Last January, we made a number of
predictions about what the year held for the Linux community. One of those
read as follows:
Desktop Linux will be taken far more seriously by the end of the
year.... At that point, the Linux desktop will have almost
everything needed by a large number of desktop users. More
specialized applications will take years to fill in, but the basics
are coming into place.
Normally we don't say much about our past predictions, in the hope that our
readers will forget them as soon as possible. We may not do any worse than
those analyst groups that sell their predictions printed on heavy paper,
but we still find ourselves embarrassed by the things we say at times. In
this case, however, we just might have gotten it right.
The latest development on the Linux desktop front is SuSE's announcement of the "SuSE Linux Office
Desktop," a new version of its distribution which is due out in January.
This distribution is, of course, aimed at the desktop market; it features
(relatively) easy administration, a full set of office productivity tools
(based on StarOffice), and CrossOver Office for those proprietary
applications that simply cannot be done without.
SuSE, of course, is not alone in its new emphasis on the desktop. Red Hat
Linux 8.0 includes a reworked, friendlier desktop. Distributions like
Lycoris and Xandros are aimed at desktop users; Mandrake Linux, of course,
has always had this emphasis. There is a Debian Desktop
Project out there. Linux systems can even be purchased at outlets like
Wal-Mart.
Not too long ago, even the strongest Linux
advocates mostly agreed that Linux was only suited to
server-oriented tasks. Now, more and more people think that Linux is ready for
desktop tasks, and, perhaps more to the point, that there is money to be
made in desktop Linux.
One might well wonder why desktop Linux is coming into its own now. There
are several possible reasons:
- The set of free desktop applications is maturing. Tools like
OpenOffice, AbiWord, Gnumeric, Mozilla, Konqueror, etc. have reached a
point where they are good enough for most users. The feature lists
may still fall short of the proprietary competition in some cases, but
most of the truly important features are there.
- The Wine project, in the form of products like CrossOver Office,
has, after many years, reached a point where it can run the
proprietary applications desktop users rely on. The availability of
these applications makes the Linux desktop that much more valuable.
- The difficult economy and Microsoft's licensing schemes have made
companies more interested in ways of saving money.
- People are finally beginning to notice that Linux users don't
have to spend their time fighting the virus of the week.
- Linux has clearly survived the dotcom crash - a fact which still
surprises many people. Fears that Linux will vanish like so many
other highly-hyped technologies are fading away.
The theory of "disruptive technologies" states that a new technology does
not have to be better than the one it replaces - at least, not in every
way. It is enough to offer advantages, financial and otherwise, that are
sufficiently compelling to get people to make a change. Linux (and free
software in general) have a lot to offer in cost savings, security, rapid
and open development, freedom from vendor lock-in, etc. Increasingly,
Linux also has applications that perform widely useful functions, and which
are becoming easier to use. Many of these applications are on their way
toward becoming the best available, free or otherwise. We are, it seems,
reaching that point where the balance begins to tip. This may truly be the
beginning of the era of the free desktop.
We should not lose track of the fact that a great deal remains to be done
before free desktops can truly achieve World Domination, however. Linux
administration is getting easier, but remains difficult. Linux
applications still lack features that many users want. A visit to any
computer store will show that there is a whole range of applications that
are still absent on Linux: where are the children's games, menu planners,
language courses, tax return preparers,
home remodel designers, and makeover assistants for
Linux? When your Linux system will help you look like the Cosmo Girl,
we'll know we have truly arrived. But that day will remain distant until
Linux becomes a more friendly platform for proprietary applications.
It is also worth noting that development on the Linux kernel has emphasized
performance on very large systems just as it looks like the Linux desktop
is going to take off. Performance on smaller systems is supposed to be
addressed during the stabilization period. Testing by desktop users will
be an important part of that process; as more people test out the
development kernel in the coming months, it becomes increasingly likely
that the next stable kernel release will meet the needs of desktop users.
The true triumph of the free desktop is still probably some years away. A
great deal of hard work remains to be done. But the results of years of
effort by thousands of developers determined to improve the Linux desktop
experience are beginning to be felt in a serious way. It is going to be
fun to watch where things go from here.
Comments (11 posted)
The MITRE corporation has just released the results of a study it performed
on the use of free and open source software (which it calls "FOSS") within
the U.S. Department of Defense. It is an interesting look at how the DoD
uses free software, and what would happen if an anti-free-software policy
were to be adopted. The full study is available as
a 160-page PDF file; here
you'll find a rather shorter summary of what it says.
The question that this study was meant to answer seems to be "should the
military ban the use of free software?" The conclusion they came to is
clear:
Neither the survey nor the analysis supports the premise that
banning or seriously restricting FOSS would benefit DoD security or
defensive capabilities. To the contrary, the combination of an
ambiguous status and largely ungrounded fears that it cannot be
used with other types of software are keeping FOSS from reaching
optimal levels of use.
Looking at one area in particular, the report continues:
The main conclusion of the analysis was that FOSS software plays a
more critical role in the DoD than has generally been
recognized... One unexpected result was the degree to which
security depends on FOSS... Taken together, these factors imply
that banning FOSS would have immediate, broad, and strongly
negative impacts on the ability of many sensitive and
security-focused DoD groups to defend against cyberattacks.
The report looks at free software licenses in considerable detail in a
deliberate attempt to address a number of institutional fears about those
licenses. Worries about licensing, say the authors, have led to a
suboptimal level of free software usage. It is a reasonably
straightforward and accurate study; for added fun, they look at the EULA
for Microsoft's "Mobile Internet Toolkit" and compare its terms with those
of free licenses. "However, unlike the Microsoft MIT EULA, the GPL
places no constraints on software simply running on the same system, and
actually goes out of its way not to intrude on other licenses outside of
that context."
The report includes a survey of how free software is used within the DoD
now. They break that usage down into four categories:
- Infrastructure, using tools like sendmail and apache.
- Software development, especially with gcc and Perl.
- Security, including intrusion detection systems, security
analysis tools (i.e. SARA and Snort), and secured operating systems
like OpenBSD. "Yet another important way in which FOSS
contributes to security is by making it possible to change and fix
security holes quickly in the face of new modes of cyberattack. This
ability, which allows rapid response to new or innovative forms of
cyberattack, is intrinsic to the FOSS approach and generally
impractical in closed source products."
- Research, which benefits from Linux clusters and the general
culture of free software.
The report authors looked at costs, of course:
More often than not, the strongest deciding factors for choosing
FOSS products were capability and reliability, with cost being an
important but secondary factor.
They note one other important factor regarding free software and costs:
Without the constant pressure of low-cost, high-quality FOSS
products competing with the closed-source products, the
closed-source vendors could more easily fall into a cycle in which
their support costs balloon and costs are passed on to their
locked-in customers.
The report concludes with three recommendations that, they say, would help the
DoD make optimal use of free software. They are:
- Create a "generally recognized as safe" list of free software. 115
free applications found by the survey would be the starting point for
this list. Suggested "applications" include, however, Linux, OpenBSD,
NetBSD, and FreeBSD, so this list would be pretty general.
- Develop generic infrastructure, development, security, and research
policies. These policies would promote the use of free software in
situations where it is deemed appropriate.
- Encourage use of FOSS to promote product diversity.
"Acquisition diversity reduces the cost and security risks of
being fully dependent no a single software product, while
architectural diversity lowers the risk of catastrophic cyber attacks
based on automated exploitation of specific features for flaws of very
widely deployed products."
Finally, a set of appendices provides lists of free software applications
in use within the DoD, and the full text of a large number of free software
licenses.
If the DoD was seriously considering banning free software, one can only
hope that this report will put an end to such thoughts. Through a great
deal of detailed research, the report's authors have demonstrated that the
Department of Defense is already heavily dependent on free software, and
would be badly hurt if use such software were forbidden. Increasingly,
free software is crucial part of the systems we all use, and that, of
course, is a good thing.
Comments (7 posted)
It's time for our weekly report to our readers. Read on for the latest
subscription counts and a few bits of site news.
As of this writing, we are getting close to 2200 subscribers. That still
leaves us far short of our medium-term goal of 4000.
Things are headed in the right direction,
however; with continued support from our readers, we hope that we will get
to where we need to be before too long.
We are also encouraged by a small increase in the rate of corporate
subscriptions. They still fall short of our hopes, but there are signs
that the bureaucratic wheels are beginning to turn. If you work for a
company that could benefit from a subscription, please consider talking to
them about setting one up.
This week we were also able to announce a
group subscription for the Debian project, which has been funded by HP.
Debian developers are encouraged to read the announcement for information
on how to get access to this subscription.
For those of you who have been requesting the ability to pay with American
Express: we have finally managed to get that set up. Progress on setting
up a Euro-zone bank account has been slower; it looks like that will not be
a viable option anytime soon. The best approach for
accepting funds from Europeans without credit cards may turn out to be to
simply have
those people send us checks. We're still working on that one, though.
There has been a small stream of requests for a stable URL for the latest
free version of the Weekly Edition. That has now been implemented; the
current free weekly can be found at:
Of course, lwn.net/current continues to refer to the
most recent (subscription) Weekly Edition.
We have been having some trouble with sites blocking mail from the LWN
server
(things like the various LWN mailing lists and subscription notices). That
mail originates from our production server, which is donated to us by
Rackspace. Some people, evidently, have received a lot of spam from
Rackspace-hosted systems, and have simply blocked the entire Rackspace network.
Rackspace tells us that they shut down spammers as soon as they know of
them, but it's an ongoing battle. Meanwhile, we are looking into other
ways of
generating and routing mail so that this problem, hopefully, will be behind
us soon.
For those of you making your holiday shopping lists: LWN gift certificates
will be available shortly. The work is mostly done, but won't be completed
at this point until after the weekly publication cycle. Stay tuned for the
announcement.
That is the LWN news for this week. Thanks, as always, for your support.
Comments (19 posted)
For the second week in a row, we have no "letters to the editor" page,
since nobody sent us any letters. The reduction in readership caused by
the subscription gate probably has a lot to do with that. Still, we would
like to hear from you; if you have comments you would like to see
published, please feel free to send them to
letters@lwn.net.
Comments (5 posted)
Page editor: Jonathan Corbet
Security
Brief items
Worth a read:
this article
by ICANN board member Karl Auerbach on how to protect the domain name
system against denial of service attacks. Mr, Auerbach's fundamental point
is simple: the DNS is a uniquely vulnerable component of the Internet
because it is centralized. The net as a whole has no center, but the DNS
depends heavily on its root servers. Most of the suggestions for improving
the security of DNS thus involve spreading things out, and making them
diverse and redundant.
The suggestions are:
- Make copies of the root DNS zone files available, and disperse them
everywhere.
- Create multiple roots for the DNS system.
- Create an early warning system which raises the alarm when it detects
the beginning of a denial of service attack.
- Create a set of canned router filters which can be quickly applied to
protect the root DNS servers in case of an attack.
- Have a plan for moving a root server elsewhere on the Internet should
that server come under attack.
- Create alternative DNS server software, so that not everybody is
running bind.
