Your editor doesn't really know any more about what will happen this year
than anybody else. But he has never been one to let such a difficulty stop
him from embarrassing himself by posting predictions in front of thousands
of people. So, without further ado, here's a set of highly unlikely
prognostications for the coming year. As usual, no warranty applies.
Legal issues
The GPLv3 process will dominate the news for the first half of the
year. The FSF seems fully aware of the stakes involved in a new version of
the GPL, and Eben Moglen is the ideal person to push this effort forward.
But there is no way that changes to such a fundamental document could be
anything but controversial. How the FSF handles the feedback it gets will
determine whether the resulting license is widely respected - and used.
The non-free kernel module issue will come to a head this year.
Patience with these modules has been fading for years, while concern over
the lack of free drivers for certain types of hardware is on the increase.
This year, some developer or other is likely to force the issue and mount a
more direct challenge to the legality of proprietary kernel modules.
Others, meanwhile, will continue to make them harder to write and
maintain. Either way, we may reach a point where the maintenance of, for
example, proprietary drivers for video cards is no longer feasible.
Whether the end result is the release of free drivers or the complete
withdrawal of support remains to be seen.
The broadcast flag will be back, and European software patents too.
The interests behind this sort of legislation never give up, so we'll never
be able to stop fighting. But if we keep up the battle, we stand a
respectable chance of winning much of the time.
Development
2006 will be the year of Linux on the desktop. Just like the last
ten years. Don't expect any amazing advances, just slow, steady progress.
The applications will get better, and people will slowly see more reasons
to run Linux. Governmental mandates for open document formats - likely to
proceed despite the tactics used in Massachusetts - will help in this
regard.
The world will begin to discover alternatives to OpenOffice.org.
OpenOffice is great stuff, and it lets Office workers move over to free
software without overly disrupting their world. But there is a great deal
of interesting work being done on platforms like AbiWord, KOffice,
Gnumeric, etc. Once people get past "looks like Office" and start to
concern themselves with issues like memory footprint or innovative new
features, they will become more open to alternatives. Luckily for us, the
free software community is strong enough to be able to provide those
alternatives.
De-bloating will gain on new features as a development priority in
many projects. This work will be driven partly by a general unease with
the size of our systems, and partly by the increase in the number of
developing-country hackers who are particularly motivated to make things
run well on older, less capable hardware.
Perl 6 will not be released; it may not even be completely specified
by the end of the year. We will, however, start seeing Perl 5
releases with more backported Perl 6 features.
The Fedora project will have to make changes to preserve developer
and user interest in 2006. Fedora is still hard to contribute to, its
decision process is relatively opaque, the
promised Fedora Foundation is missing, the short support period keeps users
on an upgrade treadmill, Fedora Legacy is not staffed at a level where
it can be relied upon, and, crucially, other free, leading-edge
distributions (OpenSUSE, Ubuntu) are increasingly competing for the same
users. Fedora remains a top-quality distribution, but it risks losing some
of the user and developer energy which makes it an important distribution.
Debian 'etch' will be released in December, on schedule -- or, at
least, very close to it. The Debian developers are tired of their
reputation for unreliable release schedules and see an opportunity to
improve the situation.
Emacs 22 will be released. This prediction may seem like more of a
stretch than even the Debian release, but the time is coming for the emacs
hackers to show the world that they have not been idle all these years.
The pace of kernel development will not slow. The increased
emphasis placed on avoiding regressions and user-space breakage will
continue, however, and the quality of kernel releases will continue to go
up. The kernel available one year from now will be substantially different
from the current 2.6.15 release - but it will be good stuff.
Commerce
There will be an increasing number of Linux-based gadgets
available. Embedded Linux is finally reaching the potential it has
shown for many years, and it will show up in no end of interesting new
toys. Unfortunately, most of those toys will be locked down and not
hackable.
Novell will get its act together and become a truly successful
Linux-based company. This result will be a combination of long experience
in selling to large businesses, clueful people on staff, and a strong
desire among customers to have more than one vendor to choose from.
Ubuntu/Canonical will start to make some real money. At some point the
company has to bring in some revenue if it is to be sustainable over the
long term. But, more to the point, the Ubuntu folks seem to be doing many
things right: generating interest in the user and developer communities
while pursuing goals (such as application certification) which make large
customers happy.
Miscellaneous
iPod users will begin to notice two free operating systems for their
toys, being iPodLinux and, toward the end of
the year, Rockbox.
The latter should be especially interesting to blind users, thanks to its
voice menu feature. The advantages of free software for gadgets will
become clear to more people - but so will the conflict with DRM schemes.
A Firefox vulnerability will be used to compromise systems. Firefox
is too big and complex to be without vulnerabilities, and it is becoming
too popular to ignore.
The SCO case will drag on, perhaps severely reduced by renewed
motions from IBM and Novell. But few people will care anymore.
The safest prediction of all, of course, is that Linux and free software
will continue to improve. The development momentum behind the free
software community is truly amazing, and it shows no signs of slowing
down. Whatever else happens over the next year, our systems will be
stronger and more fun to work with. Your editor is looking forward to it.
Comments (51 posted)
The MP3 audio format is a pain. It is patent-encumbered, making it hard for
Linux distributors to package (or Linux users to use) legally in various
parts of the world. It doesn't even sound all that good, compared to some
of the alternatives. Yet MP3 is hard to avoid; digital audio players often
prefer it, and much of the interesting audio content to be found on the net
is encoded as MP3. So Linux users who do any amount of audio listening
with their systems generally end up with MP3 software on their systems even
if their distributor refuses to include it.
The hassles of tracking down unofficial repositories, configuring a system
to use those repositories, and installing MP3-capable software are
something that many Linux users take in stride. Using Linux has often
required some of that kind of work, after all; you newcomers should just be
happy that you don't have to come up with your own XFree86 modelines
anymore. But the lack of native MP3 capability is an impediment for
potential users who want things like audio to simply work without a bunch
of fiddling around. Such people tend to be uninterested in discussions of
the evil of software patents and the superiority of Vorbis audio. None of
that helps them listen to their favorite Norwegian reggae Internet radio
station.
The folks at Fluendo - the main force behind GStreamer - have made an attempt
to
improve this situation. Fluendo has bought a patent license for the MP3
technology, and has used it to make a couple of different items available:
- A GStreamer plugin for MP3 released under the BSD license; it is
downloadable from the
Fluendo site.
- A binary-only version of the plugin which has been made freely
downloadable via the Fluendo web
shop. The binary plugin is generated from the BSD-licensed
source.
There are other freely-licensed MP3 decoders available, but the Fluendo
release is still worthy of note due to its use of the BSD license. Most
MP3 codecs are licensed under the GNU GPL, which includes
this language:
If you cannot distribute so as to satisfy simultaneously your
obligations under this License and any other pertinent obligations,
then as a consequence you may not distribute the Program at
all. For example, if a patent license would not permit royalty-free
redistribution of the Program by all those who receive copies
directly or indirectly through you, then the only way you could
satisfy both it and this License would be to refrain entirely from
distribution of the Program.
This language makes it hard to distribute patent-encumbered, GPL-licensed
code, so the redistribution of any application containing a GPL-licensed
MP3 codec is legally dubious. The use of the BSD license is an attempt to
avoid this particular clause of the GPL. One should not forget, however,
that the result of linking BSD- and GPL-licensed code is normally a
derivative work which must retain the GPL license. So it is not clear that
any GPL-licensed GStreamer application can be shipped with the new decoder.
The binary-only plugin has a different intent. This plugin is fully
licensed, so any Linux user (on a supported version of a supported
distribution on a supported architecture) should be able to install it and
play MP3 files without patent worries. Distributors can also sign a
contract [PDF] with Fluendo which allows the binary plugin to be
included with a distribution. There are plenty of restrictions in the
contract, including an end-user license which prohibits further
redistribution. So, while a distributor can gain the right to legally
distribute the binary-only MP3 decoder, any derivative distributions must
sign their own agreement with Fluendo to obtain the same right. The
contract also prohibits "embedded" use, so projects like iPodLinux seem unlikely to be
able to ship this plugin.
So Linux distributors can now ship MP3-capable distributions, as long as
they don't mind the little fact that any such distribution is not 100%
free. Which distributors will accept this deal remains to be seen; in a
few cases, some guesses can be made based on the discussion (or lack
thereof) on the relevant mailing lists:
- Fedora looks like it will sit for months waiting for Red Hat's
lawyers to issue a pronouncement. One Red Hat staff member has said, however: "I expect there will
be future developments in the media formats area of Fedora, but for now
it seems unlikely that we will do more than link to the packages you
have kindly made available."
- Mandriva already includes MP3 support in its distribution.
Assuming that Mandriva feels safe in shipping MP3 codecs now, it
probably sees little to gain by adding a binary-only version.
- Ubuntu seems to be considering including the plugin in its
"restricted" area. There is some discussion of whether it would still
be legal to include rhythmbox, which is GPL-licensed with no plugin
exception, in such a work.
Most other major distributions do not currently appear to have a public
discussion going.
In an ideal world, our systems would include free codecs for all of
the widely-used audio and video formats. The world we actually live in,
unfortunately, requires that we set our expectations a little lower. While
many of us can do nicely with formats like Ogg much of the time, the simple
fact is that missing MP3 support makes Linux less useful for many people.
And this is not a problem that can be solved by coding. The contributions
from Fluendo do not qualify as a solution, but they could well help make
Linux work for people who were not able to do what they wanted previously.
That's a step in the right direction, even if it is not ideal.
Comments (34 posted)
Just before the end of 2005, word got out that SonyBMG had put together a
proposed settlement in of of the class-action suits spawned by its
ill-advised copy protection measures. The EFF promptly
signed on to
the settlement as well. The full text is available
in PDF format; the following is
a summary.
The ostensible plaintiffs in this action - SonyBMG customers who installed
the DRM software found on SonyBMG discs - don't get a whole lot directly.
The settlement allows for XCP victims to get a non-DRM version of their
discs, to download MP3 copies of the songs on the discs, the right to
download one album "from a list of more than 200 titles," and the option of
(1) three more album downloads or (2) a check for $7.50. People
who bought MediaMax-protected discs only get one album download.
That is not a whole lot of compensation for somebody whose computer has
been compromised by SonyBMG's malware. It rather differs from the hard
line taken by the recording studios against those deemed to be "pirates."
This result is not particularly
surprising, however; class-action suits are rarely about the interests of the people
named as plaintiffs. Nonetheless, there are provisions of this
settlement which will benefit those plaintiffs - and many others as well.
They include:
- SonyBMG agrees to immediately recall all CDs containing the XCP
software. In theory, this recall has already happened, but there have
been numerous reports of XCP discs remaining on store shelves.
- The company will also stop manufacturing CDs with the MediaMax DRM
software - for at least two years. MediaMax is not quite as bad as
XCP, but it still has "phone home" capabilities and can open up a
system to security problems.
- SonyBMG will provide uninstallers for XCP and MediaMax, and a security
update for MediaMax as well.
- Numerous behavioral changes are called for; SonyBMG agrees not to
install software without a positive agreement, to make uninstallers
available, to describe the functionality of software to the user "in
plain English," to, refrain from collecting data on users, to issue patches
for security problems, and to "obtain comments" on its EULAs and
potential security vulnerabilities in its future DRM software. These
constraints only apply through 2007, however.
Together, these terms comprise a set of rules that music distributors might
be expected to play by in the future. On the good side, they call for
explicit information on what DRM software does, limitations on phoning
home, the availability of uninstallers, and some attention to security
issues. That's a start, and more than was available before.
On the other hand, this settlement fails to address fundamental questions,
such as whether it is right to force people to install software to listen
to music they have purchased. Limitations on fair use, including making
backup copies or putting music on a portable player, are not addressed.
This settlement makes it clear that DRM software does not have complete
freedom on the user's computer, but it in no way questions the correctness
of that software in the first place. The entertainment industry remains
free to make its DRM regime is restrictive as it likes, as long as it does
not step on users' toes in other ways.
In other words, SonyBMG's original purpose for XCP - keeping its customers
from putting music onto their iPods - has not been addressed. The
company is free to attempt to impose the same restrictions in the future.
The people behind the suit can claim a win, and the lawyers will certainly
get their (currently unspecified) cut. The court will likely approve the
settlement, but SonyBMG is not out of the woods yet. Various other
lawsuits are still outstanding, including one in Texas which alleges
spyware violations.
Why the EFF signed on to this agreement is not entirely clear; perhaps
declaring victory was more important trying to fight the larger battle.
It would have been nice if this case could have been used to attack the
assumptions and goals behind DRM in general, rather than being satisfied
with the creation of a basic DRM code of conduct. That is a battle which
will have to be fought another day.
Comments (5 posted)
The December 22 LWN Weekly Edition contains
an article on how a significant
amount of XGL (X over OpenGL) work has been done
behind closed doors at Novell. XGL hacker David Reveman has now
posted Novell's code with a request that it be
added to the freedesktop.org CVS repository. Large amounts of work have
been done; see David's mail for the summary. Now all that work has to be
somehow merged with what the rest of the XGL developers have been doing in
the open; this may turn out to be a long process.
Comments (2 posted)
Page editor: Jonathan Corbet
Security
Image file formats continue to be fertile ground for anybody seeking
security vulnerabilities. It seems that there is a tiny hole in the
"Windows metafile" (WMF) implementation on just about every version of
Windows. Exploits exist and are widespread; all it takes to be compromised
is an attempt to view a malicious WMF file. Using Internet Explorer to
view web page which
includes the WMF file is sufficient; depending on who you believe, it may
also be possible to deliver malicious files in email.
Quite a few sites hosting exploits have been found; by some estimates,
hundreds of thousands of machines have already been compromised. Happily,
Windows users can rely on Microsoft's recent commitment to security for a
patch.
Unhappily, it seems that Microsoft, which has known about the vulnerability
since sometime in December, will not have a fix available until
January 10. Meanwhile, users are told to be careful out there and
"avoid reading email from strangers."
So Windows users will be left vulnerable to a severe
vulnerability - with numerous exploits already happening - for a minimum of
two weeks. It is tempting to insert a long, Microsoft-bashing rant here,
but there is little point.
Instead, we'll point out a couple of things which might be worth knowing if
you're concerned with security issues involving Windows in any way:
- Firefox (on Windows) users are vulnerable too. Being compromised via
Firefox is harder than with Internet Explorer; current versions of the
browser require an explicit user action before a WMF file will be
displayed. But requiring an extra click is a thin line of defense, at
best.
- There is an unofficial
fix available for people who do not want to wait for Microsoft to
get around to putting up a patch. By all accounts, the fix does
exactly what it says it does, but, since it is a binary patch, it is
hard to verify independently.
It is hard to imagine a vulnerability of this severity staying open for so
long in the free software world. If distributors were slow in releasing a
patch, the community would fill in quickly - with verifiable,
source-available fixes. There is little doubt that, sooner or later, a
serious vulnerability will threaten free software users; that is, unfortunately,
the nature of software. But the nature of free software should keep
that vulnerability from being left open for anywhere near so long.
(See also: the CERT
advisory for the WMF vulnerability and this FAQ).
