Predictions, as they say, are hard - especially when they involve the
future. It's easy to get them wrong and look like a total fool. Your
editor, however, has long since gotten over his fear of coming across as a
total idiot in front of large numbers of people; when you have already
tipped your hand, there is no point in holding back any longer. So here's a
few things which, in your editor's view, might just come to pass in 2007.
As always, these predictions come with no warranty whatsoever.
Legal issues
Version 3 of the GPL will be adopted, perhaps after one more draft
round. Your editor has no clue of how the FSF will respond to the
criticisms of their anti-DRM provisions. If that language remains, uptake
of the new license will be somewhat lower; the FSF may try to avoid that
scenario by making "distribution on restrictive hardware without the
associated keys" an optional permission which can be granted by the
copyright holders.
Somebody will be sued for distributing proprietary kernel modules.
Threats of lawsuits have been muttered for some time, but the late-2006
discussion on banning those modules made it clear that GPL infringement
suits are the strongest weapon available to those who oppose proprietary
modules. Given the way the frustration level is rising, it is only a
matter of time until somebody uses that weapon.
We will see the end of SCO in 2007. Chances are that the company's
case against IBM will not even survive until the planned trial date in the
(northern hemisphere) fall. Look for fun around March, when dispositive
motions can be heard.
There will be serious talk of patent reform in the U.S. The EFF is
unlikely to succeed in its attempt to get the U.S. Supreme Court to throw
out patents on software altogether; the current chief justice places a
heavy emphasis on deciding no more than the current case requires, and
software patents are not at issue in that case. But the
pain caused by these patents is severe and growing; something will
eventually have to be done. Whether that "something" will help to lift the
clouds of legal uncertainty from free software remains to be seen, however.
Development
Linux will have fewer problems with closed hardware one year from
now. There is already a clear path to support for most wireless network
adapters. On the video front, a palpable determination to address the
problem has come together over the last year. The Nouveau project can be
expected to make significant progress over the next twelve months, and developers
are beginning to talk about a project to support ATI's R500 engine. A
decision by AMD to open up ATI's hardware would be a nice bonus. But,
either way, the need to solve this problem is well understood, and
developers are increasingly interested in attacking it.
Closed hardware problems will not go away, however. The content
industry, with Microsoft's help, is pushing for a new generation of
hardware which is intended to be "trusted" not to give too much control to
its owner. "Trusted content paths" are fundamentally incompatible with
free software. So we will continue to have trouble in carrying out
straightforward tasks - like watching movies - on our free systems until
the industry comes to its senses.
The war on bloat will get serious as people get tired of running out
of memory. The increasing use of Linux on small and embedded systems will
also create pressure for lower resource usage. Tools are emerging which
will help developers track down wasted memory; their employment should lead
to leaner systems for all of us.
The previous item notwithstanding, Java will move into the free software
community as Sun follows through on its promised code releases. Thus
far, the amount of free software written in Java has been relatively
small. Once free Java support is available for all Linux systems, the
number of developers of free Java code can be expected to grow.
Fedora will come into its own as a free, community-oriented
distribution. Fedora's transition from a corporate product into a
community product has been slow at best, and it is far from complete. The
right things are happening, however; the combination of a more open
process, a 100% free software policy, and a high-quality base should lead
to good things.
Debian will get the Etch release out this year. Honest. What could
possibly go wrong? Thereafter, the Debian developers will go back to
arguing about firmware in the kernel.
Free software will move into online gaming as a critical mass of
interested developers comes together. Many of the necessary pieces exist
now as free software, and the possibility of acquiring some cast-off
corporate code still exists. Meanwhile, Second Life has shown the possibilities
inherent in hackable online platforms. These environments are too much fun
- and too much a part of our future - to leave to the proprietary software
companies.
Commerce
The Microsoft/Novell deal will blow over with few consequences.
Most of the angry ink has already been spilled, and it still seems unlikely
that Microsoft will launch a patent attack against Linux. Novell
will have lost credibility in the community, and may yet lose more
developers, but it has not really changed the nature of the patent threat.
The "open source" term will take a beating as various semi-open
companies try to look like free software operations. Some companies have
already needed to be told to take the "open source" label off their code;
others will certainly follow. The need felt by
these companies to attach non-free provisions to their licenses may lead to
the creation of a "shared-source"-like replacement term by the end of the
year.
The first round of OLPC systems will be distributed to millions of
children in the developing world. That much can be predicted by looking at
the project's timeline. Much harder to predict is what will happen
when millions of children learn to use systems which are open,
Linux-powered, and network-connected. This project may well change the
free software community - and the world as a whole.
Desktop Linux will grow as corporate managers realize they already
have more desktop systems deployed than they had thought.
As always, these predictions will be reviewed in December of this year.
Comments (29 posted)
A quick search shows that there are almost 200 trademarked terms in the
U.S. using the term "Python." This name has been reserved for use with
lacrosse sticks, bungee cords, musical instruments, tape libraries, arc
welding torches, radio-controlled toys, wire rope, motorcycle exhaust
systems, perfumes, cryogenic pipes, floor polishers, carbonated beverages,
"providing online adult entertainment by means of a global computer
network," orthodontic adhesive, herbicides, garage door openers, and much
more. There is also a registration for a programming language. The term
"Python," in this context, belongs to the Python Software Foundation (PSF), and
has since early 2004.
In November, the PSF announced
the adoption of a formal policy for the use of the Python trademark. This
policy has version
1.2.2, despite being the first posted policy for the use of this name. The
rules disallow calling any other language "Python," so it's no fair
slipping in a Perl interpreter; they also forbid using the term "in
ways that confuse the community as to whether the Python programming
language is open source and free to use."
One clause regarding how the term "Python" can be used has attracted a
small amount of attention in the Debian community, however. It reads:
Use of the word "Python" when redistributing the Python programming
language as part of a freely distributed application -- Allowed. If
the standard version of the Python programming language is
modified, this should be clearly indicated. For commercial
distributions, contact the PSF for permission.
This rule would appear to take in commercial Linux distributors, all of
whom should, from a strict reading, be getting permission from the
Foundation. Debian, as a
non-commercial distributor, should not be directly affected by this
language, but anybody who redistributes Debian on a commercial basis could
be.
The question which comes up is: what uses of the word "Python" fall under
this policy? Is providing a python command sufficient? How about
in the introductory text printed when python is run interactively?
Does listing Python in an online package database count? Can the release
notes brag about the version of Python shipped? How about running a "now
includes Python 3000" Superbowl advertisement? The final case is covered
by a separate term which forbids the use of "Python" in advertisements
without prior permission. But the real location of the line separating
free use from that which requires permission is not entirely clear.
At this time, there would appear to be little cause for concern; the PSF
has little interest in harassing people who are using or distributing its
code. After inquiring with the PSF, your editor was told that the policy
was created as part of the legal requirement that trademarks be enforced if
the holder wants to keep them. The PSF has not seen any misuses of the
name that it felt the need to crack down on, and it does not feel that
noting the inclusion of Python within a commercial product necessarily
requires permission. Noting that a product contains Python is acceptable
in just about any circumstances.
The PSF wants to promote the use and development of
Python; it appears to be uninterested in legal silliness.
That said, there are a couple of things which should be kept in mind here:
- The Python Software Foundation is a corporation, and corporations can
change their minds quickly. Should the PSF - speaking entirely
hypothetically now - decide to split off "Python Corporation" as a
separate, for-profit entity, the approach to trademark policy and
enforcement could change overnight.
- Trademark law (in the U.S., at least) requires the enforcement of
trademarks. If a trademark holder can be shown to have overlooked
known violations, it can lose its rights to the mark. The law, in
other words, can force trademark holders to get into the
cease-and-desist business, even if they would rather be writing code.
The number of free software projects with trademarks and associated
policies would appear to be growing. The issues surrounding the Firefox
trademark have been well discussed here and elsewhere. Xen has a trademark policy
which is quite strict on whether a distributor can claim to ship Xen; see
the Xen trademark
FAQ for a view of their approach to trademark management. There are
trademark policies for Perl, MySQL, GNOME, and, of
course, Linux. The KDE and
OpenOffice.org trademarks have
been registered, but there does not appear to be a posted policy for their
use. Fortunately, an attempt by Unipress to trademark "emacs" was not
successful.
In recent times, there has been some concern over license proliferation,
resulting in a determined effort to reduce the number of free software
licenses in active use. It makes sense; every software license brings its
own set of conditions and interactions to worry about. Every trademark
license is unique, however; each one has its own set of quirks, any of
which can be changed at any time with no public
participation or notification.
The continuation of this trend could lead to an increasing
series of hassles for distributors; the long-term result could be more
software shipped under iceweasel-like names.
It would be nice if free software projects would stop worrying about
trademarks and get back to working on the code. Abuses of free project
names have been few and far between. This outcome seems unlikely, however.
Nobody likes to see their chosen name hijacked, and commercial
organizations can be positively paranoid about the idea. So a more
realistic solution might be the creation of some sort of standardized free
trademark license. A known set of trademark terms, the same for each mark
and drafted with an eye toward keeping the associated software free, could
do much to make life easier for software distributors. It seems like a
better alternative than being neck-deep in iceweasels.
Comments (10 posted)
One month ago, LWN
looked at the
Free Ryzom Campaign, which was trying to raise enough money to buy (and
free) the source to the Ryzom game in bankruptcy court. The Free Software
Foundation got into the game (so to speak) with a $60,000 pledge. On
December 21, however, the
bad news was
posted: another bidder had come in with a better offer. The campaign was
left with a pile of pledges and nothing to buy.
Whenever a project gets that sort of energy and resources together, it is a
shame to just let it all fade away. So the campaign organizers have been
discussing
possibilities for achieving their goal by other means. One of the
immediate outcomes is the creation of the Virtual Citizenship
Assocation, which is essentially the Ryzom campaign with the brand
names removed. The organization is still soliciting pledges on the chance
that the source for an interesting game may come available from somewhere
else. One expects, however, that the number of pledges is unlikely to grow
quickly until prospective donors can see what the organizers would like to
buy.
There is a real chance that a game platform could be obtained this way.
The history of free software projects starting with freed corporate code is
long; Mozilla, OpenOffice.org, and InterBase are just some of the more
prominent examples. The online gaming market is tough, with many failed
offerings. Perhaps one of those proprietary failures could yet be turned
into a free software success. Beyond that, the possibility of an open-source
Second Life is still real.
The history of corporate code offers other lessons, though; among them is
the fact that such code can often require a great deal of work. Mozilla
treaded water for some time until it decided to simply toss much of its
Netscape legacy and start over. It would be a shame to put a large pile of
donated money into a code base which, in the end, needs to be thrown out
and rewritten properly. It might be better to just start over from the
beginning and do it right.
Except that starting from the beginning would not be necessary. The NeL
library - the engine at the core of Ryzom - is already free software.
Arkhart is a project to develop
a GPL-licensed engine and game. The Planeshift engine is also
free software - though the associated artwork is
not. The WorldForge project has
been working in this area for a long time. Other interesting projects
exist as well.
There are a couple of conclusions to be drawn from this situation. The
first is that we do have the interest - and the ability - to create game
engines which can implement compelling virtual worlds. The code and the
developers are out there; we don't have to buy that code from a
failing company. The other side of the coin, however, is that code is only
part of the problem. Top-quality online games need top-quality artwork,
sound effects, music, storylines, and more. If our community is going to
create a great online virtual world, we must do a better job of soliciting
and integrating contributions from artists, writers, and others who are not
software developers. Without them, all we have is a pile of code.
So there are a number of challenges to the creation of truly successful,
completely free online worlds. But our community has always been good at
overcoming challenges. This one, too, will fall, and we will, eventually,
have our free online worlds. Your editor's kids think it can't happen too
soon.
Comments (7 posted)
Page editor: Jonathan Corbet
Security
January 3, 2007
This article was contributed by Jake Edge.
A particularly nasty cross-site
scripting (XSS) vulnerability has surfaced that impacts Firefox users
who have installed the Adobe Reader (Acrobat/PDF) plugin. Proof of concept
exploits have been published on Bugtraq as well as several blogs
(here
for example). Adobe has fixed the problem in Acrobat version 8; which is
only available for Windows, no word yet on a fix for the Linux plugin (which
is based on Acrobat version 7).
The technique was first disclosed last week at the 23rd Chaos Communication
Congress by Stefano Di Paola and Giorgio Fedon in their
Subverting
AJAX presentation. Sven Vetsch discovered another wrinkle and publicized
it on his
blog.
The crux of the vulnerability is a link with a URL of the following form:
http://host/path/to/file.pdf#anystring=javascript:malicious_code_here
The host and path to file are legitimate URL paths to a PDF file that is
hosted somewhere on the net, quite possibly at a site that is trusted
by the user. The attacker need not have any access to the PDF file,
but can have his code executed while appearing to be a simple download from
the affected site. It is the ability to turn any PDF hosted on any site
into an XSS attack that makes this vulnerability so insidious.
The vulnerability exploits a feature of the Adobe plugin that is not shared
with other mechanisms for viewing PDFs from the web (including using the
acroread external program that is also supplied by Adobe).
Arguments can be passed to the plugin via the information after the '#' and
can be used to specify a specific page or search string in the PDF. It can
also be used to populate PDF forms using '#FDF=URL' arguments and the
information for the forms is retrieved from the URL.
Evidently Adobe does not check for FDF or two other similar argument types
(which is why 'anystring=' works)
and blindly asks the browser to fetch the URL specified. If the URL is
javascript code as described above, the plugin does not detect that case and
in effect forces the browser to execute it.
Any site hosting a PDF file is vulnerable and there is little that the site
can do; there is no indication that the request is anything out of the
ordinary because the string after the '#' is not passed as part of the request.
Concerned sites could stop hosting PDF files, but that seems rather unlikely.
Other server-side
solutions are being discussed
as there is a concern that users are unlikely to upgrade their browser
plugins. Hosting sites would much rather that they be in control of
whether their PDF files can appear in links with malicious content. Most
XSS problems can be handled by proper server side filtering of user
supplied content, but this particular vulnerability is different.
So far there are no reports of other PDF plugins that follow Adobe's lead
in retrieving URLs that appear in links to PDF files. In this author's
experience, PDF viewing utilities are separate programs that get
invoked by the browser after it downloads a PDF file. For xpdf and
kpdf (and presumably others), this works just fine but Adobe chose
to provide a means of more closely integrating PDF viewing into the browser.
Unfortunately, the fact that this plugin is closed source implies that
users, especially Linux users, must wait for Adobe to fix the problem. We
cannot fix it ourselves.
One could certainly imagine a similar mistake being made by one of the other
PDF viewer development teams; Adobe is hardly alone in making bad choices in
developing software. However, the fix for an open source PDF viewer would
likely be
available within hours of the report. Adobe was notified about this problem
on 15 October according to the
advisory, but there is still
no fix for Linux. Disabling the plugin would seem to be prudent.
