIC microcontrollers,
has been released. Here are the change notes:
"
Added many new processors. Added support for extended 18xx mode. Fixed many bugs."
Comments (none posted)
Emulators
Peter Seebach
writes code with emulation in mind.
"
Computers have been emulating other computers for a long time, often to access a legacy application or to use applications written for a popular OS on a system with a more stable, responsive OS. As Linux grows in popularity, developers need to examine their options when planning binaries that will run on non-Linux systems. This article examines what emulators do and looks at hardware and software emulation issues in detail."
Comments (2 posted)
IDEs
KDE.News
has announced
the availability of
Issue #4 of the KDevelop TechNotes.
"
This issue describes code
navigation in the KDevelop IDE. Read on to learn about the most effective
ways to navigate your code with keyboard shortcuts, context menus and "Quick
Open..." wizards. The article also gives some useful information about
toolview management with keyboard and also describes code navigation features
available only to C++ developers."
Comments (none posted)
KDE.News
mentions
a
tutorial on the Kommander IDE.
"
"Graphical
Scripting with Kommander" takes us through the creation of a graphical
interface for Konstruct, a tool for downloading, configuring and installing
KDE from source packages. The article also lists some of the exciting
developments coming to Kommander in the near future."
There is also a new
A Kommander crash course available online.
Comments (none posted)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
TechNewsWorld
compares real time
implementations in Linux. "
Hard real-time Linux has been around
for ages, or it may never appear. It all depends on who you talk to. It
also depends on your requirements. A two-second interrupt latency may be
acceptable for some applications, and even many Linux implementations can
easily handle interrupts within tens of milliseconds."
Comments (37 posted)
News.com
looks at a report from the
Honeynet Project
that shows improvements in the ability of stock Linux distributions
to resist attacks.
"
The data, from a dozen networks, showed that the average Linux system lasts three months before being compromised, a significant increase from the 72 hours life span of a Linux system in 2001. Unpatched Windows systems continue to be compromised more quickly, sometimes within minutes, the Honeynet Project report stated."
Comments (2 posted)
Steven J. Vaughan-Nichols
predicts good
things for free software in 2005 in eWeek. "
I even see Microsoft
Office, perhaps the most bloated software suite ever, finally losing
ground. That's because Sun's open-source OpenOffice.org 2.0 is looking
very, very good. Not only does it have excellent Office file format
compatibility, it's finally become a fast application. I've used OpenOffice
for ages, but I've never warmed up to it. It's always been too darn
slow. With this last pre-beta, though... woo! Look out Microsoft Office,
OpenOffice means business."
Comments (25 posted)
The SCO Problem
Groklaw
discovered some details on the SCO/Daimler Chrysler case that
were not mentioned in the recent SCO teleconference.
"
..the Order
says that if ever SCO refiles against DaimlerChrysler for breach of contract
regarding an alleged failure to timely certify, it has to pay DC's costs and
attorneys' fees going back to August 9th, the date of the judge's order
denying in part and granting in part DC's Motion for Summary Disposition."
Comments (none posted)
Boston.com has posted
an
article on the dangers of open source code. "
Similar scenes are
playing out at software firms and other businesses across the country, as
engineers frantically search their files for something they hope not to
find: open-source components. Their improper use, in the worst case
scenario, could subject companies to costly litigation from parties like
the SCO Group of Lindon, Utah." It's a low-clue article, but, alas,
it may well scare some people.
Comments (2 posted)
Companies
News.com
reports on HP's Linux-based "home media hub." "
In addition to unveiling new hardware, HP is beginning to lay the groundwork
for strategic participation in developing DRM technology through its alliance
with Philips.
Creating digital locks that pass muster with major music labels and Hollywood
studios is widely considered a crucial step in the evolution of digital media
to ensure artists and publishers get paid, barring more radical experiments
such as compulsory licensing or hardware taxes."
Comments (10 posted)
eWeek
covers the
first beta release of Novell's Open Enterprise Server. "
Novell
Inc. gave its NetWare and Linux users a Christmas present by releasing the
first public beta of Novell Open Enterprise Server over the holiday
weekend. OES is Novell's dual operating system, NetWare services
platform. It can run on top of either SLES (SuSE Linux Enterprise Server)
9.2 or the NetWare 7.0 kernel or both. "We're not dropping NetWare; we are
adding Linux," explained Jack Messman, Novell's chairman and CEO."
Comments (4 posted)
News.com
covers the latest
financial report from Red Hat.
"
Linux seller Red Hat reported on Wednesday that its third-quarter net income jumped 155 percent year-over-year to $10.8 million as its software business matured.
That income meant the company earned 6 cents per share for the fiscal third quarter ended Nov. 30, matching the average expectations of analysts surveyed by Thomson First Call.
Red Hat also announced quarterly revenue of $50.9 million, an increase of 55 percent over the same period last year, but less than the $51.8 million analysts expected."