All of these suggestions make sense, of course, in many contexts other than
the domain name system. It is important to replicate crucial data, spread
your vital resources out, have fallback plans, and to have a diverse
software base. We will see whether these ideas are actually heard by the
DNS Powers That Be, however.
Comments (1 posted)
New vulnerabilities
inn: format string and insecure open vulnerabilities
| Package(s): | inn |
CVE #(s): | |
| Created: | October 31, 2002 |
Updated: | October 31, 2002 |
| Description: |
There are several format string coding bugs as well as unsecure open()
calls in the inn program. |
| Alerts: |
|
Comments (none posted)
krb5: Buffer Overflow in Kerberos Administration Daemon
| Package(s): | krb5, heimdal |
CVE #(s): | CAN-2002-1235
|
| Created: | October 29, 2002 |
Updated: | January 14, 2003 |
| Description: |
CERT Advisory CA-2002-29 Buffer Overflow in Kerberos Administration Daemon
Systems Affected
- MIT Kerberos version 4 and version 5 up to and including
krb5-1.2.6
- KTH eBones prior to version 1.2.1 and KTH Heimdal prior to version
0.5.1
- Other Kerberos implementations derived from vulnerable MIT or KTH
code
Overview
Multiple Kerberos distributions contain a remotely exploitable buffer
overflow in the Kerberos administration daemon. A remote attacker
could exploit this vulnerability to gain root privileges on a
vulnerable system.
The CERT/CC has received reports that indicate that this vulnerability
is being exploited. In addition, MIT advisory MITKRB5-SA-2002-002
notes that an exploit is circulating.
We strongly encourage sites that use vulnerable Kerberos distributions
to verify the integrity of their systems and apply patches or upgrade
as appropriate. |
| Alerts: |
|
Comments (none posted)
zope: Insecure XML-RPC exception handling
| Package(s): | zope |
CVE #(s): | |
| Created: | October 31, 2002 |
Updated: | October 31, 2002 |
| Description: |
Zope will reveal the complete physical
location where the server and its components are installed if it receives
"incorrect" XML-RPC requests.
In some cases it will also reveal information about the serves in the
protected LAN (10.x.x.x for example).
More information is available at:
http://collector.zope.org/Zope/359 |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
Apache shared memory scoreboard vulnerabilities
| Package(s): | apache |
CVE #(s): | CAN-2002-0839
|
| Created: | October 9, 2002 |
Updated: | December 18, 2002 |
| Description: |
Versions of Apache prior to 1.3.27 contain a couple of scoreboard-related
vulnerabilities which can be exploited by local users running under the
Apache user ID. In-server scripting languages, such as PHP, are the most
likely means of carrying out the attacks. One vulnerability causes the
server to fork off new processes, leading to denial of service scenarios;
the other allows an attacker to send SIGUSR1 to any process as root,
probably killing that process. See this
iDEFENSE advisory for the details. |
| Alerts: |
|
Comments (3 posted)
Heap corruption vulnerability in at
| Package(s): | at at, sudo, xchat |
CVE #(s): | CAN-2002-0004
|
| Created: | May 21, 2002 |
Updated: | May 15, 2003 |
| Description: |
The at command has a
potentially exploitable heap corruption bug.
(First LWN report: January 17th).
|
| Alerts: |
|
Comments (none posted)
bind buffer overflow vulnerability in DNS resolver libraries
| Package(s): | bind glibc |
CVE #(s): | CAN-2002-0651
CAN-2002-0684
|
| Created: | July 8, 2002 |
Updated: | October 1, 2003 |
| Description: |
The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1)
include fixes for a libc related vulnerability which does not
affect Linux. Updates from
the Internet Software Consortium (ISC)
are available from here.
No release or branch of Openwall GNU/*/Linux (Owl) is known to be
affected, due to Olaf Kirch's fixes for this problem getting into the
GNU C library more than two years ago.
Unfortunatly that does not mean that Linux systems are not vulnerable.
Similar code, without Olaf Firch's fixes,
is in the glibc getnetbyXXX functions.
These functions are described in the SuSE alert as
"
used by very few applications only, such as ifconfig and ifuser,
which makes exploits less likely."
CERT Advisory: CA-2002-19
Buffer Overflow in Multiple DNS Resolver Libraries
CAN-2002-0651
CAN-2002-0684 |
| Alerts: |
|
Comments (1 posted)
bzip2: file creation and symbolic link vulnerabilities
| Package(s): | bzip2 |
CVE #(s): | CAN-2002-0759
CAN-2002-0760
CAN-2002-0761
|
| Created: | October 29, 2002 |
Updated: | October 31, 2002 |
| Description: |
bzip2 does not use the O_EXCL flag to create files during
decompression and does not warn the user if an existing file
would be overwritten, which could allow attackers to overwrite
files via a bzip2 archive.
bzip2 decompresses files with world-readable permissions
before setting the permissions to what is specified in the
bzip2 archive, which could allow local users to read the files
as they are being decompressed.
bzip2 uses the permissions of symbolic links instead of the
actual files when creating an archive, which could cause the
files to be extracted with less restrictive permissions than
intended. |
| Alerts: |
|
Comments (none posted)
Potential unauthorized root access vulnerability in dietlibc
| Package(s): | dietlibc |
CVE #(s): | CAN-2002-0391
|
| Created: | August 14, 2002 |
Updated: | December 5, 2002 |
| Description: |
Felix von Leitner, discovered a
potential division by zero bug in
code derived from the SunRPC library with is used in
dietlibc, a libc optimized for small size.
The bug could be exploited to gain unauthorized root
access to software linking to dietlibc.
CERT/CC Vulnerability Note VU#192995 Integer
overflow in xdr_array() function when deserializing the XDR stream |
| Alerts: |
|
Comments (none posted)
dvips: command execution vulnerability
| Package(s): | dvips |
CVE #(s): | CAN-2002-0836
|
| Created: | October 16, 2002 |
Updated: | June 10, 2003 |
| Description: |
The dvips utility uses the system() function improperly when managing fonts. An attacker who can craft the right sort of print job can use this vulnerability to execute commands under the UID used by the print system. |
| Alerts: |
|
Comments (none posted)
Ethereal buffer overflow, infinite loop and memory management vulnerabilities
| Package(s): | ethereal |
CVE #(s): | CAN-2002-0012
CAN-2002-0013
CAN-2002-0353
CAN-2002-0401
CAN-2002-0402
CAN-2002-0403
CAN-2002-0404
|
| Created: | June 12, 2002 |
Updated: | October 27, 2002 |
| Description: |
Ethereal 0.9.4
was released
on May 19, 2002 fixing four potential security issues in Ethereal 0.9.3:
- The SMB dissector could potentially dereference a NULL pointer in two cases.
- The X11 dissector could potentially overflow a buffer while parsing keysyms.
- The DNS dissector could go into an infinite loop while reading a malformed packet.
- The GIOP dissector could potentially allocate large amounts of memory.
No known exploits exist "in the wild" at the present time for any of these issues.
Ethereal 0.9.2 has several packet handling vulnerabilities
that are best avoided by upgrading to 0.9.4.
The PROTOS test
suite found some flaws in SNMP and LDAP protocols support.
Malformed packets could also crash ethereal 0.9.2 due to a
ASN.1 zero-length g_malloc problem.
The zlib "double free" vulnerability
was addressed by the updates for that bug from many distributors. |
| Alerts: |
|
Comments (none posted)
Filename disclosure vulnerability in fam
| Package(s): | fam |
CVE #(s): | CAN-2002-0875
|
| Created: | August 19, 2002 |
Updated: | January 5, 2005 |
| Description: |
"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible. |
| Alerts: |
|
Comments (none posted)
Another set of fetchmail buffer overflows
| Package(s): | fetchmail fetchmail-ssl |
CVE #(s): | |
| Created: | October 1, 2002 |
Updated: | December 17, 2002 |
| Description: |
e-matters GmbH has issued an advisory
warning of a new set of buffer overflows in the fetchmail header parsing
code. The vulnerabilities have been fixed in fetchmail 6.1.0. |
| Alerts: |
|
Comments (none posted)
GNU fileutils race condition
| Package(s): | fileutils ucdsnmp |
CVE #(s): | CAN-2002-0435
|
| Created: | May 21, 2002 |
Updated: | May 16, 2003 |
| Description: |
A race
condition in rm may cause the root user to delete the whole filesystem.
The problem exists in the version of rm in
fileutils
4.1 stable and 4.1.6 development version. A patch
is available.
(First LWN
report: May 2).
|
| Alerts: |
|
Comments (none posted)
Potential remote root exploit in glibc
| Package(s): | glibc |
CVE #(s): | CAN-2002-0391
|
| Created: | August 14, 2002 |
Updated: | June 30, 2003 |
| Description: |
Felix von Leitner, discovered a
potential division by zero bug in
code derived from the SunRPC library which is used in glibc.This bug could be
exploited to gain unauthorized root access to software linking to glibc.
Updating as soon as practical is a good idea.
Because SunRPC-derived XDR libraries are used by a variety of vendors in a variety of applications, this defect may lead to a number of differing security problems. Exploiting this vulnerability will lead to denial of service, execution of arbitrary code, or the disclosure of sensitive information.
CERT/CC Vulnerability Note VU#192995 Integer
overflow in xdr_array() function when deserializing the XDR stream
|
| Alerts: |
|
Comments (none posted)
Buffer overflow in groff
| Package(s): | groff |
CVE #(s): | CAN-2002-0003
|
| Created: | May 21, 2002 |
Updated: | December 9, 2002 |
| Description: |
The groff package has a buffer overflow
vulnerability; if it is used with the print system, it is conceivably
exploitable remotely.
|
| Alerts: |
|
Comments (none posted)
Buffer overflow in gv
| Package(s): | gv |
CVE #(s): | CAN-2002-0838
|
| Created: | October 1, 2002 |
Updated: | November 25, 2002 |
| Description: |
gv, a graphical front end to ghostscript, has a buffer overflow
vulnerability which can be exploited by a properly crafted PostScript or
PDF file. If a user can be tricked into viewing such a file, arbitrary
code can be executed with that user's privileges. See this iDEFENSE advisory for the details. |
| Alerts: |
|
Comments (none posted)
heartbeat: remotely exploitable buffer overflow
| Package(s): | heartbeat |
CVE #(s): | |
| Created: | October 16, 2002 |
Updated: | November 6, 2002 |
| Description: |
The heartbeat failover system has a remotely exploitable buffer overflow
vulnerability; versions prior to 0.4.9e and 0.4.9.2 are affected. Any
system that is worth running heartbeat on is worth upgrading. See the advisory for the details. |
| Alerts: |
|
Comments (none posted)
UW imapd remotely exploitable buffer overflow
| Package(s): | imap |
CVE #(s): | CAN-2002-0379
|
| Created: | June 5, 2002 |
Updated: | December 20, 2002 |
| Description: |
UW imapd versions 2000c and prior allow remote authenticated users to execute code via a buffer overflow. A malicious user can craft
a request to run commands on the server under their UID and GID.