Fixing the affected software is just the start of the task of fixing the
overall problem. As mentioned above, users are not particularly good at
picking up security fixes even when they know about them. Getting the message
out on this particular problem is a big hurdle. The alternative is to
educate users so that they can recognize maliciously crafted links to PDFs
and that is almost certainly a harder task.
The potential for a widespread outbreak exploiting this vulnerability
is fairly high and this will probably not be the
last we will hear about it. It certainly has the possibility of
damaging the reputation of PDF amongst even casual web users and that is
probably keeping some folks at Adobe awake at nights.
Comments (20 posted)
New vulnerabilities
cacti: multiple vulnerabilities
| Package(s): | cacti |
CVE #(s): | CVE-2006-6799
|
| Created: | January 1, 2007 |
Updated: | January 26, 2007 |
| Description: |
The network monitoring and graphing frontend Cacti has three vulnerabilities.
The cmd.php script allows command line usage and is also installed in a
web-accessible location. The cmd.php input is insufficiently sanitized,
a passed-in URL can be used to inject arbitrary SQL code.
The cmd.php script can be used by a remote attacker to execute arbitrary
shell commands via improperly sanitized results from SQL queries. |
| Alerts: |
|
Comments (none posted)
denyhosts: denial of service
| Package(s): | denyhosts |
CVE #(s): | CVE-2006-6301
|
| Created: | January 3, 2007 |
Updated: | January 3, 2007 |
| Description: |
A botched regular expression allows a remote attacker to add arbitrary hosts to the denyhosts blacklist, causing those hosts to be unable to make ssh connections to the target system. |
| Alerts: |
|
Comments (2 posted)
elog: multiple vulnerabilities
| Package(s): | elog |
CVE #(s): | CVE-2006-5063
CVE-2006-5790
CVE-2006-5791
CVE-2006-6318
|
| Created: | December 28, 2006 |
Updated: | January 3, 2007 |
| Description: |
elog, a web-based electronic logbook has multiple vulnerabilities that
may lead to arbitrary code execution.
Log entry editing in HTML has a cross-site scripting vulnerability.
A number of format string vulnerabilities may be used for the execution of
arbitrary code. There are cross-site scripting vulnerabilities related to
the creation of new logbook entries.
There is insufficient error handling in config the file parsing that may be used for a denial of service attack. |
| Alerts: |
|
Comments (none posted)
mono: source disclosure attack
| Package(s): | mono |
CVE #(s): | CVE-2006-6104
|
| Created: | December 21, 2006 |
Updated: | January 17, 2007 |
| Description: |
The Mono ASP.NET server XSP has a source disclosure attack vulnerability.
A malicious user can use this to acquire the source code of a server-side
application. |
| Alerts: |
|
Comments (none posted)
openser: buffer overflow
| Package(s): | openser |
CVE #(s): | |
| Created: | December 26, 2006 |
Updated: | January 3, 2007 |
| Description: |
A buffer overflow was discovered in the
"parse_expression" function of the "permissions" module of the SIP router
OpenSER, versions up to and including 1.1.0. The OpenSER "permissions"
module is used to determine if a SIP call has appropriate permission to be
established. The "parse_expression" function is used during parsing of the
modules local allow/deny configuration files. |
| Alerts: |
|
Comments (none posted)
w3m: denial of service
| Package(s): | w3m |
CVE #(s): | |
| Created: | December 28, 2006 |
Updated: | January 15, 2007 |
| Description: |
The W3M textual web browser has a format string vulnerability.
If the run-time options -dump or -backend are used, W3M can be made to
crash if certain escape sequences occur in the Common Name of a web site
X.509 certificate. |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
apache: cross-site scripting
| Package(s): | apache |
CVE #(s): | CVE-2006-3918
|
| Created: | August 9, 2006 |
Updated: | April 4, 2008 |
| Description: |
From the Red Hat advisory: "A bug was found in Apache where an invalid Expect header sent to the server
was returned to the user in an unescaped error message. This could
allow an attacker to perform a cross-site scripting attack if a victim was
tricked into connecting to a site and sending a carefully crafted Expect
header." |
| Alerts: |
|
Comments (none posted)
apache-mod_auth_kerb: off-by-one error
| Package(s): | apache-mod_auth_kerb |
CVE #(s): | CVE-2006-5989
|
| Created: | November 24, 2006 |
Updated: | January 23, 2007 |
| Description: |
An off-by-one error in the der_get_oid function in mod_auth_kerb 5.0 allows
remote attackers to cause a denial of service (crash) via a crafted
Kerberos message that triggers a heap-based buffer overflow in the
component array. |
| Alerts: |
|
Comments (none posted)
bind: denial of service
| Package(s): | bind |
CVE #(s): | CVE-2006-4095
CVE-2006-4096
|
| Created: | September 7, 2006 |
Updated: | February 1, 2007 |
| Description: |
Bind has two denial of service vulnerabilities.
Recursive servers queries for SIG records will trigger an assertion
failure if more than one RR set is returned.
An INSIST failure can be triggered by sending a large number of
recursive queries. |
| Alerts: |
|
Comments (none posted)
bugzilla: multiple vulnerabilities
| Package(s): | bugzilla |
CVE #(s): | CVE-2006-5453
CVE-2006-5454
CVE-2006-5455
|
| Created: | November 10, 2006 |
Updated: | August 28, 2007 |
| Description: |
Bugzilla has the following vulnerabilities:
Input data passed to various fields is not properly sanitized before
being passed back to users.
Users can gain unauthorized access to read attachment
descriptions while using diff mode.
HTTP GET and HTTP POST requests can be used to perform unauthorized
actions due to improper verification.
Input that is passed to showdependencygraph.cgi is not properly
sanitized before being returned to users. |
| Alerts: |
|
Comments (none posted)
busybox: insecure password generation
| Package(s): | busybox |
CVE #(s): | CVE-2006-1058
|
| Created: | May 5, 2006 |
Updated: | May 2, 2007 |
| Description: |
The BusyBox 1.1.1 passwd command does not use a proper salt when generating
passwords. This would create an instance where a brute force attack could
take very little time. |
| Alerts: |
|
Comments (2 posted)
bzip2: race condition and infinite loop
| Package(s): | bzip2 |
CVE #(s): | CAN-2005-0953
CAN-2005-1260
|
| Created: | May 17, 2005 |
Updated: | January 10, 2007 |
| Description: |
A race condition in bzip2 1.0.2 and earlier allows local users to modify
permissions of arbitrary files via a hard link attack on a file while it is
being decompressed, whose permissions are changed by bzip2 after the
decompression is complete. Also specially crafted bzip2 archives may cause
an infinite loop in the decompressor. |
| Alerts: |
|
Comments (2 posted)
cpio: arbitrary code execution
| Package(s): | cpio |
CVE #(s): | CVE-2005-4268
|
| Created: | January 2, 2006 |
Updated: | March 17, 2010 |
| Description: |
Richard Harms discovered that cpio did not sufficiently validate file
properties when creating archives. Files with e. g. a very large size
caused a buffer overflow. By tricking a user or an automatic backup
system into putting a specially crafted file into a cpio archive, a
local attacker could probably exploit this to execute arbitrary code
with the privileges of the target user (which is likely root in an
automatic backup system). |
| Alerts: |
|
Comments (none posted)
vixie-cron: privilege escalation
| Package(s): | cron |
CVE #(s): | CVE-2006-2607
|
| Created: | May 31, 2006 |
Updated: | June 1, 2009 |
| Description: |
The Vixie cron daemon does not check the return code from setuid(); if that call can be made to fail, a local attacker may be able to execute commands as root. |
| Alerts: |
|
Comments (1 posted)
cscope: buffer overflows
| Package(s): | cscope |
CVE #(s): | CVE-2006-4262
|
| Created: | October 2, 2006 |
Updated: | June 16, 2009 |
| Description: |
Will Drewry of the Google Security Team discovered several buffer overflows
in cscope, a source browsing tool, which might lead to the execution of
arbitrary code. |
| Alerts: |
|
Comments (none posted)
cscope: buffer overflows
| Package(s): | cscope |
CVE #(s): | CVE-2004-2541
|
| Created: | May 22, 2006 |
Updated: | June 19, 2009 |
| Description: |
A buffer overflow in Cscope 15.5, and possibly multiple overflows, allows
remote attackers to execute arbitrary code via a C file with a long
#include line that is later browsed by the target. |
| Alerts: |
|
Comments (1 posted)
Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of Service
| Package(s): | cyrus-sasl |
CVE #(s): | CVE-2006-1721
|
| Created: | April 21, 2006 |
Updated: | September 4, 2007 |
| Description: |
Cyrus-SASL contains an unspecified vulnerability in the DIGEST-MD5
process that could lead to a Denial of Service. An attacker could possibly
exploit this vulnerability by sending specially crafted data stream to the
Cyrus-SASL server, resulting in a Denial of Service even if the attacker is
not able to authenticate. |
| Alerts: |
|
Comments (none posted)
dbus: denial of service
| Package(s): | dbus |
CVE #(s): | CVE-2006-6107
|
| Created: | December 15, 2006 |
Updated: | February 12, 2007 |
| Description: |
Unspecified vulnerability in the match_rule_equal function in bus/signals.c
in D-Bus before 1.0.2 allows local applications to remove match rules for
other applications and cause a denial of service (lost process messages). |
| Alerts: |
|
Comments (none posted)
dovecot: index cache file handling error
| Package(s): | dovecot |
CVE #(s): | CVE-2006-5973
|
| Created: | November 29, 2006 |
Updated: | May 8, 2007 |
| Description: |
The dovecot IMAP server has an error in its index cache file handling code which could be exploited by an authenticated user to execute arbitrary code. Only servers with the (non-default) mmap_disable=yes option setting are vulnerable. |
| Alerts: |
|
Comments (none posted)
elinks: arbitrary file access
| Package(s): | elinks |
CVE #(s): | CVE-2006-5925
|
| Created: | November 16, 2006 |
Updated: | October 22, 2009 |
| Description: |
The elinks text-mode browser has an arbitrary file access vulnerability
in the Elinks SMB protocol handler. If a user can be tricked into
visiting a specially crafted web page, arbitrary files may be read or
written with the user's permissions. |
| Alerts: |
|
Comments (none posted)
ffmpeg: buffer overflows
| Package(s): | ffmpeg |
CVE #(s): | CVE-2006-4799
CVE-2006-4800
|
| Created: | September 14, 2006 |
Updated: | May 28, 2007 |
| Description: |
the AVI processing code in FFmpeg has a number of buffer overflow
vulnerabilities.
If an attacker can trick a user into loading a specially crafted
crafted AVI, arbitrary code can be executed with the user's privileges. |
| Alerts: |
|
Comments (2 posted)
Mozilla stuff: multiple vulnerabilities
Comments (none posted)
freeradius: several vulnerabilities
| Package(s): | freeradius |
CVE #(s): | CVE-2005-4745
CVE-2005-4746
|
| Created: | August 8, 2006 |
Updated: | April 24, 2007 |
| Description: |
Several remote vulnerabilities have been discovered in freeradius, a
high-performance RADIUS server, which may lead to SQL injection or denial
of service. |
| Alerts: |
|
Comments (none posted)
freetype: integer overflows
| Package(s): | freetype |
CVE #(s): | CVE-2006-0747
CVE-2006-1861
CVE-2006-2493
CVE-2006-2661
CVE-2006-3467
|
| Created: | June 8, 2006 |
Updated: | June 1, 2010 |
| Description: |
The FreeType library has several integer overflow vulnerabilities.
If a user can be tricked into installing a specially
crafted font file, arbitrary code can be executed with the privilege
of the user. |
| Alerts: |
|
Comments (none posted)
ftpd: privilege escalation
| Package(s): | ftpd |
CVE #(s): | CVE-2006-5778
|
| Created: | November 10, 2006 |
Updated: | February 14, 2007 |
| Description: |
Ftpd is vulnerable to a privilege escalation attack,
an incorrect seteuid() call can be used by an FTP user to gain
unauthorized access to files or directories. |
| Alerts: |
|
Comments (none posted)
gcc: file overwrite vulnerability
| Package(s): | gcc |
CVE #(s): | CVE-2006-3619
|
| Created: | September 6, 2006 |
Updated: | March 14, 2008 |
| Description: |
The fastjar utility found in the GNU compiler collection does not perform adequate file path checking, allowing the creation or overwriting of files outside of the current directory tree. |
| Alerts: |
|
Comments (none posted)
gdb: buffer overflow
| Package(s): | gdb |
CVE #(s): | CVE-2006-4146
|
| Created: | September 15, 2006 |
Updated: | June 12, 2007 |
| Description: |
A buffer overflow in dwarfread.c and dwarf2read.c debugging code in GNU
Debugger (GDB) 6.5 allows user-assisted attackers, or restricted users, to
execute arbitrary code via a crafted file with a location block
(DW_FORM_block) that contains a large number of operations. |
| Alerts: |
|
Comments (none posted)
gdm: improper file permissions
| Package(s): | gdm |
CVE #(s): | CVE-2006-1057
|
| Created: | April 19, 2006 |
Updated: | May 2, 2007 |
| Description: |
The .ICEauthority file may be created with the wrong ownership and permissions; gdm 2.14.2 fixes the problem. |
| Alerts: |
|
Comments (none posted)
gedit: format string vulnerability
| Package(s): | gedit |
CVE #(s): | CAN-2005-1686
|
| Created: | June 9, 2005 |
Updated: | February 5, 2009 |
| Description: |
A format string vulnerability has been discovered in gedit. Calling
the program with specially crafted file names caused a buffer
overflow, which could be exploited to execute arbitrary code with the
privileges of the gedit user. |
| Alerts: |
|
Comments (1 posted)
gnupg: stack overwrite
| Package(s): | gnupg |
CVE #(s): | CVE-2006-6235
|
| Created: | December 12, 2006 |
Updated: | March 13, 2007 |
| Description: |
A "stack overwrite" vulnerability in GnuPG (gpg) allows attackers to
execute arbitrary code via crafted OpenPGP packets that cause GnuPG to
dereference a function pointer from deallocated stack memory. |
| Alerts: |
|
Comments (3 posted)
grip: buffer overflow
| Package(s): | grip |
CVE #(s): | CAN-2005-0706
|
| Created: | March 10, 2005 |
Updated: | November 19, 2008 |
| Description: |
Grip, a CD ripper, has a buffer overflow vulnerability that can
occur when the CDDB server returns more than 16 matches. |
| Alerts: |
|
Comments (none posted)
gv: stack-based buffer overflow
| Package(s): | gv |
CVE #(s): | CVE-2006-5864
|
| Created: | November 20, 2006 |
Updated: | April 9, 2007 |
| Description: |
Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv
3.6.2, and possibly earlier versions, allows user-assisted attackers to
execute arbitrary code via a PostScript (PS) file with certain headers that
contain long comments, as demonstrated using the DocumentMedia header. |
| Alerts: |
|
Comments (none posted)
gzip: multiple vulnerabilities
| Package(s): | gzip |
CVE #(s): | CVE-2006-4334
CVE-2006-4335
CVE-2006-4336
CVE-2006-4337
CVE-2006-4338
|
| Created: | September 19, 2006 |
Updated: | January 20, 2010 |
| Description: |
Tavis Ormandy of the Google Security Team discovered two denial of service
flaws in the way gzip expanded archive files. If a victim expanded a
specially crafted archive, it could cause the gzip executable to hang or
crash.
