The
first LWN.net Weekly Edition was posted on
January 22, 1998. We didn't really hit our stride until
the following week, but the fact remains: LWN is now
five years old.
LWN was originally intended to be an attention-getting mechanism for a
startup Linux support and consulting business. The whole plan was based on
a number of misconceptions, beginning with the idea that demonstrating our
expertise in an online newsletter would show the world that we could help
them deploy Linux in their companies; somehow it never quite worked that
way. We also thought that Red Hat was serious about its ill-fated "support
partner" program, and that we might actually make some money with it.
Perhaps worst of all, we were under the impression that helping people with
their system administration problems would not drive us completely crazy.
All told, it's not entirely surprising that things did not go the way we
thought they would.
But, it appears that was maybe for the best.
From the beginning, it can be argued that our heart was really in the
LWN effort, rather than in the "money making" activities it was meant to
publicize. Even so, we could never have imagined that LWN would still be
around in five years - or that it would be such a wild ride.
At this point in its history, LWN is in as good a place as it has ever
been. It's easy to miss the funner aspects of the Bubble Days - indeed,
the money coming in is still not what it needs to be for the long term -
but LWN is now sustaining itself by selling a service directly to almost
2500 individuals (and 30 companies - thanks to Zope Corporation for being the most recent
subscriber) who find it worth paying for. Our
success depends directly on keeping our readers happy, rather than trying
to sell our readers' attention to a small number of big advertisers. We
can, thus, concentrate on making our content the best it can be with no
need to worry about conflicts of interest. Advertising will remain part of
our income stream, but it's relatively small.
Looking forward, we'll soon be deploying a new version of our text ad code
- there will be a separate announcement when that happens. Then, with
luck, we can direct some effort away from site coding and toward content
creation. We have been experimenting with content from external authors
with some luck; we hope to be able to expand that program in the future.
We are also working with the folks at Progeny as they expand
their Programmers Toolkit offering; that partnership should help us to
expand LWN's reader base. And, of course, we'll be looking for other ways
to expand our list of subscribers; we'll tell you more about what we're
doing when we figure it out ourselves.
In any case, it is our plan to be part of the Linux and free software
community for the next five years; we expect them to be at least as
interesting as the previous five. Many thanks to all of you for half a
decade of support.
Comments (13 posted)
One of our favorite things to worry about here at LWN is software
monocultures. When everybody is running the same thing, a single
vulnerability can compromise them all. The BIND nameserver package has
thus occasionally come up as a topic of concern, since it has one of the
strongest monopolies in the free software arena. There have been very few
free alternatives to BIND which have become stable enough for people to
trust them with their name service tasks.
That situation is changing, however. Over the last week, two different
free DNS server implementations have announced new releases. So it seems
like a good time to give them a look.
The announcement of the first public release
of the Oak DNS server went
out recently. Oak is written entirely in Python, with the result that it
is portable to many systems (even Windows) and should be relatively
resistent to buffer overrun attacks. Oak is licensed under the LGPL, and
supports most of the features one would expect in a nameserver: recursion,
master and slave modes, etc.
That said, Oak is very much a work in progress. It comes packaged as one
big Python module and a driver script; no distutils installation support in
sight. It reads the usual DNS master file format to get zone information,
but the top-level configuration takes the form of a screenful or so of
Python code - not something every system administrator will want to get
into. Documentation is scarce; those wanting to make serious use of Oak at
this point will likely have to delve into the code. This is definitely not
Aunt Tillie's DNS server.
But the core functionality of Oak appears to be solid, and the project's
maintainer (Ed Stoner) is responsive to problem reports. It would not take
all that much work to turn Oak into a simple, secure, high-quality DNS
server, especially for smaller installations. If you like Python
programming, Oak is worth a look now; with luck it will be ready for
everybody else in the near future.
For a very different sort of nameserver, see the
announcement for PowerDNS 2.9.4. PowerDNS was, for some time, a
proprietary system; it was released under the GPL in November of 2002. The
pace of development seems to have picked up since then, and PowerDNS is
evolving into an impressive system.
While Oak may be best suited to small networks, PowerDNS is clearly aimed
at large ISPs and others who must serve huge numbers of domains. It can
obtain its DNS information via several backends; it can, for example, run
from an
existing BIND configuration, or talk (using a pipe) to an arbitary process
via a simple and well-documented protocol. The most developed backends,
however, would appear to be those which work with a MySQL, PostgreSQL, or
Oracle database. PowerDNS comes with a database scheme that it expects to
use, but the SQL it uses is easily changed via the configuration file.
PowerDNS, thus, will happily fit in with just any sort of in-house system
used for the management of domain information.
PowerDNS also includes its own built-in web server which provides
information on performance and the most frequent queries. It can also
produce statistics meant to be fed directly to MRTG. PowerDNS
supports the usual security features (setuid, chroot), and has been written
for high performance when dealing with thousands of domains. It is also
extensively documented on doc.powerdns.com.
The one thing that PowerDNS lacks is support for recursive name
resolution. With its default configuration, if PowerDNS is does not have
an authoritative answer for a given query, it refuses to answer at all. It
is thus suitable for handling primary and secondary nameserver duties, but
not for handling name lookups for users. That is changing, though; version
2.9.4 includes a recursive nameserver which can be built and run as a
separate process. The plan, apparently, is to integrate that functionality
into PowerDNS itself in the 2.9.5 release.
Oak and PowerDNS are not the only alternative free nameservers, of course.
Some others which appear to be reasonably stable and under active
development include:
- MaraDNS (a simple, recursive
nameserver).
- MyDNS (an authoritative-only
system which works with MySQL or PostgreSQL).
- NSD (authoritative-only).
(And yes, in order to forestall a flood of email, we should mention that
the not-quite-free djbdns package is also
out there).
BIND is a package with a long history of service; the Internet is literally
built on it. Its security record is not that bad, considering its wide
deployment and the amount of energy that has gone into finding
vulnerabilities. But the security of the Net as a whole can only be
improved by the emergence of solid, well-supported alternatives.
Comments (21 posted)
[This article was contributed by Joe 'Zonker'
Brockmeier]
Every trade show produces a slew of press releases from vendors, and
this year's LinuxWorld Expo is no different. Here's a quick summary of
some of the more interesting announcements made this year.
AMD introduced a trial version of the 64-bit Opteron CPU at LinuxWorld.
AMD and IBM announced that a 64-bit trial version of DB2 was ready for computers based on the Opteron. The company is planning to make about 500 Opteron-based systems available to system builders and potential customers. In further Opteron news, AMD and Scyld announced that they are working on a 64-bit version of Scyld Beowulf for Opteron machines.
While working together on DB2 on Opteron, AMD and IBM were touting
separate Linux-based PDA solutions at LinuxWorld. AMD has partnered with
Metrowerks to produce the OpenPDA
platform. OpenPDA is designed to run on the AMD Alchemy Solutions Au1100
processor for PDAs and smart phones. AMD's reference platform includes
Trolltech's Qtopia multi-language user interface, Insignia's integrated
Java Virtual Machine (JVM), and the Opera Web browser.
SYS-CON Media plans to debut its own Linux-focused magazine, Linux
Business & Technology, in May. The
magazine is a spin-off of SYS-CON's Linux Business Week website and
will be aimed at enterprise market. LBT will carry a cover price of
$5.99. SYS-CON also publishes
Java Developer's Journal, Web Services Journal and
XML-Journal.
There were a few UnitedLinux
announcements at LinuxWorld Expo, including plans to create a
software developers program and partner with the Linux Professional Institute (LPI) to
create a certification program. The United Linux developer program is
designed to encourage development for the United Linux platform and
includes a Software Evaluation Kit developed by IBM. LPI and United
Linux will be rolling out the new certifications in the first quarter of
2003: a UnitedLinux Certified Professional (ULCP) certification and a
UnitedLinux Certified Expert (ULCE) certification. UnitedLinux also
announced that HP was becoming an UnitedLinux Technology Partner.
Speaking of HP, the company announced Tuesday that it is now raking in
$2
billion a year on its Linux offerings. This announcement was actually
made by Carly Fiorina at HP's annual storage and enterprise event in
Amsterdam, but it seems to fit in nicely. At LinuxWorld, HP announced several new
Linux-based products, including a line of workstations with Red Hat 7.3
pre-installed and a four-processor blade server.
The Ximian folks were also busy at LinuxWorld. Ximian announced
a collaboration with Sun Microsystems, releasing the Sun ONE Connector
for Ximian Evolution. Like Ximian's Connector for Microsoft Exchange, the
product will allow users on Linux or Solaris systems to exchange calendars,
schedules, address books and task lists. Ximian also announced the release
of Red Carpet Enterprise 1.2, which adds rollback support so admins can
return a system to a previous configuration.
Dell was somewhat low-key at LinuxWorld this year, but did announce a
new line of server blades that will fit 84 servers in a standard rack.
The PowerEdge 1655MC blade runs Red Hat Linux. Red Hat was also fairly
quiet, though Michael Tiemann gave a keynote address with Jeffrey
Birnbaum of Morgan Stanley on Wednesday.
SuSE unveiled
its Desktop edition on Tuesday. The SuSE Linux Office Desktop includes
CodeWeavers CrossOver 1.3.1, allowing users to run Microsoft Office and a
number of other Windows applications on Linux. The Office Desktop also
includes Sun StarOffice for companies that would prefer to migrate off of
Office entirely.
MySQL AB announced
that a few new features had been added to MySQL. MySQL 4.1 now includes
subselects and improved SSL support. The company also used the occasion
to
announce their own conference. The MySQL Users Conference & Expo
will take place in San Jose, April 10-12.
Some of the more interesting Linux-related products announced this year
include the LTrix
Engineering lice 1.7 Patchless Linux Kernel Debugger and the PTC Pro/ENGINEER Wildfire MCAD software for Linux.
The next LinuxWorld Expo is scheduled for August 4-7 at the Moscone
Center in San Francisco.
Comments (none posted)
Page editor: Jonathan Corbet
Security
Brief items
[This article was contributed by LWN reader Tom
Owen]
German web tools vendor
e-matters
somehow allows the time for PHP developer Stefan Esser to read source code.
Earlier this week he
reported
serious vulnerabilities resulting from a programming error in the version
control tool CVS. Since CVS is used by most free software development
projects, this problem merits some attention.
CVS can be configured to allow read-only access to anonymous users.
Development projects use this capability to allow public access to the latest
development versions without having to build a release every time a file changes.
The e-matters advisory covers two levels of vulnerability based on read-only
access:
-
Anonymous read-only users can obtain write access,
allowing the attacker to change code in the repository.
One obvious attack is to slip a trojan into the source.
If the change isn't spotted, it will be distributed as part of the next release.
- A poorly-documented feature allows CVS users with write access to
execute arbitrary commands on the server.
The advisory does not make the holes seem easy to exploit.
The (unpublished) proof of concept depends on features of BSD memory management;
it might not work on other hosts.
But the payoff for a successful attack is huge - it's conceivable that
an attacker could get an undetected trojan in to a widely distributed package.
So it is not surprising that the distributors are rushing out updates based
on
CVS version
1.11.5,
which does not contain the fault.
The advisory also points out:
You should also note that the CVS client/server protocol includes two
commands (Update-prog and
Checkin-prog) that can be used by any CVS user with write access to the
repository to execute arbitrary shell commands on the server. This is a
questionable feature, because it is very badly documented, is unknown to most
CVS administrators and cannot be turned off within the configuration files.
Esser offers a patch to control Update-prog and Checkin-prog from the CVS
configuration.
There are numerous anonymous-CVS servers on the net, and all of them could,
conceivably, be vulnerable. It is important that they get patched up in a
hurry, or this vulnerability could be the source of no end of other
problems later on.