Comments (9 posted)
New vulnerabilities
cpio: arbitrary code execution
| Package(s): | cpio |
CVE #(s): | CVE-2005-4268
|
| Created: | January 2, 2006 |
Updated: | March 17, 2010 |
| Description: |
Richard Harms discovered that cpio did not sufficiently validate file
properties when creating archives. Files with e. g. a very large size
caused a buffer overflow. By tricking a user or an automatic backup
system into putting a specially crafted file into a cpio archive, a
local attacker could probably exploit this to execute arbitrary code
with the privileges of the target user (which is likely root in an
automatic backup system). |
| Alerts: |
|
Comments (none posted)
dhis-tools-dns: insecure temporary file
| Package(s): | dhis-tools-dns |
CVE #(s): | CVE-2005-3341
|
| Created: | December 27, 2005 |
Updated: | January 4, 2006 |
| Description: |
Javier Fernández-Sanguino Peña from the Debian Security Audit project
discovered that two scripts in the dhis-tools-dns package, DNS
configuration utilities for a dynamic host information System, which
are usually executed by root, create temporary files in an insecure
fashion. |
| Alerts: |
|
Comments (none posted)
ketm: arbitrary code execution
| Package(s): | ketm |
CVE #(s): | CVE-2005-3535
|
| Created: | December 23, 2005 |
Updated: | January 4, 2006 |
| Description: |
Steve Kemp from the Debian Security Audit Project discovered a buffer
overflow in ketm, an old school 2D-scrolling shooter game, that can be
exploited to execute arbitrary code with group games privileges. |
| Alerts: |
|
Comments (none posted)
nbd: arbitrary code execution
| Package(s): | nbd |
CVE #(s): | CVE-2005-3534
|
| Created: | December 22, 2005 |
Updated: | January 4, 2006 |
| Description: |
The network block device server has a vulnerability that can
potentially be used to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
openmotif: buffer overflows
| Package(s): | openmotif |
CVE #(s): | CVE-2005-3964
|
| Created: | December 29, 2005 |
Updated: | July 27, 2006 |
| Description: |
The libUil component of the OpenMotif toolkit has a pair of buffer
overflow vulnerabilities that can possibly be used for the execution
of arbitrary code.
|
| Alerts: |
|
Comments (none posted)
php: CRLF injection vulnerability
| Package(s): | php |
CVE #(s): | CVE-2005-3883
|
| Created: | December 27, 2005 |
Updated: | January 4, 2006 |
| Description: |
A CRLF injection vulnerability in the mb_send_mail function in PHP before
5.1.0 might allow remote attackers to inject arbitrary e-mail headers via
line feeds (LF) in the "To" address argument, when using sendmail as the
MTA (mail transfer agent). |
| Alerts: |
|
Comments (none posted)
phpbb2: multiple vulnerabilities
| Package(s): | phpbb2 |
CVE #(s): | CVE-2005-3310
CVE-2005-3415
CVE-2005-3416
CVE-2005-3417
CVE-2005-3418
CVE-2005-3419
CVE-2005-3420
CVE-2005-3536
CVE-2005-3537
|
| Created: | December 22, 2005 |
Updated: | February 11, 2008 |
| Description: |
The phpbb2 web forum has a number of vulnerabilities including:
a web script injection problem, a protection mechanism bypass, a
security check bypass, a remote global variable bypass, cross site
scripting vulnerabilities, an SQL injection vulnerability,
a remote regular expression modification problem, missing input
sanitizing, and a missing request validation problem. |
| Alerts: |
|
Comments (none posted)
pinentry: local privilege escalation
| Package(s): | pinentry |
CVE #(s): | |
| Created: | January 3, 2006 |
Updated: | January 4, 2006 |
| Description: |
Tavis Ormandy of the Gentoo Linux Security Audit Team has discovered
that the pinentry ebuild incorrectly sets the permissions of the
pinentry binaries upon installation, so that the sgid bit is set making
them execute with the privileges of group ID 0. |
| Alerts: |
|
Comments (none posted)
printer-filters-utils: privilege escalation
| Package(s): | printer-filters-utils |
CVE #(s): | |
| Created: | January 2, 2006 |
Updated: | January 4, 2006 |
| Description: |
A local root vulnerability has been discovered in the mtink binary, which
has a buffer overflow in its handling of the HOME environment variable,
allowing the possibility for a local user to gain root privileges. |
| Alerts: |
|
Comments (none posted)
rssh: privilege escalation
| Package(s): | rssh |
CVE #(s): | CVE-2005-3345
|
| Created: | December 27, 2005 |
Updated: | January 4, 2006 |
| Description: |
Max Vozeler discovered that the rssh_chroot_helper command allows local
users to chroot into arbitrary directories. A local attacker could exploit
this vulnerability to gain root privileges by chrooting into arbitrary
directories. |
| Alerts: |
|
Comments (none posted)
scponly: privilege escalation
| Package(s): | scponly |
CVE #(s): | CVE-2005-4532
|
| Created: | December 29, 2005 |
Updated: | February 13, 2006 |
| Description: |
The scponly restricted shell has a privilege escalation vulnerability.
Local users can chroot into arbitrary directories, and can gain root
privileges if a directory contains hard links to setuid programs.
Also, scponly does not properly validate command line parameters
to the scp and rsync commands. |
| Alerts: |
|
Comments (none posted)
tkdiff: insecure temporary file
| Package(s): | tkdiff |
CVE #(s): | CVE-2005-3343
|
| Created: | December 27, 2005 |
Updated: | January 4, 2006 |
| Description: |
Javier Fernández-Sanguino Peña from the Debian Security Audit project
discovered that tkdiff, a graphical side by side "diff" utility,
creates temporary files in an insecure fashion. |
| Alerts: |
|
Comments (none posted)
xnview: privilege escalation
| Package(s): | xnview |
CVE #(s): | |
| Created: | December 30, 2005 |
Updated: | January 4, 2006 |
| Description: |
Krzysiek Pawlik of Gentoo Linux discovered that the XnView package for
IA32 used the DT_RPATH field insecurely, causing the dynamic loader to
search for shared libraries in potentially untrusted directories. |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
apache: cross-site scripting
| Package(s): | apache |
CVE #(s): | CVE-2005-3352
|
| Created: | December 14, 2005 |
Updated: | May 10, 2006 |
| Description: |
Versions 1 and 2 of the apache web server suffer from a cross-site scripting vulnerability in the mod_imap module; see this bugzilla entry for details. |
| Alerts: |
|
Comments (none posted)
bzip2: race condition and infinite loop
| Package(s): | bzip2 |
CVE #(s): | CAN-2005-0953
CAN-2005-1260
|
| Created: | May 17, 2005 |
Updated: | January 10, 2007 |
| Description: |
A race condition in bzip2 1.0.2 and earlier allows local users to modify
permissions of arbitrary files via a hard link attack on a file while it is
being decompressed, whose permissions are changed by bzip2 after the
decompression is complete. Also specially crafted bzip2 archives may cause
an infinite loop in the decompressor. |
| Alerts: |
|
Comments (2 posted)
ktools: buffer overflow
| Package(s): | centericq |
CVE #(s): | CVE-2005-3863
|
| Created: | December 7, 2005 |
Updated: | August 29, 2006 |
| Description: |
From the Debian-Testing alert: Mehdi Oudad "deepfear" and Kevin Fernandez "Siegfried" from the Zone-H
Research Team discovered a buffer overflow in kkstrtext.h of the ktools
library, which is included in (at least) centericq and motor. |
| Alerts: |
|
Comments (none posted)
curl: buffer overflow
| Package(s): | curl |
CVE #(s): | CVE-2005-4077
|
| Created: | December 8, 2005 |
Updated: | March 27, 2006 |
| Description: |
The curl file transfer utility has a buffer overflow vulnerability
in the URL authentication code. If an overly long URL is used,
a buffer overflow can result, allowing for local unauthorized access. |
| Alerts: |
|
Comments (none posted)
cyrus-imapd: buffer overflows
| Package(s): | cyrus-imapd |
CVE #(s): | CAN-2005-0546
|
| Created: | February 23, 2005 |
Updated: | April 10, 2006 |
| Description: |
Cyrus-imapd, prior to version 2.2.12, contains several buffer overflows which could be exploited by an (authenticated) attacker to run code on the server system. |
| Alerts: |
|
Comments (none posted)
dia: missing input sanitizing
| Package(s): | dia |
CVE #(s): | CAN-2005-2966
|
| Created: | October 4, 2005 |
Updated: | April 6, 2006 |
| Description: |
Joxean Koret discovered that the SVG import plugin did not properly
sanitize data read from an SVG file. By tricking an user into opening
a specially crafted SVG file, an attacker could exploit this to
execute arbitrary code with the privileges of the user. |
| Alerts: |
|
Comments (none posted)
emacs21: format string vulnerability in "movemail"
| Package(s): | emacs21 |
CVE #(s): | CAN-2005-0100
|
| Created: | February 7, 2005 |
Updated: | May 15, 2006 |
| Description: |
Max Vozeler discovered a format string vulnerability in the "movemail"
utility of Emacs. By sending specially crafted packets, a malicious
POP3 server could cause a buffer overflow, which could be exploited to
execute arbitrary code with the privileges of the user and the "mail"
group. |
| Alerts: |
|
Comments (none posted)
enscript: arbitrary code execution
| Package(s): | enscript |
CVE #(s): | CAN-2004-1184
CAN-2004-1185
CAN-2004-1186
|
| Created: | January 21, 2005 |
Updated: | May 27, 2006 |
| Description: |
Erik Sjölund has discovered several security relevant problems in enscript,
a program to convert ASCII text into Postscript and other formats.
Unsanitized input can cause the execution of arbitrary commands via EPSF
pipe support. Due to missing sanitizing of filenames it is possible that a
specially crafted filename can cause arbitrary commands to be executed.
Multiple buffer overflows can cause the program to crash. |
| Alerts: |
|
Comments (none posted)
ethereal: buffer overflow
| Package(s): | ethereal |
CVE #(s): | CVE-2005-3651
|
| Created: | December 13, 2005 |
Updated: | January 4, 2006 |
| Description: |
A buffer overflow has been discovered in ethereal, a commonly used
network traffic analyzer that causes a denial of service and may
potentially allow the execution of arbitrary code. |
| Alerts: |
|
Comments (none posted)
ethereal: multiple vulnerabilities
Comments (none posted)
evolution: format string issues
Comments (2 posted)
fetchmail: multidrop bug
| Package(s): | fetchmail |
CVE #(s): | CVE-2005-4348
|
| Created: | December 20, 2005 |
Updated: | May 27, 2006 |
| Description: |
Fetchmail contains a bug which allows a malicious mail server to crash the
client by sending a message without headers. This occurs when running in
multidrop mode. |
| Alerts: |
|
Comments (none posted)
ffmpeg: buffer overflow
| Package(s): | ffmpeg |
CVE #(s): | CVE-2005-4048
|
| Created: | December 15, 2005 |
Updated: | March 17, 2006 |
| Description: |
The avcodec_default_get_buffer() function of the ffmpeg library
has a buffer overflow vulnerability. A user can be tricked into
playing a maliciously created PNG movie, allowing the attacker to
run arbitrary code with the user's privileges. |
| Alerts: |
|
Comments (none posted)
firefox: multiple vulnerabilities
Comments (none posted)
Foomatic: Arbitrary command execution in foomatic-rip
| Package(s): | foomatic |
CVE #(s): | CAN-2004-0801
|
| Created: | September 20, 2004 |
Updated: | May 31, 2006 |
| Description: |
There is a vulnerability in the foomatic-filters package. This
vulnerability is due to insufficient checking of command-line parameters
and environment variables in the foomatic-rip filter. This vulnerability
may allow both local and remote attackers to execute arbitrary commands on
the print server with the permissions of the spooler. |
| Alerts: |
|
Comments (none posted)
FUSE: mtab corruption through fusermount
| Package(s): | fuse |
CVE #(s): | CVE-2005-3531
|
| Created: | November 22, 2005 |
Updated: | January 24, 2006 |
| Description: |
Thomas Biege discovered that fusermount fails to securely handle
special characters specified in mount points. A local attacker could corrupt the contents of the /etc/mtab file by mounting over a maliciously-named directory using fusermount, potentially allowing the attacker to set unauthorized mount options. |
| Alerts: |
|
Comments (none posted)
gaim: buffer overflow
| Package(s): | gaim |
CVE #(s): | CAN-2005-2103
|
| Created: | August 10, 2005 |
Updated: | February 27, 2006 |
| Description: |
Gaim suffers from a heap-based buffer overflow which can be exploited via a hostile "away message" to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
gdb: multiple vulnerabilities
| Package(s): | gdb |
CVE #(s): | CAN-2005-1704
CAN-2005-1705
|
| Created: | May 20, 2005 |
Updated: | August 11, 2006 |
| Description: |
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered an integer
overflow in the BFD library, resulting in a heap overflow. A review also
showed that by default, gdb insecurely sources initialization files from
the working directory. Successful exploitation would result in the
execution of arbitrary code on loading a specially crafted object file or
the execution of arbitrary commands. |
| Alerts: |
|
Comments (5 posted)
gdk-pixbuf: multiple vulnerabilities
| Package(s): | gdk-pixbuf gtk2 |
CVE #(s): | CVE-2005-3186
CVE-2005-2976
CVE-2005-2975
|
| Created: | November 15, 2005 |
Updated: | March 20, 2006 |
| Description: |
The gdk-pixbuf package contains an image loading library used with the
GNOME GUI desktop environment. A bug was found in the way gdk-pixbuf
processes XPM images. An attacker could create a carefully crafted XPM file
in such a way that it could cause an application linked with gdk-pixbuf to
execute arbitrary code when the file was opened by a victim.
Ludwig Nussel discovered an integer overflow bug in the way gdk-pixbuf
processes XPM images. An attacker could create a carefully crafted XPM
file in such a way that it could cause an application linked with
gdk-pixbuf to execute arbitrary code or crash when the file was opened by a
victim.
Ludwig Nussel also discovered an infinite-loop denial of service bug in the
way gdk-pixbuf processes XPM images. An attacker could create a carefully
crafted XPM file in such a way that it could cause an application linked
with gdk-pixbuf to stop responding when the file was opened by a victim. |
| Alerts: |
|
Comments (none posted)
gedit: format string vulnerability
| Package(s): | gedit |
CVE #(s): | CAN-2005-1686
|
| Created: | June 9, 2005 |
Updated: | February 5, 2009 |
| Description: |
A format string vulnerability has been discovered in gedit. Calling
the program with specially crafted file names caused a buffer
overflow, which could be exploited to execute arbitrary code with the
privileges of the gedit user. |
| Alerts: |
|
Comments (1 posted)
gettext: Insecure temporary file handling
| Package(s): | gettext |
CVE #(s): | CAN-2004-0966
|
| Created: | October 11, 2004 |
Updated: | March 1, 2006 |
| Description: |
gettext insecurely creates temporary files in world-writeable directories
with predictable names. A local attacker could create symbolic links in
the temporary files directory, pointing to a valid file somewhere on the
filesystem. When gettext is called, this would result in file access with
the rights of the user running the utility, which could be the root user. |
| Alerts: |
|
Comments (1 posted)
grip: buffer overflow
| Package(s): | grip |
CVE #(s): | CAN-2005-0706
|
| Created: | March 10, 2005 |
Updated: | November 19, 2008 |
| Description: |
Grip, a CD ripper, has a buffer overflow vulnerability that can
occur when the CDDB server returns more than 16 matches. |
| Alerts: |
|
Comments (none posted)
groff: insecure temporary directory
| Package(s): | groff |
CVE #(s): | CAN-2004-0969
|
| Created: | November 1, 2004 |
Updated: | February 9, 2006 |
| Description: |
Recently, Trustix Secure Linux discovered a vulnerability in the groff
package. The utility "groffer" created a temporary directory in an
insecure way, which allowed exploitation of a race condition to create
or overwrite files with the privileges of the user invoking the
program. |
| Alerts: |
|
Comments (none posted)
gzip: arbitrary command execution
| Package(s): | gzip |
CVE #(s): | CAN-2005-0758
|
| Created: | August 1, 2005 |
Updated: | January 10, 2007 |
| Description: |
zgrep in gzip before 1.3.5 does not handle shell metacharacters like '|'
and '&' properly when they occurred in input file names. This could be
exploited to execute arbitrary commands with user privileges if zgrep is
run in an untrusted directory with specially crafted file names. |
| Alerts: |
|
Comments (2 posted)
htdig: cross site scripting
| Package(s): | htdig |
CVE #(s): | CAN-2005-0085
|
| Created: | February 14, 2005 |
Updated: | January 10, 2006 |
| Description: |
Michael Krax discovered that ht://Dig fails to validate the 'config'
parameter before displaying an error message containing the parameter.