Tavis Ormandy of the Google Security Team discovered several code execution
flaws in the way gzip expanded archive files. If a victim expanded a
specially crafted archive, it could cause the gzip executable to crash or
execute arbitrary code. |
| Alerts: |
|
Comments (1 posted)
gzip: arbitrary command execution
| Package(s): | gzip |
CVE #(s): | CAN-2005-0758
|
| Created: | August 1, 2005 |
Updated: | January 10, 2007 |
| Description: |
zgrep in gzip before 1.3.5 does not handle shell metacharacters like '|'
and '&' properly when they occurred in input file names. This could be
exploited to execute arbitrary commands with user privileges if zgrep is
run in an untrusted directory with specially crafted file names. |
| Alerts: |
|
Comments (2 posted)
imagemagick: buffer overflows
| Package(s): | imagemagick |
CVE #(s): | CVE-2006-5868
|
| Created: | November 28, 2006 |
Updated: | February 16, 2007 |
| Description: |
Daniel Kobras discovered multiple buffer overflows in ImageMagick's SGI
file format decoder. By tricking a user or an automated system into
processing a specially crafted SGI image, this could be exploited to
execute arbitrary code with the user's privileges. |
| Alerts: |
|
Comments (1 posted)
ImageMagick: buffer overflows
| Package(s): | ImageMagick |
CVE #(s): | CVE-2006-5456
|
| Created: | October 31, 2006 |
Updated: | March 8, 2007 |
| Description: |
Multiple buffer overflows in GraphicsMagick before 1.1.7 and ImageMagick
6.0.7 allow user-assisted attackers to cause a denial of service and
possibly execute execute arbitrary code via (1) a DCM image that is not
properly handled by the ReadDCMImage function in coders/dcm.c, or (2) a
PALM image that is not properly handled by the ReadPALMImage function in
coders/palm.c. |
| Alerts: |
|
Comments (2 posted)
imlib2: arbitrary code execution
| Package(s): | imlib2 |
CVE #(s): | CVE-2006-4806
CVE-2006-4807
CVE-2006-4808
CVE-2006-4809
|
| Created: | November 6, 2006 |
Updated: | August 13, 2007 |
| Description: |
M. Joonas Pihlaja discovered that imlib2 did not sufficiently verify the
validity of ARGB, JPG, LBM, PNG, PNM, TGA, and TIFF images. If a user
were tricked into viewing or processing a specially crafted image with
an application that uses imlib2, the flaws could be exploited to execute
arbitrary code with the user's privileges. |
| Alerts: |
|
Comments (none posted)
kdegraphics: stack overflow
| Package(s): | kdegraphics |
CVE #(s): | CVE-2006-6297
|
| Created: | December 12, 2006 |
Updated: | January 13, 2007 |
| Description: |
A stack overflow in the KFILE JPEG (kfile_jpeg) plugin in kdegraphics3, as
used by konqueror, digikam, and other KDE image browsers, allows remote
attackers to cause a denial of service (stack consumption) via a crafted
EXIF section in a JPEG file, which results in an infinite recursion. |
| Alerts: |
|
Comments (none posted)
kdelibs: integer overflow
| Package(s): | kdelibs |
CVE #(s): | CVE-2006-4811
|
| Created: | October 18, 2006 |
Updated: | March 5, 2007 |
| Description: |
The KDE khtml library can pass untrusted parameters into Qt, allowing a hostile user to trigger an integer overflow there and execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
kdelibs: kate backup file permission leak
| Package(s): | kdelibs kate kwrite |
CVE #(s): | CAN-2005-1920
|
| Created: | July 19, 2005 |
Updated: | September 21, 2010 |
| Description: |
Kate / Kwrite, as shipped with KDE 3.2.x up to including 3.4.0, creates a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set. See this advisory for more information. |
| Alerts: |
|
Comments (1 posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-4623
|
| Created: | October 18, 2006 |
Updated: | November 14, 2007 |
| Description: |
The kernel DVB layer can be caused to crash with maliciously-formatted unidirectional lightweight encapsulation (ULE) data. |
| Alerts: |
|
Comments (none posted)
kernel: bridging code buffer overflow
| Package(s): | kernel |
CVE #(s): | CVE-2006-5751
|
| Created: | December 6, 2006 |
Updated: | January 3, 2007 |
| Description: |
A buffer overflow in the bridging code in kernels through 2.6.18.3 can lead to a denial of service or potential code execution. The 2.6.18.4 kernel contains the fix. |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-4535
CVE-2006-4538
|
| Created: | September 18, 2006 |
Updated: | January 5, 2009 |
| Description: |
Sridhar Samudrala discovered a local denial of service vulnerability
in the handling of SCTP sockets. By opening such a socket with a
special SO_LINGER value, a local attacker could exploit this to crash
the kernel. (CVE-2006-4535)
Kirill Korotaev discovered that the ELF loader on the ia64 and sparc
platforms did not sufficiently verify the memory layout. By attempting
to execute a specially crafted executable, a local user could exploit
this to crash the kernel. (CVE-2006-4538) |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-4572
CVE-2006-4997
|
| Created: | November 6, 2006 |
Updated: | January 17, 2007 |
| Description: |
Some vulnerabilities were discovered in the Linux 2.6 kernel:
There are possibly exploitable bugs in the netfilter for IPv6 code.
(CVE-2006-4572)
The ATM subsystem of the Linux kernel could allow a remote attacker to
cause a Denial of Service (panic) via unknown vectors that cause the ATM
subsystem to access the memory of socket buffers after they are freed.
(CVE-2006-4997) |
| Alerts: |
|
Comments (none posted)
kernel: denial of service by memory consumption
| Package(s): | kernel |
CVE #(s): | CVE-2006-2936
|
| Created: | July 17, 2006 |
Updated: | November 14, 2007 |
| Description: |
The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to
2.6.17, and possibly later versions, allows local users to cause a denial
of service (memory consumption) by writing more data to the serial port
than the driver can handle, which causes the data to be queued. |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-5757
|
| Created: | November 13, 2006 |
Updated: | November 14, 2007 |
| Description: |
From the MOKB-05-11-2006
advisory: "The ISO9660 filesystem handling code of the Linux
2.6.x kernel fails to properly handle corrupted data structures, leading to
an exploitable denial of service condition. This particular vulnerability
seems to be caused by a race condition and a signedness issue. When
performing a read operation on a corrupted ISO9660 fs stream, the
isofs_get_blocks() function will enter an infinite loop when
__find_get_block_slow() callback from sb_getblk() fails ("due to various
races between file io on the block device and getblk")." |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-2935
CVE-2006-4145
CVE-2006-3745
|
| Created: | September 1, 2006 |
Updated: | July 30, 2008 |
| Description: |
Previous versions of the kernel package are subject to several
vulnerabilities. Certain malformed UDF filesystems can cause the system to
crash (denial of service). Malformed CDROM firmware or USB storage devices
(such as USB keys) could cause system crash (denial of service), and if
they were intentionally malformed, can cause arbitrary code to run with
elevated privileges. In addition, the SCTP protocol is subject to a remote
system crash (denial of service) attack. |
| Alerts: |
|
Comments (none posted)
koffice: integer overflow
| Package(s): | koffice |
CVE #(s): | CVE-2006-6120
|
| Created: | November 30, 2006 |
Updated: | February 20, 2007 |
| Description: |
The KOffice office suite has an integer overflow
vulnerability. If an attacker can trick a user into opening a
specially crafted PowerPoint (PPT) file, KOffice can be caused to crash or
possibly execute arbitrary code with the user's privileges. |
| Alerts: |
|
Comments (none posted)
krb5: local privilege escalation
| Package(s): | krb5 |
CVE #(s): | CVE-2006-3083
|
| Created: | August 9, 2006 |
Updated: | July 7, 2010 |
| Description: |
Some kerberos applications fail to check the results of setuid() calls, with the result that, if that call fails, they could continue to execute as root after thinking they had switched to a nonprivileged user. A local attacker who can cause these calls to fail (through resource exhaustion, presumably) could exploit this bug to gain root privileges. |
| Alerts: |
|
Comments (none posted)
libgadu: memory alignment bug
| Package(s): | libgadu |
CVE #(s): | CAN-2005-2370
|
| Created: | July 29, 2005 |
Updated: | June 25, 2007 |
| Description: |
Szymon Zygmunt and Michal Bartoszkiewicz discovered a memory alignment
error in libgadu (from ekg, console Gadu Gadu client, an instant
messaging program) which is included in gaim, a multi-protocol instant
messaging client, as well. This can not be exploited on the x86
architecture but on others, e.g. on Sparc and lead to a bus error,
in other words a denial of service.
|
| Alerts: |
|
Comments (none posted)
libgd2: denial of service
| Package(s): | libgd2 |
CVE #(s): | CVE-2006-2906
|
| Created: | June 14, 2006 |
Updated: | January 16, 2007 |
| Description: |
Certain GIF images can cause libgd2 to go into an infinite loop, adversely affecting the performance of image processing applications. |
| Alerts: |
|
Comments (none posted)
libgsf: heap buffer overflow
| Package(s): | libgsf |
CVE #(s): | CVE-2006-4514
|
| Created: | November 30, 2006 |
Updated: | January 11, 2007 |
| Description: |
The GNOME library libgsf, which is used for writing structured file
formats, has a heap buffer overflow that can be exploited for the
purpose of executing arbitrary code. |
| Alerts: |
|
Comments (none posted)
libmodplug: boundary errors
| Package(s): | libmodplug |
CVE #(s): | CVE-2006-4192
|
| Created: | December 11, 2006 |
Updated: | May 4, 2011 |
| Description: |
Luigi Auriemma has reported various boundary errors in load_it.cpp and
a boundary error in the "CSoundFile::ReadSample()" function in
sndfile.cpp. A remote attacker can entice a user to read crafted modules
or ITP files, which may trigger a buffer overflow resulting in the
execution of arbitrary code with the privileges of the user running the
application. |
| Alerts: |
|
Comments (none posted)
libpng: buffer overflow
| Package(s): | libpng |
CVE #(s): | CVE-2006-3334
|
| Created: | July 19, 2006 |
Updated: | December 15, 2008 |
| Description: |
In pngrutil.c, the function png_decompress_chunk() allocates
insufficient space for an error message, potentially overwriting stack
data, leading to a buffer overflow. |
| Alerts: |
|
Comments (none posted)
libpng: heap based buffer overflow
| Package(s): | libpng |
CVE #(s): | CVE-2006-0481
|
| Created: | February 13, 2006 |
Updated: | December 15, 2008 |
| Description: |
A heap based buffer overflow bug was found in the way libpng strips alpha
channels from a PNG image. An attacker could create a carefully crafted PNG
image file in such a way that it could cause an application linked with
libpng to crash or execute arbitrary code when the file is opened by a
victim. |
| Alerts: |
|
Comments (1 posted)
libtiff: buffer overflow
| Package(s): | libtiff |
CVE #(s): | CVE-2006-2193
|
| Created: | June 15, 2006 |
Updated: | September 1, 2008 |
| Description: |
The t2p_write_pdf_string function in libtiff 3.8.2 and earlier is vulnerable
to a buffer overflow. Attackers can use a TIFF file with UTF-8 characters
in the DocumentName tag to overflow a buffer, causing a denial of service,
and possibly the execution of arbitrary code. |
| Alerts: |
|
Comments (none posted)
libvncserver: authentication bypass
| Package(s): | libvncserver |
CVE #(s): | CVE-2006-2450
|
| Created: | August 4, 2006 |
Updated: | March 19, 2007 |
| Description: |
LibVNCServer fails to properly validate protocol types effectively
letting users decide what protocol to use, such as "Type 1 - None".
LibVNCServer will accept this security type, even if it is not offered
by the server. |
| Alerts: |
|
Comments (none posted)
libxml2 - arbitrary code execution
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0110
|
| Created: | February 26, 2004 |
Updated: | August 19, 2009 |
| Description: |
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml2 uses special
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that
parses remote resources and allows them to influence the URL, then this
flaw could be used to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
libxml2: multiple buffer overflows
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0989
|
| Created: | October 28, 2004 |
Updated: | August 19, 2009 |
| Description: |
libxml2 prior to version 2.6.14 has multiple buffer overflow
vulnerabilities, if a local user passes a specially crafted
FTP URL, arbitrary code may be executed. |
| Alerts: |
|
Comments (none posted)
linux-restricted-modules: nVidia driver vulnerability
| Package(s): | linux-restricted-modules |
CVE #(s): | CVE-2006-5379
|
| Created: | November 6, 2006 |
Updated: | January 11, 2007 |
| Description: |
Derek Abdine discovered that the NVIDIA Xorg driver did not correctly
verify the size of buffers used to render text glyphs. When displaying
very long strings of text, the Xorg server would crash. If a user were
tricked into viewing a specially crafted series of glyphs, this flaw
could be exploited to run arbitrary code with root privileges. |
| Alerts: |
|
Comments (none posted)
lynx: arbitrary command execution
| Package(s): | lynx |
CVE #(s): | CVE-2005-2929
|
| Created: | November 14, 2005 |
Updated: | September 14, 2009 |
| Description: |
An arbitrary command execute bug was found in the lynx "lynxcgi:" URI
handler. An attacker could create a web page redirecting to a malicious URL
which could execute arbitrary code as the user running lynx. |
| Alerts: |
|
Comments (none posted)
mysql: format string bug
| Package(s): | mysql |
CVE #(s): | CVE-2006-3469
|
| Created: | July 21, 2006 |
Updated: | July 30, 2008 |
| Description: |
Jean-David Maillefer discovered a format string bug in the
date_format() function's error reporting. By calling the function with
invalid arguments, an authenticated user could exploit this to crash
the server. |
| Alerts: |
|
Comments (none posted)
MySQL: privilege violations
| Package(s): | mysql |
CVE #(s): | CVE-2006-4031
CVE-2006-4226
|
| Created: | August 25, 2006 |
Updated: | July 30, 2008 |
| Description: |
MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access
a table through a previously created MERGE table, even after the user's
privileges are revoked for the original table, which might violate intended
security policy (CVE-2006-4031).