(First LWN report: May 23). |
| Alerts: |
|
Comments (2 posted)
Cross-site scripting vulnerability in Konqueror for KDE 3.0.3
| Package(s): | kdelibs |
CVE #(s): | |
| Created: | September 17, 2002 |
Updated: | November 18, 2002 |
| Description: |
Konqueror for KDE 3.0.3, and earlier versions, is subject to
this cross-site
scripting vulnerability.
Since the problem is in kdelibs, any other application which
uses the KHTML renderer is also vulnerable.
Javascript code running in one frame can
access other frames which should be inaccessible. The problem is
fixed in kdelibs 3.0.3a. |
| Alerts: |
|
Comments (2 posted)
kernel: several security issues fixed
| Package(s): | kernel |
CVE #(s): | |
| Created: | October 22, 2002 |
Updated: | November 22, 2002 |
| Description: |
A number of security fixes have gone out for the 2.2 and 2.4 kernels. There are no known exploits at this time, but upgrading will make sense anyway. As always with kernel updates, read the distributor instructions carefully; there is usually more involved than just installing a new package. |
| Alerts: |
|
Comments (none posted)
Kerberos 5 unauthorized root access to KDC host vulnerability
| Package(s): | krb5 |
CVE #(s): | |
| Created: | August 14, 2002 |
Updated: | October 29, 2002 |
| Description: |
A bug in the Kerberos 5 remote
administration service, "kadmind", could be
exploited to gain unauthorized root access to a KDC host.
It is believed that the attacker needs to be able to
authenticate to the kadmin daemon for this attack to be successful.
Felix von Leitner, discovered this
potential division by zero bug in
code derived from the SunRPC library which is used
in many places, including the Kerberos 5 administration system.
Updating now is recommended.
CERT/CC Vulnerability Note VU#192995 Integer
overflow in xdr_array() function when deserializing the XDR stream
|
| Alerts: |
|
Comments (none posted)
LPRng accepts jobs from any host.
| Package(s): | LPRng |
CVE #(s): | CAN-2002-0378
|
| Created: | June 12, 2002 |
Updated: | October 31, 2002 |
| Description: |
Matthew Caron pointed out that LPRng's default configuration accepts job submissions from any host.
This could be an especially annoying vulnerability for adminstrators
with systems exposed to the general public.
|
| Alerts: |
|
Comments (none posted)
Cross-site scripting vulnerability in mhonarc
| Package(s): | mhonarc |
CVE #(s): | CAN-2002-0738
CAN-2002-1307
CAN-2002-1388
|
| Created: | September 11, 2002 |
Updated: | January 3, 2003 |
| Description: |
Mhonarc is an HTML formatter for electronic mail; it can be vulnerable to cross-site scripting problems when presented with maliciously crafted messages. This problem is fixed in mhonarc version 2.5.3, but it is not clear that all possible vulnerabilities have been fixed. See the Debian advisory below for information on how to disable text/html attachment support in mhonarc, which may be a more secure solution. |
| Alerts: |
|
Comments (none posted)
PHP Remote Compromise/DOS Vulnerability
| Package(s): | mod_php4 |
CVE #(s): | |
| Created: | July 22, 2002 |
Updated: | February 18, 2003 |
| Description: |
PHP 4.2.0 and 4.2.1 have an error in the handling of POST requests which
can lead to the corruption of memory, and the usual bad consequences. According to this alert, the vulnerability can only be used for denial of service on x86 systems - there is no way to get it to run exploit code. SPARC/Solaris systems are apparently vulnerable to full remote compromise.
According to the CERT Advisory,
almost every Linux distributor, it seems, ships older (and thus not vulnerable) versions of PHP.
Note that, sometimes, systems thought to be safe from remote compromise turn out to be vulnerable to a modified attack, so x86 users should not relax too much. The solution, for those systems with PHP
4.2.0 or 4.2.1 installed,
is to upgrade to PHP 4.2.2.
For more information see the alert from
the discover of the vulnerability, Stefan Esser of e-matters GmbH,
or the security
advisory from the php team.
CERT Advisory: CA-2002-21 Vulnerability in PHP |
| Alerts: |
|
Comments (1 posted)
mod_ssl: cross site scripting problem
| Package(s): | mod_ssl, libapache-mod-ssl |
CVE #(s): | CAN-2002-1157
|
| Created: | October 22, 2002 |
Updated: | December 12, 2002 |
| Description: |
Joe Orton discovered a cross site scripting problem in mod_ssl, an
Apache module that adds Strong cryptography (i.e. HTTPS support) to
the webserver. The module will return the server name unescaped in
the response to an HTTP request on an SSL port.
Like the other recent Apache XSS bugs, this only affects servers using
a combination of "UseCanonicalName off" and wildcard DNS. This is very
unlikely to happen, though. Apache 2.0/mod_ssl is not vulnerable since it
already escapes this HTML. |
| Alerts: |
|
Comments (none posted)
ypserv: NIS information leak
| Package(s): | nis, ypserv |
CVE #(s): | CAN-2002-1232
|
| Created: | October 21, 2002 |
Updated: | December 5, 2002 |
| Description: |
Thorsten Kukuck discovered a problem in the ypserv program which is
part of the Network Information Services (NIS). A memory leak in all
versions of ypserv prior to 2.5 is remotely exploitable. When a
malicious user could request a non-existing map the server will leak
parts of an old domainname and mapname. |
| Alerts: |
|
Comments (none posted)
Buffer overflow in nss_ldap
| Package(s): | nss_ldap |
CVE #(s): | CAN-2002-0825
CAN-2002-0374
|
| Created: | October 9, 2002 |
Updated: | December 11, 2002 |
| Description: |
The nss_ldap package has a buffer overflow which can be exploited when the
module configures itself from information in DNS. The problem is fixed in
nss_ldap-199 and later. |
| Alerts: |
|
Comments (none posted)
String format bug in pam_ldap logging
| Package(s): | nss_ldap |
CVE #(s): | CAN-2002-0374
|
| Created: | June 5, 2002 |
Updated: | October 29, 2002 |
| Description: |
The nss_ldap package includes the pam_ldap module for
authenticating a user with an LDAP database.
Pam_ldap versions prior to 144 have a string format
bug in the logging mechanism. |
| Alerts: |
|
Comments (none posted)
PAM: password validation error
| Package(s): | pam |
CVE #(s): | |
| Created: | October 23, 2002 |
Updated: | October 23, 2002 |
| Description: |
Paul Aurich and Samuele Giovanni Tonon discovered a serious security
violation in PAM. Disabled passwords (i.e. those with '*' in the
password file) are treated as if they were empty and access to such
accounts is granted through the regular login procedure (getty,
telnet, ssh). This works for all such accounts whose shell field in
the password file does not refer to /bin/false. Only version 0.76 of
PAM seems to be affected by this problem. |
| Alerts: |
|
Comments (none posted)
Remotely exploitable vulnerability in pine
| Package(s): | pine |
CVE #(s): | CAN-2002-0014
|
| Created: | May 21, 2002 |
Updated: | November 27, 2002 |
| Description: |
Pine has an
unpleasant
vulnerability in URL handling vulnerability which can lead to
command execution by remote attackers.
(First LWN report: January 17th).
This vulnerability is remotely exploitable; updating is a good idea.
Note: If an update isn't yet available for your distribution,
setting enable-msg-view-urls to "off" in pine's setup will
avoid the vulnerability. (Thanks to Greg Herlein).
|
| Alerts: |
|
Comments (none posted)
Buffer overflow vulnerabilities in PostgreSQL
| Package(s): | PostgreSQL |
CVE #(s): | |
| Created: | August 21, 2002 |
Updated: | January 27, 2003 |
| Description: |
PostgreSQL 7.2.2 has been released in response to a number of buffer
overrun vulnerabilities which have been identified recently. "...it
should be noted that these vulnerabilities are only critical on 'open' or
'shared' systems, as they require the ability to be able to connect to the
database before they can be exploited."
Buffer overflow vulnerabilities fixed include those reported by
"Sir Mordred The Traitor" in the cash_words,
repeat, and lpad
and rpad functions. |
| Alerts: |
|
Comments (none posted)
PXE server denial of service vulnerability
| Package(s): | pxe |
CVE #(s): | CAN-2002-0835
|
| Created: | September 4, 2002 |
Updated: | November 11, 2002 |
| Description: |
The PXE server can be crashed using DHCP packets from
some Voice Over IP (VOIP) phones. Maliciously formed
DHCP packets could be used by a remote attacker to effect a
denial of service attack.
The PXE package contains the PXE (Preboot eXecution Environment)
server and code needed for Linux to boot from a boot disk image on a
Linux PXE server.
|
| Alerts: |
|
Comments (none posted)
Local arbitrary code execution vulnerability in Python
| Package(s): | python |
CVE #(s): | CAN-2002-1119
|
| Created: | August 28, 2002 |
Updated: | October 1, 2003 |
| Description: |
Zack Weinberg discovered that
os._execvpe from os.py uses a predictable name which could lead
to execution of arbitrary code. According to the Debian
advisory, the problem
was present in Python versions 1.5, 2.1 and 2.2.
CAN-2002-1119 |
| Alerts: |
|
Comments (none posted)
Multiple-use vulnerability in Safe.pm
| Package(s): | Safe.pm |
CVE #(s): | CAN-2002-1323
|
| Created: | October 9, 2002 |
Updated: | February 20, 2004 |
| Description: |
usePerl has a
description of a vulnerability in the Safe.pm Perl module. It seems
that if a Safe compartment is used more than once, it ceases to be safe.
The problem is fixed in Safe 2.08. |
| Alerts: |
|
Comments (none posted)
sendmail smrsh bypass vulnerability
| Package(s): | sendmail |
CVE #(s): | CAN-2002-1165
|
| Created: | October 2, 2002 |
Updated: | November 29, 2002 |
| Description: |
iDEFENSE has posted an advisory warning of a
couple of ways of bypassing the restrictions imposed by the sendmail
"smrsh" utility. smrsh puts limits on which programs a user may run out of
a .forward file; this vulnerability could give a local user
undesired access to the mail server system. A patch has
been made available from sendmail.org which closes the vulnerability. |
| Alerts: |
|
Comments (none posted)
Sharutils potential privilege escalation using uudecode
| Package(s): | sharutils |
CVE #(s): | CAN-2002-0178
|
| Created: | May 21, 2002 |
Updated: | October 31, 2002 |
| Description: |
According to the CVE entry,
"uudecode, as available in the sharutils package before 4.2.1, does not
check whether the filename of the uudecoded file is a pipe or symbolic
link, which could allow attackers to overwrite files or execute commands."
(First LWN
report: May 16).
|
| Alerts: |
|
Comments (none posted)
Multiple vulnerabilities fixed in Squid-2.4.STABLE7
| Package(s): | squid |
CVE #(s): | |
| Created: | July 8, 2002 |
Updated: | November 15, 2002 |
| Description: |
Here is the security advisory for the Squid proxy server reporting several vulnerabilities in versions up to and including 2.4.STABLE7.