This flaw could allow an attacker to conduct cross-site scripting
attacks. |
| Alerts: |
|
Comments (none posted)
imap: buffer overflow in c-client
| Package(s): | imap |
CVE #(s): | CAN-2003-0297
|
| Created: | February 18, 2005 |
Updated: | April 10, 2006 |
| Description: |
A buffer overflow flaw was found in the c-client IMAP client. An attacker
could create a malicious IMAP server that if connected to by a victim could
execute arbitrary code on the client machine. |
| Alerts: |
|
Comments (none posted)
ipsec-tools: denial of service
| Package(s): | ipsec-tools |
CVE #(s): | CVE-2005-3732
|
| Created: | December 1, 2005 |
Updated: | June 8, 2006 |
| Description: |
ipsec-tools has a remote
denial of service vulnerability in the racoon daemon.
If racoon is running in aggressive mode, it fails to check all peer
payloads during
When the daemon the IKE negotiation phase, allowing a malicious peer
to crash the daemon. One should always be careful around aggressive racoons. |
| Alerts: |
|
Comments (none posted)
kdebase: local root vulnerability
| Package(s): | kdebase |
CVE #(s): | CAN-2005-2494
|
| Created: | September 7, 2005 |
Updated: | August 11, 2006 |
| Description: |
The kdebase package (and kcheckpass in particular) found in KDE versions 3.2.0 through 3.4.2 suffers from a lock file handling error which can enable a local attacker to obtain root access. See this advisory for details. |
| Alerts: |
|
Comments (none posted)
kdelibs: kate backup file permission leak
| Package(s): | kdelibs kate kwrite |
CVE #(s): | CAN-2005-1920
|
| Created: | July 19, 2005 |
Updated: | September 21, 2010 |
| Description: |
Kate / Kwrite, as shipped with KDE 3.2.x up to including 3.4.0, creates a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set. See this advisory for more information. |
| Alerts: |
|
Comments (1 posted)
kernel: multiple vulnerabilities
Comments (none posted)
kernel: key rebinding
| Package(s): | kernel |
CVE #(s): | CVE-2005-3257
|
| Created: | December 14, 2005 |
Updated: | January 4, 2006 |
| Description: |
Linux kernels through 2.6.14 allow any user to rebind console keys; this opening can be exploited to inject commands when other users are logged in. |
| Alerts: |
|
Comments (none posted)
kernel: multiple vulnerabilities
| Package(s): | kernel |
CVE #(s): | CVE-2005-2709
CVE-2005-2973
CVE-2005-3055
CVE-2005-3180
CVE-2005-3271
CVE-2005-3272
CVE-2005-3273
CVE-2005-3274
CVE-2005-3275
CVE-2005-3276
|
| Created: | November 22, 2005 |
Updated: | March 15, 2006 |
| Description: |
Al Viro discovered a race condition in the /proc file handler of
network devices. A local attacker could exploit this by opening any
file in /proc/sys/net/ipv4/conf/<interface>/ and waiting until that
interface was shut down. Under certain circumstances this could lead
to a kernel crash or even arbitrary code execution with full kernel
privileges. (CVE-2005-2709)
Tetsuo Handa discovered a local Denial of Service vulnerability in the
udp_v6_get_port() function. On computers which use IPv6, a local
attacker could exploit this to trigger an infinite loop in the kernel.
(CVE-2005-2973)
Harald Welte discovered a Denial of Service vulnerability in the USB
devio driver. A local attacker could exploit this by sending an "USB
Request Block" (URB) and terminating the sending process before the
arrival of the answer, which left an invalid pointer and caused a
kernel crash. (CVE-2005-3055)
Pavel Roskin discovered an information leak in the Orinoco wireless
card driver. When increasing the buffer length for storing data, the
buffer was not padded with zeros, which exposed a random part of the
system memory to the user. (CVE-2005-3180)
A resource leak has been discovered in the handling of POSIX timers in
the exec() function. This could be exploited to a Denial of Service
attack by a group of local users. (CVE-2005-3271)
Stephen Hemminger discovered a weakness in the network bridge driver.
Packets which had already been dropped by the packet filter could
poison the forwarding table, which could be exploited to make the
bridge forward spoofed packages. (CVE-2005-3272)
David S. Miller discovered a buffer overflow in the rose_rt_ioctl()
function. By calling the function with a large "ngidis" argument, a
local attacker could cause a kernel crash. (CVE-2005-3273)
Neil Horman discovered a race condition in the connection timer
handling. This allowed a local attacker to set up an expiration
handler which modified the connection list while the list still being
traversed, which could result in a kernel crash. This vulnerability
only affects multiprocessor (SMP) systems. (CVE-2005-3274)
Patrick McHardy noticed a logic error in the network address
translation (NAT) connection tracker. A remote attacker could exploit
this by causing two packets for the same protocol to be NATed at the
same time, which resulted in a kernel crash. (CVE-2005-3275)
Paolo Giarrusso discovered an information leak in the
sys_get_thread_area(). The returned structure was not properly
cleared, which exposed a small amount of kernel memory to userspace
programs. This could possibly expose confidential data.
(CVE-2005-3276) |
| Alerts: |
|
Comments (2 posted)
libconvert-uulib-perl: arbitrary code execution
| Package(s): | libconvert-uulib-perl |
CVE #(s): | CAN-2005-1349
|
| Created: | May 20, 2005 |
Updated: | January 27, 2006 |
| Description: |
Mark Martinec and Robert Lewis discovered a buffer overflow in
Convert::UUlib (before 1.051), a Perl interface to the uulib library, which
may result in the execution of arbitrary code. |
| Alerts: |
|
Comments (1 posted)
libdbi-perl: insecure temporary file
| Package(s): | libdbi-perl |
CVE #(s): | CAN-2005-0077
|
| Created: | January 25, 2005 |
Updated: | March 2, 2006 |
| Description: |
Javier Fernández-Sanguino Peña from the Debian Security Audit Project
discovered that the DBI library, the Perl5 database interface, creates
a temporary PID file in an insecure manner. This can be exploited by a
malicious user to overwrite arbitrary files owned by the person
executing the parts of the library. |
| Alerts: |
|
Comments (none posted)
libgadu: memory alignment bug
| Package(s): | libgadu |
CVE #(s): | CAN-2005-2370
|
| Created: | July 29, 2005 |
Updated: | June 25, 2007 |
| Description: |
Szymon Zygmunt and Michal Bartoszkiewicz discovered a memory alignment
error in libgadu (from ekg, console Gadu Gadu client, an instant
messaging program) which is included in gaim, a multi-protocol instant
messaging client, as well. This can not be exploited on the x86
architecture but on others, e.g. on Sparc and lead to a bus error,
in other words a denial of service.
|
| Alerts: |
|
Comments (none posted)
libgd2: buffer overflows in PNG handling
| Package(s): | libgd2 |
CVE #(s): | CAN-2004-0990
CAN-2004-0941
|
| Created: | October 29, 2004 |
Updated: | June 28, 2006 |
| Description: |
Several buffer overflows have been discovered in libgd's PNG handling
functions.
If an attacker tricked a user into loading a malicious PNG image, they
could leverage this into executing arbitrary code in the context of
the user opening image. Most importantly, this library is commonly
used in PHP. One possible target would be a PHP driven photo website
that lets users upload images. Therefore this vulnerability might lead
to privilege escalation to a web server's privileges.
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and
earlier may allow remote attackers to execute arbitrary code via malformed
image files that trigger the overflows due to improper calls to the
gdMalloc function. |
| Alerts: |
|
Comments (none posted)
libnet-ssleay-perl: weakened cryptographic operations
| Package(s): | libnet-ssleay-perl |
CVE #(s): | CAN-2005-0106
|
| Created: | May 3, 2005 |
Updated: | January 27, 2006 |
| Description: |
Javier Fernandez-Sanguino Pena discovered that this library used the
file /tmp/entropy as a fallback entropy source if a proper source was
not set in the environment variable EGD_PATH. This can potentially
lead to weakened cryptographic operations if an attacker provides a
/tmp/entropy file with known content. |
| Alerts: |
|
Comments (none posted)
libpam-ldap: authentication bypass
| Package(s): | libpam-ldap |
CVE #(s): | CAN-2005-2641
|
| Created: | August 25, 2005 |
Updated: | October 6, 2006 |
| Description: |
libpam-ldap, the PAM LDAP interface, has a vulnerability in which
it fails to authenticate with an LDAP server which is not configured
properly, allowing an authentication bypass. |
| Alerts: |
|
Comments (none posted)
libTIFF: buffer overflow
| Package(s): | libtiff |
CVE #(s): | CAN-2005-1544
|
| Created: | May 10, 2005 |
Updated: | February 18, 2006 |
| Description: |
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a
stack based buffer overflow in the libTIFF library when reading a TIFF
image with a malformed BitsPerSample tag. Successful exploitation would
require the victim to open a specially crafted TIFF image, resulting in the
execution of arbitrary code. |
| Alerts: |
|
Comments (1 posted)
libungif: memory corruption
| Package(s): | libungif |
CVE #(s): | CAN-2005-2974
|
| Created: | November 3, 2005 |
Updated: | March 20, 2006 |
| Description: |
The libungif library has a vulnerability in the GIF file
colormap handling code. A maliciously crafted GIF file can
cause out of bounds memory writing and register corruption. |
| Alerts: |
|
Comments (none posted)
libxml2 - arbitrary code execution
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0110
|
| Created: | February 26, 2004 |
Updated: | August 19, 2009 |
| Description: |
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml2 uses special
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that
parses remote resources and allows them to influence the URL, then this
flaw could be used to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
libxml2: multiple buffer overflows
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0989
|
| Created: | October 28, 2004 |
Updated: | August 19, 2009 |
| Description: |
libxml2 prior to version 2.6.14 has multiple buffer overflow
vulnerabilities, if a local user passes a specially crafted
FTP URL, arbitrary code may be executed. |
| Alerts: |
|
Comments (none posted)
libXpm: new buffer overflows
| Package(s): | libXpm |
CVE #(s): | CAN-2005-0605
|
| Created: | March 4, 2005 |
Updated: | March 8, 2006 |
| Description: |
A new vulnerability has been discovered in libXpm, which is included in
OpenMotif and LessTif, that can potentially lead to remote code
execution. |
| Alerts: |
|
Comments (none posted)
lynx: arbitrary command execution
| Package(s): | lynx |
CVE #(s): | CVE-2005-2929
|
| Created: | November 14, 2005 |
Updated: | September 14, 2009 |
| Description: |
An arbitrary command execute bug was found in the lynx "lynxcgi:" URI
handler. An attacker could create a web page redirecting to a malicious URL
which could execute arbitrary code as the user running lynx. |
| Alerts: |
|
Comments (none posted)
mailman: denial of service
| Package(s): | mailman |
CVE #(s): | CVE-2005-3573
|
| Created: | December 2, 2005 |
Updated: | March 8, 2006 |
| Description: |
Scrubber.py in Mailman 2.1.4 - 2.1.6 does not properly handle UTF8
character encodings in filenames of e-mail attachments, which allows
remote attackers to cause a denial of service. |
| Alerts: |
|
Comments (none posted)
mod_python: remote access vulnerability
| Package(s): | mod_python |
CVE #(s): | CAN-2005-0088
|
| Created: | February 10, 2005 |
Updated: | April 10, 2006 |
| Description: |
mod_python has a vulnerability in the publisher handler that may allow
a remote user to use a specially crafted URL to allow access to
objects that should be protected. An information leak can result. |
| Alerts: |
|
Comments (none posted)
mysql: buffer overflow
| Package(s): | mysql |
CVE #(s): | CAN-2005-2558
|
| Created: | September 12, 2005 |
Updated: | January 12, 2006 |
| Description: |
The mysql CREATE FUNCTION can be used to create a buffer overflow.
A specially crafted long function name can be used by a local attacker
to crash the server or execute arbitrary code with the privileges of
the server. |
| Alerts: |
|
Comments (none posted)
mysql: low-impact security fix
| Package(s): | mysql |
CVE #(s): | CAN-2005-1636
|
| Created: | July 20, 2005 |
Updated: | February 22, 2006 |
| Description: |
An update to MySQL version 4.1.12 fixes a low-impact security
problem (bz#158689). |
| Alerts: |
|
Comments (1 posted)
ncpfs: multiple vulnerabilities
| Package(s): | ncpfs |
CVE #(s): | CAN-2005-0013
CAN-2005-0014
|
| Created: | January 31, 2005 |
Updated: | May 15, 2006 |
| Description: |
Erik Sjolund discovered two vulnerabilities in the programs bundled
with ncpfs: there is a potentially exploitable buffer overflow in
ncplogin (CAN-2005-0014), and due to a flaw in nwclient.c, utilities
using the NetWare client functions insecurely access files with
elevated privileges (CAN-2005-0013). |
| Alerts: |
|
Comments (none posted)
nfs-utils: arbitrary code execution
| Package(s): | nfs-utils |
CVE #(s): | CAN-2004-0946
|
| Created: | January 11, 2005 |
Updated: | February 27, 2006 |
| Description: |
Arjan van de Ven discovered a buffer overflow in rquotad on 64bit
architectures; an improper integer conversion could lead to a buffer
overflow. An attacker with access to an NFS share could send a specially
crafted request which could then lead to the execution of arbitrary code. |
| Alerts: |
|
Comments (none posted)
ntp: uses wrong gid
| Package(s): | ntp |
CVE #(s): | CAN-2005-2496
|
| Created: | August 26, 2005 |
Updated: | August 11, 2006 |
| Description: |
When starting xntpd with the -u option and specifying the
group by using a string not a numeric gid the daemon uses
the gid of the user not the group. This problem is now fixed
by this update. |
| Alerts: |
|
Comments (none posted)
openssh: GSSAPI credential disclosure
| Package(s): | openssh |
CVE #(s): | CAN-2005-2798
|
| Created: | September 7, 2005 |
Updated: | February 3, 2006 |
| Description: |
OpenSSH prior to version 4.2 will allow GSSAPI credentials to be delegated to users who are not using GSSAPI authentication, possibly leading to the unwanted disclosure of those credentials. OpenSSH 4.2 has the fix.
|
| Alerts: |
|
Comments (none posted)
otrs: multiple vulnerabilities
| Package(s): | otrs |
CVE #(s): | CVE-2005-3893
CVE-2005-3894
CVE-2005-3895
|
| Created: | December 16, 2005 |
Updated: | February 15, 2006 |
| Description: |
Several vulnerabilities were discovered in the CMS system OTRS. Multiple
SQL injection vulnerabilities in index.pl in Open Ticket Request System
(OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, multiple cross-site
scripting vulnerabilities in index.pl in Open Ticket Request System (OTRS)
1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, and Open Ticket Request System
(OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3, when
AttachmentDownloadType is set to inline, renders text/html e-mail
attachments as HTML in the browser when the queue moderator attempts to
download the attachment. |
| Alerts: |
|
Comments (none posted)
pcre3: arbitrary code execution
| Package(s): | pcre3 |
CVE #(s): | CAN-2005-2491
|
| Created: | August 23, 2005 |
Updated: | March 10, 2006 |
| Description: |
A buffer overflow has been discovered in the PCRE, a widely used library
that provides Perl compatible regular expressions. Specially crafted
regular expressions triggered a buffer overflow. On systems that accept
arbitrary regular expressions from untrusted users, this could be exploited
to execute arbitrary code with the privileges of the application using the
library. |
| Alerts: |
|
Comments (none posted)
perl: setuid vulnerabilities
| Package(s): | perl |
CVE #(s): | CAN-2005-0155
CAN-2005-0156
|
| Created: | February 2, 2005 |
Updated: | August 11, 2006 |
| Description: |
There are two vulnerabilities with perl when it is used in a setuid mode. The PERLIO_DEBUG environment variable can be used to overwrite arbitrary files; there is also an associated buffer overflow which can be exploited to gain root access. |
| Alerts: |
|
Comments (none posted)
perl: symlink vulnerability
| Package(s): | perl |
CVE #(s): | CAN-2005-0448
|
| Created: | March 9, 2005 |
Updated: | January 30, 2006 |
| Description: |
The rmtree() function in the File:Path.pm module has a symlink vulnerability which could be exploited to create setuid binaries. |
| Alerts: |
|
Comments (none posted)
perl: integer overflow
| Package(s): | perl |
CVE #(s): | CVE-2005-3962
CVE-2005-3912
|
| Created: | December 1, 2005 |
Updated: | February 27, 2006 |
| Description: |
Perl has an sprintf integer overflow vulnerability
that may be used for a denial of service, remote code
execution and information leakage. |
| Alerts: |
|
Comments (none posted)
phpMyAdmin: multiple vulnerabilities
| Package(s): | phpmyadmin |
CVE #(s): | CVE-2005-4079
CVE-2005-3665
|
| Created: | December 12, 2005 |
Updated: | November 20, 2006 |
| Description: |
Stefan Esser reported multiple vulnerabilities
found in phpMyAdmin. The $GLOBALS variable allows modifying the global
variable import_blacklist to open phpMyAdmin to local and remote file
inclusion, depending on your PHP version (CVE-2005-4079, PMASA-2005-9).