MySQL 4.1 before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run
on case-sensitive filesystems, allows remote authenticated users to create
or access a database when the database name differs only in case from a
database for which they have permissions (CVE-2006-4226). |
| Alerts: |
|
Comments (none posted)
MySQL: logging bypass
| Package(s): | mysql |
CVE #(s): | CVE-2006-0903
|
| Created: | April 4, 2006 |
Updated: | May 21, 2008 |
| Description: |
MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms
via SQL queries that contain the NULL character, which are not properly
handled by the mysql_real_query function. NOTE: this issue was originally
reported for the mysql_query function, but the vendor states that since
mysql_query expects a null character, this is not an issue for mysql_query. |
| Alerts: |
|
Comments (2 posted)
nbd: arbitrary code execution
| Package(s): | nbd |
CVE #(s): | CVE-2005-3534
|
| Created: | January 6, 2006 |
Updated: | March 7, 2011 |
| Description: |
Kurt Fitzner discovered that the NBD (network block device) server did not
correctly verify the maximum size of request packets. By sending specially
crafted large request packets, a remote attacker who is allowed to access
the server could exploit this to execute arbitrary code with root
privileges. |
| Alerts: |
|
Comments (none posted)
openldap: security bypass
| Package(s): | openldap |
CVE #(s): | CVE-2006-4600
|
| Created: | September 29, 2006 |
Updated: | June 12, 2007 |
| Description: |
slapd in OpenLDAP before 2.3.25 allows remote authenticated users with
selfwrite Access Control List (ACL) privileges to modify arbitrary
Distinguished Names (DN). |
| Alerts: |
|
Comments (none posted)
openoffice.org: several vulnerabilities
| Package(s): | openoffice.org |
CVE #(s): | CVE-2006-2198
CVE-2006-2199
CVE-2006-3117
|
| Created: | June 30, 2006 |
Updated: | January 4, 2007 |
| Description: |
Several vulnerabilities have been discovered in OpenOffice.org, a free
office suite.
- It turned out to be possible to embed arbitrary BASIC macros in
documents in a way that OpenOffice.org does not see them but executes them
anyway without any user interaction. (CVE-2006-2198)
- It is possible to evade the Java sandbox with specially crafted Java
applets. (CVE-2006-2199)
- Loading malformed XML documents can cause buffer overflows and cause a
denial of service or execute arbitrary code. (CVE-2006-3117)
|
| Alerts: |
|
Comments (none posted)
OpenSSH: denial of service
| Package(s): | openssh |
CVE #(s): | CVE-2006-4925
CVE-2006-5052
|
| Created: | October 6, 2006 |
Updated: | November 15, 2007 |
| Description: |
packet.c in ssh in OpenSSH allows remote attackers to cause a denial of
service (crash) by sending an invalid protocol sequence with
USERAUTH_SUCCESS before NEWKEYS, which causes newkeys[mode] to be NULL.
An unspecified vulnerability in portable OpenSSH before 4.4, when running
on some platforms, allows remote attackers to determine the validity of
usernames via unknown vectors involving a GSSAPI "authentication abort." |
| Alerts: |
|
Comments (none posted)
openssh: privilege separation issue
| Package(s): | openssh |
CVE #(s): | CVE-2006-5794
|
| Created: | November 8, 2006 |
Updated: | April 5, 2007 |
| Description: |
From the OpenSSH 4.5 announcement: "Fix a bug in the sshd privilege separation monitor that weakened its
verification of successful authentication. This bug is not known to
be exploitable in the absence of additional vulnerabilities." |
| Alerts: |
|
Comments (none posted)
openssh: remote denial of service
| Package(s): | openssh |
CVE #(s): | CVE-2006-4924
CVE-2006-5051
|
| Created: | September 27, 2006 |
Updated: | September 17, 2008 |
| Description: |
Openssh 4.4 fixes some
security issues, including a pre-authentication denial of service, an
unsafe signal hander and on portable OpenSSH a GSSAPI authentication abort
could be used to determine the validity of usernames on some platforms. |
| Alerts: |
|
Comments (none posted)
php: several vulnerabilities
| Package(s): | php |
CVE #(s): | CVE-2006-4481
CVE-2006-4484
CVE-2006-4485
|
| Created: | September 8, 2006 |
Updated: | June 13, 2008 |
| Description: |
The file_exists and imap_reopen functions in PHP before 5.1.5 do not check
for the safe_mode and open_basedir settings, which allows local users to
bypass the settings (CVE-2006-4481).
A buffer overflow in the LWZReadByte function in ext/gd/libgd/gd_gif_in.c
in the GD extension in PHP before 5.1.5 allows remote attackers to have an
unknown impact via a GIF file with input_code_size greater than
MAX_LWZ_BITS, which triggers an overflow when initializing the table array
(CVE-2006-4484).
The stripos function in PHP before 5.1.5 has unknown impact and attack
vectors related to an out-of-bounds read (CVE-2006-4485). |
| Alerts: |
|
Comments (1 posted)
php: buffer overflows
| Package(s): | php |
CVE #(s): | CVE-2006-5465
|
| Created: | November 3, 2006 |
Updated: | January 18, 2010 |
| Description: |
The Hardened-PHP Project discovered buffer overflows in
htmlentities/htmlspecialchars internal routines to the PHP Project. Of
course the whole purpose of these functions is to be filled with user
input. (The overflow can only be when UTF-8 is used) |
| Alerts: |
|
Comments (none posted)
phpbb2: missing input sanitizing
| Package(s): | phpbb2 |
CVE #(s): | CVE-2006-1896
|
| Created: | May 22, 2006 |
Updated: | February 11, 2008 |
| Description: |
It was discovered that phpbb2, a web based bulletin board, insufficiently
sanitizes values passed to the "Font Color 3" setting, which might lead to
the execution of injected code by admin users. |
| Alerts: |
|
Comments (none posted)
phpbb2: multiple vulnerabilities
| Package(s): | phpbb2 |
CVE #(s): | CVE-2005-3310
CVE-2005-3415
CVE-2005-3416
CVE-2005-3417
CVE-2005-3418
CVE-2005-3419
CVE-2005-3420
CVE-2005-3536
CVE-2005-3537
|
| Created: | December 22, 2005 |
Updated: | February 11, 2008 |
| Description: |
The phpbb2 web forum has a number of vulnerabilities including:
a web script injection problem, a protection mechanism bypass, a
security check bypass, a remote global variable bypass, cross site
scripting vulnerabilities, an SQL injection vulnerability,
a remote regular expression modification problem, missing input
sanitizing, and a missing request validation problem. |
| Alerts: |
|
Comments (none posted)
postgresql: SQL injection
| Package(s): | postgresql |
CVE #(s): | CVE-2006-2313
CVE-2006-2314
|
| Created: | May 24, 2006 |
Updated: | June 6, 2007 |
| Description: |
The PostgreSQL team has put out a set of "urgent updates" (in the form of the 7.3.15, 7.4.13, 8.0.8, and 8.1.4 releases) closing a
newly-discovered set of SQL injection issues. Details about the problem
can be found on the
technical information page; in short: multi-byte encodings can be used
to defeat normal string sanitizing techniques. The update fixes one problem
related to invalid multi-byte characters, but punts on another by simply
disallowing the old, unsafe technique of escaping single quotes with a
backslash. |
| Alerts: |
|
Comments (1 posted)
proftpd: denial of service
| Package(s): | proftpd |
CVE #(s): | CVE-2006-5815
|
| Created: | November 17, 2006 |
Updated: | January 24, 2007 |
| Description: |
A denial of service (DoS) vulnerability exists in the FTP server ProFTPD, up
to and including version 1.3.0. The flaw is due to both a potential bus
error and a definitive buffer overflow in the code which determines the FTP
command buffer size limit. The vulnerability can be exploited only if the
"CommandBufferSize" directive is explicitly used in the server
configuration. |
| Alerts: |
|
Comments (none posted)
proftpd: stack-based buffer overflow
| Package(s): | proftpd |
CVE #(s): | CVE-2006-6563
|
| Created: | December 18, 2006 |
Updated: | February 14, 2007 |
| Description: |
A vulnerability exists in the FTP server ProFTPD, versions up to and
including 1.3.0a. The vulnerability is caused by a stack-based buffer
overflow in the "pr_ctrls_recv_request" function of the "Controls"
feature. This is an optional feature of ProFTPD server which is by default
disabled in OpenPKG and probably other distributions. |
| Alerts: |
|
Comments (1 posted)
quake: buffer overflow
| Package(s): | quake3-bin |
CVE #(s): | CVE-2006-2236
|
| Created: | May 10, 2006 |
Updated: | January 12, 2009 |
| Description: |
Games based on the Quake 3 engine are vulnerable to a buffer overflow exploitable by a hostile game server. |
| Alerts: |
|
Comments (none posted)
rpm: arbitrary code execution
| Package(s): | rpm |
CVE #(s): | CVE-2006-5466
|
| Created: | November 6, 2006 |
Updated: | August 28, 2007 |
| Description: |
An error was found in the RPM library's handling of query reports. In
some locales, certain RPM packages would cause the library to crash. If
a user was tricked into querying a specially crafted RPM package, the
flaw could be exploited to execute arbitrary code with the user's
privileges. |
| Alerts: |
|
Comments (none posted)
shadow-utils: mailbox creation vulnerability
| Package(s): | shadow-utils |
CVE #(s): | CVE-2006-1174
|
| Created: | May 25, 2006 |
Updated: | June 12, 2007 |
| Description: |
The useradd tool from the shadow-utils package has a potential security
problem. When a new user's mailbox is created, the permissions are
set to random garbage from the stack, potentially allowing the
file to be read or written during the time before fchmod() is called. |
| Alerts: |
|
Comments (none posted)
squirrelmail: multiple cross-site scripting vulnerabilities
| Package(s): | squirrelmail |
CVE #(s): | CVE-2006-6142
|
| Created: | December 11, 2006 |
Updated: | January 31, 2007 |
| Description: |
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0
through 1.4.9 allow remote attackers to inject arbitrary web script or HTML
via the mailto parameter in webmail.php, the session and delete_draft
parameters in compose.php, and unspecified vectors involving "a shortcoming
in the magicHTML filter." |
| Alerts: |
|
Comments (none posted)
unzip: long file name buffer overflow
| Package(s): | unzip |
CVE #(s): | CVE-2005-4667
|
| Created: | February 6, 2006 |
Updated: | May 2, 2007 |
| Description: |
A buffer overflow in UnZip 5.50 and earlier allows local users to execute
arbitrary code via a long filename command line argument. NOTE: since the
overflow occurs in a non-setuid program, there are not many scenarios under
which it poses a vulnerability, unless unzip is passed long arguments when
it is invoked from other programs. |
| Alerts: |
|
Comments (1 posted)
virusscan: DT_RPATH vulnerability
| Package(s): | virusscan |
CVE #(s): | CVE-2006-6474
|
| Created: | December 14, 2006 |
Updated: | January 3, 2007 |
| Description: |
McAfee VirusScan for Linux has an insecure DT_RPATH vulnerability
that may allow a remote attacker to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
w3c-libwww: possible stack overflow
| Package(s): | w3c-libwww |
CVE #(s): | CVE-2005-3183
|
| Created: | October 14, 2005 |
Updated: | May 2, 2007 |
| Description: |
xtensive testing of libwww's handling of multipart/byteranges content from
HTTP/1.1 servers revealed multiple logical flaws and bugs in
Library/src/HTBound.c |
| Alerts: |
|
Comments (1 posted)
xine-lib: buffer overflow
| Package(s): | xine-lib |
CVE #(s): | CVE-2006-6172
|
| Created: | December 5, 2006 |
Updated: | June 5, 2007 |
| Description: |
A buffer overflow was discovered in the Real Media input plugin in
xine-lib. If a user were tricked into loading a specially crafted stream
from a malicious server, the attacker could execute arbitrary code with the
user's privileges. |
| Alerts: |
|
Comments (none posted)
xine-lib: buffer overflow
| Package(s): | xine-lib |
CVE #(s): | CVE-2006-1664
|
| Created: | April 27, 2006 |
Updated: | February 27, 2008 |
| Description: |
xine-lib does an improper input data boundary check on
MPEG streams. A specially crafted MPEG file can be
created that can cause arbitrary code execution when the
file is accessed. |
| Alerts: |
|
Comments (none posted)
xine-ui: format string vulnerabilities
| Package(s): | xine-ui |
CVE #(s): | CVE-2006-2230
|
| Created: | June 9, 2006 |
Updated: | January 24, 2007 |
| Description: |
Several format string vulnerabilities have been discovered in xine-ui,
the user interface of the xine video player, which may cause a denial
of service. |
| Alerts: |
|
Comments (none posted)
xinit: race condition
| Package(s): | xinit |
CVE #(s): | CVE-2006-5214
|
| Created: | October 17, 2006 |
Updated: | August 9, 2007 |
| Description: |
A race condition allows local users to see error messages generated during
another user's X session. This could allow potentially sensitive
information to be leaked. |
| Alerts: |
|
Comments (1 posted)
X.org: local privilege escalations
| Package(s): | xorg-x11 |
CVE #(s): | CVE-2006-4447
|
| Created: | August 28, 2006 |
Updated: | April 30, 2007 |
| Description: |
Several X.org libraries and X.org itself contain system calls to
set*uid() functions, without checking their result. Local users could
deliberately exceed their assigned resource limits and elevate their
privileges after an unsuccessful set*uid() system call. This requires
resource limits to be enabled on the machine. |
| Alerts: |
|
Comments (none posted)
X.Org: buffer overflow
| Package(s): | xorg-x11-server xorg-x11 |
CVE #(s): | CVE-2006-1526
|
| Created: | May 3, 2006 |
Updated: | January 10, 2007 |
| Description: |
There is a buffer overflow in the Xrender extension of the X.Org server; any process which is able to connect to the server may be able to exploit this overflow to run arbitrary code. Since the X server runs as root on most systems, this vulnerability could be exploited to gain root access. See the X.Org advisory for more information. |
| Alerts: |
|
Comments (none posted)
xpdf: buffer overflow
| Package(s): | xpdf |
CVE #(s): | CAN-2005-0064
|
| Created: | January 19, 2005 |
Updated: | March 15, 2007 |
| Description: |
iDEFENSE has found yet another xpdf buffer overflow; see this advisory for details. |
| Alerts: |
|
Comments (1 posted)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current 2.6 prepatch is 2.6.20-rc3,
released by Linus just before he
went out to celebrate the new year. It contains the fix for the file
corruption bug (see below) and a few hundred other fixes.
Previously, 2.6.20-rc2 was
released on December 23 with another big set of fixes.
Just a few patches have been added to the mainline git repository since
-rc3 came out. There are currently six entries in the known unfixed regressions list maintained by
Adrian Bunk.
The current -mm tree is 2.6.20-rc2-mm1. Recent changes
to -mm include a new version of the user-space drivers patch, more
paravirtualization hooks, a generic time implementation for x86_64, and a
generic GPIO driver core.
For older kernels: 2.6.16.37 was released on
December 28 with a long list of fixes.