Comments (1 posted)
Business
The Decatur Jones Open Source Wall Street newsletter for January 3 is
out; it's available
in
PDF format. "
As Linux continues to gain market share, we expect
to see Novell (NOVL: Outperform) and Red Hat (RHAT: Outperform) to stand
out, Citrix (CTXS: Outperform) to grow steadily, and SCO Group (SCOX:
Market perform) and Sun Microsystems (SUNW: Market perform) to stagnate or
falter."
Comments (2 posted)
Linux Adoption
Jono Bacon
begins a series
of articles on open source advocacy, on O'ReillyNet. "
In recent
years, Open Source has become a relevant and strangely addictive force in
IT. As the Internet age has dominated businesses and consumers with the
same well oiled, yet clunky machine, Open Source has crept out of the dimly
lit bedrooms occupied by toiling hackers and into the network rooms and
'enterprise centric strategies' of todays businesses. Open Source has not
just become more acceptable, it has become more relevant."
Comments (2 posted)
ZDNet
reports
that the Venezuelan government will switch to Linux. "
Over the next
three months the Ministry of Science and Technology will prepare a plan of
how all ministries will migrate to open source software, according to a
report by online news service Venezuelanalysis.com. It reported that these
plans will then be implemented over the following 24 months."
Comments (none posted)
Legal
ZDNet has posted
a lengthy article speculating on future changes to the GPL.
"
The patent problems boil down to two issues. First, should the license explicitly require those who distribute GPL software to grant others unhindered use of whatever patented technology is involved in that software? And second, should there be some form of punishment for those who file lawsuits alleging that GPL software infringes their patents?"
Comments (none posted)
The register
covers
a policy flip-flop by the Dutch government concerning software
upgrades on its 260,000 Microsoft-based computers.
"
Despite a unanimous vote by the Dutch parliament in 2002 to adopt open standards and open source software, Microsoft recently opened exclusive negotiations with the Dutch government regarding a major software upgrade. After Dutch IT weekly newspaper Automatisering Gids leaked details about the 157m ($210m) deal, Dutch MPs demanded an explanation as to why there hadn't been a mandatory public bid."
Comments (1 posted)
Groklaw
answers some recent attacks on free software licenses.
"
The bottom line is always the same: If you steal someone's code, there will be consequences. That's true for the GPL (if you distribute the code -- you are free always to use any GPL code in-house without any consequences at all), but it's not unique to it. If you steal Microsoft's code, there are consequences also. You do have to respect other people's intellectual property rights, as lawyers call them. That's true for all licensed code, including the GPL."
Comments (14 posted)
Interviews
O'ReillyNet has published
a lengthy interview with Richard Stallman. "
Porting free applications to nonfree operating systems is often useful. This allows users of those operating systems to try out using a few free programs and see that they can be good to use, that free software won't bite them. This can help people overcome worries about trying a free operating system such as GNU/Linux. Many users really do follow this path."
Comments (49 posted)
Linux Journal
interviews Richard
Thieme. "
In the field of information security, there are many
useful occupations: firewall engineer, policy analyst, auditor and security
architect all are popular choices. But what about information technology
philosopher? There's plenty of value in describing the intersections
between technology and the human experience, but I know of only one person
who makes a living doing so--Richard Thieme."
Comments (none posted)
NewsForge
looks at the PlaySMS Mobile Portal System project. "
The PlaySMS
Mobile Portal System project aims to have a major role in the mobile
applications area. Anton Raharja, the Indonesian project owner of PlaySMS
MPS, has linked up with open source developers in the Philippines, the
"mobile messaging/SMS capital of the world." Over 10% of the total SMS
messages processed in the world, averaging 200 million messages on any
given day, come from the island nation. Many mobile applications are
already in use in the Philippines before other countries start
experimenting with them."
Comments (none posted)
NewsForge
talks with the NetBSD hackers about new features in the 2.0 release. "
Scheduler activations are a mechanism invented by Thomas Anderson in a 1992 paper, which provides an interface between an operating system kernel and an application for maintaining a desired level of concurrency. In this system, the application informs the kernel how much concurrency it has, e.g. how many simultaneously computing threads it will use, and the kernel maintains a certain number of 'activations,' or scheduleable entities, on which the library layers application computation."
Comments (1 posted)
Resources
Linux Journal
looks at
SETL, a programming language modeled on set theory. "
The aim of
this article is not to offer a thorough discussion of SETL internals or a
comparisons with other languages. Rather it intends to show the strong
points of SETL by using elementary examples to convince you of how useful
it can be in the right setting. For example, SETL appears to be one of the
most suitable environments in which to make Set Theory calculations on a
PC. As most problems may be formulated using the sets formalism, SETL is a
good choice for all those times when compactness and elegance are more
relevant than speed or memory consumption."
Comments (3 posted)
Here's
an O'ReillyNet article on building a video recorder with MythTV.
"
The general advice is not to buy a TV card with its own remote. Apparently, this almost guarantees that you'll have difficulty making it work. The best way is to use an IRda keyboard and a programmable remote control that operates on a variety of frequencies. You train the remote from the keyboard, which will be useful also for web browsing or other activities you might consider later."
Comments (14 posted)
O'Reilly has published
part two of the
Cooking with Linux series.