Furthermore, it is also possible to conduct an XSS attack via the
$HTTP_HOST variable and a local and remote file inclusion because the
contents of the variable are under total control of the attacker
(CVE-2005-3665, PMASA-2005-8). |
| Alerts: |
|
Comments (none posted)
poppler: arbitrary code execution
| Package(s): | poppler |
CVE #(s): | CVE-2005-3191
CAN-2005-3193
|
| Created: | December 8, 2005 |
Updated: | January 16, 2006 |
| Description: |
The poppler PDF rendering library has a heap overflow vulnerability
that can be exploited by viewing specially crafted PDF files.
An attacker can cause a crash or the execution of arbitrary
code. This vulnerability is related to
a similar vulnerability with xpdf. |
| Alerts: |
|
Comments (none posted)
postgresql: database initialization errors
| Package(s): | postgresql |
CVE #(s): | CAN-2005-1409
CAN-2005-1410
|
| Created: | May 4, 2005 |
Updated: | February 28, 2006 |
| Description: |
PostgreSQL suffers from two vulnerabilities in how databases are set up by default; they allow a local attacker (one with access to the database) to crash the back end and, perhaps, execute code with the privileges of the server process. See this advisory for details and workarounds.
|
| Alerts: |
|
Comments (none posted)
Pound: buffer overflow
| Package(s): | pound |
CVE #(s): | CVE-2005-1391
|
| Created: | May 2, 2005 |
Updated: | January 10, 2006 |
| Description: |
Steven Van Acker has discovered a buffer overflow vulnerability in the
"add_port()" function in Pound 1.8.2+. A remote attacker could send a
request for an overly long hostname parameter, which could lead to the
remote execution of arbitrary code with the rights of the Pound daemon
process. |
| Alerts: |
|
Comments (none posted)
pstotext: remote execution of arbitrary code
| Package(s): | pstotext netpbm |
CVE #(s): | CAN-2005-2471
|
| Created: | August 1, 2005 |
Updated: | March 28, 2006 |
| Description: |
Max Vozeler reported that pstotext calls the GhostScript interpreter on
untrusted PostScript files without specifying the -dSAFER option. An
attacker could craft a malicious PostScript file and entice a user to run
pstotext on it, resulting in the execution of arbitrary commands with the
permissions of the user running pstotext. See this Secunia advisory for more information. |
| Alerts: |
|
Comments (2 posted)
Py2Play: remote execution of arbitrary Python code
| Package(s): | Py2Play |
CVE #(s): | CAN-2005-2875
|
| Created: | September 19, 2005 |
Updated: | September 6, 2006 |
| Description: |
Py2Play uses Python pickles to send objects over a peer-to-peer game network, that clients accept without restriction the objects and code sent by peers. A remote attacker participating in a Py2Play-powered game can send
malicious Python pickles, resulting in the execution of arbitrary
Python code on the targeted game client. |
| Alerts: |
|
Comments (none posted)
scorched3d: multiple vulnerabilities
| Package(s): | scorched3d |
CVE #(s): | |
| Created: | November 15, 2005 |
Updated: | August 11, 2006 |
| Description: |
Luigi Auriemma discovered multiple flaws in the Scorched 3D game
server, including a format string vulnerability and several buffer
overflows. A remote attacker could exploit these vulnerabilities to crash
a game server or execute arbitrary code with the rights of the game server
user. |
| Alerts: |
|
Comments (none posted)
spamassassin: denial of service
| Package(s): | spamassassin |
CVE #(s): | CVE-2005-3351
|
| Created: | November 9, 2005 |
Updated: | March 7, 2006 |
| Description: |
Spamassassin through version 3.0.4 can be made to dump core if a message arrives with too many addresses in the To: field. |
| Alerts: |
|
Comments (none posted)
squid: authentication handling
| Package(s): | squid |
CVE #(s): | CAN-2005-2917
|
| Created: | September 30, 2005 |
Updated: | March 15, 2006 |
| Description: |
Upstream developers of squid, the popular WWW proxy cache, have
discovered that changes in the authentication scheme are not handled
properly when given certain request sequences while NTLM
authentication is in place, which may cause the daemon to restart. |
| Alerts: |
|
Comments (none posted)
sudo: vulnerability via scripts
| Package(s): | sudo |
CVE #(s): | CAN-2005-4158
CVE-2006-0151
|
| Created: | December 16, 2005 |
Updated: | September 1, 2006 |
| Description: |
Perl and Python scripts run via Sudo can be subverted. |
| Alerts: |
|
Comments (none posted)
sudo: missing input sanitizing
| Package(s): | sudo |
CVE #(s): | CVE-2005-2959
|
| Created: | October 25, 2005 |
Updated: | February 19, 2006 |
| Description: |
Tavis Ormandy noticed that sudo, a program that provides limited super
user privileges to specific users, does not clean the environment
sufficiently. The SHELLOPTS and PS4 variables are dangerous and are
still passed through to the program running as privileged user. This
can result in the execution of arbitrary commands as privileged user
when a bash script is executed. These vulnerabilities can only be
exploited by users who have been granted limited super user
privileges. |
| Alerts: |
|
Comments (none posted)
sudo: race condition
| Package(s): | sudo |
CVE #(s): | CAN-2005-1993
|
| Created: | June 21, 2005 |
Updated: | February 24, 2006 |
| Description: |
Charles Morris discovered a race condition in sudo which could lead to
privilege escalation. If /etc/sudoers allowed a user the execution of
selected programs, and this was followed by another line containing
the pseudo-command "ALL", that user could execute arbitrary commands
with sudo by creating symbolic links at a certain time. |
| Alerts: |
|
Comments (none posted)
sylpheed: buffer overflow
| Package(s): | sylpheed |
CVE #(s): | CVE-2005-3354
|
| Created: | November 9, 2005 |
Updated: | January 6, 2006 |
| Description: |
The sylpheed mail client, prior to versions 1.0.6 and 2.0.4, contains a buffer overflow in the LDIF address book import code. |
| Alerts: |
|
Comments (none posted)
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip |
CVE #(s): | CAN-2001-1267
CAN-2001-1268
CAN-2001-1269
CAN-2002-0399
|
| Created: | October 1, 2002 |
Updated: | April 10, 2006 |
| Description: |
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability. |
| Alerts: |
|
Comments (1 posted)
tcpdump: multiple DoS issues
| Package(s): | tcpdump |
CVE #(s): | CAN-2005-1280
CAN-2005-1279
CAN-2005-1278
|
| Created: | May 2, 2005 |
Updated: | April 10, 2006 |
| Description: |
The rsvp_print function in tcpdump 3.9.1 and earlier allows remote
attackers to cause a denial of service (infinite loop) via a crafted RSVP
packet of length 4. (CAN-2005-1280)
tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of
service (infinite loop) via a crafted BGP packet, which is not properly
handled by RT_ROUTING_INFO, or LDP packet, which is not properly
handled by the ldp_print function. (CAN-2005-1279)
The isis_print function, as called by isoclns_print, in tcpdump 3.9.1 and
earlier allows remote attackers to cause a denial of service (infinite
loop) via a zero length, as demonstrated using a GRE packet.
(CAN-2005-1278) |
| Alerts: |
|
Comments (none posted)
texinfo: temporary file vulnerability
| Package(s): | texinfo |
CVE #(s): | CAN-2005-3011
|
| Created: | October 5, 2005 |
Updated: | November 9, 2006 |
| Description: |
Texinfo prior to version 4.8-r1 suffers from a temporary file vulnerability. |
| Alerts: |
|
Comments (none posted)
ucd-snmp: denial of service
| Package(s): | ucd-snmp |
CVE #(s): | CAN-2005-2177
|
| Created: | August 9, 2005 |
Updated: | January 27, 2006 |
| Description: |
A denial of service bug was found in the way ucd-snmp uses network stream
protocols. A remote attacker could send a ucd-snmp agent a specially
crafted packet which will cause the agent to crash. |
| Alerts: |
|
Comments (none posted)
udev: insecure files in /dev/input
| Package(s): | udev |
CVE #(s): | CVE-2005-3631
|
| Created: | December 20, 2005 |
Updated: | February 28, 2006 |
| Description: |
Richard Cunningham discovered a flaw in the way udev sets permissions on
various files in /dev/input. It may be possible for an authenticated
attacker to gather sensitive data entered by a user at the console, such as
passwords. |
| Alerts: |
|
Comments (none posted)
unzip: race condition
| Package(s): | unzip |
CVE #(s): | CAN-2005-2475
|
| Created: | September 29, 2005 |
Updated: | January 12, 2006 |
| Description: |
Unzip has a race condition vulnerability
in the handling of output files.
During file unpacking, a local attacker can modify the permissions
of arbitrary files in the victim's directory. |
| Alerts: |
|
Comments (none posted)
up-imapproxy: format string vulnerabilities
| Package(s): | up-imapproxy |
CVE #(s): | CAN-2005-2661
|
| Created: | October 10, 2005 |
Updated: | March 7, 2006 |
| Description: |
up-imapproxy contains two format string vulnerabilities which could be exploited to execute arbitrary code.
|
| Alerts: |
|
Comments (none posted)
uw-imap: buffer overflow
| Package(s): | uw-imap |
CVE #(s): | CAN-2005-2933
|
| Created: | October 11, 2005 |
Updated: | April 10, 2006 |
| Description: |
"infamous41md" discovered a buffer overflow in uw-imap, the University
of Washington's IMAP Server that allows attackers to execute arbitrary
code. |
| Alerts: |
|
Comments (none posted)
vixie-cron: crontab allows any user to read another users crontabs
| Package(s): | vixie-cron |
CVE #(s): | CAN-2005-1038
|
| Created: | April 15, 2005 |
Updated: | March 15, 2006 |
| Description: |
crontab in Vixie cron 4.1, when running with the -e option, allows local
users to read the cron files of other users by changing the file being
edited to a symlink. NOTE: there is insufficient information to know
whether this is a duplicate of CVE-2001-0235. See also this Security Focus
report. |
| Alerts: |
|
Comments (none posted)
w3c-libwww: possible stack overflow
| Package(s): | w3c-libwww |
CVE #(s): | CVE-2005-3183
|
| Created: | October 14, 2005 |
Updated: | May 2, 2007 |
| Description: |
xtensive testing of libwww's handling of multipart/byteranges content from
HTTP/1.1 servers revealed multiple logical flaws and bugs in
Library/src/HTBound.c |
| Alerts: |
|
Comments (1 posted)
xine-lib: buffer overflows
| Package(s): | xine-lib |
CVE #(s): | CAN-2004-1379
|
| Created: | September 22, 2004 |
Updated: | April 10, 2006 |
| Description: |
xine-lib (through version 1_rc6) contains buffer overflows in the subtitle parsing and DVD sub-picture decoder code. |
| Alerts: |
|
Comments (none posted)
xine-ui - insecure temporary file creation
| Package(s): | xine-ui |
CVE #(s): | CAN-2004-0372
|
| Created: | April 6, 2004 |
Updated: | April 27, 2006 |
| Description: |
Shaun Colley discovered a problem in xine-ui, the xine video player
user interface. A script contained in the package to possibly remedy
a problem or report a bug does not create temporary files in a secure
fashion. This could allow a local attacker to overwrite files with
the privileges of the user invoking xine. |
| Alerts: |
|
Comments (none posted)
xloadimage: buffer overflows
| Package(s): | xloadimage |
CVE #(s): | CAN-2005-3178
|
| Created: | October 10, 2005 |
Updated: | May 15, 2006 |
| Description: |
Three buffer overflows were discovered in xloadimage when handling the image title name. A malicious user can construct a NIFF file that when viewed and processed (with either zoom, reduce or rotate) by xloadimage, will cause the program to overwrite the return address and execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
xorg-x11: heap overflow
| Package(s): | xorg-x11 |
CVE #(s): | CAN-2005-2495
|
| Created: | September 12, 2005 |
Updated: | March 8, 2006 |
| Description: |
The pixmap memory allocation code in the X.Org X window system is
vulnerable to an integer overflow, a local user can use this to
execute arbitrary code with elevated privileges. |
| Alerts: |
|
Comments (none posted)
xpdf: buffer overflow
| Package(s): | xpdf |
CVE #(s): | CAN-2005-0064
|
| Created: | January 19, 2005 |
Updated: | March 15, 2007 |
| Description: |
iDEFENSE has found yet another xpdf buffer overflow; see this advisory for details. |
| Alerts: |
|
Comments (1 posted)
xpdf: arbitrary code execution
| Package(s): | xpdf |
CVE #(s): | CVE-2005-3193
|
| Created: | December 6, 2005 |
Updated: | January 11, 2006 |
| Description: |
Several flaws were discovered in Xpdf. An
attacker could construct a carefully crafted PDF file that could cause Xpdf
to crash or possibly execute arbitrary code when opened. |
| Alerts: |
|
Comments (none posted)
xpdf: denial of service
| Package(s): | xpdf kpdf |
CVE #(s): | CAN-2005-2097
|
| Created: | August 9, 2005 |
Updated: | August 2, 2006 |
| Description: |
A flaw was discovered in Xpdf in that could allow an attacker to construct
a carefully crafted PDF file that would cause Xpdf to consume all available
disk space in /tmp when opened. |
| Alerts: |
|
Comments (none posted)
zlib: buffer overflow
| Package(s): | zlib |
CVE #(s): | CAN-2005-1849
|
| Created: | July 21, 2005 |
Updated: | April 11, 2006 |
| Description: |
zlib has a vulnerability that can cause code that executes it to crash
if a corrupted file is opened. |
| Alerts: |
|
Comments (none posted)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current stable 2.6 kernel is 2.6.14.5,
released on December 26.
It contains the usual set of fixes, mostly in the networking and SCSI
subsystems.
The current 2.6 kernel is 2.6.15, announced by Linus on
January 2. The changelog entry for the release says "Hey, it's
fifteen years today since I bought the machine that got Linux started.
January 2nd is a good date." This release contains a fair number of
fixes since -rc7, but no big changes. The 2.6.15 series as a whole has
added a big set of 802.11 improvements, hotplug memory support,
much-improved NTFS support, much-improved CIFS support, the open-iSCSI
initiator, shared subtrees, a
new, IPv6-capable netfilter connection tracking implementation, and much
more. The
long-format changelog has the details. See also LWN's Kernel Page
coverage of features as they were added (here and here) and the KernelNewbies Linux
Changes Wiki.