Comments (none posted)
Bruce Schneier's CRYPTO-GRAM newsletter for January is out; it looks at
cyber-war, the Randomized Message Authentication Code, and Yahoo.
"
Someone's birthdate isn't a
secret, and is a terrible way to authenticate someone. But Yahoo goes
one step further. 'My Yahoo,' the company's popular personalized news
page, uses the information to put a 'Happy Birthday, <username>!'
message at the top of your page when you visit on your birthday."
Full Story (comments: none)
New vulnerabilities
bugzilla - insecure permissions, spurious backup files
| Package(s): | bugzilla |
CVE #(s): | CAN-2003-0012
CAN-2003-0013
|
| Created: | January 16, 2003 |
Updated: | January 22, 2003 |
| Description: |
Two vulnerabilities have been discovered in Bugzilla, a web-based bug
tracking system, by its authors. The Common Vulnerabilities and
Exposures Project identifies the following vulnerabilities:
- CAN-2003-0012 (BugTraq ID 6502): The provided data collection
script intended to be run as a nightly cron job changes the
permissions of the data/mining directory to be world-writable every
time it runs. This would enable local users to alter or delete the
collected data.
- CAN-2003-0013 (BugTraq ID 6501): The default .htaccess scripts
provided by checksetup.pl do not block access to backups of the
localconfig file that might be created by editors such as vi or
emacs (typically these will have a .swp or ~ suffix). This allows
an end user to download one of the backup copies and potentially
obtain your database password.
|
| Alerts: |
|
Comments (none posted)
CVS - exploitable double-free bug in the CVS server
| Package(s): | cvs |
CVE #(s): | CAN-2003-0015
|
| Created: | January 20, 2003 |
Updated: | April 7, 2003 |
| Description: |
CVS is a version control system frequently used to manage source code
repositories. During an audit of the CVS sources, Stefan Esser
discovered an exploitable double-free bug in the CVS server.
On servers which are configured to allow anonymous read-only access, this
bug could be used by anonymous users to gain write privileges. Users with
CVS write privileges can then use the Update-prog and Checkin-prog features
to execute arbitrary commands on the server.
All users of CVS are advised to upgrade to erratum packages which contain
patches to correct the double-free bug.
See also this CERT advisory |
| Alerts: |
|
Comments (none posted)
dhcp - Buffer Overflows in ISC DHCPD Minires Library
| Package(s): | dhcp |
CVE #(s): | CAN-2003-0026
|
| Created: | January 16, 2003 |
Updated: | January 23, 2003 |
| Description: |
The Internet Software Consortium (ISC) has discovered several buffer
overflow vulnerabilities in their implementation of DHCP (ISC DHCPD).
These vulnerabilities may allow remote attackers to execute arbitrary code
on affected systems. There are no known exploits at this time.
See CERT Advisory CA-2003-01 for complete
details. |
| Alerts: |
|
Comments (none posted)
fnord - buffer overrun
| Package(s): | fnord |
CVE #(s): | |
| Created: | January 17, 2003 |
Updated: | January 22, 2003 |
| Description: |
Ralf Wildenhues has discovered a buffer overrun in the CGI code in fnord
1.6. This function does not return, so this does not appear to be
exploitable. fnord - yet another small
httpd has an update to fix the problem in any case. |
| Alerts: |
|
Comments (none posted)
printer-drivers - multiple vulnerabilities
| Package(s): | printer-drivers |
CVE #(s): | |
| Created: | January 21, 2003 |
Updated: | January 22, 2003 |
| Description: |
Karol Wiesek and iDefense disovered three vulnerabilities in the
printer-drivers package and tools it installs. These vulnerabilities
allow a local attacker to empty or create any file on the filesystem.
The first vulnerability is in the mtink binary, which has a buffer
overflow in its handling of the HOME environment variable.
The second vulnerability is in the escputil binary, which has a buffer
overflow in the parsing of the --printer-name command line argument.
This is only possible when esputil is suid or sgid; in Mandrake Linux
9.0 it was sgid "sys". Successful exploitation will provide the
attacker with the privilege of the group "sys".
The third vulnerability is in the ml85p binary which contains a race
condition in the opening of a temporary file. By default this file is
installed suid root so it can be used to gain root privilege. The only
caveat is that this file is not executable by other, only by root or
group "sys". Using either of the two previous vulnerabilities, an
attacker can exploit one of them to obtain "sys" privilege" and then
use that to exploit this vulnerability to gain root privilege. |
| Alerts: |
|
Comments (none posted)
susehelp - remote command execution
| Package(s): | susehelp |
CVE #(s): | |
| Created: | January 20, 2003 |
Updated: | January 22, 2003 |
| Description: |
During a code review of the susehelp package the SuSE Security Team
recognized that the security checks done by the susehelp CGI scripts are
insufficient. Remote attackers can insert certain characters in CGI
queries to the susehelp system tricking it into executing arbitrary code as
the "wwwrun" user. Please note that this is only a vulnerability if you
have a web server running and configured to allow access to the susehelp
system by remote sites. |
| Alerts: |
|
Comments (none posted)
vim - modeline vulnerability
| Package(s): | vim |
CVE #(s): | CAN-2002-1377
|
| Created: | January 16, 2003 |
Updated: | February 10, 2004 |
| Description: |
VIM allows a user to set the modeline differently for each edited text file
by placing special comments in the files. Georgi Guninski found that these
comments can be carefully crafted in order to call external programs. This
could allow an attacker to create a text file such that when it is opened
arbitrary commands are executed. |
| Alerts: |
|
Comments (4 posted)
Updated vulnerabilities
Heap corruption vulnerability in at
| Package(s): | at at, sudo, xchat |
CVE #(s): | CAN-2002-0004
|
| Created: | May 21, 2002 |
Updated: | May 15, 2003 |
| Description: |
The at command has a
potentially exploitable heap corruption bug.
(First LWN report: January 17th).
|
| Alerts: |
|
Comments (none posted)
BIND8: Multiple vulnerabilities
Comments (1 posted)
bind buffer overflow vulnerability in DNS resolver libraries
| Package(s): | bind glibc |
CVE #(s): | CAN-2002-0651
CAN-2002-0684
|
| Created: | July 8, 2002 |
Updated: | October 1, 2003 |
| Description: |
The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1)
include fixes for a libc related vulnerability which does not
affect Linux. Updates from
the Internet Software Consortium (ISC)
are available from here.
No release or branch of Openwall GNU/*/Linux (Owl) is known to be
affected, due to Olaf Kirch's fixes for this problem getting into the
GNU C library more than two years ago.
Unfortunatly that does not mean that Linux systems are not vulnerable.
Similar code, without Olaf Firch's fixes,
is in the glibc getnetbyXXX functions.
These functions are described in the SuSE alert as
"
used by very few applications only, such as ifconfig and ifuser,
which makes exploits less likely."
CERT Advisory: CA-2002-19
Buffer Overflow in Multiple DNS Resolver Libraries
CAN-2002-0651
CAN-2002-0684 |
| Alerts: |
|
Comments (1 posted)
Canna server: exploitable buffer overrun
| Package(s): | canna |
CVE #(s): | CAN-2002-1158
CAN-2002-1159
|
| Created: | December 10, 2002 |
Updated: | October 1, 2003 |
| Description: |
Canna is a kana-kanji conversion server which is necessary for Japanese
language character input.
A buffer overflow bug in the Canna server up to and including version 3.5b2
allows a local user to gain the privileges of the user 'bin' which could
lead to further exploits. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2002-1158 to this issue.
A lack of validation of requests has been found that affects Canna version
3.6 and earlier. A malicious remote user could exploit this vulnerability
to leak information, or cause a denial of service attack. (CAN-2002-1159)
See also
http://canna.sourceforge.jp/sec/Canna-2002-01.txt
CAN-2002-1158
CAN-2002-1159 |
| Alerts: |
|
Comments (none posted)
cups - multiple vulnerabilities
Comments (none posted)
dvips: command execution vulnerability
| Package(s): | dvips |
CVE #(s): | CAN-2002-0836
|
| Created: | October 16, 2002 |
Updated: | June 10, 2003 |
| Description: |
The dvips utility uses the system() function improperly when managing fonts. An attacker who can craft the right sort of print job can use this vulnerability to execute commands under the UID used by the print system. |
| Alerts: |
|
Comments (none posted)
Filename disclosure vulnerability in fam
| Package(s): | fam |
CVE #(s): | CAN-2002-0875
|
| Created: | August 19, 2002 |
Updated: | January 5, 2005 |
| Description: |
"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible. |
| Alerts: |
|
Comments (none posted)
fetchmail: buffer overflow
| Package(s): | fetchmail |
CVE #(s): | CAN-2002-1365
|
| Created: | December 17, 2002 |
Updated: | October 20, 2003 |
| Description: |
Versions of fetchmail prior to 6.2.0 have (yet another) buffer overflow vulnerability which can be exploited remotely via a suitably crafted message. See this advisory for details. |
| Alerts: |
|
Comments (3 posted)
GNU fileutils race condition
| Package(s): | fileutils ucdsnmp |
CVE #(s): | CAN-2002-0435
|
| Created: | May 21, 2002 |
Updated: | May 16, 2003 |
| Description: |
A race
condition in rm may cause the root user to delete the whole filesystem.
The problem exists in the version of rm in
fileutils
4.1 stable and 4.1.6 development version. A patch
is available.
(First LWN
report: May 2).
|
| Alerts: |
|
Comments (none posted)
Potential remote root exploit in glibc
| Package(s): | glibc |
CVE #(s): | CAN-2002-0391
|
| Created: | August 14, 2002 |
Updated: | June 30, 2003 |
| Description: |
Felix von Leitner, discovered a
potential division by zero bug in
code derived from the SunRPC library which is used in glibc.This bug could be
exploited to gain unauthorized root access to software linking to glibc.
Updating as soon as practical is a good idea.
Because SunRPC-derived XDR libraries are used by a variety of vendors in a variety of applications, this defect may lead to a number of differing security problems. Exploiting this vulnerability will lead to denial of service, execution of arbitrary code, or the disclosure of sensitive information.
CERT/CC Vulnerability Note VU#192995 Integer
overflow in xdr_array() function when deserializing the XDR stream
|
| Alerts: |
|
Comments (none posted)
glibc: DNS stub resolvers contain buffer overflow vulnerability
| Package(s): | glibc |
CVE #(s): | CAN-2002-1146
|
| Created: | November 7, 2002 |
Updated: | February 5, 2004 |
| Description: |
DNS stub resolvers from multiple vendors contain a buffer overflow
vulnerability. The impact of this vulnerability appears to be limited to
denial of service. (See CERT Vulnerability Note
VU#738331)
The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such
as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer
size instead of the actual size when processing a DNS response, which
causes the stub resolvers to read past the actual boundary ("read buffer
overflow"), allowing remote attackers to cause a denial of service
(crash).
|
| Alerts: |
|
Comments (none posted)
IM: creates temporary files insecurely
| Package(s): | im |
CVE #(s): | CAN-2002-1395
|
| Created: | December 3, 2002 |
Updated: | March 6, 2003 |
| Description: |
Tatsuya Kinoshita discovered that IM, which contains interface
commands and Perl libraries for E-mail and NetNews, creates temporary
files insecurely.
- The impwagent program creates a temporary directory in an insecure
manner in /tmp using predictable directory names without checking
the return code of mkdir, so it's possible to seize a permission
of the temporary directory by local access as another user.
- The immknmz program creates a temporary file in an insecure manner
in /tmp using a predictable filename, so an attacker with local
access can easily create and overwrite files as another user.
|
| Alerts: |
|
Comments (none posted)
IMP - SQL injection vulnerability
| Package(s): | imp |
CVE #(s): | CAN-2003-0025
|
| Created: | January 15, 2003 |
Updated: | July 8, 2003 |
| Description: |
The IMP IMAP server, versions 2.2.8 and prior, is vulnerable to SQL
injection; see this advisory for details.