"
In the second part of this two-part series, Carla Schroder, author of Linux Cookbook, offers two more recipes, including tips on running different window
managers simultaneously with Xnest and hosting multiple domains with Apache."
Comments (none posted)
O'ReillyNet
offers some advice to anybody considering building a Linux cluster.
"
Using the same hardware for each machine in the cluster will simplify installing and configuring your clusters, since you'll be able to use identical system images on each machine. It will simplify maintaining your cluster since, all of the systems have the same basic configuration. You'll need to stock fewer spare parts and will be able to swap systems in and out of your cluster as needed. But the really big savings will come when you program your cluster; you won't have to code for differences in performance among machines."
Comments (1 posted)
developerWorks
introduces
a new series on embedded Linux systems on the PowerPC architecture.
"
In the process, I'll also provide sample implementations showing
some general techniques of interest in networked embedded appliances. The
end result will be that you'll turn a bare-bones networked storage
appliance into something that could be the core of a simple autonomous
vehicle controller, with basic actuator controls, sensors, and rudimentary
machine vision capabilities. Because most people probably don't need to
build robot submarines (as much as most of us would like to), this article
also explains how to design and implement web-based administration
interfaces and other topics of wider applicability."
Comments (none posted)
Reviews
LinuxDevices
takes a look
at a Linux-based portable media player from Taiwanese motherboard maker
FIC. "
The Vassili includes a built-in 20GB hard drive and large,
3.6-inch color LCD display. It also includes TV- and audio-out ports, a
built-in speaker, a USB 2.0 device interface, a USB host interface, and a
10/100 Ethernet LAN port. An included docking station supports
s-video."
Comments (4 posted)
Here's a NewsForge
review of Firestarter. "
Firestarter is a GPL-licensed graphical
firewall configuration program for iptables, the powerful firewall included
in Linux kernels 2.4 and 2.6. Firestarter supports network address
translation for sharing an Internet connection among multiple computers,
and port forwarding for redirecting traffic to an internal
workstation. Firestarter's clean and easy to use graphical user interface
takes the time out of setting up a custom firewall."
Comments (6 posted)
Linux Journal
examines
some features of FVWM. "
FVWM is a window manager used with the X
Window System, which is the standard GUI for UNIX. This article explains a
few useful things you can do with FVWM, including how to take screenshots
conveniently, how to easily change a window's title and how to reconfigure
easily a running FVWM instance."
Comments (none posted)
NewsForge
reviews Inkscape 0.4. "
Inkscape 0.4 is considerably faster than
its predecessors, and it seems to be a bit less memory-intensive. So far,
this version has been more stable than the previous version. In all the
time I have spent with this Inkscape 0.4, it has crashed only once, and
that was while creating a new layer. It is certainly stable enough for
regular use in a production environment, but users should save often just
in case."
Comments (none posted)
Bruce Perens
tries out
the Gyration Media Center Remote with Linux, on Technocrat.net. "
The
Gyration Media Center Remote is a radio keyboard and mouse with 100-foot
range. The mouse uses an accelerometer rather than a mouse wheel, and thus
has the unique feature that you can make mouse gestures in the air. The
mouse should be perfect for a public speaker who wants to move around
during a speech, without giving up control of his laptop. It would also
make a nifty remote for a Linux PVR user, since it has VCR controls and
channel and volume buttons. But does it work with Linux?"
Comments (none posted)
Miscellaneous
Microsoft Outlook may face some new competition from the Mozilla Lightning
project, according to
this article on News.com.
"
The new project, code-named Lightning, aims to integrate Mozilla's calendar application, Sunbird, with its recently released Thunderbird e-mail application. That integration is aimed right at the heart of Microsoft's widely used Outlook software."
Comments (11 posted)
PCPro takes a look at
Linux in
2004 with a few predictions for 2005. "
The year of the penguin,
some people hailed 2004 at the turn of the year. And in many ways it was.
Was it because the march on the server space continued at a relentless
pace? Because there were big announcements around desktop installments?
Because there was finally some realistic perspective about the threat from
SCO, or the threat to Microsoft? However you look at it, the penguin's tux
has never looked more pristine or ready for business. So here we'll take a
stroll though the last 12 months that sharpened the creases and quickened
the pace of the Linux-based platforms."
Comments (none posted)
The
ars
technica year-end edition looks back at a year of Linux, and offers
various awards. "
So much has been said about Ubuntu that it should
be apparently that it's something special. By attempting to create a single
distribution with a tweaked desktop, Project Utopia, and a multicultural
approach, Ubuntu has come close to being the Holy Grail of Linux for many
of us." LWN is their "online publication of the year." (Thanks to
"TomS").
Comments (7 posted)
SearchNetworking.com has a few
predictions
for 2005. "
Two years ago, I said that Linux on the desktop was a
nonstarter, but a lot has happened since then. The popular Firefox browser
started the ball rolling in 2004. Now, in 2005, several vendors release
desktop environments that mimic the Windows interface, establishing Linux
as a low-cost alternative to Windows. The trend builds slowly, but the
adoption of Linux as the desktop standard by a major U.S. government agency
juices the trend. By year's end, Linux approaches 10% market share of new
desktop operating system sales. Microsoft isn't exactly under siege, but
the lights start burning late in Redmond."