The floodgates have not yet opened for the 2.6.16 development cycle, so
there is no pile of pending patches in the mainline git repository as of
this writing. There have also been no -mm kernel releases since
December 14.
The current 2.4 prepatch is 2.4.33-pre1; Marcelo launched the 2.4.33
cycle on December 29. This prepatch includes some security fixes,
some networking work, and, it is said, the last ever big SATA update for
2.4.
Comments (3 posted)
Kernel development news
The problem is that if we allow the release to be stalled by bugs
it allows one sluggish maintainer to block the entire kernel. At
some point in time we do need to just give up and hope that the bug
will get fixed in 2.6.x.y or that it'll just magically fix itself
later on (this happens, for various reasons).
We get in the situation where lots of people are sitting there with
arms folded, complaining about lack of a new kernel release while
nobody is actually working on the bugs. Nobody knows why this
happens.
-- Andrew Morton
Actually "sprinkling with penguin pee" means that something is
blessed (it's like a kernel baptism). Maybe that's not very
civilized, but hey, penguins don't have thumbs, and are thus kind
of limited in their actions. Don't be speciest.
--
Linus Torvalds
Comments (none posted)
The 2.6.15 kernel is out. The following is a summary of changes to the
internal kernel API found in this release, with an emphasis on changes
visible to driver writers. This information will be folded into the
LWN 2.6 API changes page shortly.
- The nested class device
patch was merged, allowing class_device structures to
have other class_devices as parents. This patch is a hack to
make the input subsystem work with sysfs. This code will change again
in the future; see Greg
Kroah-Hartman's article for more information on what is planned.
- The prototypes for the driver model class "interface" methods
add() and remove() have changed; there is now a new
parameter pointing to the relevant interface structure.
- A new platform_driver structure has been added to describe
drivers for devices built into the core "platform."
- The prototypes for the suspend() and resume()
methods in struct device_driver have changed. They are also
only called once per event, rather than three times as in previous
kernels.
- Two new fields have been added to the device_pm_info which
control how drivers should act on hardware-created wakeup events; see
this article for
details.
- There is a notification mechanism which lets interested modules know
when a USB device is added to (or removed from) the system. This
system is used by some core code; drivers do not normally need to hook
in to it.
- The gfp_t type
is now used throughout the kernel. If you have a function which takes
memory allocation flags, it should probably be using this type.
- Code using reader/writer semaphores can now use
rwsem_is_locked() to test the (read) state of the semaphore
without blocking.
- The new vmalloc_node() function allocates memory on a
specific NUMA node.
- The "reserved" bit for memory pages has, for all practical purposes,
been removed.
- vm_insert_page()
has been added to make it easier for drivers to remap RAM into user
space VMAs.
- There is a new kthread_stop_sem() function which can be used
to stop a kernel thread which might be currently blocked on a specific
semaphore.
- RapidIO bus support has
been merged into the mainline.
- The netlink connector
mechanism makes netlink code easier to write. Independently, a
type-safe netlink interface has been added and is used in parts of the
networking subsystem.
- These kernel symbols have been unexported and are no longer available
to modules: clear_page_dirty_for_io,
console_unblank, cpu_core_id
hugetlb_total_pages, idle_cpu,
nr_swap_pages, phys_proc_id,
reprogram_timer, swapper_space,
sysctl_overcommit_memory, sysctl_overcommit_ratio,
sysctl_max_map_count, total_swap_pages,
user_get_super, uts_sem, vm_acct_memory,
and vm_committed_space.
- Version 1 of the Video4Linux API is now officially scheduled for
removal in July, 2006.
- The owner field has been removed from the pci_driver
structure.
- A number of SCSI subsystem typedefs (Scsi_Device,
Scsi_Pointer, and Scsi_Host_Template) have been
removed.
- The DMA32 memory zone has been added to the x86-64
architecture; its purpose is to make it easy to allocate memory below
the 4GB barrier (with the new GFP_DMA32 flag).
- A call to rcu_barrier() will block the calling process until
all current RCU callbacks have completed.
As can be seen from this list, the kernel API continues to evolve. The
claims of certain well-known maintainers notwithstanding, it doesn't look
like things will slow down much anytime soon.
Comments (2 posted)
Kernel programmers tend to like inline functions. They resemble C macros,
in that they result in code inserted directly into the calling function,
with no added function call overhead. But, unlike macros, they offer type
checking and the ability to include multiple lines of code without adding a
pile of backslashes. In cases where a function is optimized out entirely,
an inline function turns into no code at all - a level of efficiency which
is hard to beat. And, in some cases, inlining is required; consider, for
example, functions which embody special assembly instructions needed by the
kernel.
Inline functions also have their costs, however. Their code is duplicated
for every call, so inline functions which are called from more than one
place make the kernel larger. Increasingly, developers are becoming aware
that this size increase carries a performance penalty. As the gap between CPU
and memory speeds grows, cache behavior increasingly determines how fast a
program runs. So the performance benefits of inline functions are often,
at best, illusory, and sometimes negative; a larger kernel will be a slower
kernel.
Ingo Molnar recently raised this issue with
a set of patches changing how the kernel is built. By turning on
unit-at-a-time compilation (which causes gcc to consider an entire file in
its optimization decisions) and by turning off forced inlining, he was able
to achieve a 5.3% size reduction. Taking things to an extreme, and
applying these patches to an "allyesconfig" kernel (one with all
configuration options turned on) results in
a nearly 25% smaller kernel.
That is, to say the least, a significant size reduction to be achieved by
such a small patch. Anybody interested in de-bloating the kernel should be
paying attention.
These patches have not been accepted by everybody, however. In particular,
the turning off of forced inlining is controversial. When gcc is not
forced to honor the inline keyword, it makes its own decisions,
based on the size of the function and how many times it is called. When
told to optimize for size, in particular, gcc will have a strong bias
against inline functions. This approach yields a significant size
reduction, but there is a problem: Linus doesn't
trust the gcc maintainers to code consistent and correct inline
heuristics, and Andrew Morton doesn't
either. Rather than turning off forced inlining and letting gcc figure
things out, they would rather go through the code and remove unnecessary
inline declarations one by one.
It is true that the kernel has been burned by changes to how gcc handles
inline in the past. Since then, gcc seems to have gotten smarter,
and one can argue that its maintainers have become more aware of the
issues. There is also the little fact that cleaning up the existing inline
declarations is not a small job; Ingo says:
There are 22,000+ inline functions in the kernel right now (inlined
about a 100,000 times), and we'd have to change _thousands_ of them.
They are causing an unjustified code bloat of somewhere around
20-30%.
Arjan van de Ven adds:
The reality is, most driver writers (in fact kernel code writers)
tend to overestimate the gain of inline in THEIR code, and to
underestimate the cumulative cost of it. Despite what akpm says, I
think gcc can make a better judgement than most of these authors
(probably including me :). We can remove 6400 now, but a year from
now, another 1000 have been added back again I bet.
How all of this will turn out is unclear. Certainly one can expect a
higher level of resistance to patches adding inline functions in the
future. There is likely to be a long flurry of de-inlining patches as
well. The ability to turn off forced inlining might be added to the build
system as an experimental option; some distributors may even decide to use this
option for the kernels they ship. But enough developers seem uncomfortable
with the idea of turning off forced inlining wholesale that this option may
not get beyond the "experimental" stage for some time.
Comments (10 posted)
In
the previous episode, Ingo
Molnar had posted his own version of the mutex patch, adding a new
synchronization primitive to the kernel. Ingo has continued to refine this
patch set, with frequent releases; the current version is
V10 V11
V12
V13
V14. This patch set has faced
ongoing resistance from Andrew Morton, who didn't see the reasons for
adding a new mutual exclusion mechanism to the kernel. Andrew, instead,
wished that the developers would concentrate on fixing the problems with
the current semaphore code.
Perhaps the most significant development since then has been a private conversation between Andrew and
Ingo. There is, it seems, a plan in place which would replace the
current semaphore implementation entirely. Almost all current semaphore
users are implementing simple mutual exclusion areas, so they would be
converted over to the new mutex type directly. An estimated 90% of current
semaphore users fall into this category. Of the remaining users, about 90% employ
semaphores to indicate event completion. The task of converting those
users to the completion type
has been ongoing for some time; replacing semaphores would require
finishing this job. Finally, an estimated 1% of the semaphores in the
kernel are used for their counting feature; they can be converted over to a
(not yet posted) architecture-independent counter type.
Once all that work is done, semaphores could be removed from the kernel
altogether. Says Andrew: "It's a lot of churn, but we'll end up with
a better end result and a somewhat-net-simpler kernel, so I'm
happy." Linus, meanwhile, has offered some suggestions for
improvements (already incorporated by Ingo) and stated: "At that point I'd like to
switch to mutexes just because the code is cleaner!"
Since then, most of the discussion has been concerned with the details of
the mutex implementation rather than whether it is fundamentally a good
idea or not. The main objections would appear to have been overcome.
So, unless something new comes up, it looks like this change is going
to happen; the only question is "when." The next couple of weeks will
determine whether the mutex code will be part of 2.6.16 or not. Then all
that's left is the long task of converting all semaphore users over and,
finally, removing the old semaphore code.
Comments (11 posted)
Patches and updates
Kernel trees
Build system
Core kernel code
Development tools
- Junio C Hamano: GIT 1.0.3.
(December 23, 2005)
- Junio C Hamano: GIT 1.0.5.
(December 28, 2005)
- Marco Costalba: qgit 1.0.
(January 1, 2006)
Device drivers
Documentation
Janitorial
Memory management
Networking
Security-related
Miscellaneous
Page editor: Jonathan Corbet
Distributions
News and Editorials
There aren't many Linux companies that were established in 1992 and are
still going strongly today. With the exception of Slackware, Turbolinux is
probably the only one, its beginnings dating back to that year when it was
established in Tokyo under the name of Pacific HiTech. The company later
moved its headquarters to the United States, but returned to Japan shortly
after the dot-com bust where it changed hands several times. Currently
concentrating on markets in Japan and China, it recently recorded a profit
for the first time and, according to an analyst firm, it consistently beats
all other Linux suppliers, including Red Flag, in terms of new server
shipments in China.
In November, a new version of Turbolinux was released. Version 11, better
known as "Fuji", was the company's first major product in over two years
and, similar to its previous version, it is primarily intended as a desktop
operating environment designed to simplify migration from Windows to Linux.
Besides the standard base system with Linux kernel 2.6.13, X.Org 6.8.2, KDE
3.4.2 and GNOME 2.10, the product bundles a large number of third-party
applications, which makes Turbolinux a heavily customized proprietary Linux
distribution. It is currently available in Japan only where it retails for
a hefty $143, although a low-end edition without some of the proprietary
components is available for about $49. An international edition is planned
for release in early 2006. All products are supported with security updates
for 5 years.
Turbolinux was kind enough to send me a review copy of the product and I
installed it on my test system - a 1.4GHz Pentium 4 machine with an ASUS
P4T mainboard, 384 MB of RAM, Matrox Millennium G450 graphics card, and
Realtek 8139too network card. The Turbolinux installer, called "Mongoose",
provides little to write about other than to say that it is a
nicely-designed and intuitive graphical installer with support for English
(en_US), Japanese (EUC) and Chinese (GB18030 and Big5). After copying the
base system from the first two CDs, the installer gives an option to
install the proprietary applications (both commercial and some gratis ones,
such as Flash Player) from the third CD. I chose to install all that was
available - partly to see what Turbolinux ships with and partly to evaluate
the usefulness of these applications, especially in the light of the high
price tag.
After the trouble-free installation of the system and spotless hardware
auto-configuration, I rebooted and was pleased to see that the Turbolinux
GRUB menu listed not only Turbolinux, but also all other Linux
distributions on the two hard disks. By default, the system boots straight
into a good-looking KDE desktop, automatically logging in the first user
created during system install. The boot process was remarkably fast and KDE
was ready for use in as little as 45 seconds after boot (for comparison,
SUSE Linux 10.0 takes 117 seconds to boot into KDE on the same system). The
company's way of preventing illegal copying of its products is to supply a
serial number which the user needs to transmit to Turbolinux to obtain a
license file. Without it, some of the included custom utilities, such as
"TurboPlus" for product updates, will not work.
Now it was time to investigate the proprietary components of the
distribution. After all, Turbolinux's marketing strategy clearly revolves
along the lines of providing enough added value to justify the product's
high price. The first utility that hit my eyes after browsing through the
KDE menu was TurboPlus. Designed to provide a convenient way to keep the
product up-to-date with security and bug fixes, this custom application is
pre-configured to connect to the Turbolinux server (once a day by default)
to check for package updates and optionally update the system. Roughly one
month after the release, TurboPlus listed 6 packages that needed security
updates and 42 packages were lined up to receive bug fixes. Besides
software updates, the application also serves to install and uninstall
software and plugins, and to create desktop and menu shortcuts.
The next on test was "DAVID". Spotting its icon in the system tray and not
being able to make out the purpose of the application from its name, I
clicked on the icon to launch what looked like a file manager, with the
right pane containing unusual icons labeled as "a:", "c:", "d:", "f:",
"z:". Upon some investigation it turned out that DAVID Explorer, as is the
application's full name, is indeed a file manager - but with a difference.
Here, "c:" represents a Windows directory as created by the WINE emulator
and pre-configured with many common file extensions, while "f:" is the
user's home directory and "z:" is the root directory. Very unusual if you
are a seasoned Linux user, but perhaps a more familiar directory layout for
those just moving over from Windows. The application's interface is in
Japanese only.
Another unique piece of software shipping with Fuji is "Turbo Media Player".
This time there was no need to guess what the application was for, although
a closer examination after its launch revealed that it is nothing more than
a revamped Kaffeine 0.7.1. Turbolinux previously released a multimedia
edition which featured a licensed DVD player (a Linux edition of PowerDVD)
to play encrypted videos on Linux, but I was disappointed to see that Fuji
does not include it. The only difference between standard Kaffeine and
Turbo Media Player is the latter's ability to play Windows Media files out
of the box (Turbolinux has licensed the codecs from Microsoft). But it
certainly doesn't play encrypted DVDs and there is no easy way to install
the required plugin.
One of the most important value-added applications in Fuji is a Linux
edition of ATOK, a proprietary input method for the Japanese language,
together with 5 Japanese TrueType fonts. Unfortunately, I couldn't find a
way to change the language and, being unfamiliar with ATOK, I couldn't
figure out whether it was possible to use it while the language was set to
English. At that point I decided to re-install the system, choosing
Japanese this time. After this, ATOK was available by default - by the way
of a floating toolbar in the bottom right corner of the screen. Trying to
type Japanese, ATOK indeed turned out to be a much more intelligent and
intuitive input method than any of the free ones, offering choice in case
of ambiguous input and automatically inserting correct characters wherever
possible.
Fuji also comes with the new StarOffice 8 (or StarSuite, as it is called in
Japan), RealPlayer, Java, Acrobat Reader, and Flash plugin. There is
TurboSearch, a desktop search engine, similar to Beagle or Kat and nicely
integrated into the KDE panel. I was unable to check the GNOME
implementation of Turbolinux because the KDE's "End Session" button would
simply re-start KDE without taking a breather at the login screen - this
was one of the few bugs I noticed during the day of examining the
distribution.