Version 3.x is not vulnerable to this problem. |
| Alerts: |
|
Comments (1 posted)
KDE - command parameter quoting problems
| Package(s): | kde |
CVE #(s): | CAN-2002-1393
|
| Created: | December 24, 2002 |
Updated: | February 21, 2003 |
| Description: |
In some instances, KDE (versions 2 and 3) fails to properly quote parameters of instructions
passed to a command shell for execution.
These parameters may incorporate data such as URLs, filenames and e-mail
addresses, and this data may be provided remotely to a victim in an e-mail,
a webpage or files on a network filesystem or other untrusted source.
By carefully crafting such data an attacker might be able to execute
arbitary commands on a vulnerable sytem using the victim's account and
privileges.
See this announcement for more details. |
| Alerts: |
|
Comments (none posted)
kdelibs: Vulnerabilities in KIO subsystem support
| Package(s): | kdelibs |
CVE #(s): | CAN-2002-1281
CAN-2002-1282
|
| Created: | November 22, 2002 |
Updated: | March 15, 2003 |
| Description: |
Vulnerabilities were discovered in the KIO subsystem support for various
network protocols. The implementation of the rlogin protocol affects all
KDE versions from 2.1 up to 3.0.4, while the flawed implementation of the
telnet protocol only affects KDE 2.x. They allow a carefully crafted URL
in an HTML page, HTML email, or other KIO-enabled application to execute
arbitrary commands as the victim with their privilege.
The KDE team provided a patch for KDE3 which has been applied in these
packages. No patch was provided for KDE2, however the KDE team recommends
disabling both the rlogin and telnet KIO protocols. This can be
accomplished by removing, as root, the following files:
/usr/share/services/telnet.protocol and
/usr/share/services/rlogin.protocol.
If either file also exists in a user's ~/.kde/share/services directory,
they should likewise be removed.
See also:
http://www.kde.org/info/security/advisory-20021111-1.txt |
| Alerts: |
|
Comments (none posted)
kernel: local denial of service vulnerability
| Package(s): | kernel |
CVE #(s): | |
| Created: | November 19, 2002 |
Updated: | February 5, 2003 |
| Description: |
All versions of the Linux kernel from (at least) 2.2.x through 2.4.19 and
2.5.47 contain a vulnerability which allows any local user to crash the
system. This LWN article describes how the
exploit works in detail. The vulnerability affects only x86 systems. |
| Alerts: |
|
Comments (none posted)
leafnode: denial of service
| Package(s): | leafnode |
CVE #(s): | |
| Created: | January 2, 2003 |
Updated: | January 15, 2003 |
| Description: |
- From leafnode advisory:
"This vulnerability can make leafnode's nntpd server, named leafnode, go
into an unterminated loop when a particular article is requested. The
connection becomes irresponsive, and the server hogs the CPU. The client
will have to terminate the connection and connect again, and may fall
prey to the same problem; ultimately, there may be so many leafnode
processes hogging the CPU that no serious work is possible any more and
the super user has to kill all running leafnode processes."
Read the full advisory at
http://marc.theaimsgroup.com/?l=bugtraq&m=104127108823436&w=2 |
| Alerts: |
|
Comments (none posted)
libmcrypt: buffer overflows and memory exhaustion
| Package(s): | libmcrypt |
CVE #(s): | CAN-2003-0031
CAN-2003-0032
|
| Created: | January 6, 2003 |
Updated: | February 27, 2003 |
| Description: |
libmcrypt versions prior to 2.5.5 contain a number of buffer overflow
vulnerabilities that stem from improper or lacking input validation. By
passing a longer than expected input to a number of functions (multiple
functions are affected) the user can successful make libmcrypt crash.
Another vulnerability is due to the way libmcrypt loads algorithms via
libtool. When the algorithms are loaded dynamically the each time the
algorithm is loaded a small (few kilobytes) of memory are leaked. In a
persistant enviroment (web server) this could lead to a memory exhaustion
attack that will exhaust all avaliable memory by launching repeated
requests at an application utilizing the mcrypt library. |
| Alerts: |
|
Comments (none posted)
libpng, libpng3: buffer overflow
| Package(s): | libpng, libpng3 |
CVE #(s): | CAN-2002-1363
|
| Created: | December 19, 2002 |
Updated: | July 14, 2004 |
| Description: |
Glenn Randers-Pehrson discovered a problem in connection with 16-bit
samples from libpng, an interface for reading and writing PNG
(Portable Network Graphics) format files. The starting offsets for
the loops are calculated incorrectly which causes a buffer overrun
beyond the beginning of the row buffer. |
| Alerts: |
|
Comments (none posted)
lynx: CRLF injection vulnerability
| Package(s): | lynx |
CVE #(s): | CAN-2002-1405
|
| Created: | November 19, 2002 |
Updated: | October 1, 2003 |
| Description: |
If lynx is given a url with some special characters on the command line, it
will include faked headers in the HTTP query. This feature can be used to
force scripts (that use Lynx for downloading files) to access the wrong
site on a web server with multiple virtual hosts.
CAN-2002-1405 |
| Alerts: |
|
Comments (none posted)
perl-MailTools: remote command execution
| Package(s): | MailTools |
CVE #(s): | CAN-2002-1271
|
| Created: | November 5, 2002 |
Updated: | September 19, 2003 |
| Description: |
The SuSE Security Team reviewed critical Perl modules, including the
Mail::Mailer package. This package contains a security hole which allows
remote attackers to execute arbitrary commands in certain circumstances.
This is due to the usage of mailx as default mailer which allows commands
to be embedded in the mail body.
Note that mail processing programs which use this package can be affected by this vulnerability; in particular, SpamAssassin is vulnerable if you use the -r or -w flags.
|
| Alerts: |
|
Comments (none posted)
micq: Denial of service
| Package(s): | micq |
CVE #(s): | |
| Created: | December 13, 2002 |
Updated: | April 24, 2003 |
| Description: |
Rüdiger Kuhlmann, upstream developer of mICQ, a text based ICQ client,
discovered a problem in mICQ. Receiving certain ICQ message types
that do not contain the required 0xFE seperator causes all versions to
crash. |
| Alerts: |
|
Comments (none posted)
PHP Remote Compromise/DOS Vulnerability
| Package(s): | mod_php4 |
CVE #(s): | |
| Created: | July 22, 2002 |
Updated: | February 18, 2003 |
| Description: |
PHP 4.2.0 and 4.2.1 have an error in the handling of POST requests which
can lead to the corruption of memory, and the usual bad consequences. According to this alert, the vulnerability can only be used for denial of service on x86 systems - there is no way to get it to run exploit code. SPARC/Solaris systems are apparently vulnerable to full remote compromise.
According to the CERT Advisory,
almost every Linux distributor, it seems, ships older (and thus not vulnerable) versions of PHP.
Note that, sometimes, systems thought to be safe from remote compromise turn out to be vulnerable to a modified attack, so x86 users should not relax too much. The solution, for those systems with PHP
4.2.0 or 4.2.1 installed,
is to upgrade to PHP 4.2.2.
For more information see the alert from
the discover of the vulnerability, Stefan Esser of e-matters GmbH,
or the security
advisory from the php team.
CERT Advisory: CA-2002-21 Vulnerability in PHP |
| Alerts: |
|
Comments (1 posted)
mod_php - buffer overflow
| Package(s): | mod_php php |
CVE #(s): | CAN-2002-1396
|
| Created: | January 13, 2003 |
Updated: | February 20, 2003 |
| Description: |
The wordwrap() function on user-supplied input may allow a
specially-crafted input to overflow the allocated buffer and overwrite the
heap. There are no known exploits, but an exploit is theoretically possible.
Read the full advisory at
http://marc.theaimsgroup.com/?l=bugtraq&m=104102689503192&w=2 |
| Alerts: |
|
Comments (none posted)
Mozilla: Privacy leak and other vulnerabilities
| Package(s): | mozilla |
CVE #(s): | CAN-2002-1126
CAN-2002-1091
|
| Created: | November 1, 2002 |
Updated: | February 13, 2003 |
| Description: |
Mozilla 1.1 and earlier, and Mozilla-based browsers such as Netscape and
Galeon, set the document referrer too quickly in certain situations when a
new page is being loaded, which allows web pages to determine the next page
that is being visited, including manually entered URLs.
Netscape 6.2.3 and earlier, and Mozilla 1.0.1, allow remote attackers to
corrupt heap memory and execute arbitrary code via a GIF image with a zero
width.
See also Mozilla's
Recently fixed security issues page.
All users are encouraged to upgrade to this latest stable 1.0.x release of
Mozilla. |
| Alerts: |
|
Comments (none posted)
MySQL: multiple vulnerabilities
| Package(s): | mysql |
CVE #(s): | |
| Created: | December 13, 2002 |
Updated: | April 10, 2003 |
| Description: |
The MySQL database server has several buffer overflow and integer bounds checking vulnerabilities which can lead to denial of service attacks, and, possibily, remote code execution. See this e-matters advisory for details. Version 3.23.54 fixes the problems. |
| Alerts: |
|
Comments (none posted)
net-snmp: denial of service vulnerability
| Package(s): | net-snmp |
CVE #(s): | CAN-2002-1170
|
| Created: | December 17, 2002 |
Updated: | November 7, 2003 |
| Description: |
The SNMP daemon included in the Net-SNMP package versions 5.0.1 through
5.0.4 can be caused to crash if it is sent a specially crafted packet. |
| Alerts: |
|
Comments (none posted)
OpenLDAP2: remote command execution
| Package(s): | OpenLDAP2 |
CVE #(s): | CAN-2002-1378
CAN-2002-1379
|
| Created: | December 6, 2002 |
Updated: | February 21, 2003 |
| Description: |
OpenLDAP is the Open Source implementation of the Lightweight Directory
Access Protocol (LDAP) and is used in network environments for distributing
certain information such as X.509 certificates or login information.
The SuSE Security Team reviewed critical parts of that package and found
several buffer overflows and other bugs remote attackers could exploit to
gain access on systems running vulnerable LDAP servers. In addition to
these bugs, various local exploitable bugs within the OpenLDAP2 libraries
(openldap2-devel package) have been fixed.
Since there is no workaround possible except shutting down the LDAP server,
an update is strongly recommended. |
| Alerts: |
|
Comments (1 posted)
PHP: vulnerability in mail function
| Package(s): | php |
CVE #(s): | CAN-2002-0985
CAN-2002-0986
|
| Created: | November 13, 2002 |
Updated: | October 1, 2003 |
| Description: |
Two vulnerabilities exists in the mail() PHP function. The first one allows
the execution of any program/script bypassing safe_mode restriction, the
second one may give an open-relay script if the mail() function is not
carefully used in PHP scripts. See this Bugtraq
report for more details. Note that this is a different vulnerability than the previous PHP mail() problem, which affected versions through 4.1.0.
CAN-2002-0985
CAN-2002-0986 |
| Alerts: |
|
Comments (none posted)
Buffer overflow vulnerabilities in PostgreSQL
| Package(s): | PostgreSQL |
CVE #(s): | |
| Created: | August 21, 2002 |
Updated: | January 27, 2003 |
| Description: |
PostgreSQL 7.2.2 has been released in response to a number of buffer
overrun vulnerabilities which have been identified recently. "...it
should be noted that these vulnerabilities are only critical on 'open' or
'shared' systems, as they require the ability to be able to connect to the
database before they can be exploited."