Several of the bugs are believed to allow remote code execution.
The security advisory lists the following
changes:
- Several bugfixes and cleanup of the Gopher client, both
to correct some security issues and to make Squid properly
render certain Gopher menus.
- Security fixes in how Squid parses FTP directory listings into
HTML
- FTP data channels are now sanity checked to match the address
of the requested FTP server. This to prevent theft or injection
of data. See the new ftp_sanitycheck directive if this sanity
check is not desired.
- The MSNT auth helper has been updated to v2.0.3+fixes for
buffer overflow security issues found in this helper.
- A security issue in how Squid forwards proxy authentication
credentials has been fixed
|
| Alerts: |
|
Comments (none posted)
squirrelmail: cross-site scripting vulnerability
| Package(s): | squirrelmail |
CVE #(s): | CAN-2002-1131
CAN-2002-1132
|
| Created: | October 16, 2002 |
Updated: | January 2, 2003 |
| Description: |
The Squirrelmail web mail package has a cross-site scriptinog vulnerability; versions 1.2.7 and prior are affected. See the advisory for details. |
| Alerts: |
|
Comments (none posted)
syslog-ng: buffer overflow vulnerability
| Package(s): | syslog-ng |
CVE #(s): | |
| Created: | October 16, 2002 |
Updated: | November 14, 2002 |
| Description: |
Versions 1.4.15 and 1.5.20 (and prior) of the syslog-ng system logging package have a remotely exploitable buffer overflow vulnerability; see this advisory for the details. |
| Alerts: |
|
Comments (none posted)
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip |
CVE #(s): | CAN-2001-1267
CAN-2001-1268
CAN-2001-1269
CAN-2002-0399
|
| Created: | October 1, 2002 |
Updated: | April 10, 2006 |
| Description: |
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability. |
| Alerts: |
|
Comments (1 posted)
Multiple vendor telnetd vulnerability
| Package(s): | telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5 |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | October 5, 2004 |
| Description: |
This vulnerability,
originally thought to be confined to BSD-derived systems, was first covered
in the July 26th Security
Summary. It is now known that Linux telnet daemons are vulnerable as
well.
|
| Alerts: |
|
Comments (none posted)
Tomcat 4.x JSP source code exposure vulnerability
| Package(s): | tomcat |
CVE #(s): | |
| Created: | September 25, 2002 |
Updated: | January 29, 2003 |
| Description: |
Rossen Raykov reports that Tomcat 4.0.5 and 4.1.12 fix a JSP source code exposure vulnerability
in "Tomcat 4.0.4 and 4.1.10 (probably all other earlier versions also).".
The current version of Tomcat is available here.
|
| Alerts: |
|
Comments (none posted)
Local root vulnerability in chfn
| Package(s): | util-linux |
CVE #(s): | CAN-2002-0638
|
| Created: | July 30, 2002 |
Updated: | October 31, 2002 |
| Description: |
chfn (change finger information) is one of the utilities in
the util-linux package.
The BindView RAZOR Team has discovered a local root vulnerability
in chfn which is described in the Bindview Advisory.
Under certain conditions, "a
carefully crafted attack sequence can be performed to exploit a
complex file locking and modification race present in this utility,
and, as a result, alter /etc/passwd to escalate privileges in the
system." The conditions include a password file, /etc/passwd, over 4 kilobytes and locating the attacker's account record in any
but the last 4 kB chunk of the file.
CERT/CC Vulnerability Note VU#405955 util-linux package vulnerable to privilege escalation when "ptmptmp" file is not removed properly when using "chfn" utility |
| Alerts: |
|
Comments (none posted)
webalizer: reverse DNS buffer overflow vulnerability
| Package(s): | webalizer |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | January 27, 2003 |
| Description: |
The cause is a buffer overflow bug.
This one sounds nasty.
If reverse DNS lookups are enabled in webalizer,
"an attacker with control over the victims DNS may spoof responses thus
triggering a buffer overflow, potentially leading to a root compromise."
Webalizer 2.01-10 "fixes this and a few
other buglets that have been discovered in the last month or so".
(First LWN report: April 18th, 2002).
|
| Alerts: |
|
Comments (none posted)
Webmin/Usermin vulnerabilities
| Package(s): | webmin |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | January 10, 2003 |
| Description: |
Webmin is a web-based interface for
system administration for Unix.
Webmin has cross-site scripting and
session ID spoofing vulnerabilities
which are fixed in the May 6, 2002 release of version 0.970.
(First LWN
report: May 9).
This one is scary. The session ID
spoofing vulnerability allows the "possibility that arbitrary
commands may be executed with root privileges."
Upgrading is strongly recommended. At a minimum avoid the
"preconditions for a successful exploit" by disabling
password timeouts under Webmin->Configuration->Authentication.
|
| Alerts: |
|
Comments (1 posted)
Multiple vulnerabilities in wordtrans
| Package(s): | wordtrans |
CVE #(s): | CAN-2002-0837
|
| Created: | September 11, 2002 |
Updated: | February 4, 2003 |
| Description: |
The "wordtrans" interface to multilingual dictionaries suffers from input validation and cross-site scripting vulnerabilities; versions through 1.1pre8 are vulnerable. See this Guardent advisory for details. |
| Alerts: |
|
Comments (none posted)
Problems with libgtop_daemon
| Package(s): | wuftpd libgtop |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | May 7, 2003 |
| Description: |
The libgtop_daemon package is a GNOME
program which makes system information available remotely.
LWN reported the remotely exploitable format
string and buffer overflow vulnerabilities in that package
on December 6th.
On November 28th
disabling the libgtop_daemon on systems where it is running until
an update is available.
Many Linux systems do not run
libgtop by default, but applying the update is a good idea anyway.
|
| Alerts: |
|
Comments (1 posted)
Wwwoffle remote privilege escalation vulnerability
| Package(s): | wwwoffle |
CVE #(s): | CAN-2002-0818
|
| Created: | August 14, 2002 |
Updated: | October 1, 2003 |
| Description: |
The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests
with negative Content Length values.
"It is believed
that an attacker could exploit this bug to gain remote wwwrun access
to the system wwwoffled is running on."
CAN-2002-0818 |
| Alerts: |
|
Comments (none posted)
Local privilege escalation vulnerability in XFree86
| Package(s): | xf86 xfree86 |
CVE #(s): | |
| Created: | September 18, 2002 |
Updated: | October 27, 2002 |
| Description: |
XFree86 version 4.2.1 fixes a problem in
Xlib that made it possible to execute arbitrary code in privileged clients.
Other libraries are dynamically loaded by libX11.so as needed.
When linking against a setuid program, arbitrary code
could be loaded and executed from a pathname controlled by the user.
|
| Alerts: |
|
Comments (none posted)
Denial of service vulnerability in xinetd
| Package(s): | xinetd |
CVE #(s): | |
| Created: | August 14, 2002 |
Updated: | December 3, 2002 |
| Description: |
A file descriptor leak into services started from xinetd
may be used, by programs it stats, to crash xinetd.
Xinetd is a replacement for the BSD derived inetd. |
| Alerts: |
|
Comments (none posted)
Resources
The Economist has run
a
lengthy survey on digital security. "
A final, minor,
misperception is that computer security is terribly boring. In fact, it
turns out to be one of the more interesting aspects of the technology
industry. The war stories told by security consultants and computer-crime
specialists are far more riveting than discussion of the pros and cons of
customer-relationship management systems. So there really is no excuse for
avoiding the subject."
Comments (none posted)
The
October 28 Linux Security Week and
October 25 Linux Advisory Watch from
LinuxSecurity.com are available.
Comments (none posted)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current development kernel is 2.5.45,
announced by Linus on October 30,
just in time to make your
editor go back and rewrite this section.
Linus has been busy, having merged over 500 patches since returning from
his Caribbean
cruise. The most significant changes include another set of block layer
fixes, an ia-64 update, many fixes from the -ac series, the device mapper
(LVM2) code, the new cryptographic API (see below), the beginnings of an
IPSec implementation, an ISDN update, Roman Zippel's new kernel
configuration system, the
sys_epoll patch (see below), much device
model work, and many other fixes and updates. The
long-format changelog is longer than usual, and
has all the details.
There are many open issues, still, that need to be resolved before the
feature freeze. For varying perspectives on what remains to be merged, see
Guillaume Boissiere's 2.5 status summary for
October 30, Rob Landley's merge candidate
list, or Rusty Russell's Remarkably
Unreliable 2.6 list.
For a view of what's in the kernel now, see Dave Jones's post-Halloween document which serves as a sort
of preliminary release notes for people interested in testing the new
kernel.
The current stable kernel is still 2.4.19, but the next stable
release got a little
closer with the announcement of the first
2.4.20 release candidate on October 29..
Comments (1 posted)
Kernel development news
One of the first things Linus merged once he got back home was the brand
new cryptographic API written by James Morris, David S. Miller, and
Jean-François Dive, with ideas and code taken from many other places. This
patch is interesting for a couple of reasons: it is a brand-new, previously
unseen kernel crypto implementation, and it is the first time that serious
cryptographic code has been included in the mainline kernel tree. With
luck, worldwide crypto regulations will remain sane enough that this code
can stay there.
This API's purpose is to provide fast, general-purpose cryptographic
operations for the rest of the kernel. The driving need in the short term
is IPSec (which has also been partially merged), but other applications,
such as cryptographic filesystems, can also make use of this facility.
Needless to say, use in the networking and filesystem layers places some
strong performance demands on the cryptographic layer.
The new crypto API is based on the scatterlist structure, which is
used in many other parts of the I/O subsystem. Scatterlists give direct
access to the page structures describing the memory to be operated
on, below the level of the virtual memory system. Among other things, this
architecture means that data can be encrypted or decrypted "in place" in
the buffers that are used for I/O operations. It should, in other words,
be fast (if the crypto algorithms themselves are fast).
Three basic types of "transforms" are supported by this API: ciphers,
digests, and compressors. The kernel currently has implementations for DES
(including triple DES), MD4, MD5, and SHA. See Documentation/crypto/api-intro.txt
for a quick overview of how this API works.
(As a postscript: a few people have asked if this API would be made
available to user space. It would not be hard to write a system call or
pseudo-device which would export this functionality, but it is hard to
imagine why that would be useful. It would be better just to run the
crypto algorithms in user space directly).
Comments (2 posted)
One of the remaining issues to be resolved before the Halloween feature
freeze is whether the Reiser4 filesystem will be included in the 2.5
kernel. This has been a hard question to answer, however, given that
almost nobody had actually seen the Reiser4 source. That situation, at
least, has come to an end with the
announcement of the first public Reiser4
snapshot.
Reiser4 is the latest incarnation of the ReiserFS filesystem. It is not
simply an upgrade; Reiser4 has been redesigned and reimplemented from the
beginning. It is a completely different filesystem than the ReiserFS (also
known as "Reiser3") found in the 2.4 kernel; should it be included, the
next stable kernel will contain both Reiser3 and Reiser4, as separate
options.