So how does Turbolinux's new product rate in the grand scheme of things? As
proprietary distributions go by, Fuji certainly offers a fair share of
extra bells and whistles, all pre-configured and ready to use. The company
has obviously gone to great length to make the product acceptable to new
converts from Windows and to minimize the stress associated with learning a
new operating system. Users already familiar with Linux might prefer to
save their money by choosing a free distribution, then do a bit of work to
install plugins, OpenOffice.org, and one of the freely available software
for Japanese input. But it is easy to see how Turbolinux can be a viable
choice for medium-size companies which might prefer a pre-configured
product with long-term support. Given the company's good financial results
in recent years, it seems that many of their customers in Japan do indeed
see good value in the product - despite its relatively high price tag and
other negatives of a proprietary operating system, such as vendor lock-in.
Comments (2 posted)
New Releases
The NetBSD Project has
announced
the release of NetBSD 3.0. "
NetBSD is widely known as the most
portable operating system in the world. It currently supports fifty seven
different system architectures, all from a single source tree, and is
always being ported to more. NetBSD 3.0 continues our long tradition with
major improvements in stability, performance, networking, security, also
includes support for two new platforms (iyonix and hp700), and many new
peripherals."
Comments (12 posted)
KANOTIX has
released
version 2005-4 in a Lite-Version with Koffice 1.4.2, a Full-Version with
OpenOffice 2.0.0-5, and a new AMD64-Version.
Comments (none posted)
Linux Netwosix has
announced the release of stable version 1.3
with many updates and enhancements. Development version 2.0-rc1 has also
been
announced. "
This is the first
release of the 2.x branch and include a new improved setup tool based on
Crux-Linux. Among the many program updates and distribution enhancements
you will find a stable, complete and cleaned GNU/Linux box for your
network-security related jobs. Linux Netwosix 2.0-rc1 uses the latest
2.6.14.5 stable kernel bringing you advanced and reliable
performances." A
new
forum for the Linux Netwosix community is also available.
Comments (none posted)
Version 3.0 of
Trinity Rescue Kit
(TRK) has been announced (click below). TRK is a live CD for rescuing dead
systems, Linux or Windows. "
Aside from the features already in TRK
1.1, many rescue and management features have been added and existing
seriously improved and debugged."
Full Story (comments: none)
Yellow Dog Linux v4.1 is in
beta testing. This version features Linux kernel version 2.6.15-rc5, X.org
6.8.2, USB device auto-mount under both KDE & GNOME, and more.
Full Story (comments: none)
Distribution News
Novell has sent out
a press release on how well OpenSUSE is doing. "
SUSE Linux is installed more than 7,000 times
every day, an average of one installation every 12 seconds. The openSUSE
project features easy access to builds and releases, and will soon offer new
resources and programs for open access to the development process used to
create SUSE Linux..."
Comments (1 posted)
The Debian 'etch' release team has sent out an update; the plan is still
to have a new major Debian release in December (of this year!). The first
freeze is still almost seven months away, but the release managers say the
time has come to start paying more attention to fixing release-critical
bugs. Click below for the full posting.
Full Story (comments: none)
This December post from the Debian Release Team notes that four architectures
have not met the release criteria for 'etch', so far. These are arm, m68k,
s390 and sparc. "
And to the porters of the other eight architectures
(alpha, amd64, hppa, i386, ia64, mips, mipsel, and powerpc): let me
caution you that this is not the final word on the subject. :-) You can
all take a deep breath now if you like, but please don't treat this
requalification as a reason to ignore the port's health from now until
release. The issues identified as release criteria are genuinely
important, and we are counting on porters to help us keep up the pace for
etch."
Full Story (comments: 3)
For those following the declassification of debian-private, the votes are
in. The
results
show option 2 to be the winner. A declassification procedure will be
established for future posts. Anthony Towns, author of the original
proposal, has this
analysis
of the results. (Found on
DebianPlanet)
Comments (none posted)
The folks at DebianPlanet have
been checking the
Ubuntu-Sounder list and found
this
post from Mark Shuttleworth on the DCC Alliance. "
The
Premise. The vision behind DCC, which is indeed compelling, is that it
would provide a common platform for certification, and that the distros
that make up the DCC would all ship exactly that same core. But it strikes
me that this approach has never worked in the past. In fact, every distro
ALWAYS modifies elements of the core, and with good reason. And while we
would love that not to be the case, the truth is that the reasons to
specialise outweigh the benefits of homogeneity."
Comments (11 posted)
Here's a report that FC5test1 with SELinux can be hazardous to older ext3
root filesystems, they can become unbootable. "
These compatibility
problems seem to be even worse than the ones that resulted from the
xattr-on-symlink bugfix to ext3 more than a year ago, when Fedora Core 2
zapped RedHat 9 and earlier ext3..."
Full Story (comments: 28)
DebConf6 will be held in Mexico next May. This announcement (click below)
is the final call for sponsorships. If you would like to go, but need help
with financing you have until the 15th of this month to apply.
Full Story (comments: none)
New Distributions
IBLS is a compact, easy to use
webserver that you can run from a live CD, even on older hardware. It will
run on a P133 with 32MB RAM, or possibly less. IBLS got its start in the
UK, using Damn Small Linux as a base. It has since been rebuilt from
scratch by an international community of developers. IBLS is modular and
uses its own package management system, designed to run from the CD or from
a hard drive. Although designed to be a server, there are plenty of
packages available to build any type of system.
Comments (none posted)
FoX Desktop is based on Fedora Core
and designed for the desktop. It offers a single CD install with a KDE
desktop and lots of other desktop software, optimized for i686. FoX joined
our list with FoXDesktop 1 released December 25, 2005.
Comments (none posted)
The People's Daily Online
covers
a Nepali version of Linux,
NepaLinux. "
The main features
of the NepaLinux are NepaLinux dictionary, Lexicon and Spell Checker and
Grammar Checker, the statement noted, adding, "NepaLinux is a Free/Open
Source Software in which the source code is open and the users have the
freedom to use, study, modify according to one's needs and redistribute
it," the statement noted."
Comments (none posted)
KDE.News
introduces the
Turkish distribution
Pardus.
"
Turkish distribution Pardus, one of the first GNU/Linux
distributions to feature KDE 3.5 as its desktop, has announced its first
stable release. All Pardus specific desktop applications, including the
installer and package manager are developed using the powerful KDE and Qt
libraries."
Comments (1 posted)
Distribution Newsletters
The Debian Weekly News for January 3, 2006 takes a look at Mohammed Adnène
Trojette's 2005 Debian timeline, new CD images for Debian GNU/Hurd, the
debian-private list is only private for three years now that the General
Resolution has passed, efforts to reduce the archive size, apt-torrent, a
report from FOSS.IN, vim as the default vi, and more.
Full Story (comments: none)
The Debian Weekly News for December 27, 2005 covers an essay on the cost of
Free Software in connection to the freedom people gain by using Free
Software, package backports for Sarge, the status of Debian unstable,
a common power management framework, the kernel package hooks transition,
architectures in the next release, XULRunner for Mozilla and friends,
Debian in Munich, and several other topics.
Full Story (comments: none)
This week the
Fedora Weekly
News covers the Red Hat Magazine for December 2005, Fedora Core 5 Test
2 slipping until January 16, Fedora Logo Usage Update, Fedora Ambassadors
Meeting Minutes, Open source in Africa, Fedora users and contributors -
Unite, Fedora Reloaded Podcast #3, Current Gotchas in OpenOffice.org, and
several other topics.
Comments (none posted)
The
DistroWatch
Weekly for January 2, 2006 is out. "
An unusually high number of
interesting releases have kept us busy during the Christmas break. We'll
take a quick look at FoX Desktop Linux 1, a nice-looking distribution
designed in the style of Mac OS X. We'll also discuss the increased
acceptance of non-free software packages in Mandriva, point you to a
resource about updating a SUSE 10.0 installation, and reveal the processor
architectures that will likely see full support in Debian "etch". A quick
tip to make it easier to switch between open applications on KDE and some
end-of-year statistics complement the issue. Finally, our December 2005
donation goes to the Cacti project."
Comments (none posted)
Package updates
Fedora Core 4 has updated
kdelibs
(bug fixes),
k3b (bug fixes),
sane-backends (version 1.0.17 with gphoto2
backend).
Comments (none posted)
Mandriva Linux 2006.0 updates:
msec
(bug fixes),
digikamimageplugins (update to
0.8.0),
libgphoto (hotplug usermap
restored),
nss_ldap (bug fix),
mdkonline (bug fix).
Comments (none posted)
Newsletters and articles of interest
The folks at the LinuxWorld News Desk
talked with Vincenzo
Ciaglia about Linux Netwosix. "
LW: What's the vision behind
Linux Netwosix? Why are you creating this software? Ciaglia: We think
that its light structure could make Linux Netwosix suited for all network
security work. For a good network plan, the sysadmin needs a light system
that is highly configurable. Every sysadmin wants to configure networks,
and work with them, with the possibility of doing everything alone."
Comments (none posted)
DesktopLinux
looks at live
CD distributions that make good desktops. "
[M]any liveCD distros
can be used as a day to day desktop without ever installing them to your
hard drive. Huh? Wait a minute, everyone installs the OS to a hard disk!
Well yes, that's the way it has always been done, but I am not sure why we
should continue in that direction... "ah, but I was so much older then, I'm
younger than that now" (Robert Allen Zimmerman)."
Comments (none posted)
Distribution reviews
Vincenzo Ciaglia
writes
about Linux Netwosix. "
With the new 2.x release, among the many
program updates and distribution enhancements, you will find a stable,
complete and cleaned GNU/Linux box for your network-security related
jobs. Linux Netwosix 2.0-rc1 uses the latest 2.6.14.5 stable kernel,
bringing you advanced and reliable performances. From the 2.0 new branch
to the next one, Linux Netwosix will try to offer the first real valid
alternative to historically secure systems like the *BSD ones, providing
core operating system to deliver stability, performance, and support for
mission-critical application deployments. Using Linux Netwosix the user
could benefit from outstanding robustness, scalabilty, and
reliability."
Comments (none posted)
NewsForge has an
article
from a SimplyMEPIS fan. "
I've been using SimplyMEPIS happily for
six months. I've never had big problems with it. Sometimes applications
crash, but it's very rare and it has never ruined my files. I guess
SimplyMEPIS just suits my-not-so-adventurous self. I'm not really that fond
of configuring stuff, but at the same time I like to do geeky stuff. For
me, this OS is a perfect fit."
Comments (none posted)
Page editor: Rebecca Sobol
Development
The
Schrödinger Project,
named after Austrian physicist
Erwin Schrödinger, is a joint effort between
Fluendo and
BBC Research & Development with the aim of developing a
set of ANSI C libraries that implement the encoding and decoding
functions of the
Dirac video codec
project.
"
Dirac is a video codec that provides general-purpose video compression and decompression tools comparable with state-of-the-art systems. Dirac is available for distribution under the MPL version 1.1 software license."
The Dirac
introduction
outlines that project's early history:
"In January 2003, BBC R&D produced a prototype video coding algorithm, based on wavelet technology, which is different from that used in the main proprietary or standard video compression systems. Our algorithm seems to give a two-fold reduction in bit rate over MPEG-2 for high definition video (e.g. 1920x1080 pixels), its original target application. It has been further developed to optimise it for internet streaming resolutions and seems broadly competitive with state of the art video codecs.
At the moment the codec, called Dirac, is in the early stages of development. It has been developed as a research tool, not a product, as a basis for further developments. An experimental version of the code, written in C++, was released under an Open Source licence agreement on 11th March 2004."
The Schrödinger Project is the next step forward.
The Dirac codec is a C++ project, while the Schrödinger libraries will
be written in ANSI C.
The Schrödinger Project's
initial announcement
states:
"The goal of this new implementation is to focus on speed and
maintainability."
The announcement mentions the planned support for Ogg containers:
As part of this project we will also make sure the Dirac video codec can
be contained in the
Ogg
container format and work with Xiph.org to
ensure that this mapping is acceptable to the Xiph community.
The code is not yet in a working state, but interested people are
suggested to join the mailing list or check out development as it
proceeds in our Subversion repository.
A more formal announcement is forthcoming. This looks like fertile
ground for the development of some interesting new video applications.
New developers are welcome to join the project.
Comments (7 posted)
System Applications
Database Software
The last release candidate
for the Firebird 1.5.3 final database is available.
"
This sub-release introduces a number of retrospective fixes (backports) to bugs that became
apparent and were fixed in
the Firebird 2 tree during the alpha and beta phases of the Firebird 2.0 development. This release
candidate (RC3) will
become the final stable version in about a few days."
Full Story (comments: 1)
Version 5.0.18 of the MySQL database has been released.
"
This is a bugfix version for the current production release family."
Full Story (comments: none)
The December 25, 2005 edition of the PostgreSQL Weekly News is
out with new PostgreSQL database articles and resources.
Full Story (comments: none)
The January 1, 2006 edition of the PostgreSQL Weekly News is
out with new PostgreSQL database articles and resources.
Full Story (comments: none)
Interoperability
Version 3.0.21a of Samba has been announced.
"
This is the latest stable release of Samba. This is the
version that production Samba servers should be running
for all current bug-fixes. The major reason for this
release is a fix for bugzilla defect #3349 (client hangs
due to oplock error)."
Full Story (comments: none)
Mail Software
Version 2.1.7 of Mailman, a mailing list manager, is out.
"
This release enhances the fixes for CAN-2005-0202 and CVE-2005-3573
which were fixed in mailman release 2.1.6, and reduces the chance of
list admin privilege abuse. Because of these and other fixes, it
is highly recommended that all sites update to 2.1.7."
Full Story (comments: none)
Telecom
Version 1.1rc4 of SIPp
has been announced.
"
SIPp 1.1rc4 brings RTP play capabilities. SIPp is a free Open Source test tool / traffic generator for the SIP protocol. The project is very active and is largely used in the SIP community.
The new pcap play feature (contributed by Guillaume Teissier) allows to send RTP streams and RFC2833 DTMFs along with the SIP traffic. This greatly widen the scope of SIPp and allows SIP compatible equipment provider to test their implementation better than ever."
SIP is the Session Initiation Protocol, a telecom standard.
See the
Wikipedia definition for details.
Comments (none posted)
Web Site Development
Version 2.0.19 of
phpBB, an open-source bulletin board
package,
has been announced.
"
This release addresses several bugfixes and some security issues only affecting Internet Explorer. Additionally we introduced a new feature to limit the number of logins. The admin is able to configure this feature on two ways, defining the number of maximum allowed logins and setting a time period after the user is allowed to login again. With this feature we hope to address the recent dictionary attacks happening on some forums to crack user passwords."
Comments (none posted)
Desktop Applications
Audio Applications
Version 0.1 of JackMiniMix has been announced.
"
JackMiniMix is a simple console based JACK client that mixes a
number of stereo inputs into a single stereo output. The gains of each of
the input channels can be queried and controlled by sending it OSC
messages."
Full Story (comments: none)
Version 0.9.2 of MuSE is out with stability and usability improvements.
"
MuSE is an application for mixing, encoding, and network streaming of
sound: it can transmit an audio signal by mixing together sound taken
from files or also network, recursively remixing more MuSE streams."
Full Story (comments: none)
Business Applications
Version 1.7.0 of Eventum, an issue tracking system, is available
with a long list of bug fixes and new features.
"
Eventum is a user-friendly and flexible issue tracking system that can
be used by a support department to track incoming technical support
requests, or by a software development team to quickly organize tasks
and bugs. Eventum is used by the MySQL AB Technical Support team, and
has allowed us to dramatically improve our response times."
Full Story (comments: none)
Data Visualization
Version 0.4.0.2 of
GtkDatabox,
a GTK+ data display widget, is out with bug fixes.
"
GtkDatabox is a widget for the Gtk+-library designed to display large amounts of numerical data fast and easy. One or more data sets of thousands of data points (X and Y coordinate) may be displayed and updated in split seconds. The widget is therfore used in many scientific and private projects that need to show quickly changing data "live".
GtkDatabox offers the ability to zoom into and out of the data and to navigate through your data by scrolling."
Comments (none posted)
Version 1.39 of PyChart
has been announced, this release adds limited Unicode capabilities.