2.4.34 came out on
December 28. It has a number of security fixes and support for the
gcc 4.x compilers.
Comments (3 posted)
Kernel development news
I don't care much, really. But then, I understand how all this
stuff works. Try explaining to someone the relationship between
pte-dirtiness, page-dirtiness, radix-tree-dirtiness and
buffer_head-dirtiness.
-- Andrew Morton
Comments (2 posted)
Writing device drivers can be a tricky task. Simply getting a piece of
hardware to operate as desired - perhaps working from erroneous or
nonexistent documentation - can be a frustrating process. Beyond that,
however, the driver must allocate several different types of resources for
the device; these resources can include I/O memory mappings, interrupt
lines, blocks of memory, DMA buffers, registrations with multiple
subsystems, etc. All of these allocations must be returned to the system
when the device (or its driver) goes away. It is not uncommon for driver
writers to forget to deallocate something, leading to resource leaks.
The problem can get worse, however, in the face of initialization errors.
If the driver is unable to properly set up its device, it must undo any
registrations which had been done up to the point of failure. Attempts to
handle initialization failures usually take the form of several
goto labels within the initialization function or some sort of
global "initialization state" variable describing where cleanup should
begin. Either way, these paths tend not to be well tested, so the chances
of an initialization failure leading to some sort of resource leak are
quite good.
Tejun Heo, who has done much to improve the Linux serial ATA subsystem over
the last year, has had enough of these sorts of initialization problems.
So he has put together a device
resource management patch which, if accepted, has the potential to make
driver code simpler and more robust. The core idea is simple: every time
a driver allocates a resource, the management code remembers the allocation
and any information needed to free that allocation. When the driver
disconnects from the device, all of the remembered allocations are returned
to the system.
This sort of allocation tracking cannot be added to the current API in any
sort of coherent way. Tejun's patch, instead, creates new "managed"
versions of various allocation functions. The new functions look like the
old ones with (1) the addition of "m" (or "devm") to
the name, and (2) a struct device argument if the function
did not already have one. So, for example, the managed versions of the
interrupt allocation functions are:
int devm_request_irq(struct device *dev, unsigned int irq,
irq_handler_t handler, unsigned long irqflags,
const char *devname, void *dev_id);
void devm_free_irq(struct device *dev, unsigned int irq,
void *dev_id);
The patch also includes managed functions for dealing with DMA buffers, I/O
memory regions, plain memory allocations, and PCI device setup. They allow
the driver author to replace a whole set of deallocation calls with a
simple call to devres_release_all(), simplifying the code
significantly. In fact, even that call is unnecessary; the driver core
will call it when the driver detaches from the device.
For more complicated situations, there is also a "group" concept. Groups
can be thought of as markers in the stream of allocations associated with a
given device. The allocations performed within a specific group can be
rolled back without affecting any others. In brief, the group API is:
void *devres_open_group(struct device *dev, void *id, gfp_t gfp);
void devres_close_group(struct device *dev, void *id);
void devres_remove_group(struct device *dev, void *id);
int devres_release_group(struct device *dev, void *id);
A call to devres_open_group() will create a new group for the
given device, identified by the id value. Any allocations
performed thereafter will be considered to be a part of that group until
devres_close_group() is called. If initialization works as
desired, however, devres_remove_group() can be used to get rid of
the group overhead while leaving the allocations (and their tracking
information) untouched. In the failure path,
devres_release_group() will return all allocations belonging to
the given group.
There has been very little discussion of this patch set, as of this
writing. Driver writers, perhaps, are still recovering from the holiday
festivities. It is not too hard to imagine that there could be some
discomfort about the extra overhead involved in tracking all of those
allocations - especially since things do function normally almost all of
the time. In the end, however, the promise of correct operation in a wider
range of situations may be enough to motivate the inclusion of the new
interface.
Comments (6 posted)
The December 20 LWN Kernel Page contained
an article about a file
corruption bug generally (but not exclusively) seen with ext3 filesystems.
Certain applications which have unusual patterns of access to memory-mapped
files could, at times, see gaps where data had not made it all the way to
the disk. The rtorrent tool was one such application; other test cases
were found (and developed) as the hunt for this problem intensified.
The problem is now solved, but it offers some interesting lessons on how
this kind of subtle bug can come about - and how to get it fixed.
In an attempt to explain what was going on, your editor will once again
employ his rather dubious artistic skills. To that end, readers are kindly
requested to look at the diagram to the right and suspend enough disbelief
to imagine that it
represents a page in memory - a page containing interesting data, and which
represents an equivalent set of blocks found within a file on the disk.
The distinction between the page and its component blocks is important,
which is why the dotted lines divide up the page. A 4096-byte page in
memory is likely represented by eight 512-byte disk blocks (which are, most
likely, merged back together by the drive, but we'll pretend that isn't
happening).
There are a couple of different kernel data structures which contain
information about this page, making the diagram a bit more complicated:
The page may be mapped into one or more process address spaces. For each
such mapping, there will be a page table entry (PTE) which performs the
translation between the user-space virtual address and the physical address
where the page actually lives. There is also some other information in the
PTE, including a "dirty" bit. When the application modifies the page, the
processor will set the dirty bit, allowing the operating system to respond
by (for example) writing the page back to its backing store. Note that, if
there are multiple PTEs pointing to a single page, they may well disagree
on whether the page is dirty or not. The only way to know for sure is to
scan all existing PTEs and see if any of them are marked dirty.
The kernel maintains a separate data structure known as the system memory
map; it contains one struct page for every physical page known to
exist. This structure contains a number of interesting bits of
information, including a pointer to the page's backing store (if any), a
data structure allowing the associated PTEs to be found relatively easily,
and a set of page flags. One of those flags is a dirty bit - another flag
which notes that the page is in need of writing to its backing store. (For
those following closely, it may be worth pointing out that the red arrow
pointing to the page does not actually exist as a pointer field; it is
implicit in the structure's position within the memory map).
Finally, there is another set of structures which may be associated with
this page:
The "buffer head" (or "bh") goes back to the earliest days of Linux. It
can be thought of as a mapping between a disk block and its copy in
memory. The bh is not central to Linux memory management in the way it
once was, but a number of filesystems still use it to handle their disk I/O
tracking. Note that there is not necessarily a bh structure for every
block found within a page; if a filesystem has reason to believe that only
some blocks need writing, it does not need to create bh structures for the
rest. Among other things, the bh structure contains yet another dirty
flag.
With all of these different flags representing what is essentially the same
information, it is not entirely surprising that some confusion eventually
came about. The maintenance of redundant data structures can be a
challenge in any setting, and the kernel environment adds difficulties of
its own.
Deep within the kernel, there is a function called
set_page_dirty(); it is used by the memory management code when it
notices (via a PTE or a direct application operation) that a page is in
need of writeback. Among other things, it copies the dirty bit from the
page table entries into the page structure. If the page is part of a
file, set_page_dirty() will call back into the relevant filesystem
- but only if said filesystem has provided the appropriate method. Many
filesystems do not provide set_page_dirty() callback, however; for
these filesystems, the kernel will, instead, traverse the list of
associated bh structures and mark each of them dirty.
And that is where the problem comes in. The filesystem may well have
noticed that a block represented by a given bh was dirty and started I/O on
it before the set_page_dirty() call. When the I/O is complete,
the filesystem clears the dirty flag in the bh. If the
set_page_dirty() call comes while the I/O on the block is active,
the filesystem will not notice the fact that the block's data may have
changed after it was written. Instead, the block will be marked clean,
even though what was written does not correspond to what is currently in
memory. File corruption results.
Linus's fix is simple. When the virtual
memory subsystem decides that it is time to write a page, a new call to
set_page_dirty() is made. That ensures that all buffer heads
will be marked dirty at the time the filesystem's writepage()
method is called. That change ensures that all blocks of the page will be
written; testers have confirmed that it makes the file corruption problems
go away. The patch has gone into the mainline git repository; it should
show up in the next 2.6.19 stable update as well.
The longer-term solution is to continue pushing buffer heads out of the
kernel's I/O paths. As Linus puts it:
The buffer head has been purely an "IO entity" for the last
several years now, and it's not a cache entity. Anybody who does writeback
by buffer heads is basically bypassing the real cache (the page cache),
and that's why all the problems happen.
I think ext3 is terminally crap by now. It still uses buffer heads in
places where it really really shouldn't, and as a result, things like
directory accesses are simply slower than they should be. Sadly, I don't
think ext4 is going to fix any of this, either.
Ted Ts'o responds that a fix for ext4 could
yet happen, but it involves other filesystems as well. The ext3 filesystem
is probably going to stay with buffer heads, however, meaning that the
kernel will have to continue to work with them indefinitely.
Finally, this story illustrates just how hard it can be to track down and
fix certain kinds of kernel bugs. Early in the process it was hard for the
interested developers to reproduce the problem, so they had to rely on the
initial reporters to try out various patches. Those reporters stuck with
the process, building and testing a lot of kernels before the
problem was flushed out. They deserve much of the credit for the
resolution of this problem.
Comments (18 posted)
Asynchronous I/O (AIO) operations have the property of not blocking in the
kernel. If an operation cannot be completed immediately, it is set in
motion and control returns to the calling application while things are
still in progress. This functionality allows a suitably-programmed
application to keep multiple operations going in parallel without blocking
on any of them.
While Linux has long offered a set of system calls for asynchronous I/O,
support within the kernel has been spotty and slow in coming. Most char
devices do not provide the necessary methods - generally because there is
no pressing need for them to support asynchronous operations. Networking
supports AIO reasonably well. At the block level, all I/O is asynchronous,
but that is not true when dealing with the virtual filesystem layer. Quite
a bit of work went into supporting asynchronous direct filesystem I/O,
making the big database vendors happy. But most applications do not use
direct I/O, and the system as a whole usually benefits from the use of
buffered I/O. So asynchronous buffered I/O support is arguably the biggest
remaining hole.
Various buffered filesystem AIO patches have been posted over the course of
some three years, but none have made it into the kernel. Recently, Suparna
Bhattacharya has restarted this work with a new
file AIO patch which attempts to add this capability in the least
intrusive way possible. This work may now be simple enough that few will
be able to find things to object to.
Like previous versions of the patch, the current code adds a special wait
queue to each process's task structure. That queue is used for normal
synchronous operations, while asynchronous operations each have their own,
dedicated queue. The current wait queue is passed into filesystem I/O
operations which could block. That enables a couple of special tricks to be
performed:
- The I/O wait code checks to see if an asynchronous wait queue is
in use. If so, it simply returns -EIOCBRETRY rather than
waiting. This return code indicates that the operation is still in
progress; among other things, it is used to ensure that the wait queue
entry remains on the queue until the operation completes.
- Normally, wait queues wake up whatever process is waiting on them.
They are, however, rather more general than that. By changing the
wakeup function (see this LWN
article for information on how to do that), the AIO code can use
wait queues as notification service. When a "wakeup"
happens on a queue being used for AIO, the kernel, rather than waking
up a process, starts up a workqueue with an entry that will take the
next step in the I/O operation.
The normal buffered filesystem read code, simplified almost into oblivion,
looks something like this:
for each file page to be read
get the page into the page cache
copy the contents to the user buffer
The real code can be found in mm/filemap.c as
do_generic_mapping_read(), but the leading comment notes that
"this is really ugly." It is one of only three functions so
marked in that file, so, trust your editor, and go with the simple version
above.
In the pseudocode version, the place where things block is clearly the step
where the file page is read into the page cache. If the page is not
already cached, the kernel will have to set up a disk I/O operation and
wait for it to be carried out. That code proceeds the way it always did,
until it gets to the "wait" part, at which point the AIO wait queue will be
noticed and the code will return to whatever it was doing before. Once the
read completes, the special wakeup function associated with the AIO queue
will pick up where things left off.
One might well wonder just how that "pick up" part works. The wakeup
function will not be running in the process of the original calling
application, and may well not be running in process context at all. So it
queues up a workqueue function which will examine the state of the
outstanding I/O operation and, if necessary, jump back into the loop above
to continue the work. Before doing so, however, the workqueue function
carefully tweaks its memory management context so that it shares the
original application's address space. That tweak is necessary to make the
final line above (copy the page to the user buffer) work as expected. The
workqueue function will perform that copy, then proceed on to the next page
(if any). Likely as not, that next page will need to be read in from disk,
so the workqueue function will, after ensuring that the operation is
started, simply quit. This process repeats until all of the requested data
has been read, at which point the application can be notified that the
operation is complete.
On the write side, one might think that no changes are required - buffered
file writes are already asynchronous, with the flush to disk happening in
the background. The exception, however, is when O_SYNC is in
use. There are situations where applications want to know when the data
has found its way to the disk platter, but they still don't want to block
waiting for that to happen. A very similar approach is used to make
asynchronous O_SYNC writes work, though the patch is a little
larger. A couple of the low-level page writeback functions required
modifications so that they would pass the relevant wait queue around.
Even with this change in place, writes can still block on occasion. In
particular, any operation which requires allocating disk blocks for the
file may block while those allocations are performed. This issue can
probably be worked around, but that work has not yet been done.
The result of all this is a working asynchronous buffered file I/O
capability which makes almost no changes to (and adds little overhead to)
the "normal" synchronous code. If no serious objections are raised, the
Linux AIO subsystem might just become a little more complete in the near
future.
Comments (5 posted)
Patches and updates
Kernel trees
Core kernel code
Development tools
Device drivers
Documentation
Filesystems and block I/O
Janitorial
Memory management
Networking
Architecture-specific
Virtualization and containers
Miscellaneous
Page editor: Jonathan Corbet
Distributions
News and Editorials
Two highly specialized Linux distribution projects were added to our
Distribution List over the holidays and
they are worth a closer look. These aren't your typical desktop
distributions, or LAMP server distributions, but they do scratch a
particular itch.
The first one we'll cover is Firmware Linux. It was
introduced in this comment as an example of
a Linux system that does not rely on GNU software, although it's not quite
there yet. "Currently, building it still requires four gnu packages
(gcc, binutils, make, and bash), but replacements for all four are in the
works. (The replacement for gcc/binutils is tcc, which still needs some
work, and I'm writing my own shell and when that's ready, my own make.) If
your final system doesn't need to be a development environment, then it
doesn't have to have any gnu code in it at all."
Firmware Linux is designed to be a build system that produces a bootable
single file Linux system for various hardware platforms. Along the way, the
build produces a relocatable cross compiler for the target hardware, and
also a native build environment. This is a very young project, with only a
few months of development so far, however, according to the news page as of changeset 68 it does build
a native build environment with a working toolchain.
The second project is a bit more mature and has a family of Linux systems
in development. The NSLU2-Linux
project exists to discuss, develop and modify the firmware and hardware of
the Linksys NSLU2, the Synology DS101, the Iomega NAS100d, the D-Link
DSMG600, and other ixp4xx-based devices with large attached storage. SlugOS is the
collective name for a group of firmware distributions which are derived
from a common source base. The post to
the NSLU2 mailing list summarizes the current state of the project.