Comments (1 posted)
ZDNet UK
reports that Asian software vendors are on track to release Asianux 2.0
by next July (originally not scheduled before September). "
According
to The Korea Herald, HaanSoft has said that by this summer it will have
produced a distribution that is comparable to those of SuSE and Red Hat
Linux. The newspaper also reported that the date of release was put forward
because the Korean government is due to adopt a large high-school
population database in the second half of 2005. This could be a "huge
opportunity" to introduce open source, according to HaanSoft."
Comments (none posted)
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
Benjamin Rossen
calls for a
discussion on a new Linux business model. "
Advantages to
this business model:(1) At present people contributing to the Open
Source Movement and Free Software Foundation do their work for the love of
it, or for intangibles such as kudos from the community of open source
colleagues, but they cannot live from their efforts. This initiative should
make if possible for people who write code to live from their work. In
principle, it should be possible to divide the source of Bill Gates'
billions among the people who are actually doing the creative work. By
commoditizing the process, as we shall be doing (and as shall happen
regardless of what we do), the billions may become mere hundreds of
millions; but that that should be enough for us to live from."
Comments (19 posted)
The Python Software Foundation has announced the award of three grants.
Projects include Moving Jython Forward, Implementation of SNMPv3,
and Software Engineering with
Python for Scientists and Engineers.
Full Story (comments: none)
The Free Sofware Foundation, Europe has sent an open letter to
Mr. Lee Jong-wook, Director General of the World Health Organization
concerning software patents.
"
In fact: lawyers are generally in a better position to obtain
software patents than the majority of programmers are. Each program
consists of thousands of ideas -- each of them potentially subject to
patent claims. Even though the European Patent Convention explicitly
excludes software from being patented, so far 30,000 software patents
have in fact already been granted in recent years."
Full Story (comments: none)
Commercial announcements
The Linux Professional Institute is collaborating with the
United Nations Development Program (UNDP) and LinuxIT to provide
Linux education and certification programs in the developing world.
"
The UNDP, together with LinuxIT, are supporting the creation of high-quality Linux courseware to be
distributed freely under an open source license. Complementing this initiative, LPI is working with
the UNDP to provide world-standard Linux skills certification at reduced cost in developing
countries in South Asia."
Full Story (comments: none)
ZDNet
covers the investment of $3 Million by NTT DoCoMo in MontaVista Software.
"
Japanese mobile provider NTT DoCoMo has invested a $3m equity stake in Linux developer MontaVista Software.
In a press statement, DoCoMo said it hoped the investment would allow it to improve its Linux products."
Comments (none posted)
Sub300.com has
announced
that for the next ninety days half of all proceeds from the Linux Challenge
Bundle (a two CD set with Linspire 4.5, OpenOffice.org and Firefox) will go
to the Red Cross with the money earmarked for aid and relief of the victims
of the tsunami.
Comments (none posted)
SCOfacts.org has posted audio and video from the November 24 hearing
in the SCO v. DaimlerChrysler case - the one where SCO was denied a stay in
the case. It's available
on the DaimlerChrysler
update page. Al Petrofsky, proprieter of scofacts.org, tells us: "
If
nothing else, it's of interest to people who would like to see what a SCO
lawyer losing an argument looks like."
Comments (4 posted)
New Books
O'Reilly has published the book
Home Hacking Projects for Geeks by
Eric Faulkner and Tony Northrup.
Full Story (comments: none)
O'Reilly has published the book
Learning GNU Emacs, Third Edition
by Debra Cameron, James Elliott, Marc Loy, Eric Raymond, and Bill Rosenblatt.
Full Story (comments: none)
Prentice Hall PTR has published the book
Java Application Development on Linux by
Carl Albing and Michael Schwarz.
Full Story (comments: none)
Syngress Publishing has published the book
Hacking a Terror Network: The Silent Threat of Covert Channels
by Matthew Devost.
Full Story (comments: none)
Resources
IBM
has published a new Linux Client Migration Cookbook (in PDF format).
"
The goal of this IBM Redbook is to provide a technical planning reference for IT organizations large or small that are now considering a migration to Linux-based personal computers. For Linux, there is a tremendous amount of how to information available online that addresses specific and very technical operating system configuration issues, platform-specific installation methods, user interface customizations, etc. This book includes some technical how to as well, but the overall focus of the content in this book is to walk the reader through some of the important considerations and planning issues you could encounter during a migration project. Within the context of a pre-existing Microsoft Windows-based environment, we attempt to present a more holistic, end-to-end view of the technical challenges and methods necessary to complete a successful migration to Linux-based clients."
Thanks to Steve Head.
Comments (none posted)
The December 29, 2004 edition of the Linux Documentation Project Weekly News
is available, take a look for the latest documentation updates.