"
PyChart is a Python library for creating high-quality Postscript, PDF, or PNG scientific charts ready for publishing. It supports line charts, bar charts, range-fill charts, and pie charts."
Comments (none posted)
Desktop Environments
Version 2.13.3 of the GNOME desktop has been announced,
numerous bug fixes are included.
Full Story (comments: none)
The following new GNOME software has been announced this week:
You can find more new GNOME software releases at
gnomefiles.org.
Comments (none posted)
The following new KDE software has been announced this week:
You can find more new KDE software releases at
kde-apps.org.
Comments (none posted)
More details are available from the X.Org Foundation on the
X11R7.0/X11R6.9 release that was recently announced.
"
The first major version release
of the X Window System in more than a decade, X11R7.0 is the first release
of the complete modularized and autotooled source code base for the X Window
System. X11R6.9, its companion release, contains identical features, and
uses the exact same source code as X11R7.0, but with the traditional imake
build system.
These changes in source code management, giving openness and transparency to
the source code base and employing current technology, invite a new
generation of developers to contribute, building on the long tradition of
the X Window System. The new modular format offers focused development, and
rapid and independent updates and distribution of tested modular components
as they are ready, freed from the biennial maintenance release timetable."
Thanks to Jay R. Ashworth.
Full Story (comments: 46)
Electronics
A new version of
Kicad,
an electronic CAD suite, was released on January 3, 2006.
Changes include support for more distributions, Unicode mode
compilation, bug fixes, and more. See the
news file
for details.
Comments (none posted)
Games
O'Reilly is running
part two in a series on hacking Pong.
"
In part one of this three-part series on hacking Pong, Josh Glover detailed
how you can write your own Pong clone, using SDL. So what's next? Adding the
paddles. Today Josh walks through how, with the help of sprites, you can
create and animate player-controlled paddles for your Pong clone. Tune in the
first week of '06 for Josh's conclusion--you'll need to add the ball and
scoring next, right?"
Comments (none posted)
Version 2.0.0 of Atari800, a cross-platform Atari game emulator,
is out.
"
Atari800 is an emulator of Atari 400/600XL/800/800XL/130XE/5200 with various extensions (320kB RAM, stereo sound and more) running on just about every operating system (Unix/Linux, Windows, DOS, TOS, MacOS, OS/2, Workbench, WinCE...)"
Comments (none posted)
Instant Messaging
GnomeDesktop.org
covers
the latest release of the Gaim instant messaging client.
"
This new beta, Gaim 2.0beta1, now includes support for several IM (instant messaging) protocols, such as the SIP/SIMPLE protocols, Apple Inc.'s Bonjour, the older Zephyr protocol, Novell Inc.'s GroupWise Novell protocol and several more obscure protocols such as the Polish Gadu-Gadu."
Comments (none posted)
Interoperability
An image of KDE for the VMware virtualization solution
has been announced.
"
Stephan Binner has released a VMware Player image of KDE 3.5 with KOffice
running on SUSE Linux 10. The image is fully functional and can be upgraded
and tweaked as needed. The version of VMware necessary to run it can be
downloaded for free."
Comments (none posted)
Version 0.9.4 of
Wine
is available. Changes include:
Improvements to the IDL compiler,
Some infrastructure work for loadable driver support,
The usual assortment of Direct3D improvements,
IME support in the edit control,
Better support for AVI animations,
Debugging support improvements,
Relay traces now work on NX platforms and
Lots of bug fixes.
Comments (3 posted)
Mail Clients
Release candidate 2 of Mozilla Thunderbird 1.5
has been announced.
"
Scott MacGregor writes: "The second release candidate of Mozilla Thunderbird
1.5 is now available for download. Mozilla Thunderbird 1.5 RC2 is intended to
allow testers to ensure that there are no last-minute problems with the
Thunderbird 1.5 code. "
"RC2 contains several key bug fixes that were identified during the RC1
testing cycle. There are no new features or enchancements from RC1. Users of
Thunderbird 1.5 RC1 will be offered RC 2 through the software update system.""
Comments (none posted)
Music Applications
Version 2.0 of gmidimonitor is out with lash support and bug fixes.
"
gmidimonitor is GTK application that shows MIDI events.
Currently MIDI events can be received at an ALSA sequencer port only.
Support for other sources like ALSA RawMIDI port may be added in
future."
Version 2.1
was released a few days later:
"
This release adds dumping of sysex data and somewhat limited MMC
decoding."
Full Story (comments: none)
Version 0.19 beta of MMA, the Musical MIDI Accompaniment, has been
announced. Changes include:
"
Many bug fixes, major rewrite of volume code, REPEAT
count enhancements, Lyric autochord transposition,
GOTO recognizes line numbers, MALLET works in all
tracks, and lots more!"
Full Story (comments: none)
Office Suites
The December, 2005 edition of the OpenOffice.org Newsletter is online
with the latest OpenOffice.org news and resources.
Full Story (comments: none)
Digital Photography
Version 0.4.0 of
Slideshow Creator is available.
"
With Slideshow Creator you can edit jpeg slideshows in a visual and fast way so you can reach a much higher productivity with dvd-slideshow.
The final result is a high quality dvd slideshow out of your jpegs!"
See the
CHANGELOG file
for a list of new features.
Comments (none posted)
Web Browsers
The producers of Mozilla Links have sent out a status update:
"
As you must have noticed there hasn't been a Mozilla Links release in a
long while now due to basically lack of time to setup a whole issue
release. So, we are moving to a new delivery media: a blog (web log).
We expect this to be a much more agile way to reach you and an
opportunity to bring more contributors with more content on board. You
may expect the same great content including news, tips, power tips,
interviews with Mozilla personalities, polls and product reviews."
Full Story (comments: none)
A new
draft plan for Gecko
has been announced.
"
Brendan Eich has posted a draft plan for Gecko 1.9 Trunk and 1.8 Branch Management, including a FAQ at the mozilla wiki. Comments should be directed as followups to the newsgroup post."
Comments (none posted)
Word Processors
For those of you who thought that AbiWord was just a graphical application: AbiWord hacker Martin Sevior has posted
a guide to AbiWord's server mode, which includes a command interface. Its main use appears to be scripted document format conversion, but various edition operations are possible as well.
Comments (6 posted)
Miscellaneous
GnomeDesktop
mentions
the new FileZilla FTP client.
"
FileZilla is currently
being ported over to Linux from Windows (using wxWidgets) and will arrive in
the form of FileZilla 3. At present it is in alpha stage but nightly builds
are available to download from the FileZilla development site."
Comments (none posted)
Languages and Tools
Caml
The December 27, 2005 edition of the Caml Weekly News is out
with the latest Caml language articles.
Full Story (comments: none)
The January 3, 2006 edition of the Caml Weekly News
is available.
Full Story (comments: none)
Java
Version 1.2 of Joda-Time
has been announced.
"
Joda-Time provides a Java library for date and time handling including the ISO8601 standard. It completely replaces the JDK Date and Calendar classes, while still providing good integration. It is open-source software under the ASF2 license.
Version 1.2 has just been released. This release fixes a nnumber of minor bugs in v1.1. There are also some new features".
Comments (none posted)
O'Reilly presents a
year in review article on Java developments in 2005.
"
2005 may not have seen a new version of Java, but it was a year of tremendous
activity that saw Java assert its popularity, even while some wondered how
well-suited Java is for its second decade. In this article, ONJava editor
Chris Adamson wraps up the year in Java by looking back at some of the year's
most popular articles."
Comments (none posted)
Lisp
Version 0.9.8 of SBCL (Steel Bank Common Lisp) is available.
"
This is mostly a bug fix release with
some performance optimizations."
Full Story (comments: none)
Python
The December 27, 2005 edition of Dr. Dobb's Python-URL! is online
with new Python language article links.
Full Story (comments: none)
The January 3, 2006 edition of Dr. Dobb's Python-URL! is online
with new Python language article links.
Full Story (comments: none)
The November 16-30, 2005 edition of the python-dev Summary is out
with a summary of python-dev mailing list activity.
Full Story (comments: none)
Ruby
The December 25th, 2005 edition of the
Ruby Weekly News looks at the latest discussions
from the ruby-talk mailing list.
Comments (none posted)
The January 1st, 2006 edition of the
Ruby Weekly News looks at the latest discussions
from the ruby-talk mailing list.
Comments (none posted)
Tcl/Tk
The December 28, 2005 edition of Dr. Dobb's Tcl-URL! is online with
new Tcl/Tk article links.
Full Story (comments: none)
The January 2, 2006 edition of Dr. Dobb's Tcl-URL! is online with
new Tcl/Tk article links.
Full Story (comments: none)
Version Control
Version 0.25 of monotone, a free distributed version control system,
is out.
"
This is _not_ the roster-enabled release; this is a maintainence
release of the old code, containing mostly small bug-fixes since 0.24.
Highlights include IPv6 support, 'read' fixed to handle
0.23-and-earlier privkey packets, and the ticker display being fixed
on win32."
Full Story (comments: none)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
Business Week
looks back at 2005. "
It was a year when CIOs signed off on open-source projects, a big change from previous years when that happened only after low-level engineers started such projects on their own initiative. It was a year when venture capitalists woke up to the new business opportunities of open source. It was a year when open source was the word on the lips of not just early adopters but of an early majority. According to a new study by consulting firm Optaros, 87% of organizations are now using open-source software, somewhere."
Comments (none posted)
Doc Searls
reflects
on the past, present and future. "
In the old days--the mid-late
1990s--"world domination" was an article of faith. Now it's a fact of
life. There are still struggles, of course. But the ones that matter most
are not at the operating system level. Linux is solid infrastructure
now. For many--perhaps most--computing purposes, it's a default first
choice. That choice will only get easier to make as Linux evolves."
Comments (5 posted)
Trade Shows and Conferences
The Linux Journal has
a lengthy report from a talk by GNOME and Ubuntu hacker Jeff Waugh. "
Apparently Mark [Shuttleworth] originally wanted, given that Ubuntu is Linux for human beings, the first release of Ubuntu to carry a tasteful, artistic picture of a naked woman. This caused everyone in the company and community to offer some version of 'this is a very bad idea'. So, the community got Mark to step away from that in stages. In the end Mark backed down. The upshot of all of this has been that the pictures used for release versions of Ubuntu depict at least one man, at least one woman, at least two races--and everyone is fully clothed."
Comments (22 posted)
NewsForge
covers
a seminar for parliamentary staff members and representatives of local
government in the UK. "
When Dr. Mohammad Al-Ubaydli agreed to
deliver a seminar on "Open Source in Government" to parliamentary staff
members and representatives of local government in the United Kingdom
earlier this month, he planned to introduce his audience to some basic
concepts. However, when he got there, he found that most of the audience
was already familiar with the concepts. As a result, instead of educating
people in public life, he may have done more than he hoped -- he may have
helped to create an ongoing forum in which the free and open source
software (FOSS) communities, political lobbyists, and members of the
governing Labour Party and the opposition Conservative Party can work
together to promote the use of FOSS in the governments of the United
Kingdom."
Comments (none posted)
The SCO Problem
Groklaw
summarizes
SCO's press release on its fourth quarter financial results. One thing
you can say about SCO, they know how to spin a press release. SCO stock
was up today.
Comments (24 posted)
Groklaw
reports that the SCO Group is now trying to expand its complaint against Novell; the new version includes a number of new claims, including copyright infringement in SUSE Linux. There is a new list of stuff that SCO claims to own; in addition to the usuals (RCU, ELF, ...) it includes "the kmalloc data structure," IRQs, reference counters, semaphores, and more.
Comments (12 posted)
Linux Adoption
EFY Times
covers
the increasing use of Linux by the South Korean government.
"
The state-owned Korea Post and the National Agricultural Cooperative Federation (NACF) have both said their systems will be up and running for Linux users before the end of this month as a part of the open source software fostering projects of the Ministry of Information and Communication."
Comments (none posted)
Legal
Groklaw
examines the threat of a lawsuit against Microsoft by the EU,
regarding the availability of standards information.
"
Dear Massachusetts (Governor Romney, Secretary Galvin, Senator Hart, et
al):Are you watching this? Microsoft, as you may have heard, has been under
pressure in Europe to make their APIs available to its competition for
interoperability purposes. Now, so far, that has meant only that they have
to do so for non-Linux competitors, as they were able to achieve a carve-out
that leaves Linux and all FOSS out in the cold during the appeal. For all
their other competitors in the server space, they were ordered to "to
disclose complete and accurate interface documentation which would allow
non-Microsoft work group servers to achieve full interoperability with
Windows PCs and servers"."
Comments (1 posted)
Groklaw
looks
at the resignation of Peter Quinn, the man who spearheaded the adoption
of Open Document Format in Massachusetts. "
[E]verything I am hearing
is that Massachusetts is firm in its decision to go with OpenDocument
Format. If Microsoft can meet the Commonwealth's definition of openness, ha
ha, they can qualify too, but that has always been the case. It was only
Microsoft's intransigence that had them out in the cold, their refusal to
support ODF, for reasons that make no sense to anyone, that shut them
out. Now they're trying a workaround, and we'll see how that works out for
them, but the ODF decision is firm."
Comments (none posted)
Here's
a BBC article by Michael Geist on the proposed Sony rootkit settlement. "
The disclosure requirements provide a model for treating TPMs [technical protection measures] much like cigarettes and alcohol, with appropriate warnings on their potential negative consequences.
The security measures may be the first step toward a comprehensive TPM approval and licensing system that places the security needs of the general public ahead of private commercial interests."
Comments (none posted)
Interviews
O'Reilly has published
an interview with Roland Dowdeswell.
"
Security-minded laptop users live in fear of theft, not only of their
computer but also of their precious secret data. NetBSD's CGD project is a
cryptographic virtual disk that can protect sensitive data while acting like
a normal filesystem. Federico Biancuzzi recently interviewed its author,
Roland Dowdeswell, on the goals and implementation of the system."
Comments (none posted)
KDE.News has an
interview with Rex
Dieter. "
Rex Dieter has been making the unofficial KDE Red Hat
packages for some years now. Since this is a service depended upon by
thousands of Red Hat users to get their required latest build of KDE, KDE
Dot News interviewed Rex to find out how he got started, why the need for
the project exists and how he makes the packages."
Comments (none posted)
David Beers
talks with Linux
kernel hacker Marty Fouts about PalmOS on Linux and general embedded
topics. "
DB: What in your view are the areas of the biggest
challenges for engineers who are trying to turn Linux into a mobile device
platform? MF: The biggest one is as much social as it is
technical. Linux, especially in areas like power management that are
important to embedded development, is a very quickly moving
target." (Thanks to Atul Chitnis)
Comments (none posted)
The People Behind KDE has an
interview with Sebastian Trüg,
author and maintainer of K3b. "
What do you think is still badly
missing in KDE? I think KOffice should get way more attention and
developers. It is promising but far from being a full replacement
(Hopefully Qt 4 will fix the font and printing problems)." (Found
on
KDE.News)
Comments (none posted)
Resources
IBM developerWorks
looks
at the use of Eclipse and Assistive Technologies (ATs) to create
accessible applications. "
An accessible solution combines an enabled
product and one or more ATs targeted for a user with an impairment. You
create an accessible solution by enabling your product for accessibility
during product design and development. This is analogous to enabling
software for internationalization; that is, you build the infrastructure to
facilitate the addition of functions later on. Then, when you deploy an
accessible product in a work setting for people with disabilities, you can
readily pair it with a complementary AT to create a complete solution. The
AT interprets the enabled software and allows users to interface with
hardware via a variety of alternative access methods."
Comments (none posted)
Linux.com
covers
bandwidth monitoring using iptables. "
Most of the time we use
iptables to set up a firewall on a machine, but iptables also provides
packet and byte counters. Every time an iptables rule is matched by
incoming or outgoing data streams, the software tracks the number of
packets and the amount of data that passes through the rules."