Here are some highlights:
- Unslung - a distribution which is targeted to those who wish to
continue using the vendor firmware, but add the ability to install
Optware packages. Unslung is stable at version 6.8.
- Optware - the ever growing set of packages available to users of
Unslung and SlugOS.
- SlugOS - a distribution based on OpenEmbedded, which completely
replaces the vendor firmware with custom firmware and packages designed
from the ground up for devices with limited memory and storage. The
current stable version is 3.10 and work progresses on SlugOS 4.
- NSLU2 is also a fully supported target for Debian Etch.
- OpenWRT - work is underway to provide support for the NSLU2,
NAS100d, DSMG600 and FSG3 in OpenWRT kamikaze.
- Improved infrastructure with a move to OSUOSL for the main project
server machine.
- Look for NSLU2-Linux at the Fifth Annual Southern California Linux
Expo (SCALE 5x).
LinuxDevices covered the Debian etch support in is this November
article: "Now, the newly available RC1 release of
debian-installer for Etch makes installing Linux on the Slug much easier,
according to Debian ARM hacker Martin Michlmayr. For one thing, the generic
IXP4xx kernel in Debian ARM now appears to support the device."
There's also an article on SmallNetBuilder, Hacking the
Linksys NSLU2 - Debian and more with a look at the project's history.
Comments (5 posted)
New Releases
BLAG Linux and GNU has announced
the first beta of BLAG 60000, a new series based on Fedora Core 6, with
many new applications. Since September 3rd, 2006, over 50 alpha versions of
BLAG-60000 have been spun. Now the first beta is ready for testing.
Full Story (comments: none)
The first official Fedora live CD has been announced. This live CD is based
on packages from the Fedora Core 6 (codenamed "Zod") and Fedora Extras
package collections and is such 100% free software. The live CD is
currently only available for i386 architectures. Support for other
architectures including ppc and x86_64 is planned. Click below for
download information.
Full Story (comments: 9)
DesktopLinux
takes a look
at the recent release of KateOS 3.2. "
The KateOS project team, which
maintains a full-featured Linux distribution derived from Slackware Linux,
last week released an installation version. KateOS version 3.2 features a
2.6.18 kernel, Xfce as its default desktop, and native support for the KDE
and GNOME desktop environments. The latest release also boasts a new
graphical package management tool, KatePKG, said to enable easy and
intuitive installation, removal, and updating of packages."
Comments (none posted)
Version 5.1 of the Debian-based
KNOPPIX live CD and DVD is available.
It features a 2.6.19 kernel, ntfs-3g and beryl. See the
release notes
for more information. (Thanks to Phil Lewis)
Comments (1 posted)
Musix GNU+Linux has released version
0.79. Musix is a free multimedia operating system for music production,
graphic design, audio and video edition, and more.
Full Story (comments: none)
Trustix Secure Linux 3.0.5 Beta 3 is
available. "
Thanks to many reports and suggestions, this release
contains some critical fixes and improvements in the installer and other
software."
Full Story (comments: none)
Terra Soft Solutions and The Research and Development Department of AMULET,
Inc (Chiyoda-ku Tokyo) have announced the launch of Japanese Language
Package of Yellow Dog Linux v5.0J for the Sony Computer Entertainment
PLAYSTATION3, slated to ship January 4, 2007.
Full Story (comments: none)
Distribution News
While it does look like the Debian stable 'etch' release will not happen
this year, it is getting closer. Here's an update from Andreas Barth.
"
There are a few items to resolve so that we could actually
release. We need your help there - in whichever area you want to help us,
please do so. Please remember: Releasing of Debian is a common effort of
the whole community."
Full Story (comments: 6)
Here's an official announcement from the Fedora Legacy project. "
In
case any of you are not aware, the Fedora Legacy project is in the process
of shutting down. The current model for supporting maintenance
distributions is being re-examined. In the meantime, we are unable to
extend support to older Fedora Core releases as we had planned. As of now,
Fedora Core 4 and earlier distributions are no longer being
maintained."
Full Story (comments: none)
The
OpenPKG project has made some changes
to its policies on contributions and asks contributors to explicitly agree
to the new
OpenPKG Contributor
Agreement (OCA) document.
Full Story (comments: none)
The openSUSE project has a "devroom" at the Free Open source Software
Developers' European Meeting (FOSDEM) taking place February 24 - 25, 2007
in Brussels (Belgium). "
For 2007, we dare to challenge all of us,
the community, to play a much more active role in making FOSDEM 2007 a
great success. Therefore we would like to open a "call for papers" and
encourage everyone to send proposals to the opensuse-project@opensuse.org
mailing list. Proposals should be submitted by January 15, 2007."
Full Story (comments: none)
Distribution Newsletters
The Debian Weekly News for December 26, 2006 covers the 400,000th bug
report, a call for participation in the Debian mini-conf at linux.conf.au,
20,000 submitters for popularity contest, five years of debianforum.de, ARM
is now the third most-popular Debian Architecture, installing Debian
without a CD-ROM, an Etch-CD with KDE as the default desktop, Etch frozen,
Debian powers Australia's largest satellite network, Debian Package of the
Day, and much more.
Full Story (comments: 17)
The
Gentoo
Weekly Newsletter for December 18, 2006 looks at EFIKA overlay opens,
Quickstart 0.3 and several other topics.
Comments (none posted)
The
DistroWatch
Weekly for January 1, 2007 is out. "
With another exciting year
safely behind us, we'll start the first issue of DistroWatch Weekly in 2007
with a statistical look at the popularity of Linux distributions and other
interesting data collected here during the past year. The news section will
then bring a varied collection of happenings from the distro world,
including news about the latest beta release of SimplyMEPIS, updates about
the forthcoming Fedora 7, information about the release blockers delaying
Debian GNU/Linux 4.0, links to interviews with the developers of Ulteo and
SabayonLinux, and alerts to articles of interest to users of PCLinuxOS,
openSUSE and Yellow Dog Linux. Finally, we are pleased to announce that the
December 2006 DistroWatch donation goes to SabayonLinux."
Comments (none posted)
Package updates
Updates for
Fedora Core 6:
frysk
(split to several rpms),
wget (bug fixes),
jpackage-utils (update to latest
jpackage-utils),
htdig (fixed htfuzzy's
sigfaults),
gtk2 (bug fixes),
evince (fix a copy-and-paste error in the
%post script),
gnome-applets (bug fix),
desktop-printing (bug fix),
selinux-policy (bug fix),
dvd+rw-tools (bug fix),
poppler (solve conflict with xpdf-utils),
gnome-python2-extras (rebuild against
firefox),
scim (bug fixes),
frysk (new upstream version),
dbus-glib (bug fixes),
autofs (bug fixes),
xen (update to xen-3.0.3-8.rhel5),
libvirt (new upstream release),
kernel (update to 2.6.18.6 final),
gtk2 (bug fixes),
virt-manager (bug fixes),
python-virtinst (bug fixes),
less (bug fixes),
cups (bug fixes),
logwatch (bug fixes),
m17n-db (bug fix),
gphoto2 (update to 2.3.1),
hal (bug fix),
libgnomeprint22 (bug fix),
smartmontools (bug fix),
eclipse-cdt (update autotools plug-in to
0.0.6).
Updates for Fedora Core 5: frysk
(split to several rpms), dvd+rw-tools (bug
fix), frysk (new upstream version), xen (add vmxassist fix), less (bug fixes), gphoto2 (update to 2.3.1).
Comments (none posted)
Updates for
Mandriva Linux 2007.0:
lsb (bug fix).
Comments (none posted)
Updates for
rPath Linux 1:
httpd,
mod_ssl (MIME type and path corrections).
Comments (none posted)
Updates for
Trustix Secure Linux 2.2 & 3.0:
hwdata, mysql (various bug fixes).
Comments (none posted)
Updates for
Ubuntu 6.10:
control-center (upload to edgy-updates).
Comments (none posted)
Newsletters and articles of interest
ZDNet
covers the release schedule for Red Hat Enterprise Linux 5.
"
Red Hat Enterprise Linux 5 had been scheduled to ship by the end of 2006. However, the company began giving itself scheduling wiggle room in September, when Red Hat released the first RHEL 5 beta. A second beta arrived in November.
Now Red Hat is being more definitive. "I'm sure we will ship a gold (version) on February 28," Chief Executive Matthew Szulik, referring to the final version, said in an interview after the company reported its quarterly financial results."
Comments (1 posted)
HowtoForge
builds a custom
kernel on a Debian Sarge system. "
Each distribution has some
specific tools to build a custom kernel from the sources. This article is
about compiling a kernel on Debian Sarge systems. It describes how to build
a custom kernel using the latest unmodified kernel sources from
www.kernel.org (vanilla kernel) so that you are independent from the
kernels supplied by your distribution. It also shows how to patch the
kernel sources if you need features that are not in there."
Comments (none posted)
KnoLinux has
an
interview with Sabayon Linux developer Christopher Villareal.
"
Knolinux: Hello Chris, Why did you start working on a new Linux
distro? Chris: Let's see, my gnu/linux experience started about 6
years ago when I started out with the major binary distributions. Since
then, I got agitated by the fact that I didn't have as much control over
the system as I wanted. Then I came to gentoo after trying out some other
source distros due to the tools that were available to me. As such, I was
doing some searching and found a distro called RR4/RR64 which looked
extremely promising. So on Dec. of '05 I joined the forums and started
making post. Soon, I got used to helping others and really enjoyed the RR
experience and had the pleasure to speak with the Lead on occasion. 6
monthes of hard work, I threw the idea to Fabio (lxnay) to become his
co-lead and I really liked the fact of helping people come to an excellent
distro. Its all about the community effort, and I wanted to help.
Currently I am helping maintain the main chroot environment, our custom
overlay, and just managing bugs and interacting with the users through irc,
the forums, and jabber."
Comments (none posted)
HowtoForge
sets up
OpenVZ on a Debian etch system. "
This guide is written during an
install of a Supermicro machine with 2 dual-core opterons (64-bit), 2
identical disks (for RAID) and a load of memory. Why OpenVZ and not XEN or
the recent KVM kernel module? Well, XEN is not very stable for 64-bit
architectures (yet), and it comes with quite a bit of overhead (every VM
runs its own kernel) due to its complexity. KVM is very simple but
restricts you to run a kernel as one process, so the VM cannot benefit from
multi core systems."
Comments (none posted)
Distribution reviews
Linux.com has
a review of
VectorLinux 5.8. "
VectorLinux, a lightweight, fast Linux distribution
for the x86 platform, just released its new version 5.8 this week. This
user-friendly distribution makes the average computer user's life easy by
supplying office software, Web browsing, photo editing, and archiving on
top of a fast, clean Xfce window manager."
Comments (none posted)
Rick Lehrbaum
reviews a
Debian Etch install on an old Thinkpad. "
I began by downloading RC1
of the Debian "testing" net-install CD (aka "etch RC1") iso file from
here. It's a quick download, being a 100-150MB file. I like that. After
burning the CD from the iso, I popped it into the Thinkpad, and booted it
up."
Comments (none posted)
Page editor: Rebecca Sobol
Development
CherryPy is a Python-based
cross-platform object-oriented web development framework:
CherryPy allows developers to build web applications in much the same way they would build any other object-oriented Python program. This usually results in smaller source code developed in less time.
CherryPy is now more than three years old and it is has proven very fast and stable. It is being used in production by many sites, from the simplest ones to the most demanding ones.
The basic operation of CherryPy is explained:
Your CherryPy powered web applications are in fact stand-alone Python applications embedding their own multi-threaded web server. You can deploy them anywhere you can run Python applications. Apache is not required, but it's possible to run a CherryPy application behind it (or IIS).
Passing interactive data to CherryPy is simple:
You write request handler classes that you tie together in a tree of objects, starting with a root object. CherryPy maps incoming request URIs to this object tree. The URI '/' represents the 'root' object, '/users/' the 'root.users' object, and so on. Requests are handled by methods inside these request handler classes.
Examples of a simple
Hello World program and the
passing of GET/POST variables to methods
show the simplicity that CherryPy development offers.
CherryPy version 3.0.0 brings the following
changes:
- The speed has been improved by up to 3X.
- Configuration information can now be attached to page handlers.
- Configuration scopes now have further separation.
- Configuration namespace prefixes have been added to the config info.
- Filters have been replaced by more flexible Tools.
- There are new and improved built-in tools.
- Support for custom tools and toolboxes has been added.
- New Hook and Dispatch methods have been added for dealing with callbacks.
- URL construction has been improved for better handling of portable URLs.
- A reworked Autoreload feature fixes some bugs.
- Improvements have been made to the built-in WSGI server.
- CherryPy application objects are now WSGI applications.
- WSGI middleware callables are now supported.
- The logging system has been improved.
- CherryPy now works better with the Python interactive interpreter.
- Support for InternalRedirect situations has been improved.
- A new engine.drop_privileges function is available for process control.
- CherryPy now natively supports the mod_python Apache extension.
- CherryPy can now support multiple HTTP servers simultaneously.
CherryPy 3.0.0 is available for download
here,
people running older versions should read the
How to upgrade to CherryPy 3.0 document.
Comments (1 posted)
System Applications
Database Software
Version 1.5.4 of the Firebird DBMS
has been announced.
"
This sub-release introduces a number of bug fixes backported from the Firebird 2.0.x branches."
Comments (none posted)
The December 25, 2006 edition of the PostgreSQL Weekly News
is online with the latest PostgreSQL DBMS articles and resources.
Full Story (comments: none)
The January 1, 2007 edition of the PostgreSQL Weekly News
is online with the latest PostgreSQL DBMS articles and resources.
Full Story (comments: none)
Embedded Systems
Stable version 1.3.1 of
BusyBox,
a collection of command line utilities for embedded systems, is out.
"
Closing 2006 with new release. It includes only trivial fixes accumulated since 1.3.0"
Comments (none posted)
Libraries
Version 1.4 of PyTables
has been announced.
"
PyTables is a library for managing hierarchical datasets and designed to
efficiently cope with extremely large amounts of data with support for
full 64-bit file addressing. It is based on the HDF5 library for doing
the I/O and leverages the numarray/NumPy/Numeric packages so as to
deliver the data to the end user in convenient in-memory containers.
This is a new major release of PyTables, and probably the last major one
of the 1.x series (i.e. with numarray at the core). On it, we have
implemented better code to deal with table buffers, enhanced the
capability for reading native HDF5 files, enhanced support for 64-bit
platforms (but not with Python 2.5: see ``Special Warning`` section
below), better support for AIX, optional automatic parent creation and
the traditional amount of bug fixes."
Comments (none posted)
Mail Software
Brice Burgess has sent us an announcement for his
poMMo mailing list manager project.