There is a fair amount of online information available on Reiser4, though
some of it makes for a bit of a challenging read. This lengthy document provides
discussion in depth of many of the Reiser4 features (not all of which are
implemented yet), along with an explanation of Hans Reiser's long-term
vision for filesystems, a polemic on free software, and some of the
weirdest imagery to be found in software documentation anywhere. The
document entitled The
Infrastructure for Security Attributes in Reiser4 is actually a
relatively straightforward discussion of many of the technical details
behind the Reiser4 design, and might be a better starting point.
For those wanting a shorter summary, here's a few of the features to be
found in Reiser4:
- The filesystem maintains many of the basic features of Reiser3 -
it is based on (mostly) balanced trees, with file data incorporated in
the tree along with names. Reiser4 thus remains well suited to the
handling of large numbers of very small files.
- It is smarter about block allocation and data placement. Block
allocation is delayed until file data is actually written to disk,
leading to more efficient layouts. On-disk layout is done with
extents. The result of these optimizations is that the filesystem's
read performance is greatly improved over Reiser3.
- "Wandering logfiles" take some techniques from log-structured
filesystems to provide journaling without (always) writing data to the
disk twice. In many cases, Reiser4 can write "journal" data to a disk
block, then atomically swap the journal block into the file itself.
The journaling code can overwrite or replace blocks, depending on
which technique would provide better layout on the disk.
- Most filesystem semantics are implemented with plugins. The normal
Unix directory behavior, for example, is implemented with the "Unix
directory plugin." Plugins can be used to implement security features
(access control lists and such), encryption, maintenance of audit
trails, and no end of strange, non-POSIX
semantics. Hans Reiser remains determined to implement a lot of
interesting features in his filesystem, and plugins are the mechanism
by which those features will be included.
- Reiser4 is heavily transaction-oriented, and is able to provide
guarantees that operations will be performed atomically. Future plans
call for the ability to perform multi-file operations in an atomic
manner.
- The Reiser4 design includes a reiser4() system call
"to support applications that don't have to be fooled into
thinking that they are using POSIX." This system call will
accept (and parse) command strings that can describe complex
operations. The reiser4() system call is not implemented in
the current snapshot.
As an example of the sort of uses that the Reiser4 developers eventually
would like to see, consider the classic Unix password file. Each line in
the file describes one account, and contains several colon-separated fields
with information like the account name, user and group IDs, the user's home
directory and shell, etc. In Reiser4, each field in the password file
would become a file in its own right; one could obtain the home directory
of a given user via a path like:
/etc/passwd/user/home
A special-purpose plugin would aggregate the various files, so that a
process reading /etc/passwd would see the same information as
always. But each field file could be protected differently; a user could
have write access to the file describing his or full name, but not to the
one containing the user ID value.
In the Reiser4 vision, file attributes would also be stored as files. For
a given file, something like file/owner would contain
the UID of the
user who owns that file.
Needless to say, in the long-term Reiser vision, Linux systems will behave
rather differently than they do now. In the shorter term, Reiser4 promises
a high-performance journaling filesystem with highly efficient handling of
small files and a plugin architecture which encourages experiments with
interesting new semantics.
Will it be merged? The Reiser4 team plans to submit a patch for merging at
the last second, sometime before midnight on Halloween. Some developers
have argued that it is too late to propose a major new feature that nobody
has had a chance to look at. Hans feels this is
inappropriate:
I'm the last straggler coming back from the hunt, and I've got what
looks like it might be a wooly mammoth on my shoulders, and my
tribesmen are complaining that I'm late for dinner. How about
helping me by cutting down a tree for the roasting spit instead
Linus has not offered any public opinions on the matter. The Reiser4 patch
is apparently unintrusive, however, so there is probably no real reason not
to include it.
Comments (11 posted)
The classic Unix way to wait for I/O events on multiple file descriptors is
with the
select() and
poll() system calls. When a
process invokes one of those calls, the kernel goes through the list of
interesting file descriptors, checks to see if non-blocking I/O is
available on any of them, and adds the calling process to a wait queue for
each file descriptor that would block. This implementation works
reasonably well when the number of file descriptors is small. But if a
process is managing thousands of file descriptors, the
select()
and
poll() calls must check every single one of them, and add the
calling process to thousands of wait queues. For every single call.
Needless to say, this approach does not scale very well.
Davide Libenzi and others have been working for some time on a new approach
to polling that would work for thousands of files. It was originally
implemented as a special device (/dev/epoll), but, on request from
Linus, the new scheme was turned into a new set of epoll() system
calls.
These calls work in a very different way. Every call to select()
or poll() is a separate event; the data structures must be set up
and torn down every time. epoll, instead, requires the
application to build a persistent (across calls) data structure in kernel
space first. The application starts by creating a special epoll
file descriptor:
epfd = epoll_create(int maxfds);
The maxfds parameter is the maximum number of file descriptors
that the process expects to manage. The return value is a file descriptor
to be used with the other epoll calls; it should be shut down with
close() when it is no longer needed.
Each file descriptor to be managed must be added to the special
epoll descriptor with:
int epoll_ctl(int epfd, int op, int fd, unsigned int events);
The op parameter specifies the operation to be performed (add,
change, or remove the given file descriptor fd), and
events is a mask of events of interest to the process.
Once everything has been set up, the process can sit back and wait until
there is something for it to do:
int epoll_wait(int epfd, struct pollfd const **events, int timeout);
The return value is the number of events (i.e. readable or writeable file
descriptors) that epoll_wait() has found.
These system calls have been shown, through heavy benchmarking, to scale in
constant time up to unbelievable numbers of file descriptors (some graphs
can be found on this
page). The persistent data structure built around the epoll
file descriptor is one of the reasons for this scalability: there is no
need to set it up and tear it down for every epoll_wait() call.
The other half of the story is in how epoll_wait() finds the
readable or writeable file descriptors. Rather than polling each file
descriptor (and adding itself to wait queues), the epoll mechanism
adds a callback structure onto the struct file associated
with each file descriptor. When a file descriptor becomes readable or
writeable, its callback(s) are called, and processes using
epoll_wait() can be notified directly. So an
epoll_wait() call never needs to make a pass over the list of file
descriptors it is watching.
The epoll patch is ready, and Linus has indicated that he wants to
merge it. For now, epoll only works for pipes and sockets (its
initial use is likely to be network services that manage large numbers of
connections). Expanding its scope to other types of I/O should just be a
matter of doing the work, however.
Comments (8 posted)
Patches and updates
Kernel trees
Build system
Core kernel code
Development tools
Device drivers
Filesystems and block I/O
Janitorial
Memory management
Networking
Architecture-specific
Security-related
Benchmarks and bugs
Miscellaneous
Page editor: Jonathan Corbet
Distributions
News and Editorials
Linux clusters may be one area in which Linux has already achieved World
Domination. Clusters running some variant of the Linux operating system
are in use at universities, large corporations and research centers
worldwide. There are systems made with older hardware, some mix a variety
of operating systems and processors in the cluster, but when a special
version of the Linux operating system is combined with a set of
rack-mounted high-end boxes, Linux clusters are among the fastest and most
powerful supercomputers in the world. Clusters present unique challenges
for an operating system. Good cluster distributions make it easy to get a
large number of boxes up and running, and they make it easy to keep them
up-to-date with the latest security and bug fixes. They have kernel
patches and other software that enables them to best utilize CPU time.
Right now there are several Linux distributors that do this very well,
however World Domination requires constant work to maintain. Competition
in this arena can only strengthen an already strong product, and keep Linux
on top.
Enter MandrakeSoft, who along with partners Bull and INPG/INRIA, has announced the first release of a new Linux
Clustering Distribution named "CLIC", a project publicly funded by the
French Agency for New Technologies (RNTL). The first CLIC version features
rapid deployment, auto-configuration, MPICH, LAM and PVM support, a large
number of mathematical libraries, and Netjuggler (a parallelized virtual
reality 3D engine). Given the desktop success of Mandrake Linux, we can
well imagine that CLIC is easy to use and maintain. CLIC is published
under the General Public License (GPL). Users can download the first ISO here.
Also working to keep Linux ahead in clustering is the openMosix Project which has announced the release of openMosix version
2.4.19-6. openMosix is a Linux kernel extension for single-system image
clustering, available under the terms of the GPL.
Comments (4 posted)
Distribution News
This week's DWN includes items by Matt Black and Andre Lehovich; an
IndustryWeek report on corporate Linux are adoption; a very verbose
installation walkthrough by Clinton De Young and much more.
Full Story (comments: none)
Here is the Mandrake Linux Community Newsletter for October 24, 2002.
"
This Week's Summary: Upcoming Frankfurt LinuxWorld Expo; Mandrake in
the News; The Latest MandrakeClub Activities; Financial Corner; Linux
Training; Desktop Fun; New Russian Mailing List; Software Updates;
Headlines from MandrakeForum"
Full Story (comments: none)
Slackware has a few more updates this
week, including some tweaks to gcc. See the
change log
for full details.
Comments (none posted)
SuSE has sent out a press release on its upcoming "SuSE Linux Enterprise
Desktop" offering. It is a new version of the SuSE distribution which is
intended to coexist well with Microsoft installations and offer easy
administration. It's based on StarOffice for productivity applications, but
CrossOver Office is also thrown in so that Windows applications can be
run. The whole thing should become available in January at a price of
EUR 139.
Full Story (comments: none)
With the release of the SuSE Linux 8.1 i386 ftp version, SuSE has announced
that the SuSE Linux 7.0 distribution will be discontinued. Vulnerabilities
found after Monday, November 4 2002, will not be fixed for SuSE Linux 7.0
any more. If you are still running versions 7.0 or earlier it is time for
an upgrade.
Full Story (comments: none)
Minor distribution updates
BanShee Linux/R has released
v0.61 with major
bugfixes. "
Changes: In this release, E3 was upgraded to 2.4 and
BusyBox was upgraded to 0.60.5, which fixes many problems."
Comments (none posted)
Cool
Linux CD has released
v2.00. "
Changes:
The boot procedure has been changed to be more compatible with some
hardware. Some problems have been fixed, and a lot of software has been
added."
Comments (none posted)
The
Familiar Project has a
major
new release of its iPAQ distribution.
Version 0.6 has many improvements. Busybox was added to decrease the size,
make it smaller, ipkg was upgraded, the GPE login manager now allows
non-root logins and much more. Here's the
v0.6 Freshmeat link.
Comments (none posted)
LEAF Bering has released
v1.0rc4. "
Changes:
This should be the final rc version before 1.0 stable is out. It includes a
lot of minor bugfixes, an update to Shorewall 1.3.9b firewall, and major
extensions to the documentation (both the installation and the user's
guide)."
Comments (none posted)
Lonix has released
v1.0rc5. "
Changes:
Ncftp, lftp, compression tools, and network utilities were added. The
system translation to English is now complete. Small problems with sendmail
and proftpd were fixed. Lonixconfig was recoded to make it cleaner."
Comments (none posted)
NSA Security Enhanced Linux has
released
v2002102211.