Comments (4 posted)
NewsForge
looks
at optical character recognition (OCR) software. "
If you use
Linux, or another free operating system, and need optical character
recognition (OCR) software, be prepared for a challenge. OCR is a tricky
problem on any computing platform -- both because it is conceptually hard,
and because the task does not lend itself to simple, easy-to-use
interfaces. OCR is the use of visual pattern matching to extract text from
an image -- usually a scanned paper document, but it could be a digital
photo, a frame of video, or a screenshot just as easily."
Comments (none posted)
Linux Journal has
this
article on embedding Python code into C programs. "
Including the
Python interpreter in your program is extremely simple. Python provides a
single header file for including all of the definitions you need when
embedding the interpreter into your application, aptly named Python.h. This
contains a lot of stuff, including several of the standard headers. For
compiling efficiency, it might be nice if you could include only those
parts of the interface that you actually intend to use, but unfortunately
Python doesn't really give you that option. If you take a look at the
Python.h file, you'll see that it defines several important macros and
includes a number of common headers that are required by the individual
components included later in the file."
Comments (22 posted)
Linux.com
covers one
sysadmin's favorite tools, including OpenSSH, ps, netstat, lsof, vmstat,
iostat, Pine, ping, traceroute and tcpdump. "
There are, of course,
many more tools that I need. As was mentioned in the original My Sysadmin
Toolbox article, vim is a must have. Also dmesg, uptime, netcat, nmap, and
even the who and last commands are all deserving of a spot in the
toolbox."
Comments (10 posted)
Reviews
eWeek
takes a look at Gaim 2.0beta1.
"
After several months of delay, the first beta of the popular open-source IM client Gaim is now available.
This new beta, Gaim 2.0beta1, now includes support for several IM (instant messaging) protocols, such as the SIP/SIMPLE protocols, Apple Inc.'s Bonjour, the older Zephyr protocol, Novell Inc.'s GroupWise Novell protocol and several more obscure protocols such as the Polish Gadu-Gadu."
Comments (9 posted)
RealTechNews
looks at
a new Linux-based game platform that sells for under $200.
"
The machine comes with dual cpu cores, 64mb ram, 64mb NAND flash memory, SD card compatible slot, USB 2.0 connection, 3.5" TFT LCD screen and TV-out. Also, the devices supports playback of most codecs such as MPEG, MPEG4, DivX 3.11, 4x, 5x, XVID, WMV, MP3, OGG, WMA, JPG, BMP, PCX, GIF and others."
Comments (1 posted)
KDE.News
introduces the Solid project, which aims to make hardware - especially mobile, wireless, and hot-pluggable hardware - "just work" with KDE. It will be part of KDE4.
"
After a lot of hacking behind the scenes, a new initiative to improve KDE's interaction with network and hardware devices has been launched. Solid will provide a robust basis for the dynamic modern desktop in KDE, which needs to be aware of available hardware and networks, paving the way for innovative functionality."
The
Solid web site has more information.
Comments (11 posted)
Linux.com
covers
Pylize, a Python-based command-line tool for creating presentations.
"
In addition to a standard Python installation, Pylize depends on
HTMLgen, a Python package used to generate HTML; Empy, one of the
templating packages available for Python; and, optionally, the Python
Imaging Library. The Python Imaging Library and HTMLgen have been packaged
for a number of distributions (for example, there are Ubuntu and Fedora
packages available). Empy comes with a standard setup.py which you can use
to install the package with the python setup.py install command. To install
Pylize itself, run the install.py Python script that comes with the
distribution (after you've installed the prerequisites)."
Comments (19 posted)
Miscellaneous
LinuxDevices has published
part four
of its Great Gadget Smack-Down series.
"
Welcome to Round Four of the ultimate showdown between Linux and Windows in the arena of embedded and device computing! After three heated but inconclusive rounds, our combatants are pulling no punches in their all-out quest to dominate the hottest consumer electronics and industrial computing markets.
Our smack-down aims to set aside the marketing hype and pit Linux versus Windows where it really counts -- devices on the street today."
Comments (1 posted)
The
Grants.gov site, which offers
information on applying for US Government grants, promotes the
PureEdge Viewer software. Unfortunately, PureEdge only works for
users running Windows, or a Windows emulator on an Apple platform.
The
PureEdge Support for Non-Windows Users document spells out the
usage requirements. In this case Non-Windows really means Apple-Only.
"
Grants.gov recognizes that support to users of Non-Windows operating systems and the PureEdge Viewer is often required across a distinct segment of the grant applicant community. Although at this time, the PureEdge Viewer is only available for Windows based installs, Grants.gov offers support for Non-Windows platforms.
Grants.gov is working with PureEdge in the development of a Non-Windows compatible viewer. PureEdge has committed to providing a platform independent viewer by November 2006."
(Thanks to Eric Firing.)
Comments (14 posted)
Joe Barr
wonders
if LUGs still serve a purpose. "
There is no question that LUGs --
Linux User Groups -- have been important to the rapid growth and adoption
of Linux. In the early years, a typical LUG brought together early adopters
from every walk of life who had a missionary zeal for Linux. Today, most
members are IT professionals. Given that, I wonder, do LUGs matter any
longer?"
Comments (12 posted)
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
The Free Standards Group is
requesting comments on accessibility standards specifications for
the Keyboard Access Functional Specification and the
Generic Assertions for Manual Testing.
"
The Freestandards Group Accessibility (FSGA) workgroup's keyboard team is requesting comments on two candidate FSG standards specification documents. These specifications are expected to become FSGA standards in 2006."
Comments should be submitted by December 31.
Comments (none posted)
MozillaZine
reports
on the move of the Mozilla newsgroups.
"
As announced earlier, the new
newsgroups will be hosted by Giganews. Access to the news server
news.mozilla.org will remain free. The new groups will only be propogated to
news.mozilla.org, Giganews Servers and Google Groups in an effort to combat
news spam."
Comments (none posted)
The Electronic Frontier Foundation has released an announcement
regarding Diebold voting machines.
"
Raleigh, North Carolina - After a series of lawsuits led by
the Electronic Frontier Foundation (EFF) to defend North
Carolina's election integrity laws, controversial
electronic voting machine manufacturer Diebold Election
Systems finally withdrew from the state's voting machine
procurement process on Thursday."
Full Story (comments: 2)
Commercial announcements
Fluendo has announced a cost free mp3 plugin
for the GStreamer multimedia framework.
"
With this plugins end-users and
distributions everywhere can get hold of a cost free MP3 playback
solution.
This plugin is for the 0.10 version of the GStreamer framework."
Full Story (comments: none)
Interact-TV has
announced a new sales record for November.
"
Interact-TV
(OTC: ITVI), a leading developer of Linux-based Home Entertainment Servers has
announced a record month in November, 2005 with an increase of over 480% from
the same month a year ago.
Telly Home Entertainment Servers allow consumers to easily store, share,
manage and enjoy digital media throughout their home."
Comments (none posted)
Linspire, Inc. and Mirus Innovations have
announced a new line of Linux-based desktop computers, starting with
the $299 entry.
"
At $299, the Essential Koobox is just
right for basic computing -- a perfect student machine or second home
computer. The machine comes complete with CDRW drive, 5 USB ports, including
a convenient front-side port, Internet keyboard and optical mouse, and 2W
speakers. Inside, the machine rounds out with an AMD Sempron processor,
256 MB RAM, 40 GB hard drive, and onboard video and sound networks."
Comments (none posted)
Open-Xchange, Inc. has announced the availability of a free, fully
functional Live-CD of Open-Xchange Server 5 that gives users a cost-free,
risk-free way to test all the attributes of the worlds leading open source
alternative to Microsoft Exchange.
Full Story (comments: none)
Red Hat, Inc. has
announced
that its Chief Executive Officer, Matthew Szulik, plans to enter into a
Rule 10b5-1 stock trading plan with respect to the Company's common stock
and also to engage in transactions in the Company's common stock outside of
the stock trading plan, in January 2006.
Comments (none posted)
Sun Microsystems, Inc. has
announced a new release of the NetBeans Profiler.
"
Sun Microsystems
Inc. (Nasdaq: SUNW), the creator and leading advocate of Java(TM) technology,
today announced NetBeans Profiler Milestone 11, the latest release of its
high-performance Java application profiler, and an add-on to the upcoming open source NetBeans(TM) IDE release 5."
Comments (none posted)
Terra Soft Solutions has announced the shipment of Y-Bio, its first
solution for the life sciences market, originally launched at SC2005.
Full Story (comments: none)
Versora and Linspire, Inc. have
announced the release of Versora's Progression Desktop
for Linspire.
"
This easy-to-use migration tool allows users to transfer
e-mail, files and settings from their Windows machine to a Linux
machine, moving critical data, application settings, e-mail, calendar entries, contact
lists, desktop settings and directory structures via a
"Click-Next-Next-Finished" interface."
Comments (none posted)
Video Without Boundaries, Inc. has
announced demonstrations of a new release of its MediaREADY Digital
Media Center product line.
"
To be demonstrated live at the International Consumer Electronics Show in Las
Vegas on the Linux-based line of products will be a series of popular online
services and applications including iTunes, Yahoo! Music, Google Video, AOL
Optimized 9.0, voice calling as well as transfer of video and audio to the
Apple iPod."
Comments (none posted)
Contests and Awards
Astaro has announced the receipt of rewards from Computer Reseller News
and SC Magazine for its network security solutions.
"
Astaro products were featured in the Multifunction Appliances and
Firewalls/VPNs categories in the Best of 2005 SC Magazine issue. In the
October issue of the same publication, the Astaro Security Gateway 220
received a Best Buy and five-out-of-five star rating."
Full Story (comments: none)
KDE.News
covers KOffice GUI
and Functionality Design competition. There's a cash prize for the winner,
and the new design will be used in KOffice 2.x which is due for release
around the same time as KDE 4.0.
Comments (none posted)
Upcoming Events
Early registration is open for the Black Hat Europe security conference.
The Black Hat USA 2006 call for papers will open at the end of January.
Full Story (comments: none)
The GNU Classpath and friends meeting will be held on February 25
during the Fosdem 2006 conference in Brussels, Belgium.
Full Story (comments: none)
A reminder has gone out for the 2006 linux.conf.au event.
"
With just over a month to go before the start of linux.conf.au 2006,
we feel it's time to let those that have not heard, hear, and give
those that have a reminder that time to register is running short.
linux.conf.au 2006 will be held at the University of Otago in the
remarkable city of Dunedin, New Zealand from the 23rd - 28th of
January 2006."
Full Story (comments: none)
Registration for the 2006 MySQL Users Conference
has been announced.
The event takes place in Santa Clara, California on April 24-27.
Comments (none posted)
A Call for Proposals has gone out for the O'Reilly OSCON 2006
conference. The event will take place on July 24-28, 2006 in Portland,
Oregon. Proposals are due by February 13.
Full Story (comments: none)
The
schedule
for the 2006 PyCon has been posted.
The conference takes place on February 24-26, 2006 in Addison, Texas.
Full Story (comments: none)
The SCALE Workshop On Open Standards For Government will be held on February 10, 2006 in Los Angeles, CA.
"
In partnership with The Open Document Fellowship, the Southern
California Linux Expo (SCALE) has announced plans to host a workshop on
open standards in government at their upcoming conference, SCALE 4x. The
focus of this workshop will be on the use of OASIS OpenDocument Format
for Office Applications (ODF) and document accessibility standards in
state and local government. The goal of this event is to foster a
discussion about choice in software and open standards at all levels of
California government."
Full Story (comments: none)
Here's an event announcement that we somehow failed to get up earlier: the
X.Org Developer's Conference
will be held February 8 to 10 in Santa Clara, California. Coming
on the heels of the X11R7.0 release, this conference should offer some
interesting insights into where X development goes next. Scheduled talks
include a session by Jim Gettys on graphics in the One Laptop Per Child
project and an intriguing talk on "NVIDIA driver internals."
Comments (7 posted)
| Date | Event | Location |
| January 13 - 15, 2006 | ShmooCon
2006 | (Wardman Park Marriott Hotel)Washington, D.C. |
| January 23 - 28, 2006 | linux.conf.au
2006 | Dunedin, New Zealand |
| January 23 - 25, 2006 | Black Hat Federal
Briefings and Training 2006 | (Sheraton Crystal City)Washington, D.C. |
| January 24 - 26, 2006 | O'Reilly
Emerging Telephony Conference | (San Francisco Airport Marriott)San Francisco,
CA |
| February 6 - 7, 2006 | ICMCC Conference on
EHR Standards and Interoperability | (World Forum Convention Center, The Hague)The
Netherlands |
| February 8 - 10, 2006 | X Developer's
Conference(XDevConf) | (Sun Campus)Santa Clara, CA |
| February 8 - 10, 2006 | LinuxAsia Conference and
Expo 2006 | (India Habitat Centre)New Delhi, India |
| February 10 - 12, 2006 | CodeCon
2006 | San Francisco, CA |
| February 10, 2006 | SCALE Workshop On
Open Standards For Government Organizations | (Airport Radisson)Los Angeles,
CA |
| February 11 - 12, 2006 | Southern California
Linux Expo(SCALE 4x) | (Los Angeles Airport Westin)Los Angeles, California |
| February 20 - 21, 2006 | EuSecWest/core06
conference | London, England |
| February 24 - 26, 2006 | PyCon
2006 | (Dallas/Addison Marriott Quorum hotel)Addison, TX |
| February 25 - 26, 2006 | FOSDEM
2006 | (ULB Campus)Brussels, Belgium |
| February 27 - March 3, 2006 | SELinux
Symposium and Developer Summit | (Wyndham Hotel)Baltimore, MD |
| February 28 - March 3, 2006 | Black Hat Europe
Briefings and Training 2006 | (Grand Hotel Krasnapolsky)Amsterdam, the
Netherlands |
Comments (none posted)
Page editor: Forrest Cook
Letters to the editor
| From: |
| James Dixon <jdixon-AT-pobox.com> |
| To: |
| letters-AT-lwn.net |
| Subject: |
| Community help as an attack vector |
| Date: |
| Sun, 25 Dec 2005 21:09:08 EST |
I'm afraid the potential may be more real than we would like.
I used to respond to questions on the free linux support site before it
died. On at least three occasions, I was asked if I would be willing
to remotely access the machine in question as root and work on it. The
only contact these people had with me was my posts on the forum and my
name given at the end of the posts. In each case, I declined and
pointed out that offering root access to an almost complete stranger
was ot really a good idea. Instead I usually gave the person the
contact addresses for their nearest LUG's and suggested they contact
them to see if they could arrange for onsite support from a qualified
support person.
It would be reassuring to think my experience was unique, but I doubt
that's the case.
Oh, this is emailed, as I'm not a subscriber. I read you free edition
weekly, but I can't really justify your subscription rates. I'd love
to be able to do so, but barring winning the lottery, I don't see that
it's likely. This is not intended as a criticism of your rates, as I
know that you keep them as low as possible, and that even the current
rates don't really meet your needs.
You're welcome to publish this in your letters section, or copy it to
the comments section o fthe appropriate story, as you see fit. You may
edit it as required.
James Dixon
jdixon@pobox.com
Comments (5 posted)
| From: |
| "Ian Bruntlett" <ianbruntlett-AT-hotmail.com> |
| To: |
| letters-AT-lwn.net |
| Subject: |
| "Just works with Linux" |
| Date: |
| Thu, 22 Dec 2005 11:26:44 +0000 |
Hi,
Take a look at "http://kerneltrap.org/node/5743", an article about the Open
Graphics Project which sets out to have open documentation about its
hardware (registers etc) so that the FOSS can maintain graphics drivers.
I'm looking forward to supporting this project.
Ian
Comments (3 posted)
Page editor: Jonathan Corbet