Full Story (comments: none)
The January 5, 2005 edition of the Linux Documentation Project Weekly News
is out with the latest new documentation.
Full Story (comments: none)
The January 2005 edition of the
Linux Gazette is out.
Articles in this edition include;
Free as in Freedom: Part One:
GNU/Linux, by Adam Engel,
ParallelKnoppix, by hameed,
A
Knight's Tour on OCaml (when a Python fails to digest it), by Kapil
Hari Paranjape,
Preparing For My Interviews Part 2: MySQL and
Python, by Mark Nielsen,
Flickr and Perl, by Jimmy O'Regan,
Bash Shell and Beyond, by William Park, and more.
Comments (4 posted)
Contests and Awards
Voting is open for the 2004 LinuxQuestions.org Members Choice Awards.
"
Awards will be given out in 24 categories,
including Distribution of the Year, Browser of the Year, Multimedia App of
the Year, Office Suite of the Year and Security App of the Year. The
polls will close on February 3rd and winners will be able to pick up their
awards in Boston at the LinuxQuestions.org LinuxWorld Expo booth."
Full Story (comments: none)
Upcoming Events
Open Source Development Labs (OSDL) has
announced the companies that will be exhibiting at the
OSDL Enterprise Linux Summit.
"
The Open Source
Development Labs, a global consortium dedicated to accelerating
the adoption of Linux in the enterprise, today announced the addition
of AMD, CA and Red Hat,
Inc., among others, to the lineup of exhibits at OSDL's Enterprise
Linux Summit. Aduva, Barracuda Networks, Black Duck Software,
DigitalGuru Computer Bookshops, Eclipse Foundation, Gelato,
Levanta, Open Country, OverNite Software and RLX Technologies are also
exhibiting.
OSDL's Enterprise Linux Summit will take place January 31 -
February 2, 2005 in Burlingame, CA."
Comments (none posted)
Registrations for Linux.conf.au (Canberra, April 18 to 23) are now open.
The
list of speakers has
also been posted; it looks like another great event.
Full Story (comments: none)
A Linux Audio Miniconf will be held at the 2005 linux.conf.au
in Canberra, Australia during April, 2005.
Papers should be submitted by February 20.
Full Story (comments: none)
A call for participation has gone out for the first OpenOffice.org
Miniconf, the event will be part of the LCA 2005 conference in
Canberra, Australia on April 19-20, 2005.
"
Presentations will be given over the two days and will take on two major
themes for the conference User and Community, and Development. Any
topic is allowed based around OpenOffice.org, the cross-platform office
productivity suite."
Full Story (comments: none)
A call for papers has gone out for the fourth international SAMBA conference.
The event will be held in Göttingen, Germany on May 2-4, 2005, papers
should be in by March 14.
Full Story (comments: none)
The final
call for papers has gone out for the 2005 UK Python Conference.
The event will take place in Oxford, England on April 20-23, 2005.
Papers are due by January 6.
Comments (none posted)
PyCon 2005, the third annual Python developers' conference, will be held
at George Washington University's Cafritz Conference Center in Washington
DC on March 23-25, 2005. The keynote speaker will be Jim Hugunin, author
of IronPython. IronPython is a new implementation of the Python
programming language for the Microsoft .NET and open-source Mono
platforms.
Full Story (comments: 1)
An information update is available for the 2005 International Computer
Music conference. The event will take place on September 5-9, 2005
in Barcelona, Spain.
Full Story (comments: none)
Use Perl has a
Call for Papers
for the YAPC::EU::2005 conference. The event will take place in
Braga, Portugal from 31 August to 2 September, 2005.
Comments (none posted)
| Date | Event | Location |
| January 14, 2005 | PHP West Web Services
conference | (HR MacMillan Space Centre)Vancouver, BC,
Canada |
| January 28 - February 4, 2005 | Asia
Source | (Visthar training venue)Bangalore, India |
| January 31 - February 2, 2005 | OSDL
Enterprise Linux Summit | (Hyatt Hotel)Burlingame,
California |
| February 2 - 3, 2005 | Solutions
Linux 2004 | (CNIT, Paris la Défense)Paris, France |
| February 7 - 11, 2005 | GlobusWORLD | (Sheraton Boston Hotel)Boston,
MA |
| February 9 - 11, 2005 | German
Perl-Workshop 2005 | Dresden, Germany |
| February 9 - 11, 2005 | Third-Annual
Desktop Linux Summit | (Del Mar Fairgrounds)San Diego, CA |
| February 9, 2005 | OOo
RegiCon North America | (Del Mar Fairgrounds)San Diego,
CA |
| February 11 - 13, 2005 | CodeCon
2005 | San Francisco, CA |
| February 12 - 13, 2005 | Southern California
Linux Expo 2005(SCALE) | (Los Angeles Convention Center)Los Angeles,
CA |
| February 14 - 17, 2005 | Linux World
Conference and Expo | (Hynes Convention Center)Boston, MA |
| February 24 - 25, 2005 | UKUUG
LISA/Winter Conference | Birmingham, UK |
| February 25, 2005 | Dutch Perl
Workshop | Amsterdam, the Netherlands |
| February 26 - 27, 2005 | Free and Open Source
Developers' European Meeting(FOSDEM 2005) | Brussels,
Belgium |
| February 28 - March 3, 2005 | EclipseCon 2005 | (Hyatt
Regency)Burlingame, CA |
| March 1 - 2, 2005 | JBoss World 2005 User
Conference | (Omni/CNN Center)Atlanta, GA |
| March 2 - 4, 2005 | Security-Enhanced
Linux Symposium | Silver Spring, Maryland |
Comments (none posted)
Web sites
Dave Philips has updated his Linux audio
musings column
for November/December 2004. Read about the latest new
Linux audio software releases, upcoming conferences, and more.