"
Changes: The base 2.5 kernel version has been updated to 2.5.44. The
base 2.4 kernel version remains at 2.4.19, but many changes have been made
to the 2.4 LSM patch and to the 2.4 SELinux module since the last
release. The modified login, sshd, and crond programs have been updated to
use a new configuration scheme. Socket handling has been
improved. Internally, precondition functions have been removed in favor of
early initialization support. The modified tar has been updated to
tar-1.13.25. A number of other improvements, bugfixes, and policy
enhancements have taken place."
Comments (none posted)
PXES Linux Thin Client has
released
v0.5.1-6.
"
Changes: Mouse autodetection problems have been solved. lspci has
been patched and included."
Comments (none posted)
Sentry Firewall has released
v1.4.0-beta2.
"
Changes: This version includes several package and kernel
updates. The howto has also been updated."
Comments (none posted)
VectorLinux has released
v3.0. "
Changes:
The distribution has been rebuilt to be totally Slackware 8.1-compatible
and mostly LSB-compliant. Glibc was updated to 2.2.5 and the kernel to
2.4.19. reiserfs was added as an install option. All the preinstalled
software has been updated to the latest version. A clone of Debian's apt
program called Autopkg was added that makes installing packages and keeping
the system up-to-date a breeze. New instant messaging and CD burning tools
were added. Installation has been improved with the novice Linux user in
mind."
Comments (none posted)
Warewulf has released
v1.3. "
Changes:
This release adds many minor bugfixes, some enhancements, and support for
the Sun Gridengine and Ganglia."
Comments (none posted)
xbox-linux has released
v26-10-2002.
"
Changes: This release includes an audio driver update."
Comments (none posted)
Distribution reviews
ExtremeTech
reviews
Lycoris Desktop/LX. "
I personally used Lycoris Desktop/LX, Amethyst
Release, Update 1 on a regular basis between February and July. I was very
happy with it, enough so that it got more use on my desktop than either
Mandrake or Libranet, my two other personal favorites. But when Amethyst
Release, Update 2 (Build 46) came out, I was even more impressed."
Comments (2 posted)
Linux Journal
reviews SuSE
Linux 8.1 Professional. "
SuSE Linux 8.1 includes kernel 2.4.19 and
gcc 3.2. The Powertweak program allows experienced Linux admins to modify
kernel parameters to maximize performance."
Comments (none posted)
The Register
reviews
SuSE 8.1.
"
The user experience is so close to XP now that one can expect it to surpass
it in the next edition or the one following. Now add to that Linux's
resistance to viruses, the comparative speed with which open-source security
bugs get fixed, the wealth of free applications included, and the GPL
enlightenment that allows you to install it on as many machines as you please
and upgrade it free of charge on your own, and you can see why MS is feeling
the heat around the corner and not taking it terribly well."
Comments (none posted)
ExtremeTech
reviews
Xandros Desktop 1.0. "
Xandros is another debian based distro, geared
toward the desktop and promising good Windows compatibility. Our initial
impression of Xandros is very positive. It lives up to a lot of its
potential, with a few drawbacks."
Comments (none posted)
Page editor: Rebecca Sobol
Development
The Debian Linux distribution has a new
Debian Desktop Project, which was recently
announced by Colin Walters. The project's aim is well stated:
"
Our motto is 'Software which Just Works'. In short, our goal is to
bring Debian, GNU, and Linux to the mainstream world."
The list of project goals includes:
- Support for both the GNOME and KDE desktop environments.
- Keeping the needs of both novice and expert users in mind.
- Making configuration simple and foolproof.
- Focusing configuration options on standard desktop users.
- Integration of project management utilities into the standard Debian distribution.
- Simplification of installation questions with the non-technical user in mind.
- Having Fun.
To get an idea of what the project aims to accomplish,
the current objectives include:
- A menu rewrite project.
- Integration of KDE 3.
- Improvement of the Debian installer.
- Integration of webmin and/or Ximian Setup Tools into the Debian core.
- Improvements to the ppp system.
- Work on X11 configurations.
- Work on USB implementation.
- Internationalization and multilingualization.
- A clean-up of debconf questions to simplify system installation.
- Creation of a desktop-optimized kernel.
- Work on the Debian TODO list.
- Building Debian themes for GNOME and KDE.
- Adding items to this list.
Debian would be a better distribution if it were to move toward
these goals, the
timing is certainly right for development of easy-to-use and
easy-to-install Linux software for the masses.
Perhaps a good goal for this project would be to morph
Debian into something that your grandmother would be comfortable using, assuming your grandmother isn't a software developer. Hopefully the project will undergo frequent testing by people who are not especially
computer literate, with the literati looking over their shoulders.
Comments (none posted)
System Applications
Audio Projects
Real Networks has
announced
the release of the source for its "Helix DNA Client" application.
"
For the first time ever, developers can easily access the code of a
commercial grade media player, integrate support for the industry-leading
audio and video formats, RealAudio and RealVideo, as well as other formats,
and create a robust media player for their own specific needs."
Comments (7 posted)
The
ALSA
sound card driver project has released version 0.9.0rc5, which fixes a bug
involving GCC 3.2.
Comments (none posted)
Database Software
CVS access
has been added for the SapDB database source code.
Comments (none posted)
Rani Pinchuk
examines Perl/SQL database issues on O'Reilly's Perl.com:
"
if you look at the code above, you will see two languages: Perl and SQL. This makes the code not that readable. Besides, SQL statements that are only slightly different may appear in several places, and this will make it more difficult to maintain. In addition, suppose you have an SQL expert who should optimize your SQL calls. How do you let him work on the SQL; should he look through your Perl code for it? And what if that guy is so ignorant that he doesn't even know Perl? "
Comments (4 posted)
Education
Stephen Figgins
writes about the use of Python in education on O'Reilly's ONLamp.com site.
"
PyKarel is a Python implementation of Karel the Robot. Introduced in the 80's, Karel was intended to jump-start students in the Pascal programming language. A virtual robot moves about a maze, interacting with walls and beepers, performing programmed tasks. It has a Pascal-like structure, but only five commands: move, turn left, pick beeper, put beeper, turn off. There are 18 or so conditionals that are mostly repetitious "if facing north", or "if facing south." There are no variables. Karel's virtue is in being both visual and simple."
Comments (none posted)
Electronics
The
latest developments
from gEDA, the Gnu Electronic Design and Analysis project include new
versions of Icarus Verilog, Covered, and GTKWave.
Comments (none posted)
Embedded Systems
Version 0.60.5 of the
BusyBox Embedded system tool set
has been released.
"
This is a bugfix release for the stable series to address all the problems that have turned up since the last release. Unfortunately, the previous release had a few nasty bugs (i.e. init could deadlock, gunzip -c tried to delete source files, cp -a wouldn't copy symlinks, and init was not always providing controlling ttys when it should have)."
Comments (1 posted)
Mail Software
Glenn Graham
investigates SquirrelMail, a web-based mail server, on O'Reilly's ONLamp.com site.
"
I started my search for a Webmail solution at Freshmeat. After sifting through over 65 programs, I stumbled across SquirrelMail. It didn't have fancy screenshots, but to my surprise, had everything I needed. It's easy to install, runs right out of the box, and my clients love it. What else could I ask for?"
Comments (none posted)
Networking Tools
A group of Australian surfers (and coders), known as
Softgineering.com
have released a Java-based library called Sniffer that is used
for network security and management tasks.
Comments (none posted)
Printing
LinuxPrinting.org
has an article that shows how to work with the GhostScript align.ps file
for setting printer dimensions and margins.
"
A problem brought up very often on the Forums of linuxprinting.org is that PostScript files come out shifted, with a very wide border on one side and the image cut of on the opposite side. Or the printer prints much less close to the borders as it is able to by hardware."
Comments (none posted)
Web Site Development
Mod_python 3.0 beta 4
has been announced.
This should be the last beta release before the official
mod_python 3.0 is released.
Comments (none posted)
The most recent headlines on the
Zope Members News
include:
Zope Corp Funds Open Source ESI in Squid, ZShellScripts v0.1 is out,
CMFReportTool initial release, WingDBG for Zope 1.1.6-2,
Silva 0.8.5 released, Nuxeo releases Nuxeo Collaborative Portal Server,
Maildrop Host 1.2 released, PersistentThreads 0.2 released,
Localizer news!!, and MailBoxer 2.1 released.
Comments (none posted)
Web Services
Ed Dumbill
looks at the current state of web services on O'Reilly's XML.com.
"
Whatever else they have or haven't been, web services have been a boon for the popular technology media. On the way up the hype curve, breathless reports of the coming automation of our very existence filled pages and pages. Software executives jostled to join the right cabals, and to sit in smoke-filled rooms hammering out the formation of committees and specifications with daft acronyms."
Comments (none posted)
IBM's developerWorks has
an article on grid services.
"
According to Gartner, many businesses will be completely transformed over the next decade by using Grid-enabled Web services to integrate across the Internet to share not only applications but also computer power. In this article, Liang-Jie Zhang, Jen-Yao Chung, and Qun Zhou from IBM introduce developers to the basic idea of Grid computing and the Open Grid Services Architecture (OGSA). They describe how developers can use the latest Globus Toolkit (Open Grid Services Infrastructure technology preview) to discover a Grid service, create a Grid service interface, and invoke a Grid service instance."
Comments (none posted)
Standards
The LSB workgroup has just released its latest LSB v1.3 draft for public
review. The workgroup is soliciting comments from the community until
Friday November 8th.
Full Story (comments: none)
Desktop Applications
Audio Applications
Version 0.5.10 of the Sweep audio editor and playback tool is available.
"
New features in this release include vertical zoom with a draggable dB scale
and mouse wheel control, and some basic channel operations: Duplicate to
stereo/multichannel, Swap left and right, Remove left/right, Mix down to
mono, and Add/Remove channels."
Full Story (comments: 1)
Desktop Environments
Issue #45 of
Kernel Cousin KDE
is available. This edition covers
the new snake charmer Eric,
Xrandr, KMail and Windows Viruses, a KMail OpenPGP/MIME HOWTO
a KDE log file viewer, a KOffice filter status update and a
Developer Newsflash.
Comments (none posted)
KDE.News
looks at
the recently released KDE 3.1 RC 1.
"
A couple of points to consider: First,
if you are wed to the hicolor icons, please note that they have been moved
to the kdeartwork package; the other packages ship only with the new modern
and attractive Crystal-SVG icon theme.
Second, Klipper users who experience slowness or possible crashes in Konsole
or KMail with this release should try disabling the Klipper syncing options,
and then check the KDE 3.1 Info Page
about reporting results. Please give this release a thorough testing
so KDE 3.1 will be good and ready on schedule!"
Comments (none posted)
This week's GNOME Summary looks at the Captains of Nautilus; GNOME 2.1.1
development snapshot; Abiword robbed; First development release of GNOME 2
Galeon; and much more.