Buffer overflow vulnerabilities fixed include those reported by
"Sir Mordred The Traitor" in the cash_words,
repeat, and lpad
and rpad functions. |
| Alerts: |
|
Comments (none posted)
Local arbitrary code execution vulnerability in Python
| Package(s): | python |
CVE #(s): | CAN-2002-1119
|
| Created: | August 28, 2002 |
Updated: | October 1, 2003 |
| Description: |
Zack Weinberg discovered that
os._execvpe from os.py uses a predictable name which could lead
to execution of arbitrary code. According to the Debian
advisory, the problem
was present in Python versions 1.5, 2.1 and 2.2.
CAN-2002-1119 |
| Alerts: |
|
Comments (none posted)
Multiple-use vulnerability in Safe.pm
| Package(s): | Safe.pm |
CVE #(s): | CAN-2002-1323
|
| Created: | October 9, 2002 |
Updated: | February 20, 2004 |
| Description: |
usePerl has a
description of a vulnerability in the Safe.pm Perl module. It seems
that if a Safe compartment is used more than once, it ceases to be safe.
The problem is fixed in Safe 2.08. |
| Alerts: |
|
Comments (none posted)
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip |
CVE #(s): | CAN-2001-1267
CAN-2001-1268
CAN-2001-1269
CAN-2002-0399
|
| Created: | October 1, 2002 |
Updated: | April 10, 2006 |
| Description: |
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability. |
| Alerts: |
|
Comments (1 posted)
Multiple vendor telnetd vulnerability
| Package(s): | telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5 |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | October 5, 2004 |
| Description: |
This vulnerability,
originally thought to be confined to BSD-derived systems, was first covered
in the July 26th Security
Summary. It is now known that Linux telnet daemons are vulnerable as
well.
|
| Alerts: |
|
Comments (none posted)
Tomcat 4.x JSP source code exposure vulnerability
| Package(s): | tomcat |
CVE #(s): | |
| Created: | September 25, 2002 |
Updated: | January 29, 2003 |
| Description: |
Rossen Raykov reports that Tomcat 4.0.5 and 4.1.12 fix a JSP source code exposure vulnerability
in "Tomcat 4.0.4 and 4.1.10 (probably all other earlier versions also).".
The current version of Tomcat is available here.
|
| Alerts: |
|
Comments (none posted)
traceroute-nanog: buffer overflow and root exploit
| Package(s): | traceroute-nanog/nkitb |
CVE #(s): | |
| Created: | November 12, 2002 |
Updated: | February 27, 2003 |
| Description: |
Traceroute is a tool that can be used to track packets in a TCP/IP network
to determine it's route or to find out about not working routers.
Traceroute-nanog requires root privilege to open a raw socket. It does not
relinquish these privileges after doing so. This allows a malicious user to
gain root access by exploiting a buffer overflow at a later point. |
| Alerts: |
|
Comments (none posted)
typespeed: buffer overflow
| Package(s): | typespeed |
CVE #(s): | |
| Created: | January 1, 2003 |
Updated: | June 17, 2003 |
| Description: |
A problem has been discovered in the typespeed, a game that lets you
measure your typematic speed. By overflowing a buffer a local
attacker could execute arbitrary commands under the group id games. |
| Alerts: |
|
Comments (none posted)
webalizer: reverse DNS buffer overflow vulnerability
| Package(s): | webalizer |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | January 27, 2003 |
| Description: |
The cause is a buffer overflow bug.
This one sounds nasty.
If reverse DNS lookups are enabled in webalizer,
"an attacker with control over the victims DNS may spoof responses thus
triggering a buffer overflow, potentially leading to a root compromise."
Webalizer 2.01-10 "fixes this and a few
other buglets that have been discovered in the last month or so".
(First LWN report: April 18th, 2002).
|
| Alerts: |
|
Comments (none posted)
wget:directory traversal bug
| Package(s): | wget |
CVE #(s): | CAN-2002-1344
|
| Created: | December 10, 2002 |
Updated: | October 1, 2003 |
| Description: |
Versions of wget prior to 1.8.2-4 contain a bug that permits a malicious
FTP server to create or overwrite files anywhere on the local file system.
FTP clients must check to see if an FTP server's response to the NLST
command includes any directory information along with the list of filenames
required by the FTP protocol (RFC 959, section 4.1.3).
If the FTP client fails to do so, a malicious FTP server can send filenames
beginning with '/' or containing '/../' which can be used to direct a
vulnerable FTP client to write files (such as .forward, .rhosts, .shosts,
etc.) that can then be used for later attacks against the client machine.
See also
this Bugtraq article from 1997.
CAN-2002-1344 |
| Alerts: |
|
Comments (none posted)
wmaker: buffer overflow in Window Maker image handling code
| Package(s): | wmaker windowmaker |
CVE #(s): | CAN-2002-1277
|
| Created: | November 7, 2002 |
Updated: | February 6, 2003 |
| Description: |
Al Viro found a problem in the image handling code used in Window Maker,
a popular NEXTSTEP like window manager. When creating an image it would
allocate a buffer by multiplying the image width and height, but did not
check for an overflow. This makes it possible to overflow the buffer.
This could be exploited by using specially crafted image files (for
example when previewing themes). |
| Alerts: |
|
Comments (none posted)
Multiple vulnerabilities in wordtrans
| Package(s): | wordtrans |
CVE #(s): | CAN-2002-0837
|
| Created: | September 11, 2002 |
Updated: | February 4, 2003 |
| Description: |
The "wordtrans" interface to multilingual dictionaries suffers from input validation and cross-site scripting vulnerabilities; versions through 1.1pre8 are vulnerable. See this Guardent advisory for details. |
| Alerts: |
|
Comments (none posted)
Problems with libgtop_daemon
| Package(s): | wuftpd libgtop |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | May 7, 2003 |
| Description: |
The libgtop_daemon package is a GNOME
program which makes system information available remotely.
LWN reported the remotely exploitable format
string and buffer overflow vulnerabilities in that package
on December 6th.
On November 28th
disabling the libgtop_daemon on systems where it is running until
an update is available.
Many Linux systems do not run
libgtop by default, but applying the update is a good idea anyway.
|
| Alerts: |
|
Comments (1 posted)
Wwwoffle remote privilege escalation vulnerability
| Package(s): | wwwoffle |
CVE #(s): | CAN-2002-0818
|
| Created: | August 14, 2002 |
Updated: | October 1, 2003 |
| Description: |
The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests
with negative Content Length values.
"It is believed
that an attacker could exploit this bug to gain remote wwwrun access
to the system wwwoffled is running on."
CAN-2002-0818 |
| Alerts: |
|
Comments (none posted)
xpdf: integer overflow
| Package(s): | xpdf |
CVE #(s): | CAN-2002-1384
|
| Created: | January 2, 2003 |
Updated: | February 6, 2003 |
| Description: |
- From iDEFENSE advisory:
The pdftops filter in the Xpdf and CUPS packages contains an integer
overflow that can be exploited to gain the privileges of the target user
or in some cases the increased privileges of the 'lp' user if installed
setuid. There are multiple ways of exploiting this vulnerability.
Read the full advisory at
http://www.idefense.com/advisory/12.23.02.txt |
| Alerts: |
|
Comments (none posted)
Events
Computer Security Mexico will be held in Mexico City on March 6
and 7, 2003. Papers are being accepted through February 7.
Full Story (comments: none)
The Sixth International
Symposium on the Recent Advances in Intrusion
Detection is scheduled for September 8 to 10 in Pittsburgh,
Pennsylvania. The call for papers is out now, with a deadline of
March 31.
Full Story (comments: none)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current development kernel is 2.5.59, which was
released by Linus on January 16.
It includes a number of architecture-specific updates, an
XFS update, support for the SHA-386 and SHA-512 algorithms in the crypto
API, a new NUMA scheduler (see below), and some sysfs work.
The
long-format changelog has the details.
This will be the last release from Linus for a bit, since he will be
traveling through the end of the month. There are currently no additional
patches merged into his BitKeeper tree.
The current stable kernel is 2.4.20; Marcelo has not released any
2.4.21 prepatches since January 6.
Comments (none posted)
Kernel development news
The O(1) scheduler was integrated relatively early in the 2.5 development
cycle with great results. So it could be a bit surprising to see a new set
of scheduler changes going in at this late, feature-frozen date. The
inclusion of a new NUMA scheduler in 2.5.59, however, is a relatively safe
move which will help Linux perform well on high-end systems.
NUMA (non-uniform memory access) systems, of course, are distinguished by
an architecture which makes some memory "closer" to certain processors than
others. Each "node" in a NUMA system contains one or more processors,
along with an array of local memory. Processors can access memory belonging
to other nodes, but that access will be relatively slow. To get top (or
even reasonable) performance on NUMA systems, the kernel must keep each
process - and its memory - within a single node whenever possible.
The memory allocation side has been in place for some time; the Linux
kernel memory allocator sets up one or more zones for each node, and
allocates new pages from the current node's zones whenever possible. But
the scheduler, as found in 2.5.58, will happily move processes between
nodes in its efforts to keep all processors busy. There has been a NUMA
scheduler patch floating around for a while, but it has not been merged,
perhaps because it made too many changes to the scheduler for non-NUMA
systems.
More recently, the NUMA scheduler patch has been reworked (by Martin Bligh,
Erich Focht, Michael Hohnbaum, and others) around a simple observation:
most of the NUMA problems can be solved by simply restricting the current
scheduler's balancing code to processors within a single node. If the
rebalancer - which moves processes across CPUs in order to keep them all
busy - only balances inside a node, the worst processor imbalances will be
addressed without moving processes into a foreign-node slow zone.
A simple (three-line) patch which did nothing but add the within-node
restriction yielded most of the benefits of the full NUMA scheduler;
indeed, it performed better on some benchmarks. Real-world loads, however,
will require a scheduler which can distribute processes evenly across
nodes. Occasionally it is necessary, even, to move processes to a slower
node; a lot of CPU time on a lightly-loaded node will give better
performance than waiting in the run queue on a heavily-loaded node. So a
bit of complexity had to be added back into the new scheduler to complete
the job.
The 2.5.59 scheduler distributes processes across NUMA nodes in two
places. The first is in the exec() system call. A process which
calls exec() is very simple to move, since almost all of its
context, including memory, is being thrown away. For many loads, proper
balancing at exec() time is enough to get good performance.
Some loads, however, will tend to pile up processes within a single node.
Any process which forks many times, for example, will find itself competing
with all of its children for the same node's resources (unless, of course,
those children call exec() and are moved to a new node). To
address this problem, the new NUMA scheduler will occasionally look for a
large load imbalance between nodes, and, if one is found, move processes to
balance things out. This rebalancing happens once for every ten or hundred
intra-node rebalancings, depending on the architecture.
The scheduler has seen continued tweaking since 2.5.59 came out. The most
significant change, perhaps, is to move the explicit load balancing out of
the main scheduler code (where it could get called many times per second on
an idle processor) and to restrict it to the scheduler's "timer tick"
routine. That change allows more exact control over when the rebalancings
happen. A recent patch from Ingo Molnar performs fairly frequent
rebalancings (intra-node every 1ms, and globally every 2ms) when the
current processor is idle; if the processor is busy the rebalancings only
happen every 200 (local) and 400ms (global).
Linus raised an interesting point when he
merged the NUMA scheduler: can this scheduler handle hyperthreading as
well? Hyperthreaded processors implement two (or more) virtual CPUs on the
same physical processor; one processor can be running while the other waits
for memory access. Hyperthreading can certainly be seen as a sort of NUMA
system, since the sibling processors share a cache and thus have faster
access to memory that either one has accessed recently. So the same
algorithm should really work in this case.