Comments (none posted)
Page editor: Forrest Cook
Letters to the editor
| From: |
| Leon Brooks <leon-olc-AT-cyberknights.com.au> |
| To: |
| Robert Weisman <weisman-AT-globe.com>,
Herald Tribune Letters <letters-AT-iht.com> |
| Subject: |
| Blessing and cursing |
| Date: |
| Wed, 29 Dec 2004 08:39:34 +0800 |
| Cc: |
| Linux Weekly News <letters-AT-lwn.net> |
Good morning (well, it's morning here), Mr Weisman;
WRT http://www.iht.com/articles/2004/12/28/business/code.html -
> The improper use of open-source components, in the worst-case
> scenario, could subject companies to costly litigation from
> parties like SCO Group of Lindon, Utah.
I very much hope so. The more of these idiots that get spectacularly shot down
like TSG is, the fewer fellow idiots are going to try barratry as a career
path.
However, doing business today in any form exposes you to an ever-increasing
risk of suit. Open Source has nothing to do with the problem. Your article is
trying to draw a connection which does not exist.
> SCO says it owns intellectual property in the Linux open-source
> operating system
No they don't. Not in court, at least.
"Intellectual Property" comes in four basic forms: Patents, Copyrights,
Trademarks and Trade Secrets.
None of these are at issue in TSG vs IBM.
The case revolves around a contract dispute, and even the bulk of the material
involved in the contract dispute turns out to have been already Opened one
way or another.
> Jothy Rosenberg, chief executive and chief technical officer of
> Service Integrity,
Quoting an officer of a company with an immediate vested interest in the kind
of uncertainty generated by your article is hardly clever, to say nothing of
what it does to the authority of the quote.
> who this month ordered a 24-hour scanning of his company's Sift 3.5
> software during a "code freeze" before its introduction.
> "In this day and age, anybody building a commercial piece of software
> has got to do this. It's like buying insurance on your building."
It also has nothing substantial to do with Open Source.
If anything, Open Source makes Rosenberg's job much easier. Can you imagine
the fun and games involved in getting hold of a copy of (say) MS-Office's
source code so you can scan your software against it for copyright clashes?
> anyone who acquires and modifies open-source code must make their
> modified versions freely available to the public. Depending on how
> many files of code are covered and what is in them, such a
> requirement can sometimes be a major impediment for a proprietary
> software company.
Robert, this issue has long been dead and buried. It's hardly credible that
anyone writing with authority in any IT field can now claim to be ignorant of
this.
If you don't like the GPL, simply eschew the head-start gained by basing your
own code on it. Don't use it. Write your own code! Nobody's putting a gun to
your temple and forcing you to use anyone else's code, now, are they?
And again: can you imagine the trauma and hullabaloo which would ensue if you
based an application on the source code for Adobe Illustrator?
In every way, Open Source software gives you the advantages, the safety and
the choices and yet you're presenting it here as if it's a bad thing.
If Open Source software is the big risk-and-expense that you claim, then why
are these companies so eager to use it in the first place?
> Among the scariest aspects of the problem is that many business
> executives do not know whether open-source code is in their
> software, or they mistakenly presume that they have none. Either
> way, they could be setting themselves up for a lawsuit.
Two things to note here are that (1) if their control of their own product is
so pathetic, they really do deserve to go to the wall; and (2) if they steal
someone else's code, Open or closed, then they really do deserve to go to the
wall. Please let it happen soon, let natural attrition work its way so they
can be off our collective backs!
> Software developers working on "value-added" applications routinely
> borrow pieces of open-source code as building blocks for such
> functions as encryption, security or platform interfacing.
Let's have a look at those. SSL and TLS are widely used security protocols
provided by the OpenSSL library. OpenSSL uses a BSD-ish licence. All you need
to do to comply with this is include three short sentences in your product's
documentation:
This product includes software developed by the OpenSSL Project for
use in the OpenSSL Toolkit (http://www.openssl.org/). This product
includes cryptographic software written by
Eric Young <eay@cryptsoft.com>. This product includes software
written by Tim Hudson <tjh@cryptsoft.com>.
Having done this, you can modify and derive OpenSSL to your heart's content.
It's not like an entire encryption layer is going to magically appear
unnoticed in your product, so if this bites you on the butt, you get bitten
for gross stupidity, not for using Open Source. Once again, contrast the
consequences with what would happen if you sliced a TLS layer out of
MS-Windows 2000 and used that instead.