Full Story (comments: 4)
Headlines on the GNOME desktop
FootNotes site include:
GPL movie editing project gets grant from LinuxFund.org,
Release of GnuCash 1.7.2 alpha, Gtk# version 0.5 released,
GNOME Foundation Elections, Galeon 1.3.0 Released,
GNOME Development Series Snapshot 2.1.1, Eclipse IDE screenshots,
MIME-Type Specific Properties tabs checked into Nautilus,
GnomeMeeting 0.94.1 is out, the Debian Desktop Project,
and more.
Comments (none posted)
Games
The Pygame Project
has news of the projects page being split into a number of
Gamelets,
also check out the new versions of Spacewarpy and Monkeystomp.
Comments (none posted)
Graphics
The Linux Journal has
an article
that shows how to use the PLOT_PS and PLOT_XPS libraries to generate
PostScript and X window viewable graphics plots.
"
Almost any data analysis benefits from graphic outputs. They often lead to a more affordable and synthetic view of results than any table can provide. To meet this type of need, we developed a graphic library that easily produces high quality printouts using the PostScript (PS) language."
Comments (1 posted)
GUI Packages
The latest news from the
FLTK project
includes the release of flPhoto 0.7, a digital picture maniuplation
program, and the Equinox Desktop Environment developers have
joined FLTK Team.
Comments (none posted)
Interoperability
Issue #141 of the
Kernel Cousin Wine is out. Topics include
Xandros Release, WineX with Lycoris, Klez Virus,
RPC Update, Listview Update, Commctrl Update,
Wanted: AppDB Maintainer, Wine PR Manager Needed,
Web Browser Integration Needed, Running Australia's eTax,
Running Native Windows Utilities, and Compiling Wine With glibc 2.3.
Comments (none posted)
Office Applications
Issue #115 of the
AbiWord Weekly News is out with the latest AbiWord word processor
development news. Topics include the theft of AbiWord funds on PayPal,
selecting the right locale, status bar work, encoding problems,
Word import/export improvements, the upcoming 1.1.1 release,
AbiWord issues with Red Hat 8.0, and development stats.
Comments (none posted)
Issue #52 of
Kernel Cousin GNUe
is out. Topics include
PostgreSQL/Red Hat issues, Roadmaps and other project planning issues,
Forms graphical resolution, a WikiWikiWeb for GNUe,
Strong commercial interests and free software projects, the
Status of GNUe Tools and Packages, and much more.
Comments (none posted)
The second alpha version of GnuCash 1.7.2 is available.
Release highlights include search by reconcile flag for transactions,
read-only support for posted invoices and payments,
an updated glossary, transaction retrieval improvements,
two accounts for investment transactions, bug fixes, and more.
Full Story (comments: none)
Web Browsers
Version 1.3.0 of the Galeon minimalist web browser
has been released.
"
This is the first unstable release based on gnome 2 libraries and gtk2 mozilla.
It's a development version. This means that it will crash, it won't work as expected and it may damage random files of your system. However, we encourage you to test it and report any bug you find, and send us patches if you feel that you can help."
Comments (1 posted)
The latest
Mozilla News
includes the release of Phoenix 0.4, Mozilla 1.2 Beta,
Bugzilla 2.16.1, Mozilla 1.0.1, Chimera 0.5,
Netscape 7.0, a new API Announcement Mailing List, and more.
Comments (none posted)
The latest
mozillaZine topics
include: Phoenix 0.4 (Oceano) Released, Help to Make Phoenix 0.4 Not Suck,
Introduction to mozdev, Bugzilla Upgrade Plans,
Creating Links with Mozilla's window.getSelection() Method,
the Register on Web Sites that Block Minority Browsers,
and Mozilla Independent Status Reports.
Comments (none posted)
Languages and Tools
Caml
The October 22 to 29 edition of the Caml Weekly News is out.
Topics include GlSurf: surface in OCaml/OpenGL, Baire Status,
a standard library naming scheme, an email parser in ocamllex/ocamlyacc,
a question about polymorphic variant, and macros and camlp4.
Full Story (comments: none)
Java
Giuseppe Naccarato
explains how to work with CORBA under Java on O'Reilly's OnJava.com site.
"
OBV (Object by Value) was introduced in CORBA 2.3 to allow the exchange of CORBA Object value types. This powerful extension is very useful, for example, to design mutable applications. You can combine OBV with RMI-IIOP to allow Java clients to obtain a copy of remote object."
Comments (none posted)
Sing Li
looks at JMX 1.1 on IBM's developerWorks.
"
JMX is a popular new standard extension to the Java platform that enables devices, applications, and services to be managed, controlled, and monitored through modern Network Management Systems or Enterprise Management Systems. In this second article of his three-part series on JMX, consultant and popular author Sing Li demonstrates how to rapidly add instrumentation code to a Java-based application."
Comments (none posted)
Lisp
Version 0.7.9 of SBCL (Steel Bank Common Lisp) has been released.
This is a maintenance release that features new runtime checks
as well as bug fixes.
Full Story (comments: none)
Perl
Use Perl's
This Week on Perl5-porters is out for October 21-27, 2002.
"
This week was moderately busy for the Perl 5 porters. The highlights
feature various crashes and considerations about Unicode string handling;
not forgetting, as usual, about newly fixed bugs, and bugs yet to be fixed."
Comments (none posted)
Joe Johnston
documents his Perl-based SOAP journaling software for the Use Perl site.
"
Like journaling at use.perl.org but hate composing entries in the HTML widget TEXTAREA? Tired of the Web Services hype and what to see a real application? Hold on to your hats, true believers, because the answer to both problems lies in the article below."
Comments (none posted)
PHP
Topics on this week's
PHP Weekly Summary
include PHP and GD, naming tests, the cURL extension, regex bundling,
a new sybase_ct maintainer, and OpenSSL and sockets.
Comments (none posted)
Daniel Solin
shows how to code a PHP-based web site search engine on O'Reilly's
ONLamp.com site.
"
A little while ago, I was working on an intranet site for a mid-sized company. As the site grew in both size and popularity, the assigner requested me to extend the site with a search feature. Since one of the rules of the intranet was that all logic code should be written in-house, using an existing open source engine was not an option.
Within a day, the engine was quite complete, and the result actually turned out better than expected. With PHP, MySQL, and a few techniques, these small projects are very easy."
Comments (none posted)
Python
This week's edition of the Python-URL looks at transitioning from Java/C++
to Python, a comparison of Ruby and Python, and much more.
Full Story (comments: none)
This week's
Daily Python-URL
looks at articles on Open source in the lab, Mitch Kapor's open-source
Chandler Personal Information Manager project, Linux Lunacy 2002,
and more.
Comments (none posted)
Ruby
Topics on this week's
Ruby Weekly News
include the RAA Replaced, a comp.lang.ruby FAQ, and
reading the current line from a file.
New Ruby software includes
FixedTime 0.0.1, Crawler 0.0.1, and Ruby QT Embedded 0.2.
Comments (none posted)
Scheme
The October 28, 2002 Scheme Weekly News is out with a bunch of new Scheme-based software releases.
Full Story (comments: none)
Tcl/Tk
The October 29, 2002 edition of Dr. Dobb's Tcl-URL!
covers the latest Tcl/Tk development news.
Full Story (comments: none)
XML
Kendall Grant Clark
covers work toward the XML 1.1 specification on O'Reilly's XML.com.
"
Despite the frequent and usually accurate complaints that XML specifications and standards are insufficiently layered, there is a sort of conceptual stack of technologies which together constitute the architecture of the Web. In this week's XML-Deviant column I report on developments in XML, the base layer of the Web's architecture."
Comments (none posted)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
Joe Barr
continues
his comparison of installing Linux and Windows with Red Hat Linux 8.0
vs. a newbie install of Windows XP. "
The rules for the installation
were the same as before: defaults rule. If a choice was offered and a
default given, the default was taken. If a choice is offered, there is no
default and Susan doesn't know what to do, she can ask me for guidance. The
only exception to the above would be a case in which she knew that the
default is wrong without asking."
Comments (7 posted)
The Register
covers a
report commissioned by the US military which concludes that open source and
free software should play a greater part in the infrastructure of the U.S
military. "
Mitre Corporation's 152-page study addresses the extent
of software libre, or FOSS-licensed software use - FOSS being "Free and
Open Source Software" ... - in various branches of the military."
Comments (none posted)
Companies
Dan
Gillmor's latest column on SiliconValley.com looks at the Helix DNA
Client code release. "
Indeed, there's an echo in this
development. Years ago, as Microsoft was turning Netscape into roadkill,
Netscape announced it was moving key technology toward an open-source model
as well. The Mozilla browser and development platform resulted, but not
until Microsoft pretty much owned the browser market."
Comments (none posted)
ZDNet
looks at
the latest computing blade products from IBM.
"
IBM on Wednesday unveiled a pair of dual-processor blades during a customer conference in Palm Springs, Fla., said Tim Dougherty, IBM's director of blade strategy.
IBM's pSeries servers typically run Unix, but for its Power blades, the company expects the Linux operating system to be more popular, he said."
Comments (none posted)
News.com
takes a
look at IBM's newest line of Linux powered supercomputers.
"
Linux will be the main operating system for IBM's upcoming family of
"Blue Gene" supercomputers--a major endorsement for the operating system
and the open-source computing model it represents."
Comments (none posted)
TechWeb
reports that
SourceForge.net now has 500,000 registered users, nearly 50,000 projects.
"
To support its growth, SourceForge.net began a migration to IBM's
DB2 for Linux in August, with plans to be running fully on DB2 by
mid-January 2003." That's a lot of eggs in one basket.
Comments (1 posted)
ZDNet
covers a Gartner analysis of Sun's total cost of ownership advantage
with Linux PCs.
"
Gartner sees an opportunity for Sun to create a relatively large cost differential compared to a mainstream PC, through lower-cost elements such as an Advanced Micro Devices processor and a lower software-licensing fee. Because Linux potentially consumes fewer resources, Sun could configure the system with a slower processor, less storage, and less memory. It can also carefully control the hardware, software, and messaging configuration to tune the systems for security and stability."
Comments (none posted)
Business
The Register
covers a
partnership between Trustix AS and Chinese server manufacturer Langchao
Group to bundle its Trustix Linux Solutions Software (TLS) suite on the
company's Intel-based hardware. "
The Trustix portfolio includes the
Secure Linux operating system distribution, as well as firewall, web
server, proxy server, LAN server, web server, and mail server software
through the TLS suite. The company has worked with IBM to deploy TLS on its
xSeries servers for convenience retailer 7-Eleven, and most recently to
replace an existing Novell network for sports car vendor Ferrari."
Comments (none posted)
The Australian ComputerWorld site
looks
at a study published by IT analyst company, Butler Group, part of
Butler Direct Ltd. "
Though Unix systems from Hewlett-Packard
Co. (HP), IBM Corp. and Sun Microsystems Inc. will remain the server
operating systems of choice through 2004, within seven years Linux and .Net
will have fully penetrated the market from file and print servers, through
to the mainframe, the Butler Group, in Hull, England, said in a statement
outlining its study: "Server Operating Systems -- Winners and Losers in the
Open/Proprietary OS Market.""