Treating hyperthreaded systems as NUMA systems has a a certain conceptual
elegance, but it may not be the way the Linux kernel goes in the end. The
most recent hyperthreading patch from Ingo
Molnar takes a different approach: rather than mess with "rebalancing"
processes across the same physical processor, why not just use the same run
queue for both? Sibling processes on a hyperthreaded core are truly
equivalent; it does not matter which process runs on which virtual
processor as long as they are all busy. So NUMA and hyperthreading may
stay as distinct cases for now.
Comments (4 posted)
One of the things that has been on the 2.5 "to do" list since before there
was a 2.5 is expanding the
dev_t type to 32 bits.
dev_t, of course, is currently a 16-bit value holding the
eight-bit major and minor device numbers. The small size of the device
number fields has been a constraining factor for people building systems
with thousands of devices for some time; it had been pretty well assumed
that it would be expanded in this development cycle.
Almost three months into the feature freeze, the dev_t expansion
is nowhere in sight. It remains necessary, however; consider this statement from Alan Cox:
32bit dev_t IMHO is essential to 2.6. Essential enough that if its
not in the base 2.6 all the vendors have to get together and issue
a Linus incompatible but common 32bit dev_t interface.
32-bit dev_t as an added vendor patch would make for a big
difference between the Linus kernel tree and that which is shipped by the
distributors. But large distributor patches to the kernel are not that
uncommon. The real issue here is that no 32-bit dev_t patch has
been posted - whether for integration or not.
Expanding dev_t is not a trivial task. The interface with user
space must be handled carefully to avoid breaking older applications. The
kernel currently tracks devices through the static blkdevs and
chrdevs arrays, which are indexed by the major device number.
This approach works when there are only 256 possible device numbers, but
falls apart when you can have thousands of them. And, despite a
continued effort to stamp them out, there are, beyond doubt, many places in
the kernel which assume implicitly that device numbers are eight bits
wide.
So the dev_t expansion will be somewhat invasive and
destabilizing - though certainly achievable. It really should happen
sooner rather than later. If it is
true that a larger dev_t will be a part of the 2.6 kernel actually
seen by customers, then this work is one of the factors which is delaying
the 2.6 release.
Comments (2 posted)
Patches and updates
Kernel trees
Build system
Core kernel code
Development tools
Device drivers
Documentation
Memory management
Architecture-specific
Security-related
Miscellaneous
- Cliff White: Re-aim-7.
(January 22, 2003)
Page editor: Jonathan Corbet
Distributions
News and Editorials
The Free Standards Group
announced "
that every major Linux distribution vendor has now
applied for and passed Linux Standards Base Certification." We
would amend that statement to read "every major RPM-based distribution
vendor". Notably missing from the list of LSB-certified distributions are
Slackware and Debian.
For now at least, RPM is the standard, and that's unlikely to change any
time soon. Chapter 16 (Software Installation) of the LSB 1.3 begins,
"Applications should be provided in the RPM packaging format as
defined in this specification."
It's a reasonable standard given its wide use. Other distributions may
have a "better way", but they are not as widely implemented as RPM.
Debian is LSB compliant in most respects. Though packaging is done with
dpkg rather than RPM, support for the RPM format is supplied. Debian also
includes a "lsb" package that sets up most of what is needed for LSB
compliance. What Debian lacks, in particular, is a company that can deal
with the paperwork, pay the required fees. Debian is a group of
volunteers with no legal existence to sign all the paperwork. These are
the issues that will prevent Debian from gaining LSB certification in the
near future, even when it has achieved LSB compliance.
Comments (8 posted)
Distribution News
The
Debian Weekly News for January 21, 2003
is out. This week covers the EFF award nomimations; a Debian swirl seen
from space; and much more.
The Debian Project will be represented at
events in Australia, USA and Germany.
Raphael Hertzog provides an update on the
Package Tracking System and the DebianEdu subproject.
Comments (none posted)
The Gentoo Weekly Newsletter for January 20, 2003 is out. This week, a
sneak peek at the next release of Gentoo Linux (1.4_rc3) and a Gentoo PPC
developer presentation at MIT.
Full Story (comments: none)
TechWeb
looks
at an educational package from Lindows. "
Software maker
Lindows.com Inc. is selling its desktop version of open-source Linux at a
special rate to schools. The San Diego company will sell the Lindows
operating system for an unlimited number of computers for $500 a year. The
OS will come with educational software, Web-browsing, e-mail, and other
basic programs."
Comments (none posted)
The
Mandrake Linux Community Newsletter for
January 16 is out. It looks at the Mandrake Linux 9.1 beta, RPM
Voting, and several other topics - but there is no mention of the
bankruptcy filing.
A number of bugs have been fixed in new sane and
sane-related packages. A number of new models of scanners are now
supported, and a serious bug was fixed with the Epson Perfection 1260
support, which in older versions of sane could potentially physically
damage the scanner. A new library is also provided (libieee1284) which
provides additional support for parallel port scanners.
Comments (none posted)
Slackware Linux has seen a number of
changes in slackware-current. Extras such as docbook have been added,
along with new non-English word lists for Aspell. There were several
security fixes this week as well. You can find more about the security
fixes in this week's security section. Visit the
change log
for complete details.
Comments (2 posted)
SuSE Linux annnounced the availability of the SuSE Linux Office Desktop,
which combines SuSE Linux 8.1 with Codeweavers CrossOver Office 1.3.1 to
provide users a system for the office desktop.
Full Story (comments: none)
Minor distribution updates
2-Disk
Xwindow embedded Linux has released
1disk1.0 final with major
bugfixes. "
Changes: This release actually works now, and includes
various new features and bugfixes."
Comments (none posted)
Astaro Security Linux
has released
v3.215
with major security fixes, quickly followed by 3.216 with additional
bugfixes. "
Changes: This Up2Date fixes security issues in the DHCP
server, DHCP client, and HTTP Proxy. Some small improvements and changes
are included too."
Comments (none posted)
The
Aurora SPARC Linux Project
announced Build 1.0 (Ansel). This is the first "STABLE" build of Aurora.
Full Story (comments: none)
The GNU-Darwin project is in stable production status, and some key web
pages have been updated..
Full Story (comments: none)
KNOPPIX has released
v3.1-2003-01-20 with major
bugfixes. "
Changes: This version includes lots of updates and
bugfixes, including fixes for the checkroot.sh script (it now adds the
correct / entry after a HD install), better support in isdn-config for
non-hisax ISDN cards, and more KDE menu reordering."
Comments (none posted)
Lycoris and Transgaming Technologies unveiled the GamePak gaming suite for
Desktop/LX. The GamePak gaming suite includes 5 games, plus access to
WineX, TransGaming's cross platform gaming software that gives users the
ability to play over 150 Windows games on Desktop/LX.
Full Story (comments: none)
NSA Security Enhanced Linux has
released
v2003011510
with major feature enhancements. "
Changes: The base 2.5 kernel
version has been updated to 2.5.58. The base 2.4 kernel version remains at
2.4.20, but the LSM patch and the SELinux module for 2.4 have changed since
the last release. New contributed policy analysis and policy management
tools have been added to the provided tools and utilities. Hooks for xattr
operations were added to 2.4. Inode security initialization has been
reworked using the d_instantiate hook. The nfsd private file bug in 2.4 has
been fixed and the task_kill bug in 2.5 has been fixed."
Comments (none posted)
Version 1.2 of the OpenPKG "cross-platform software packaging facility" has
been announced. This release contains 361 packages wrapped up in a "roll
your own distribution" packaging and build system.
Full Story (comments: none)
RxLinux has released
v1.2.7 with minor feature
enhancements. "
Changes: The kernel was updated to 2.4.20. A PPTP
connection dropping problem was fixed. The lvs patch was updated to
1.0.7. Support for PCMCIA network devices was added. Support for serial
console was added. The missing libpam library was added. PPP dial-on-demand
is now working."
Comments (none posted)
AMD has
announced
that Scyld Computing Corporation is developing a 64-bit version of
Scyld Beowulf, a clustering OS operating
system, for systems based on the upcoming AMD Opteron processors.
Comments (none posted)
ttylinux has released
v2.7 with minor feature
enhancements. "
Changes: This release updates dhcpcd, modutils,
util-linux, and tinylogin to their latest versions and adds
ipmasqadm."
Comments (none posted)
xbox-linux has released
v11-01-2003 with major
feature enhancements. "
Changes: Ed's ISO 0.0.10 is available with
support for v1.1 XBoxes. Note that the included bootloader is erroneous, so
you have to download the postinstall images separately. Presentations and
documents have been added."
Comments (none posted)
Zool Linux has released
v3 which adds networking
support.
Comments (none posted)
Distribution reviews
The second beta release of Mandrake Linux 9.1 is
reviewed on
DistroWatch. "
So, is this beta 2 a significant improvement in
relation to beta 1? My answer is yes, without any doubt. This beta 2 is
still not for Linux beginners, it still has a few annoying bugs (but no
show-stoppers) and quirks, and some essential packages are still missing
(where is my kernel source?). But if MandrakeSoft can keep up with this
rate of development, by beta 3 or 4 they could start concentrating on the
eye-candy and their final 9.1 release would then be terrific."
Comments (none posted)
Page editor: Rebecca Sobol
Development
One of the more popular audio file editors that is available for Linux and
other Unix compatible platforms is
Sweep.
Sweep will work with a number of different audio file formats including
WAV, AIFF, Ogg Vorbis, Speex, MP3 and others. Sweep supports the
LADSPA plugin API, which allows a wide
range of audio processors to be plugged in. Sweep works with both the
OSS and ALSA sound drivers. Unlike many sound file editors, Sweep
has a number of real-time audio effect capabilities, making it useful
for live music DJ applications. Sweep also works well for
more typical audio editor uses, such as the creation of CD
audio tracks.
Some of the major features of Sweep include:
- Unlimited undo/redo.
- Multithreaded background rendering and file import/export.
- Interactive Scrubbing.
- Support for multichannel files.
- Customizable keybindings.
- Support for French, Hungarian, Italian, German, Russian, and Polish languages.
- Support for the Speex speech codec.
Sweep editing, recording, and playback capabilities include:
- Cut, copy and paste insert.
- Support for discontinuous selections.
- Invert, double/halve, and shift left/right.
- Many wave visualization options.
- Numerous playback modes including reverse and looping.
- Tape loop recording.
Sweep features a "virtual stylus", known as Scrubby.
Scrubby is useful for quickly locating sounds in audio tracks.
By moving the mouse over a section of the displayed audio waveform,
Scrubby plays the underlying audio track. The effect is similar to
that achieved by manually moving a reel tape over a tape head.
Scrubby can also be used to modify live audio inputs.
Other features of Sweep include the ability to mix and speed-modify
an unlimited number of samples and loops, and "piano style QWERTY playback", which allows the computer keyboard to be used to generate
musical notes in real-time.
Version 0.8.0 of Sweep
has been released.
"This is the first milestone release for Sweep 1. Please test it
thoroughly for both general sample editing and live performance."
One interesting new features in version 0.8.0 is the inclusion of a new
monitoring system that allows people with two sound cards to listen to
a monitor track on one sound card while playing a main output on the other
sound card. This opens up a wide range of capabilities that are typically
performed by an audio mixing console. The release also features bug fixes
and an improvement to the Italian language support.
Sweep 0.8.0 may be downloaded
here.
Sweep has been released with a GPL license.
Comments (1 posted)
System Applications
Audio Projects
This week has been busy for
JACK Audio Connection Kit
software releases.
The following new applications have come out:
JACK Rack 1.1.2,
JACK TimeMachine 0.0.1,
k_jack v0.0.0.5 and Mammut v0.15, and
JACK TimeMachine 0.0.2.
Comments (1 posted)
The January 19, 2003 edition of
Ogg Traffic
is out with the latest Ogg Vorbis audio compression software
development news. Some of the topics covered include:
Playing Ogg Vorbis with Windows Media Player,
Replacing Real Audio with Low Bitrate Ogg Vorbis,
User confirms Ogg Vorbis Support in DVD Player,
and Speex RC1.