"
poMMo is versatile mass mailing software. It can be used to add a mailing list to your Web site or to organize stand alone mailings. Unique Features such as the ability to mail subsets of your subscribers set it apart from alternatives. poMMo is written in PHP and freely provided under the GPL."
Full Story (comments: none)
Snapshot 20061229 of the
Postfix
mail transfer agent is out. See the
CHANGELOG file for details.
Comments (none posted)
Desktop Applications
Audio Applications
New versions of the audio applications das_watchdog and jack_capture
have been announced.
"
Whenever a program locks up the machine, das_watchdog will temporarily
sets all realtime process to non-realtime for 8 seconds. You will get an
xmessage window up on the screen whenever that happens. ...
jack_capture is a program for recording soundfiles with jack."
Full Story (comments: none)
KDE.News
has announced
issue #4 of the
Amarok Weekly Newsletter:
"
Late but worthy - thats how one can call this issue of AWN. It talks about
new or updated Amarok features, and continues to provide tips and links to
interesting scripts. As a bonus, kind of New Year gift, we provide you an
experimental RSS feed, for your pleasure. Enjoy!"
Comments (none posted)
Desktop Environments
Version 2.17.4 of the GNOME desktop environment is available.
"
This is our second development release on our road towards GNOME
2.18.0, which will be released in March 2007. New features are coming
in at a nice rate, and that's great. A lot of bug fixes too. And some
crashers are appearing here and there: that's the fun of unstable
releases!"
Full Story (comments: none)
Version 2.17.4 of GARNOME, the bleeding-edge GNOME distribution, is out.
"
This release includes all of GNOME 2.17.4 plus a
whole bunch of updates that were released after the GNOME freeze date.
This is the fourth release in the unstable cycle, with more features,
more fixes and yet more madness added. It is for anyone who wants to get
his hands dirty on the development branch, or who'd like to get a peek
at future features."
Full Story (comments: none)
The migration of the GNOME desktop to the Subversion version control
system has been completed.
"
For those that haven't noticed, the subversion migration is now
complete. In the end, it took about 49 hours. Apologies for the downtime
involved."
Full Story (comments: none)
The following new GNOME software has been announced this week and last:
You can find more new GNOME software releases at
gnomefiles.org.
Comments (none posted)
The December 24, 2006 edition of the
KDE Commit-Digest has been
announced.
The content summary says:
"
A new game, KSquares, is imported into KDE
SVN, with KLines starting on the (now familiar) path towards scalable
graphics and general improvement. Usability and other improvements in Okular.
Support for multiple "identies", alongside a festive basket of other
enhancements in Mailody. Search support and plugin handling improvements in
KGet. In Amarok, the "yauap" engine (a redeveloped GStreamer interface, using
D-Bus interaction) progresses, with support for audio CD's. Improved
OpenFormula specification compliance in KSpread. A much-enhanced
implementation of "run-around text" comes to KWord. A work-in-progress python
parser for KDevelop is imported into KDE SVN. Work begins on the
Oxygen-themed widget style and window decoration for KDE 4."
Comments (none posted)
The December 31, 2006 edition of the
KDE Commit-Digest has been
announced.
The content summary says:
"
The KDE Commit-Digest 2006 retrospective.
blinKen and KNetWalk become the latest applications to move to scalable
graphics. KSquares further develops, with an AI player implemented. More maps
and a more sophisticated divisions and capitals implementation in KGeography.
Support for password-protected RAR archives in the kio_rar interface. Work to
support drag-and-drop of transfers in KGet. Import of "koregressions" test
suite for KOffice. Longstanding KWeather and KHTML bugs fixed. Major
refactoring in the "sonnet" natural language checker. Version 1.0 of Eigen,
the library for vector and matrix math, is released."
Comments (none posted)
The following new KDE software has been announced this week:
You can find more new KDE software releases at
kde-apps.org.
Comments (none posted)
KDE.News
presents a short
overview of some of features going into KDE 4. "
Since KDE 4
development is in full swing with plans for a KDE 4.0 release sometime
later this year, I thought I'd put together a weekly piece entitled The
Road to KDE 4. The idea is to have a short overview of one or two of the
features that show progress in KDE 4. For my first issue, the goal is to
show off some of the great SVG work that has taken place so far."
Comments (31 posted)
The following new Xorg software has been announced this week and last:
More information can be found on the
X.Org Foundation wiki.
Comments (none posted)
Electronics
Version 1.1.0 of
KJWaves,
a Java program for viewing RAW SPICE electronic simulation files,
has been announced.
"
New version allows adding of traces to previous graphs and improves on ability to add current through a component analysis."
Comments (none posted)
Games
Version 1.2 of the game Battle for Wesnoth
has been announced.
"
The single player mode has a new tutorial, and 3 new campaigns: Two Brothers, The South Guard, and Under the Burning Suns. The first one was intentionally designed to be easy for beginning players. The last one is set in an environment quite different from that of the typical Wesnoth campaign, and includes a few changes to game rules. The existing campaigns include new scenarios, dialogue, items, and optional bonus victory objectives. Replay of saved games has been improved considerably, allowing one to show single turns at a time, navigate through the replay, and toggle fog-of-war at will." Many more changes have been included.
Comments (none posted)
Imaging Applications
Version 0.0.2 of
PDFCube
is out.
"
PDF Cube is an OpenGL API-based PDF viewer that adds a compiz/Keynote-like spinning cube tra[n]sition effect to your PDF presentations (including Latex, Beamer and Prosper). You can also zoom on 5 predefined areas of any presentation page with a smooth zooming effect."
Comments (none posted)
Interoperability
Version 0.9.28 of Wine
has been announced. Changes include:
OpenGL in child windows should work again,
Better mouse support in games,
Beginnings of new state management in Direct3D,
Improved audio and font support on Mac OS and Lots of bug fixes.
Comments (none posted)
Medical Applications
LinuxMedNews
reports on the Linux port of Synapse EMR, an electronic medical
record system.
"
Synapse EMR port to Linux has now gone beta. Download from
http://www.compkarori.com/emr/linux/. Almost all of the non-Windows specific functionality is now available for the Linux client."
Comments (none posted)
Music Applications
Version 1.2.0 of amSynth, a virtual music synthesizer, is out.
Changes include better graphics, better MIDI all-off handling,
a new about dialog, better installation and bug fixes.
Full Story (comments: none)
Version 0.7.1 of BEAST/BSE and BSE-ALSA have been announced, it features
a security fix and other improvements.
"
This is a development version of BEAST/BSE, the BEdevilled Audio SysTem
and the Bedevilled Sound Engine. BEAST is a powerful music composition
and modular synthesis application released as free software under the
GNU GPL and GNU LGPL, that runs under unix. BSE-ALSA is an ALSA driver
for BSE."
Full Story (comments: none)
Version 1.9.5 of
RTSynth,
a midi event triggered real time synthesizer is out with support for
dynamically loaded jack drivers, a new --polyvoice command line option
and bug fixes.
Full Story (comments: none)
Office Applications
Release 1.2 of Bruce The Presentation Tool has been announced.
"
Bruce the Presentation Tool is for Python programmers who are tired
of fighting with presentation tools. In its basic form it allows
text, code or image pages and even interactive Python sessions. It
uses PyGame and is easily extensible to add new page types."
Full Story (comments: none)
Office Suites
The December, 2006 edition of the OpenOffice.org Newsletter
is out with the latest OO.o office suite articles and events.
Full Story (comments: none)
Science
The
ANUGA
hydrodynamic modeling system has been launched.
"
ANUGA is a software implementation of a hydrodynamic model which is
specifically designed to model wetting and drying processes. ANUGA
implements a Finite-Volumes technique for solving the Shallow Water Wave
Equations. ANUGA is a joint development project between Geoscience Australia
(GA) and the Australian National University (ANU) and is being used to
simulate the impact from natural disasters such as tsunami and storm-surge
on coastal communities. ANUGA is also suitable for detailed dam-break
simulations."
Full Story (comments: none)
Web Browsers
Versions 1.5.0.9 of the Mozilla Firefox web browser and the
Mozilla Thunderbird email client
have been announced.
"
Security and Stability updates for Mozilla products based on the Gecko 1.8.0 branch have been released.
Firefox 1.5.0.x will be maintained with security and stability updates until April 24, 2007. All users are strongly encouraged to upgrade to Firefox 2."
Comments (none posted)
Version 2.0.0.1 of the Mozilla Firefox web browser
has been announced.
"
Mozilla Firefox 2.0.0.1, a security and stability update for
Firefox 2, has been released. This release addresses several critical
security issues. All users are encouraged to upgrade to this release."
Comments (1 posted)
Languages and Tools
Caml
The December 26, 2006 edition of the Caml Weekly News
is out with new Caml language articles.
Full Story (comments: none)
The January 2, 2007 edition of the Caml Weekly News
is out with new Caml language articles.
Full Story (comments: none)
FORTRAN
A year end status report for Gfortran, the GNU FORTRAN compiler project,
has been published.
"
Gfortran has achieved many milestones this year and hopefully the
contributors can continue to move forward with bug fixes, conformance
to Fortran 95 standard, and the implementation of Fortran 2003 features."
Full Story (comments: none)
Haskell
The January 2, 2007 edition of the
Haskell Weekly News is online. This week brings a new release of vty and HsColour, and some interesting discussion over the holiday break.
Comments (none posted)
Java
Chris Adamson
looks at recent and upcoming Java developments on O'Reilly.
"
2006 will be remembered as the year that Sun open-sourced Java
under the GPL, that EJB 3.0 finally shipped, and that Google surprised
everyone with its Google Web Toolkit. But how will history record the
results of these events? For the 2006 year-ender, ONJava editor Chris
Adamson looks at the year's events through the lens of how they may play
out in 2007."
Comments (8 posted)
Ralf Stuckert
discusses the latest changes to JUnit on java.net.
"
Let's face it, JUnit is the most widely used (unit-) testing tool in the Java world. There are other powerful test frameworks out there, such as TestNG (which is very comprehensive), but they've never enjoyed the broad acceptance JUnit has. With version 4, Kent Beck and Erich Gamma introduced the first significant API changes in the last few years. When the first release candidate was available back in 2005, you could hardly use it in a productive working environment due to the lack of tool support at that time. By now, most build tools and IDEs come with support for JUnit 4, so it's about time to give it a try. This article describes what's different compared to JUnit 3.8.x."
Comments (none posted)
Perl
The December 17-23, 2006 edition of the
Weekly Perl 6 mailing list summary is out with coverage of the latest
Perl 6 developments.
Comments (none posted)
The December 24-30, 2006 edition of the
Weekly Perl 6 mailing list summary is out with coverage of the latest
Perl 6 developments.
Comments (none posted)
Curtis Poe
solves some problems using Perl 6 in an O'Reilly article.
"
Have you wanted to start playing with Perl 6 but find yourself wondering what to write? I use Pugs, a Perl 6 implementation being written in Haskell and have been tremendously enjoying Perl 6. Like many, Im impatient, but the work on Perl 6 has been progressing quite well and Im quite keen to see the alpha. However, if youre like me, you probably do better with a new language by actually writing something in it. Well, not only do I have something for you to write, you can actually help out the Perl 6 effort!"
Comments (none posted)
Ruby
Pat Eyler
looks ahead
to Ruby developments in 2007 in a Linux Journal article.
"
Last week, I looked back at Ruby in 2006. This week, it's time to look ahead. Here are 10 Ruby things I think are going to be hot in 2007:"
Comments (none posted)
Tcl/Tk
The December 29, 2006 edition of Dr. Dobb's Tcl-URL! is online with new
Tcl/Tk articles and resources.
Full Story (comments: none)
The January 2, 2007 edition of the Tcl-URL! is online with new
Tcl/Tk articles and resources.
Full Story (comments: none)
XML
XML.com presents an article by David Orchard entitled
A Theory of Compatible Versions.
"
Creating XML languages that are compatible and extensible is a difficult problem. This week David Orchard argues for a theory of compatibility in which he describes some of the conditions for creating compatible XML languages."
Comments (none posted)
Debuggers
Robert O'Callahan
talks about the Amber debugger project in his web log.
"
I have built a system, which I'm calling Amber, to record the complete execution history of arbitrary Linux processes. The history is recorded using binary instrumentation based on Valgrind. The history is indexed to support efficient queries that debuggers need, and then compressed and written to disk in a format optimized for later query and retrieval. The history supports efficient reconstruction of the contents of any memory location or register at any point in time. It also supports efficient answers to "when was the last write to location X before time T", "when was location P executed between times T1 and T2", and other kinds of queries. I can record the 4.1 billion instructions of a Firefox debug build starting up, displaying a Web page, and exiting; the compressed, indexed trace is about 0.83 bytes per instruction executed."
(Thanks to Jerome Lacoste.)
Comments (3 posted)
IDEs
Version 3.9.3 of eric3, an IDE for Python and Ruby,
is available.
"
This release fixes a few bugs and enhances compatibility with
subversion 1.4."
Comments (none posted)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
Peter Gutmann has posted
a lengthy
look at the costs of the DRM features built into Windows Vista.
Reading it is a sort of Alice-in-Wonderland experience, highly recommended.
"
If a graphics chip is integrated directly into the motherboard and
there's no easy access to the device bus then the need for bus encryption
is removed. Because the encryption requirement is so onerous, it's quite
possible that this means of providing graphics capabilities will suddenly
become more popular after the release of Vista. However, this leads to a
problem: It's no longer possible to tell if a graphics chip is situated on
a plug-in card or attached to the motherboard, since as far as the system
is concerned they're both just devices sitting on the AGP/PCIe bus. The
solution to this problem is to make the two deliberately incompatible, so
that HFS can detect a chip on a plug-in card vs. one on the
motherboard."
Comments (67 posted)
Don Marti
takes a
look at his predictions for 2006 and makes some new predictions for
2007. "
"Platforms get granular for self-defense. Tired of worms that
attack software you don't use, but that you need to patch anyway because
it's part of the 'platform'? In 2006, you'll get better dependency checking
to deploy just what you need, and update services that are smart enough not
to bug you about software you don't need to update because you don't have
it." Partial hit. The hot distribution was Ubuntu, which borrows
its easier to manage approach from Debian. Package management is getting
better all the time, but there still aren't enough tools to detect software
that isn't being used and encourage new sysadmins to remove it."
Comments (13 posted)
Glyn Moody
examines
the advantages of distribution forks in a Linux Journal article.
"
This is one of free software's greatest and least-appreciated strengths: the fact that it can continue to evolve in an almost organic fashion, untrammelled by constraints of economics, or even feasibility. It is this fecundity that drives free software forward unstoppably, and that distinguishes it from the sterile code monster that is Windows, which, trapped within the carapace of its closed source, only slouches towards Redmond to be born every five years or so."
The article mentions the
Linux distribution timeline, which gives a graphical representation
of distribution forks.