Thanks to Vladimir Likic
Comments (none posted)
Legal
Some members of the U.S. Congress are looking into which software licenses
will and will not be allowed for release of government-sponsored software.
Alert LWN readers dwheeler, Barry Gould and Magnus Lycka have sent in links
for three articles addressing this issue.
This Newsforge article by Robin "Roblimo" Miller looks
at how open source advocates are lobbying the U.S. congress as members
decide which software licenses are and are not allowed for release of
government-sponsored software.
InformationWeek focuses on
Rep. Adam Smith, D-Wash., whose biggest campaign contributor is Microsoft,
who has added an addendum to an official letter that criticized open-source
software distributed under the GNU General Public License.
The topic is causing ripples as far away as Australia, as seen in this
article in TheAge.
Comments (1 posted)
Resources
The October 24, 2002 edition of the LinuxDevices Embedded
Linux Newsletter is out with the latest Embedded Linux news.
Full Story (comments: none)
Here's a Linux Journal
article about
the preemptible kernel patch, and its effect on the interrupt latency of a
Linux system. The patch reduces the measured interrupt latency of the
system, making it more appropriate for real-time applications. "
For
this work, interrupt latency is measured with an open benchmark called
Realfeel, written by Mark Hahn. Realfeel issues periodic interrupts and
measures the time needed for the computer to respond to these
interrupts. Response times vary from interrupt to interrupt. Realfeel
measures these interrupts and produces a histogram by putting the
measurements into bins."
Comments (none posted)
Linux Journal has
an article by Jose Nazario on building a remote,
secure web-based email system.
"
This article describes how you can set up your Linux computer to be a
web-based e-mail system for yourself or a group of friends. It will work
best, of
course, if you are on a dedicated internet connection, like a cable modem or a
DSL line at home. This will provide you with a secure method to check your
e-mail from remote locations without having to add insecure connection methods
that could be used by an attacker. While your friends and coworkers complain
about their free web based e-mail system being inaccessible, yours will be
humming along."
Comments (1 posted)
Here's a Register
article about
getting the best looking fonts in KDE. "
One of the more common
disappointments reported about the Linux GUI is clunky fonts under X. While
it's true that they can look pretty rough out of the box, it's also true
that sharpening them up is easy and well worth the effort, thanks to MS
TrueType fonts and the open-source FreeType project which makes them
useable on Linux. What follows is an explanation of how to get the most out
of both, assuming KDE is your desktop manager. (I imagine this may work on
other desktops, but KDE is the only one I'm well acquainted with.)"
Comments (none posted)
Reviews
ZDNet
examines the
current Linux kernel release schedule. "
Torvalds, the top programmer
of the kernel at the center of the heart of the Linux software project,
implemented a "feature freeze" for the 2.5 testing series, after which no
new features will be permitted. The deadline is set for the end of
October. Also, Torvalds said "early next year" will be the "code freeze,"
when the gates close for the software for those features."
Comments (none posted)
ZDNet
reviews
the upcoming LindowsOS 3.0 Membership Edition,
"
Lindows.com has fixed a date for the "General Release" of its operating system software, promising that Lindows 3.0 will be available from mid-November. The company also announced that Hewlett-Packard and other companies will be sponsoring the Desktop Linux Summit next year."
Comments (none posted)
Joe Barr doesn't think the Linux version of Unreal Tournament 2003 from
Epic Games is quite ready for prime time, in this
LinuxWorld
article. "
The rest of the news about the Linux port of UT 2003
is not so good. There are issues. And there remains in my mind a big
question: why has the Linux release been slipstreamed into something of a
stealth release? There is also one big issue that you need to be aware of
before you rush out to buy the boxed version, but I'm getting ahead of
myself."
Comments (3 posted)
Miscellaneous
A technial writer's publication known as TECHWR-L
looks at Linux for a technical writer's platform.
"
The truth is, most of what you think you know about Linux is outdated. Today, most types of Linux have a graphical install, balk only at hardware that specifically requires a copy of Windows, and (depending on your choices) can be installed in as little as fifteen minutes. And, once you're up and running, you can use Linux applications for almost all your work-related computing. Diehards can use a distribution like Slackware to install the old-fashioned hard way, but installing and using Linux is only slightly harder than doing the same things under Windows.
The program names, unfortunately, are still with us. You can't win them all."
Thanks to Bruce Byfield.
Comments (5 posted)
Linux Journal
covers the
upcoming meeting of SVLUG, where the featured speaker will be Hans Reiser,
architect of the Reiser filesystem and founder of namesys. "
Why is
Reiser4 50-100% faster than version 3? Find out at SVLUG."
Comments (none posted)
LinuxDevices.com
covers
data recently compiled by Evans Data Corp. which says Linux and Windows are
running neck-and-neck in terms of developer use for future projects.
"
Interestingly, Wind River's VxWorks embedded OS, which is generally
considered to be the encumbent embedded software market leader, trails
slightly behind Embedded Linux for current project use. Additionally,
VxWorks' modest gain of just 2.9 percentage points for expected use in
future projects drops it to a distant third place position, ending up with
less than half the usage rate of the two neck-and-neck future project usage
leaders (Windows Embedded and Embedded Linux)."
Comments (none posted)
"Verity Stob"
pokes fun
at open-source announcements on Dr. Dobb's.
"
Will there be lots of feeble Open Source wordplay, for example, referring to the FSF as a bunch of "gnerds"?"
Comments (none posted)
Page editor: Forrest Cook
Announcements
Commercial announcements
Lycoris Desktop/LX is now available on Microtel PCs at WalMart.com. After
undergoing the Desktop/LX Certification process to ensure consumer
satisfaction, nine different Microtel PCs from $228 and up are now
available.
Full Story (comments: none)
Prentice Hall PTR and HP announced the publication of "The Business and
Economics of Linux and Open Source" written by open source expert Martin
Fink. This book offers managers a guide to the role of open source in a
corporate environment and how to use it to gain a competitive advantage.
Full Story (comments: none)
Fujitsu Limited
announced that it
is positioning Linux as one of the key operating systems for its
next-generation IT systems, and it plans to commercialize large-scale,
mission-critical enterprise systems to run on Linux within the next three
years. As a first step in its stepped-up Linux business efforts, Fujitsu
released Linux versions of nine of its middleware and packaged software
products, available initially in the Japanese market. (Thanks to Maya
Tamiya)
Comments (3 posted)
The TV Linux Alliance has
invited
vendors in the cable, satellite and telecommunications industry to
participate in the TV Linux Alliance by joining the Alliance as members.
The Alliance has also announced
the availability of its specification version 0.8.
Comments (none posted)
AMD has
announced
the opening of the AMD Developer Center and the availability of two
additional development support resources - a beta x86-64 Linux distribution
and the AMD x86-64 Architecture Programmer's Manual.
Comments (2 posted)
Cray Inc. gets into the Linux cluster market with this
announcement
that the Ford Motor Company has ordered, installed and accepted a
Linux-based cluster with 192 processors at its data center in Dearborn,
Michigan.
Comments (none posted)
Resources
O'Reilly has
an article about building online communities.
"
The Internet exists to improve communication. Communities can grow
anywhere communication occurs.
Truisms or not, those statements have tremendous implications. Their
adherents see a commercial Web site less as a brochure and more as an
opportunity to communicate with customers. They consider those who run a
television fan site not as copyright infringers but as a community of
fans. They think in terms of conversations and relationships. Cultivate a
community, and you'll attract eyeballs and ears willing to read and to
listen to your message. Encourage discussion, and you'll attract people
willing to share their own messages.
"
Comments (none posted)
KDE.News
points to
an online
workshop for KOrganizer.
Comments (none posted)
The Linux Standards Base will be adding the
PPC32 and IA64 architectures to its certification program.
Full Story (comments: none)
The
Linux Audio Users Guide
has added a section called the LAD Techies Database that
lists Linux Audio Developers who are able to assist in
setting up Linux audio software. Click below for the announcement.
Full Story (comments: none)
An online Lisp book called "Loving Lisp" has been published by
Mark Watson.
Full Story (comments: none)
Upcoming Events
The online IRC-based UMeet conference will be held from December 9-20,
2002. Participants will include
Alan Cox, Rik van Riel, Dave Jones, Greg Kroah-Hartman, and
Chris Wright.
Full Story (comments: none)
A call for papers has been issued for the educationaLinux 2003 miniconf,
to be held on January 21 and 22, 2003 at
the University of Western Australia.
Full Story (comments: none)
Lindows.com, Inc. has
announced their sponsorship of a conference called the
Inaugural Desktop Linux Summit, which will be held in
San Diego on Feb 20-21, 2003.
"
The Summit will be the first event entirely
devoted to desktop Linux and will be hosted by the top executives of leading
technology companies worldwide including Codeweavers, Hewlett Packard,
Lindows.com, Lycoris, MandrakeSoft, Sun Microsystems, SuSE, and Ximian. Key
political and open source community advocates have also confirmed their place
at the Desktop Linux Summit."
Comments (2 posted)
| Date | Event | Location |
| October 31, 2002 | International Lisp Conference 2002 - The Art of Lisp | San Francisco, CA |
| October 31, 2002 | Think-Linux, The Solutions Show | (The Pinnacle)Toledo OH |
| November 1 - 3, 2002 | 2nd Annual Ruby Conference(RubyConf 2002) | (Washington State Trade and Convention Center)Seattle, Washington |
| November 2, 2002 | Southern CaliforniA Linux Expo 2002(SCALE) | (Davidson Conference Center, University of Southern California)Los Angeles, CA |
| November 3 - 6, 2002 | International PHP 2002 conference | Frankfurt, Germany |
| November 3 - 8, 2002 | 16th System Administration Conference(Lisa '02) | Philadelphia, PA |
| November 6, 2002 | Red Hat Road Tour 2002 | St. Louis, MO. |
| November 9, 2002 | Lightweight Languages 2002(LL2) | (MIT)Cambridge, MA |
| November 14 - 15, 2002 | The Open Source Health Care Alliance(OSHCA) | (UCLA Medical Center)Los Angeles, CA |
| November 18 - 21, 2002 | Embedded Systems Conference, Boston | (Hynes Convention Center)Boston, Mass |
| December 3 - 5, 2002 | Linux Bangalore/2002 | (J.N.Tata Auditorium)Bangalore, India |
| December 9 - 20, 2002 | UMeet conference | On IRC |
Comments (none posted)
Software announcements
Here are the software announcements, courtesy of
Freshmeat.net. They are available in
two formats:
Comments (none posted)
Miscellaneous
The UnitedLinux folks have sent out a press release claiming that over
15,000 copies of the UnitedLinux beta release have been downloaded over the
last month.
Full Story (comments: none)
The Danish parliament is in the process of implementing the European Union
directive called "copyrights and related rights in the information
society" in the Danish law code. The directive is probably better known
to LWN readers as the EU version of the DMCA. Protests are underway.
Full Story (comments: 2)
Bruce Perens has sent out a
personal
message asking for financial support of his ongoing work to defend and
promote free software.
Comments (8 posted)
Page editor: Forrest Cook