Comments (none posted)
Database Software
MySQL Version 4.1
was announced at the LinuxWorld conference.
"
MySQL AB, developer of the world's most popular open source database, today announced a new version of the MySQL database that includes "subselects" and other enhancements designed to facilitate large-scale enterprise application development with MySQL."
Comments (none posted)
Version 0.5.6 of Knoda, a KDE frontend for Mysql, Postgresql and ODBC,
has been released. New features include support for color forms
and reports, syntax-highlighting in the queries-window,
new command line tools for hk_classes, report can be opened
depending on form values, tables and queries can be printed,
and lots of bug fixes.
Full Story (comments: none)
Electronics
Snapshot 20030116 of the
Icarus Verilog electronic simulation language compiler has been
released.
Changes include: support for scaled system time, new PLI1.0 functionality,
bug fixes, support for gcc 3.X, and more. See the
release notes for more information.
Comments (none posted)
Printing
The latest news on
LinuxPrinting.org includes
a new driver for the Epson EPL-5700L, EPL-5800L, and EPL-5900L printers,
unidirectional printing support for the Lexmark Z12, support for the
HP OfficeJet 520, 570, 580, 590, 610, 630, 700, 720, 725. 6110 printers,
and text/URL/driver updates for the HP OfficeJet 500, 600, 625, 635,
710, D155 printers.
Comments (none posted)
Version 3.8.20 of the
LPRng printing system is
available. Change information is in the source code.
Comments (none posted)
Telecom
Veronika Megler
introduces the Parlay API on IBM's developerWorks.
"
For too long, application development for the telecommunications industry has been an arcane art, relying on proprietary protocols and interfaces. In this two-part series, Veronika Megler introduces the Parlay architecture, an open set of APIs that could change all that. You'll learn how you can use the Parlay architecture to build telecommunications applications that will run on any telecom carrier's network with minimal human intervention. You'll also get an introduction to the tools and products you need to start writing the code that changes the way we'll use our telephones."
Comments (none posted)
Web Site Development
A beta version of
Quixote 0.6 is avilable. Quixote is a Python-based web application
framework. Change information is in the source code.
Comments (none posted)
According to Use Perl, an online version of
"Embedding Perl in HTML with Mason"
is available.
Comments (none posted)
The most recent headlines on the
Zope Members News
include:
Plone 1.0 Release Candidate 2 available, MySQL User Folder 0.9.0 released,
ZWeatherApplet 1.51 (bugfix release), Silva Sample Content Types 0.1 released!,
CMFCollector 0.20 beta 1 released, ASP404 1.0-beta2 Zope+IIS Connector,
Nuxeo Collaborative Portal Server 2.2 beta1 released, and more.
Comments (none posted)
This week's
Zope Newbies
includes articles on
Python's Design Goals, and Python success stories.
Comments (none posted)
Web Services
André Tost
demonstrates the use of web services on IBM's developerWorks.
"
In this article André Tost shows how a purchase order business process can be implemented across many different Web services environments. An example application defines different roles that play a part in the process of a purchase order, where each role can be played by a different vendor's implementation. André will describe what the application does, and how the individual parts of the application work together."
Comments (none posted)
Desktop Applications
Audio Applications
Due to the wide variety of open-source audio editing packages that
are now available, development of Ecawave has been stopped.
Meanwhile, ecawave 0.6.0, has been released as the official
last version.
Full Story (comments: none)
Version 0.4.0 of ecamegapedal, a real-time virtual guitar effects
box, has been released. Changes include:
"
Sliders for parameter control and text inputs for
lower and upper bounds have been added as well as
support for LADSPA-1.1 and ecasound effect parameter
hints. There has been some user interface improvements
and a native JACK support has been added. Updated to
use the new ecasound-2.2 libraries."
Full Story (comments: none)
Desktop Environments
Here is the latest GNOME Summary. This week looks at the GNOME 2.2 Desktop
Release Candidate 1 and much more.
Full Story (comments: 1)
Headlines on the GNOME desktop
FootNotes site include:
High quality fonts donated to Free Software, Gnome Desktop SubDistro,
MrProject 0.8 released, DiaSCE v1.3 released, GNU/Linux Media Player
Round-up, Firestarter 0.9.1 released, Gtk# 0.7 released!, Mono 0.19
released, GTK2 Sodipodi soon to be released, New GNOME themes module,
Screenshot of Lumiere working, and more.
Comments (none posted)
The January 17, 2003 edition of the
KDE-CVS-Digest
is out.
The digest summary says: "
VFolder support in KDE, more Apple updates
in Konqueror, and security fixes. Also in this issue: commits to
Kaplan are flowing in, the KMail merges from the different branches
are finally coming together and much more."
Comments (none posted)
Interoperability
Release 20030115 of wine
has been announced. The list of changes include:
Much better header files compatibility in Winelib,
A ton of Direct3D work, Many improvements in sound support,
New wineboot tool to simulate a Windows reboot, and
Lots of bug fixes.
Comments (none posted)
Issue #153 of
Kernel Cousin Wine is out. Topics include:
News: Wine-20030115; TransGaming Update; CodeWeavers Partnership,
IWebBrowser Status / More Ideas, No C++ in Wine, Wineboot Progress,
D3D Status Page, Accessing X11 Calls, and NTFS Filesystem Type.
Comments (none posted)
A new version of ntfsprogs (formerly linux-ntfs) has been released.
ntfsprogs allows linux to work with ntfs volumes.
"
The new release includes (for the first time) ntfsresize, ntfsundelete,
ntfsinfo and also mkntfs and ntfslabel."
Full Story (comments: none)
Office Applications
Version 1.0.2 of OpenOffice is available.
"
It is a "micro" release and
does not include new features. Rather it incorporates many bug fixes.
Reports indicate that it is faster and more robust."
Full Story (comments: none)
OpenOffice.org has announced the creation of a new
Japanese Language project for the OpenOffice office suite,
led by Nakata Maho.
Full Story (comments: none)
Version 1.7.8 of GnuCash is out. New features include
Scheduled Transactions, a Mortgage & Loan Repayment Druid,
Small Business Accounting Features, OFX Import,
HBCI Support, Multi-Currency Transaction Handling,
new documentation, and improved menus.
Full Story (comments: none)
Web Browsers
The latest
mozillaZine topics
include: New Favorites Plug-in for K-Meleon, Chimera Not Dead Either,
Trunk Freezes for 1.3 Beta Tonight, Reports of Phoenix's Death Greatly
Exaggerated, Improved about:config Page, Rolling Out Mozilla Across an
Organization, Automatic Image Resizing Checked In, and
European Mozilla Developers Meeting 2003.
Comments (none posted)
Version 2.8.5dev.13 of Lynx, a text-based web browser,
is available for download.
Tons of bug fixes and performance improvements have been added, see
the documentation that comes with the source code for details.
Comments (none posted)
Languages and Tools
Caml
The Caml Weekly News for January 14 - 21, 2003 is out.
Topics include Introduzione alla programmazione funzionale,
ChartPak - a data visualization library for the web, and
Coyote Gulch test in Caml.
Full Story (comments: none)
This week, the new software on
The Caml Light / OCaml Hump includes
the HOL Light theorem prover, ChartPak for dynamically generating
business graphics on the web, and
Introduzione alla programmazione funzionale,
an introduction to functional programming.
Comments (none posted)
Java
Peter C. Bahrs and Barry A. Feigenbaum introduce the Java
Thin Client Framework on IBM's developerWorks, the series is
available as
Part 1 and
Part 2.
"
Thin Client Framework (TCF) is a lightweight, flexible, and powerful programming framework for Java client applications. In this two-part series, you will learn about TCF from two of its originators. Follow along as Drs. Barry Feigenbaum and Peter Bahrs use detailed discussion, a working example, and live code samples to introduce you to the TCF architecture, design, and implementation."
Comments (none posted)
Budi Kurniawan
shows how to work with JMeter on O'Reilly.
"
JMeter is a Java-based tool for load testing client-server applications. Stefano Mazzocchi originally wrote it to test the performance of Apache JServ (the predecessor of Jakarta Tomcat). It has since become a subproject of Jakarta."
Comments (none posted)
Otis Gospodnetic
explains Lucerne on O'Reilly.
"
Lucene is a Java library that adds text indexing and searching capabilities to an application. It is not a complete application that one can just download, install, and run. It offers a simple, yet powerful core API. To start using it, one needs to know only a few Lucene classes and methods."
Comments (none posted)
O'Reilly has published
an excerpt on Java Swing menus from "Java Swing, 2nd Edition".
"
This chapter discusses Swing menus and toolbars. Menus are the richer and more flexible of the two, so they encompass most of the chapter. They tend to be the first thing users explore in learning a new application, so it's fitting that Swing provides a great deal of freedom in laying out menu components."
Comments (none posted)
Lisp
Version 0.13.3 of OpenMCL, an open-source Common Lisp implementation,
is available.
"
This version provides options for
controlling the generation and retention of additional debugging and
documentation information, exports symbols related to Grays Streams from a
new package, improves ANSI compliance and fixes several bugs."
Full Story (comments: none)
Beta versions of three Lisp applications have been released.
Araneida 0.69, CLiki 0.3.9 and db-sockets 0.58.
Full Story (comments: none)
Perl
Volume 0, Issue 7 of
The Perl Review is out.
Articles include:
Jotto: The Five-Letter Word Game, Processing RSS Files with XSLT,
Separating code, presentation, and configuration, and
Paying Homage to Perl (PHP).
Comments (none posted)
Artur Bergman
explores new features in Perl 5.8.0 on O'Reilly.
"
It's been nearly six months since the release of Perl 5.8.0, but many people still haven't upgraded to it. We'll take a look at some of the new features it provides and describe why you should investigate them yourself."
Comments (none posted)
The January 13-19, 2003 edition of
This Week on perl5-porters is out.
"
Another week, and its load of patches. A major evolution of the
UTF8 implementation, some experimental surgery on the debugger,
weak hashes, strong pack templates, Win32 modules and quite a number
of new ideas are summarized in this week's summary."
Comments (none posted)
The January 12, 2003 edition of
This week on Perl 6 is out. Topics include:
More Thoughts on DOD, The Perl 6 Parser, LXR - Source code indexing,
Thoughts on Infant Mortality, Objects, Finally (try 1),
The Benchmarking Problem, Meanwhile, in perl6-language, Array Questions,
L2R/R2L Syntax, "Disappearing" code, Who's Who in Perl 6:Steve Fink, and more.
Comments (none posted)
PHP
Topics on this week's
PHP Weekly Summary
include: Dual PHP installations, GD 2.0.11 compatibility,
Using PHP with Make, Spring International PHP Conference,
SNMP additions, and PEAR is release quality.
Comments (none posted)
Python
The Python-dev Summary for January 1 to 15 is out; it looks at the
Minimal Python project, extensions to divmod(), cross compiling, and
several other topics.
Full Story (comments: none)
The Dr. Dobb's Python-URL for January 20, 2003 is out, with news and links,
for the Python community.
Full Story (comments: none)
This week's
Daily Python-URL
article topics include:
Jason Orendorff on path 1.0, A conversation with Guido van Rossum,
part II: Python's design goals, Andrew Dalke on EUtils,
Mark Paschal on PyFunk, Python success stories, Py 1.3, the
Minimal Python project, Prototype Python package registry based on PEP 301,
and more.
Comments (none posted)
Ruby
Topics on this week's
Ruby Weekly News
include: sorting with the Swartzian transform,
Yet Another Test First Example ... in Ruby, ruby-dev summary 19198-19345,
Unit Testing in dynamic environments, Automating Perl -> Ruby translation?,
Using the Ruby DBI Module, and ruby-dev summary 19346-19379.