Now a typical GPL example: Samba. The first question to ask is since this is a
complete CIFS implementation, independently functional, why would you want to
modify it? If you don't modify it, you don't need to release any source.
For the case where it is indeed tempting to borrow and expand a Samba
component, say you wanted to modify the "smbtorture" diagnostic tool to do
something hinky with the CIFS protocol so you can use it for your own private
authentication scheme, there are two major cases:
1. What you want to do is trivial, in which case either just release
the modified code or write it from scratch yourself (as you would
do if Samba didn't exist); or
2. What you want to do is not trivial, in which case the modifications
will be extensive: so write your own code, it won't be that much
extra work.
Proprietary software companies like BabelMedia use Samba every day. It hasn't
caused them any licence problems, they haven't put any of their own software
at risk, and they haven't gone out of their way at all to achieve this.
City administrations are notoriously sensitive to licence issues, and yet a
major driver of the City of Bergen's move to (GPLed) Linux has been the cost
savings in using (GPLed) Samba for file-serving.
Even if you don't use any Samba code, you'll still be ahead of the game by
using their excellent documentation, which in many places more accurately
reflects what's happening on the wire than Microsoft's own documentation.
> SCO has since sued DaimlerChrysler, AutoZone and Novell
The DC suit has since been dismissed and the other suits made dependent on the
outcome of the IBM suit, which as I mentioned above is looking very gloomy
for TSG. All of this is a matter of public record, as accessible to IT
journalists as to anyone else.
When the rubble finally stops bouncing, TSG are going to be an eloquent object
lesson for anyone else selfish enough to try blackmail as a business model.
> Businesses fear that SCO's flurry of lawsuits may be a sign of
> trouble to come.
Only businesses that are silly enough to believe ill-researched (I hope, since
the alternatives are not as pleasant) articles like that one.
Think of it as evolution in action. By scaring these companies away from Open
Source, you are leaving their competitors a clear field in which to take
advantage of it. Eventually, the companies gullible enough to believe that
article will be crushed by the absence of that competitive advantage. In the
long term, you're doing in your own target audience!
> Scott Nathan, a lawyer,
...with a vested interest in the outcome, like all of your references so
far...
> said. "If SCO is successful, there are going to be copycats."
There's the sand in your vaseline. For TSG to be successful in any meaningful
way, they'd have to first prove ownership of some significant piece of Linux,
then prove that they suffered damage by its inclusion, then identify the
person responsible for its inclusion and sue _them_ for the damages, rather
than some random corporation among the thousands using Linux.
And by the time they got that far, any offending code would be ripped and
replaced fast enough to create a sonic boom. There would be no ongoing
damages.
So far, they're not up to Step One.
Every time TSG tried to increase their ownership claims, they wound up in a
poorer position, and with more of the evidence involved now a part of the
public record. Amongst other things, a lot of the mystery surrounding the
original BSD court case has been cleared up, and evidence clearly pointing
out that Novell still own the copyrights etc on that disputed code has been
turned up. Read all about it from the original court documents here:
http://www.groklaw.net/
http://scofacts.org/
> "[...] you might be seen as a deep pocket" by litigious SCO copycats,
> said Thomas Carey, an attorney
Vested interest again? Goodness me, do you have _any_ independent opinions?
When have you _ever_ seen a lawyer give a non-fear-based non-worst-case
answer to a journalist?
> "If we violated something and get sued, their investments would
> vaporize like that," Rosenberg, the chief of Service Integrity, said.
I should hope so. Venture capital _should_ vanish in the face of gross
negligence.
Even so, and speaking of gross negligence, there are several remedies to
pursue with an Open Source inclusion, and your article hasn't even hinted
that any of them might exist.
Unlike the Microsofts and Adobes of the world, very few Open Source providers
are highly litigious. This means that if _someone_else_ discovers Open Source
code buried in your software, the usual remedy is to simply replace it.
The exact case you're waving about portentously has actually happened many
times already, but you again don't even hint that this might be so. Was this
gross carelessness again, or is there an agenda tucked away in there?
LinkSys were discovered to be running a modified version of Linux on some of
their routers. The remedy so far employed has been the publication of the
sources to the modified software, but not to the "secret sauce" network
interface driver. Open Source RTL8xxx drivers were subsequently written by
others.
The LinkSys WRT54G and related routers have since seen an increasing amount of
use as a cheap and readily available embedded platform, and LinkSys are
selling more of them as a result of having released their modifications as
they originally should have.
They've also skipped the royalties other embedded systems would have required,
and the expense and lead time of writing it all themselves from scratch.
In another example, Minitar were found to be using modified Linux in their
routers without releasing source, and the solution in this case was to
convince the network card manufacturer to Open their drivers, so the entire
codebase for the router could be released.
Again, Minitar are selling more gear through having Opened their code than
they would be if they hadn't, so again the solution has been beneficial all
round.