New Ruby software includes:
ruby-sumo-2003.01.08 and MacOSX package, FoxTails 0.1 for FXRuby,
saprfc - Ruby extension for RFC calls to an SAP R/3 System,
Ruby SunOS Packages, FXRuby API Documentation - Preview,
dbi-dbrc 0.2.0, SOAP4R/1.4.8 with WSDL4R/0.0.2, Ruby/Google 0.5.0, and
YAML.rb 0.49.2 -- YPath.
Comments (none posted)
Tcl/Tk
Dr. Dobb's Tcl-URL for January 22 is available with the latest from the
Tcl/Tk development community.
Full Story (comments: none)
XML
Kendall Grant Clark
comments on some unusual practices being used with RDF.
"
The issue I want to raise here is the increasingly widespread practice of embedding information -- mainly using, but not limited to, RDF -- intended for machine consumption in a format, HTML comments, which is intended for human consumption.
When I realized people were embedding RDF in HTML comments, claiming that the resulting document is part of the Semantic Web, I was confused."
Comments (none posted)
Miscellaneous
Version 1.3 of ProjectMaster, a plugin for the Jext programmer's editor,
has been released.
"
ProjectMaster, the successor of CodeMaster, is a fully featured project manager for Java. You can either use it as separate frame or dock it in Jext interface. This plugin allows to compile projects very easily. It also supports ANT compiling tool."
Comments (none posted)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
ZDNet is running
a column by Whitfield Diffie on open source and security.
"
As for the notion that open source's usefulness to opponents outweighs the advantages to users, that argument flies in the face of one of the most important principles in security: A secret that cannot be readily changed should be regarded as a vulnerability."
Comments (none posted)
Here's
a Gartner Group pronouncement on MandrakeSoft's bankruptcy filing.
"
However, MandrakeSoft customers should not worry as the high portability of Linux distributions should make it easy to transition to a new supplier. Nevertheless, MandrakeSoft's woes underline the challenge of selecting Linux distributors in a consolidating market. To reduce their risk, enterprises should use distributions and features that align with the Linux Standards Base, one industry effort at coalescing around standard application programming interfaces." Gartner is figuring out that the relative vendor independence provided by Linux is a good thing.
Comments (2 posted)
Trade Shows and Conferences
Here are a few of the LinuxWorld inspired articles we have seen today.
- It's a
LinuxWorld, after all (News.com) "Linux advocates will
convene at a trade show in New York this week to promote their wares,
tout customers, swap business cards and make their case that the
operating system is growing up."
- Open-Source
Crowd Hits New York For LinuxWorld (TechWeb) "When lovers of
Linux take to the Javits Center next week in New York for LinuxWorld,
scores of companies will be touting their newest hardware and software
products, pitching them to crowds dissatisfied with Windows and
enamored of open-source ideals."
- MS
bids to intercept Unix defectors at LinuxWorld (The Register)
"Redmond, Washington-based Microsoft will deploy 15 staff at the
New York-based event in an attempt to spread the Windows mantra. The
company will demonstrate four products and its gotdotnet.com online
service for developers."
Comments (2 posted)
News.com
reports on the troubles with the Desktop Linux Summit.
"
An HP representative confirmed Friday that the company had withdrawn from the conference. Sun Microsystems, another big-name exhibitor, appeared on an earlier exhibitor list, but its name isn't on the current lineup. A Sun representative couldn't immediately confirm that it had withdrawn."
Comments (none posted)
Companies
News.com is carrying
a Forrester Research pronouncement on IBM's open source strategy.
"
IBM has earned the trust of the open source community. As vendors like HP and Sun step up their involvement, the risk that hypercompetitive IBMers will overstep the community boundaries increases. IBM can't let that happen. It must maintain the trust by keeping its agenda in its proper, democratic place."
Comments (none posted)
Open for Business
has this
take on MandrakeSoft's bankruptcy announcement. "
Other great
GNU/Linux companies have come and gone, and each time the Linux desktop
"dies." Somehow, mysteriously enough -- and if anyone can explain this to
me, please do -- this dead desktop seems to be able to keep dying and dying
and dying. It's almost like the Energizer Bunny, or if it isn't, the
critics most certainly are."
Comments (none posted)
Linux Adoption
TechWeb says 2003 will be the year that
Linux becomes
a mainstream operating system used for mission-critical business
processes, thanks to strong vendor support and the growing availability of
apps ported to Linux. "
Linux already is mainstream at Cendant
Corp. The real-estate, travel-services, and hospitality holding company has
7,000 hotels, and there's nothing more mission critical than efficiently
managing check-ins, departures, payments, and reservations. About 60% of
the hotels use a property-management system from Hotel Software Systems
Ltd. that runs on a Linux distribution from SCO Group, even though Cendant
offers Windows-based property-management software."
Comments (none posted)
The Finanical Times has
a
lengthy article on the business of Linux. "
While HP leads in the
Linux business, claiming the free software drove sales of computer systems
worth $2bn last year, IBM is probably the best-placed to benefit from this
trend - hence its enthusiastic embrace of Linux. With the world's biggest
IT services arm and a software business based on middleware - programs that
sit between an operating system and the different software applications -
Big Blue has ample incentive to reshape the corporate computing business in
its own image." (Thanks to Richard Jones).
Comments (none posted)
InfoWorld
covers
U.S. opposition to a declaration for open source. "
A three-day
meeting that brought together Asian governments, organizations, companies
and non-governmental organizations (NGOs) ended Wednesday morning with the
approval of a declaration that, among other things, calls for encouraging
the development of open-source software. A draft of the declaration had
called for open source to be "supported" but was changed after objections
from the U.S. government delegation late Tuesday night."
Thanks
to Magnus Lycka
Comments (9 posted)
Legal
Linux Journal
looks at two
DMCA reform bills to be considered by the US Congress. "
Again this
Congress, we'll have two similar DMCA reform bills. Why two? Representative
Zoe Lofgren (D-CA) is planning to reintroduce the Digital Choice and
Freedom Act of 2002, a bill that would reform the controversial
anticircumvention provisions of the Digital Millennium Copyright Act
(DMCA). The bill would allow users to bypass copy restriction systems for
fair use purposes, much like the Digital Media Consumers' Rights Act,
cosponsored by Rep. Rick Boucher (D-VA), John Doolittle (R-CA), Spencer
Bachus (R-AL) and Patrick Kennedy (D-RI), proposes."
Comments (none posted)
The word is out; Norwegian prosecutors will appeal the recent acquittal of
Jon Johansen on DVD piracy charges. Covered in articles from
CNN,
Wired,
and
The
Register.
Comments (1 posted)
News.com has
some more information on SCO's possible intellectual property moves against other vendors.
"
One particular area of concern is with companies that signed agreements to see proprietary SCO source code and whose programmers now are working on different projects that could use that proprietary code..."
Access to proprietary code will always present a trap for free software developers, who could find themselves "contaminated" and subject to legal action if they contribute to free projects.
Comments (none posted)
Reuters
covers a change in strategy in the RIAA's fight against online music
piracy:
"
The music industry is in a tailspin with global sales of CDs expected to fall six percent in 2003, its fourth consecutive annual decline. A major culprit, industry watchers say, is online piracy.
Now, the industry wants to hit the problem at its source - internet service providers.
"We will hold ISPs more accountable," said Hillary Rosen, chairman and CEO the Recording Industry Association of America (RIAA), in her keynote speech at the Midem music conference on the French Riviera."
Comments (2 posted)
Interviews
On Friday January 17, 2003 Bruce Perens will be interviewed on National
Public Radio's "Talk of the Nation: Science Friday". The subject will be
the philosophy and business of Open Source software. The interview will
take place between 2:20 P.M. and 3:00 EST, that's 11:20 to 12:00 PST. Find
your local NPR radio station
here. For general information on the program, see
http://www.sciencefriday.com/ .
Eben Moglen, general counsel for the Free Software Foundation, will appear
in an interview on PBS' NOW with Bill Moyers, Friday 17 January. The show
will discuss the impact of Wednesday's ruling in the Eldred case and its
implications for the way copyright legislation will impact us in the
future. More information is available at
http://www.pbs.org/now/politics/comingup.html.
Comments (6 posted)
Tinyminds.org has
an interview with Shamyl Zakariya, one of the SlicKer developers.
"
As the second victim in the TinyMinds interview series we have picked the SlicKer project as our target. SlicKer aims to someday replace Kicker in KDE (ed's note: Kicker is the taskbar at the bottom of the screen) with its own more taskoriented approach."
Comments (none posted)
O'Reilly has
an interview with Jaakko Peltonen, author of the game Falcon's Eye,
a graphical version of NetHack.
"
We're proud to present an interview with Jaakko Peltonen, creator of Falcon's Eye, who discusses some of the technical and social challenges his project has faced."
Comments (none posted)
FOSDEM has published four new interviews with speakers giving talks at FOSDEM,
February 8 - 9, 2003 in Brussels.
These four interviews are related to the "Education Track":
Don't forget to participate to the FOSDEM Support Operation if you like
the event and want to help organizing it. More info here:
http://www.fosdem.org/index/support/
Comments (none posted)
News.com
talks with Microsoft's Peter Houston about Linux.
"
I still believe Linux is an extension of the Unix paradigm. It's a command-line-focused approach that's not particularly designed to be user friendly. The Windows approach is very different. I will say that the adoption of Linux is likely to be bounded by how many companies are happy with Unix."
Comments (5 posted)
Resources
The LinuxDevices.com Newsletter for January 16, 2003 is out. Get caught up
on all the embedded Linux news for the past week.
Full Story (comments: none)
IBM developerWorks
discusses
the performance of the Linux kernel. "
The first step in improving
Linux performance is quantifying it, but how exactly do you quantify
performance for Linux or for comparable systems? In this article, members
of the IBM Linux Technology Center share their expertise as they describe
how they ran several benchmark tests on the Linux 2.4 and 2.5 kernels late
last year. The benchmarks provide coverage for a diverse set of workloads,
including Web serving, database, and file serving. In addition, we show the
various components of the kernel (disk I/O subsystem, for example) that are
stressed by each benchmark."
Comments (none posted)
Reviews
Here's a TechWeb
article about
IBM's newest Linux tools. "
IBM plans on Monday to introduce new
Linux tools for devices from the handheld to the mainframe, including a
pre-configured and tested Linux on mainframe installation, and Lotus Notes
client software for Linux."
Comments (none posted)
Linux Orbit
compares
several Linux friendly media players including Sinek, Totem, XINE_UI,
Xmovie, and others.
Comments (6 posted)
NewsForge
reviews Quanta+ and Quanta Gold. The review involves:
"
A side-by-side comparison of (free GPL) Quanta+ and (commercial)
Quanta Gold, two popular HTML editors from theKompany."
Comments (none posted)
Vnunet
takes a look at
SuSE's new business desktop offering. "
Dan Homolka, technical sales
manager at SuSE, claimed that the vendor's Linux environment actually runs
Microsoft Office faster than Windows "mainly because Linux is much better
at context-switching"."
Comments (4 posted)
Miscellaneous
Linux Journal
covers the
Electronic Frontier Foundation Pioneer Awards. Nominations are open to
both individuals and organizations from any country. The deadline for
nominations for the 12th Annual International EFF Pioneer Awards is
February 1, 2003. "
All nominations are reviewed by a panel of judges
chosen for their knowledge of the technical, legal and social issues
associated with information technology."
Comments (none posted)
Linux Journal is putting on a
spamtrap
race. Ladies and gentlemen, rev up those disposable email addresses.
"
Thought you'd never want to seek out spam intentionally? Think
again! Are you sitting around with some extra time on your hands?