These two examples are reasonably representative. If you had the best
interests of your readers at heart, you would have encouraged them to find
out more and ride the Open Source bandwagon for all it's worth instead of
spreading TSG's fear-and-doubt propaganda.
Unlike traditional business where each participant fights for the biggest
share of a fixed-size pie, Open Source is all about making the whole pie
bigger.
Please get it right next time, if there is a next time.
Cheers; Leon
--
http://cyberknights.com.au/ Modern tools; traditional dedication
http://plug.linux.org.au/ Vice President, Perth Linux User Group
http://osia.net.au/ Member, Open Source Industry Australia
http://slpwa.asn.au/ Member, Linux Professionals WA
http://linux.org.au/ Member, Linux Australia
Comments (8 posted)
| From: |
| Mikko Rauhala <mjrauhal-AT-cs.helsinki.fi> |
| To: |
| lwn-AT-lwn.net |
| Subject: |
| My open letter to Wlodzimierz Marcinski |
| Date: |
| Thu, 23 Dec 2004 17:37:56 +0200 |
Preface: This is an open letter from Mikko Rauhala of the Department
of Computer Science of the University of Helsinki to Undersecretary
Wlodzimierz Marcinski of Poland. Reproduction and publication are
permitted and encouraged as long as the text is unmodified. The
author would be glad to be notified of such publications via
E-mail to mjrauhal@cs.helsinki.fi, but this is not required.
Dear Undersecretary Wlodzimierz Marcinski,
I was positively elated to hear about you standing up to the pressures
of certain other parties in the EU Council of Ministers and getting
the Software Patent Directive in its current form off of the Agenda
of the Council of Agriculture and Fisheries. The citizens of EU owe you
a debt of gratitude for this upstanding act of defending democracy,
innovation and competition within the Union.
I am sure you are more informed than myself about the backhanded
dealings within the Council to completely disregard the Parliament's
view on software idea patents in their so-called compromise text.
You can also probably well imagine the dealings that have led to
some parties' insistence on wider patentability. Nevertheless, in the
hope that it might prove somehow useful, I would like to offer my
admittedly limited insight on how things seem to have progressed here
in Finland, if even just to affirm what you might already reasonably
suspect.
In the autumn of 2003 there was a hearing on the Parliament's version
of the directive text here in Helsinki. Among others, the Department
of Computer Science of the University of Helsinki was invited. I had
already been working there for a couple of years, and the department
head appointed me as our official representative at the hearing. Also,
as it happens, Electronic Frontier Finland¹, which concentrates on
defending civil and consumer rights in the digital age, did not
receive a timely invitation to the hearing. Luckily, I happened to be
on the board of EFFI at the time, and was recognized as representing
them also.
With the notable exception of Finland's Parliament member Jyrki Kasvi,
who had come to the hearing uninvited, there were no other opponents
of software idea patents present, and neither were there any other
representatives of the scientific community. In fact, mostly the
participants seemed to be composed of three interest groups: big
business (as represented by Nokia), lawyers and the National Board of
Patents and Registration of Finland. In other words, these were people
who were standing to gain personally from wide patentability of
software ideas: Nokia could better strong-arm smaller competitors into
submission, patent lawyers would become indispensable for everyone
wishing to write and market software, and the patent office wouldn't
have to worry about losing work or funding any time soon.
Even though software idea patent proponents tend to talk about
such high ideals as promoting the progress of science and useful
arts, it comes as no big surprise that the actual opinion of the
part of the scientific community I was representing didn't carry
much weight in the proceedings, and that the civil rights issues²
were likewise dismissed altogether. It was also widely argued that the
EU Parliament's directive text was too unclear on what was patentable.
Curiously, the correct remedy seemed always to be to clearly allow
wide patentability of software ideas. On the whole, I would summarize
the hearing as the aforementioned parties asking for our government
to please make others give them more money (albeit not in such a
straightforward manner). The government apparently thought this
to be a reasonable suggestion.
Thus it came to pass that Finland supported walking over the EU
Parliament and sacrificing the interests of both private individuals
and small and medium-sized enterprises in favor of lawyers and
aspiring monopolists. Sadly, not many have had the courage to oppose
this practice of perverting supposedly democratic processes into
something better described as plutocracy.
I know that this particular fight is not over yet, and that there are
many other issues where the interests of the rich and the powerful are
likely to take precedence also in the minds of many a politician.
However, Poland's example gives me some hope in a democratic Europe
once more. Hopefully it will also inspire others, especially the EU
newcomers, to take a similar stand as equal members of the Union
and not be intimidated into compliance by entrenched political powers.
Yours Truly,
Mikko Rauhala
¹ See <URL: http://www.effi.org/index.en.html >. EFFI is also a
founding member of European Digital Rights (EDRi), see
<URL: http://www.edri.org/ >.
² I do consider it a civil rights issue when the rights of
individuals to write original software and earn a living off of
their work is threatened by monopolizing programming practices.
Strangely enough, some do not.
--
Mikko Rauhala <mjrauhal@cs.helsinki.fi>
University of Helsinki
Comments (none posted)
Page editor: Jonathan Corbet