Excellent. We've got the perfect meaningless task for you. If you're lucky,
you could even win a prize ("Oooooh", the crowd roars.)"
Comments (1 posted)
Smh.com.au has
an article about a linux-based robotic system that is being
used for brain surgery.
"
A six-legged robot has been developed by Singapore experts and programmed to drill through the skull during surgery to remove deep-seated brain tumours in sharply reduced operating time."
Comments (none posted)
Page editor: Forrest Cook
Announcements
Commercial announcements
The GNOME Foundation and Bitstream Inc have
announced
an agreement that will bring high quality fonts to the free software
world. "
'The donation of these fonts to the free software community
is the final piece that will give full functionality to projects like
Freetype, XFT2 and X Render extensions in the Xfree86 project, Pango, KDE
and Trolltech's QT Rendering,' said Jim Gettys, GNOME Foundation board
member."
Comments (none posted)
APC has announced a recall on 2.1
million of its BackUPS units worldwide due to a danger of fire. Details at
http://www.apcc.com/rely/index.cfm
These are low-end units for both home and office, so it might be a good
idea to check under your desk and in your server room!
Comments (none posted)
Codehost and Easy Software Products
have announced
that they will be integrating CUPS source code into a commercial product.
"
Software developers Codehost, Inc. and Easy Software Products announced today that the two companies have entered into a licensing agreement that will allow Codehost to utilize aspects of the Common UNIX Printing System (CUPS) source code. The CUPS source code will be used within BrightQ®, Codehost's popular turnkey printing suite for corporate UNIX and Linux users of multi-function devices and high-end printers."
Comments (none posted)
UnitedLinux has made a few announcements at LinuxWorld:
- HP has joined as a UnitedLinux
"technology partner." Among other things, HP will have a seat on the
UnitedLinux technical advisory board, and will engage in "joint
marketing activities."
- UnitedLinux has announced a deal with
the Linux Professional Institute to create a UnitedLinux certification
program. It will be based on the standard LPI certification with an
additional test which is specific to the UnitedLinux distribution.
- There is also a new software developers
program which seems to consist mostly of a mailing list and access
to some IBM demoware.
Comments (none posted)
UnitedLinux announced plans to integrate the full OSDL Carrier Grade Linux
(CGL) 1.1 feature set for UnitedLinux 1.0. The CGL features will be
available as a Service Pack in the first quarter of 2003.
Full Story (comments: none)
O'Reilly has released the second edition of "Understanding the Linux
Kernel" by Daniel P. Bovet and Marco Cesati. The new edition of
"Understanding the Linux Kernel" has been updated to cover version 2.4 of
the kernel.
Full Story (comments: none)
O'Reilly has published the book
"Programming Web Services with Perl".
Full Story (comments: none)
Qlusters has announced the release of ClusterFrame(tm). Qlusters'
ClusterFrame product brings mainframe features and capabilities to business
applications and traditional compute-intensive environments. There are two
new product configurations. ClusterFrame/VM(tm) is a virtual mainframe
hosting any IA-32 Operating System. ClusterFrame/SSI(tm) is a true
Single-System-Image Linux Cluster platform.
Full Story (comments: none)
PeerDirect Corporation announced that its flagship product suite,
PeerDirectT Distributed Enterprise, now provides native support for
Linux.
Full Story (comments: none)
Archaeopteryx Software has released version 1.1.8 of their Wing
IDE for Python.
Full Story (comments: none)
Upcoming Events
Each LinuxWorld brings with it a flood of press releases from participating
companies. Here is a small sample of the many press releases we've seen
today.
Comments (2 posted)
Here's a selection from the dozens of LinuxWorld press releases which have
found their way to our inbox:
- Dell has announced
a new set of high-density supercomputer cluster offerings.
- Egenera has
sold a number of its BladeFrame systems to JPMorgan Chase.
- HP has announced
a new set of big customers and various new offerings; the company
claims to have done $2 billion in Linux business in 2002.
- IBM's big
announcement is the availability of the Lotus iNotes client for
Linux. "In addition, IBM announced enhancements to its
Linux hardware and software offerings for Linux, including a new
reference platform that makes it easier to create Linux-based
smartphones and personal digital assistants (PDAs); Tivoli(R) systems
management software for Linux; integrated software and services for
its mainframe Linux support; as well as performance improvements for
Intel(R) processor-based Linux servers running Linux." A
separate announcement
talks about new customers, including the PGA Golf Tour.
- Linuxcare has announced
the general availability of its Levanta server consolidation software.
- LTrix Engineering is pitching
its kernel debugger (with the appealing name of "lice"); $2000/seat.
- RealNetworks has released
the code for its Helix DNA server. This pretty much completes the
set of code releases that RealNetworks promised to the community.
- Red Hat seemingly has no new products to announce at this time; instead,
the company has put
out a press release on what a good year 2002 was.
- SGI has announced
several new customers for its "Altix 3000" Linux-based
supercomputers. SGI has also announced
an expansion of its Linux developer program.
- Sun announces
the Sun ONE software stack for Linux (several new products), an
expansion of support for the Grid Engine project, the forthcoming
availability of "Mad Hatter" (Sun's Linux desktop), and a few other
things. There is also a
separate PR for the Grid Engine "portlet" code contribution.
- Sun and Ximian have announced
the availability of the "Sun ONE Connector for Ximian Evolution."
Comments (2 posted)
Registrations for the Australian national Linux conference, Linux.Conf.Au
2003, have closed online in a mad rush as punters secured their seats at
this technically focused event. While the main conference is kicking off on
Wednesday, January 22, 2003, numerous mini-conferences being held prior to
the conference are already well under way.
Full Story (comments: none)
The Linux Summit will be held in Espoo, Finland on Febrary 27 and 28,
2003.
"
A two-day conference in Finland aims to convince IT managers
of the commercial advantages of using GNU/Linux and Open Source,
by presenting real-life examples."
Full Story (comments: none)
OMG Days Europe 2003 will be held across Europe from
February 18 to June 11, 2003.
"
An OMG Information Day is a one-day conference and exhibition
with focus on Enterprise Integration."
Full Story (comments: none)
Lindows.com, Inc. has
announced
that the Desktop Linux Summit, to be held on February 20 - 21, 2003 in San
Diego, is nearly sold out. Early registration ends January 17, 2003.
Comments (none posted)
DesktopLinux.com has posted
an article on its
withdrawal from the Desktop Linux Summit, which, they believe, has
become dominated by a single vendor. "
Then, last week, Lindows.com
suddenly and unilaterally directed DesktopLinux.com to substitute a new
agenda for the old one -- one that had not been discussed or reviewed with
the Advisory Board. The agenda was a completely new one, with major changes
such as substitution of Lindows.com CEO Michael Robertson for Open Source
advocate Bruce Perens in the conference welcome keynote slot."
(Thanks to Timothy R. Butler).
Comments (none posted)
Use Perl has
an announcement for YAPC::NA, to be held in Boca Raton, Florida
on June 16-18, 2003. A CFP has been issued for the conference.
Comments (none posted)
The first OpenOffice.org Conference will be held on
March 20 and 21, 2003 in Hamburg, Germany. A CFP has
been announced for the conference.
Full Story (comments: none)
| Date | Event | Location |
| January 23 - 25, 2003 | Linux.conf.au 2003 | Perth, Australia |
| January 23 - 24, 2003 | LinuxWorld Conference & Expo | (Jacob K. Javits Center)New York, NY |
| January 27 - 31, 2003 | SAINT-2003 | Orlando, Florida, USA |
| February 3 - 6, 2003 | O'Reilly Bioinformatics Technology Conference | (Westin Horton Plaza.)San Diego, CA |
| February 4 - 6, 2003 | Linux Solutions 2003 | (CNIT)Paris, France |
| February 8 - 9, 2003 | Free and Open source Software Developers' European Meeting(FOSDEM) | Brussels, Belgium |
| February 10 - 14, 2003 | The fifth NordU/USENIX Conference(NordU2003) | (Aros Congress Center)Västerås, Sweden |
| February 20 - 21, 2003 | Desktop Linux Summit | (Vivendi Universal Building)San Diego, CA |
| February 22 - 24, 2003 | CodeCon 2.0 | (Club NV)San Francisco CA, USA |
| February 27 - 28, 2003 | Linux Summit 2003 | (Dipoli Conference Center)Espoo, Finland |
| March 17 - 19, 2003 | Open Source for National and Local eGovernment Programs in the U.S. and EU | (The Marvin Center Grand Ballroom, George Washington University)Washington, DC |
| March 20 - 21, 2003 | First OpenOffice.org Conference(OOoCon2003) | (University of Hamburg)Hamburg, Germany |
Comments (none posted)
Web sites
Dave Phillips has updated his Linux Music & Sound Software
page, check out the Musings and New Additions sections.
Full Story (comments: none)
Software announcements
The Helix Community Newsletter #3 is available. This issue looks at the
Helix DNA Server release on January 22; new mailing lists; the Helix
Community is hiring; and more open source news from RealNetworks.
Full Story (comments: none)
Here are the software announcements, courtesy of
Freshmeat.net. They are available in
two formats:
Comments (none posted)
Miscellaneous
Finalists have been
announced for the LinuxWorld Open Source Product Excellence awards. The winners will be announced next week at LinuxWorld.
Comments (4 posted)
Page editor: Forrest Cook
Letters to the editor
| From: |
| Sam Trenholme |
| To: |
| letters@lwn.net |
| Subject: |
| MaraDNS is another DNS offering |
| Date: |
| Sun, 19 Jan 2003 07:29:57 -0600 (CST) |
I have been working on MaraDNS for nearly two years
now. A 1.0 release was released over six months ago,
and I am currently working on a 1.2 release. MaraDNS
is both an authoritative and recursive DNS server, is
written with security in mind, and the 1.0 release is
public domain; the 1.2 release will be released under
a simple BSD license.
Unlike PowerDNS, it has recursive DNS and is free.
Unlike Oak DNS, it is written in C which is both
high-performance and portable. In fact, MaraDNS is
twice as fast as BIND and three times as fast as
TinyDNS for fetching authoritative DNS records.
It would seem that I am not marketing MaraDNS well
enough, since your editors seem to be ignorant of its
existance.
More information is at http://www.maradns.org/
Please keep my email address private; I am getting
enough spam as it is.
- Sam
Comments (2 posted)
| From: |
| Tres Melton <class5@pacbell.net> |
| To: |
| editor@lwn.net |
| Subject: |
| Lessig laughs after 52 hours reading a humorous interview with Mickey
Mouse. |
| Date: |
| Sat, 18 Jan 2003 13:02:53 -0800 |
While reading Professor Lessig's blog I stumbled across this: Reason Online
has interviewed Mickey Mouse and
"Disney's cartoon rodent speaks out on the Eldred decision."
Mickey's interview includes such jewels such as: "Q: How does it feel
to have your sentence extended by two decades?" -- "A: How do you
think it feels? For almost 70 years, I've only been allowed to do what
the Disney people say I can do. ... " and "In 1971, for instance,
Dan O'Neill got me a part in something called Air Pirates Funnies. It
was great: I got to have sex, I got to use drugs, I got to explore the
whole underground comix scene. It was liberating."
Mickey goes on to discus Disney's lawyers enforcing the laws that Walt
Disney broke when he started it all. Lest we not forget that Steamboat
Willie -- Mickey's original name -- was a direct parody of Buster Keaton's
Steamboat Bill, right down to the opening music, or The Brothers
Grimm who originally authored such jewels as: Rapunzel, Hänsel
und Gretel, Cinderella, Little Snow-white, and Rumpelstiltskin.
(Not having children, I'm not sure if Disney plagiarized all of these or
just some of them.)
--
Tres Melton <class5@pacbell.net>
Comments (1 posted)
Page editor: Jonathan Corbet