Comments (23 posted)
Companies
Groklaw
reports that Samba hacker Jeremy Allison has left Novell in protest. "
Whilst the Microsoft patent agreement is in place there is *nothing* we can do to fix community relations. And I really mean nothing.
We can pledge patents all we wish, we can talk to the press and "community leaders", we can do all the right things w.r.t. all our other interactions, but we will still be known as GPL violators and that's the end of it."
Comments (39 posted)
The Register
reports on some recent high profile SUSE Linux subscription customers.
"
Three big financial firms have come out of the closet and confirmed they have taken delivery of SUSE Linux subscriptions from Microsoft.
Deutsche Bank, Credit Suisse and AIG Technologies have all signed up to the Franken-deal in the belief that it will make it easier to run Linux-based systems alongside Microsoft software."
Comments (none posted)
Linux-Watch
looks at Red
Hat's financial results. "
Red Hat Inc. on Dec. 21 announced its
financial results for its fiscal year 2007 third quarter. The Raleigh,
NC-based Linux company's numbers were, in a word, great. The total revenue
for the quarter was $105.8 million, an increase of 45 percent from the
year-ago quarter and 6 percent from the prior quarter. Subscription revenue
was $88.9 million, up 48 percent year-over-year and 5 percent
sequentially."
Comments (5 posted)
Linux at Work
Joe 'Zonker' Brockmeier
takes a look at a web-controlled Christmas light display that is
powered by Linux.
"
During the holiday season, Komarnitsky says that he runs four Linux servers to keep up with the load -- one for each webcam, and one that serves up the pages to the public. Komarnitsky says that the entire system is run by Linux, with the exception of the laptop that displays messages typed in by users.
Komarnitsky uses three D-Link DCS-6620G webcams, one of which was donated by D-Link."
Comments (none posted)
Legal
Bloomberg
briefly reports on a software patent suit filed against Apple, Google, and Napster. "
Culver City, California-based Intertainer's investors include Microsoft Corp., the world's biggest software maker, and Intel Corp., the world's biggest semiconductor maker." The patent in question would appear to be
#6,925,469, which covers distribution of "digital media content" in very general terms.
Comments (6 posted)
Interviews
The Red Herring
interviews
Mark Shuttleworth. "
Microsoft and others, a lot of them say that
free software and open source is all about copying what was being done
before in proprietary software, and for a lot of time that was true. The
world we are seeing is that, as soon as the free software reaches a point
where it's as good as the proprietary software, suddenly all the
innovation shifts to the free software."
Comments (2 posted)
Resources
Ubuntu Geek
takes a look at a number of network bandwidth monitoring tools.
"
Here is the list of bandwidth monitoring tools for your network bandwidth: bmon, bwbar, bwm, bwm-ng, iftop, iperf, ipfm,
speedometer, cbm, ibmonitor, pktstat, mactrack, MRTG, Cacti.
Now we will see each tool separately."
Comments (none posted)
The
January edition of
Linux Gazette is available. Articles include Fun with FUSE, Mounting
remote resources as filesystems via FUSE (Filesystem in Userspace), Away
Mission -- OracleWorld '06, San Francisco, Installing Mandriva, OSI, GAP,
and "Exhibit B" licences, Perl One-Liner of the Month: The Count of Corpus
Christi (TX), and much more.
Comments (none posted)
Reviews
Dave Phillips
reviews Aldrin on
Linux Journal.
"
For the past month I've been building and playing with Leonard 'paniq' Ritter's Aldrin, a music production system that combines a tracker-style composition interface with audio synthesis and processing modules called machines. Users of the famous Buzz music software will probably recognize Aldrin's design at once. In fact, it may be fair to describe Aldrin as Leonard Ritter's interpretation of the original Buzz."
Comments (none posted)
Dave Phillips
looks at DSP software in the Linux Journal. "
[Sonic Visualizer] truly emphasizes visualization, with data view formats such as various spectrograms, amplitude waveform, piano roll (for MIDI plot), chronogram, pitch envelope, and power curve. The user scrolls through the views with the Navigate cursor (the pointing hand) and uses the Select tool (the arrow) to make selections within the view. Edits are limited to cut/copy/paste, but the program isn't intended for audio processing. It is primarily a tool for audio analysis and visualization, and an excellent tool at that. Highly recommended for serious research and viewing enjoyment."
Comments (none posted)
Yahoo has
an
AP article on the OLPC project. "
Nicholas Negroponte, who
launched the project at the Massachusetts Institute of Technology's Media
Lab two years ago before spinning One Laptop into a separate nonprofit,
said he deliberately wanted to avoid giving children computers they might
someday use in an office.
'In fact, one of the saddest but most common conditions in elementary
school computer labs (when they exist in the developing world), is the
children are being trained to use Word, Excel and PowerPoint,' Negroponte
wrote in an e-mail interview. 'I consider that criminal, because children
should be making things, communicating, exploring, sharing, not running
office automation tools.'"
Comments (10 posted)
Linux.com
reviews
a book about OpenOffice.org. "
OpenOffice.org expert Solveig Haugland
has published a massive new manual called the OpenOffice.org 2 Guide. This
520-page tome will be useful both for OOo newbies and power users who are
interested in learning arcane features of the office suite. What does
Haugland's $28 book have that the free online guides don't? The primary
distinction is that Haugland's book is one work in one place, whereas the
community's guides are available for sale in the form of separate books on
the main OOo programs (Writer, Calc, Draw, Impress) for generally $10 to
$20, or for free download."
Comments (none posted)
Linux.com
looks at
Thunderbird 2.0. "
After many months of development, Thunderbird 2.0
is almost ready to debut. The Mozilla Foundation released the first beta of
Thunderbird 2.0 last week, and I've been using it to manage my mail since
then. The new release boasts tagging, history navigation, new mail alerts,
improved extension support, and a number of other features. Thunderbird 2.0
won't knock your socks off with exciting new features, but it's a nice,
gradual improvement over the Thunderbird 1.5 series."
Comments (2 posted)
Linux.com
looks at
the Google Toolbar 3 beta for Firefox. "
I tested the toolbar with
Firefox 2.0 and Flock 0.7.9. You'll see a warning before you install the
toolbar on Flock that the extension wasn't designed specifically for Flock,
but I haven't run into any problems with it so far in Flock. Once I had it
installed, I signed out of Google services and signed in using the Google
Toolbar sign-in feature. I was then authenticated for Gmail, Google Apps,
Google Bookmarks, Blogger, and the whole kit and caboodle of Google
services I tried, with the exception of AdSense."
Comments (1 posted)
ZDNet
looks at
a new release of Xen, a commercial virtualization system.
"
On a desktop system, Xen virtualization promises to keep separate zones for test, work, personal and management software. So far, however, that promise has been hampered by a major weakness: the inability to display multiple graphical user interfaces for these "guest" operating systems.
Xen 3.0.4 changes this. By including what's called a virtual frame buffer, Xen's controlling "host" operating system can capture video data written to a specific part of memory and then send it to the display. The technology lets users see virtual machines through a graphical interface, a feat competitors such as EMC's VMware can already accomplish, rather than the text-based command line suitable chiefly for the technically proficient."
Comments (11 posted)
Miscellaneous
NewsForge
reports that Lawrence Lessig has retired from his position as the
Creative Commons chairman of the board.
"
After four successful years of revolutionizing how content is shared in the real world, Lawrence Lessig, founding chairman of Creative Commons, announced his retirement as chairman of the board last week. Lessig passed the CC torch to Joi Ito, a venture capitalist from Japan.
Creative Commons (CC) is a non-profit organization and is known for its Creative Commons copyright licenses. "We provide free licenses," Lessig writes, "that mark creative work with the freedom the creator wants it to carry, so others can share the work, or remix the work, or both share and remix the work, as the author chooses.""
Comments (none posted)
ZDNet Korea
looks at antbear, a desktop search system that addresses problems
in the searching of text written with Asian character sets.
"
Advanced word recognition technology gives more reliable search results Linux desktop search, thus far, had some limitations due to its lacking features compared to Windows environment that has various features. Although 'Beagle' has been available for supporting Korean and other Asian languages (Chinese, Japanese), its 'bigram' search method in many situations fails to recognize true meanings of Asian characters for the search. For example, it breaks down and indexes the search word(s) into two separate characters, which can generate unrelated results. The reliability of the search result gets even worse when its search is based on larger number of files."
Comments (2 posted)
ZDNet
reports
that the nonprofit Internet Archive has received a million dollar grant
from the Alfred P. Sloan Foundation. "
The archiving organization's
Open-Access Text Archive is an open-source alternative to book-scanning
efforts like the ones from Google and Microsoft. Internet Archive, perhaps
best known for its WayBack Machine archive of Web pages by date--is also an
online digital library of text, audio, software, images and video
content."
Comments (none posted)
Linux.com
looks at
the Free Software Foundation. "
The list of the community-based
actions the FSF has taken in the past year is a long one. It begins with an
expanded role for some of its longstanding institutions. Throughout the
year, the FSF's high-priority list seems to have exerted some influence on
such items as the open source release of the Java code and the growing
interest in LinuxBIOS by chipset manufacturers. Similarly, the FSF's
compliance lab, although now more than five years old, enlisted five
volunteers to answer licensing questions using a ticket system, and now
fields more than 75 questions each week, according to compliance engineer
Brett Smith. In the last couple of years, too, rather than maintaining just
the GNU Project Web site, the FSF has also started a non-developer site
that Peter Brown, executive director of the FSF, describes as carrying
"more of a mainstream message.""
Comments (33 posted)
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
It seems that the Council of the European Union has a
streaming service so that
people can watch the meetings. That's a great idea, but they are using a
proprietary format for the feed so that it can only be viewed on Microsoft
Windows and Macintosh platforms. From the
FAQ:
On which platforms can I view the live streaming media service of the
Council of the European Union?
The live streaming media service of the Council of the European Union can
be viewed on Microsoft Windows and Macintosh platforms. We cannot support
Linux in a legal way. So the answer is: No support for Linux
A
petition
has been created by Stefan Esterer, asking the council to make the feed
available to all by using a free codec. So if you are in the European
Union and would like to watch the council meetings you should consider
signing the petition.
Comments (35 posted)
The Free Ryzom Campaign has
announced that
its bid to buy the Ryzom game from its bankrupt creator was turned down by
the court. "
At the end, there were three offers presented, and the
other two were bigger than our's. They are keeping more employees than we
do, and offer more money." The project is now
discussing how it
could continue and achieve its goal of creating a free multi-player
online game. With the energy and resources they have pulled together, they
could yet do interesting things. (Thanks to Dafydd Walters).
Comments (4 posted)
The
nouveau driver
project is working on an open source 3D acceleration driver for nVidia
cards. To help out the project David Nielsen has started a
pledge drive. He's
looking for 1000 people to each pledge $10 USD by February 8, 2007.
Comments (12 posted)
The One Laptop Per Child project has sent out
a press
release proclaiming the virtues of the user interface it has
developed. "
The Sugar UI, jointly developed with Red Hat and
Pentagram, is the first to have been purpose-built as an educational
environment for children using laptops. It is designed to support the
learning experiences of elementary- and secondary-school children in poor,
often rural communities by providing them with opportunities to freely
explore, experiment and express themselves."
Comments (2 posted)
The One Laptop Per Child project has
announced
that Rwanda will be rolling out OLPC systems. "
In recognition of
children being Rwanda's most precious natural resource, the government of
Rwanda has committed to provide one laptop per child to all primary school
children within five years."
Comments (14 posted)
Commercial announcements
Digium has announced the availability of "AsteriskNOW," a version of
Asterisk bundled with an (unspecified) Linux distribution. It is claimed
that, with AsteriskNOW, a functioning Asterisk phone system can be up and
running within 30 minutes.
All the software is GPL, but registration is required to download it.
Worse, registration requires agreeing to terms of use including this gem:
"Digium hereby authorizes you to copy materials published by Digium
on the Website solely for non-commercial use by you or internally within
your organization (or if you are a Digium Distributor or Partner, your
customer's organization) solely in support of Digium products. No other use
of the information is authorized."
Update: the problem with the terms of use has been fixed.
Full Story (comments: 19)
eyeon Software
has announced the availability of Fusion for Linux.
Fusion is a visual effects software system.
"
Based on the recent December release of version 5.1, Fusion on Linux is the companys next universal platform initiative.
We have been working hard on Fusion Linux, discovering along the way the necessary changes required to provide a product equal to the task of both the Fusion and Linux communities. And were really proud to deliver this in time for the holidays
I need some sleep and a beer."
Comments (none posted)
OpenMFG has announced version 2.0 of OpenRPT, a dual-licensed
report writer.
"
OpenRPT 2.0 was retooled from the ground up to take full advantage of the underlying Qt 4
framework. Qt is an open source, comprehensive development framework that includes an extensive
array of features, capabilities and tools that enable development of high-performance,
cross-platform rich-client and server-side applications. Among the new OpenRPT features enabled by
updating from Qt 3 to Qt 4 is the ability to export to Adobe PDF natively for both the OpenRPT API
and the rendering application."
Full Story (comments: none)
The OpenVZ project now runs on the Sun UltraSPARC T1 processor.
"
The OpenVZ project today announced its open source virtualization
software is available for servers using Sun's breakthrough UltraSPARC(r) T1
CoolThreads(TM) processor. The operating system-level server virtualization
software technology helps increase server utilization rates."
Full Story (comments: none)
Red Hat
has announced their third quarter FY2007 financial results.
"
Total revenue for the quarter was $105.8 million, an increase of 45% from the year-ago quarter and 6% from the prior quarter. Subscription revenue was $88.9 million, up 48% year-over-year and 5% sequentially.
Net income for the quarter was $14.6 million or $0.07 per diluted share compared with $11.0 million or $0.05 per diluted share for the prior quarter. Non-GAAP adjusted net income for the quarter was $29.6 million, or $0.14 per diluted share, after adjusting for stock compensation and tax expense as detailed in the tables below. This compares to non-GAAP adjusted net income of $22.7 million, or $0.11 per diluted share in the third quarter of last fiscal year."
Comments (none posted)
Resources
David A. Wheeler presents
an essay
that looks at how commercial and open-source software are not mutually
exclusive entities.
"
When I talk with with other people about Free-Libre / Open Source Software (FLOSS), I still hear a lot of people mistakenly use the term commercial software as if it had the opposite meaning of FLOSS (aka open source software, Free-Libre Software, or OSS/FS). Thats in spite of the rise in commercial development and support for FLOSS, most FLOSS projects goal to incorporate improvements, which are actually a form of financial gain, official definitions of commercial item that include FLOSS, and FLOSS licenses and projects that clearly approve of commercial support. Terms like closed source or proprietary software are plausible antonyms of FLOSS, but commercial is absurd as an antonym."
Comments (25 posted)
Contests and Awards
LinuxQuestions.org has
announced
that voting for the
2006
LinuxQuestions.org Members Choice Awards is now open. The Members
Choice Awards allow the Linux community to select their favorite products
in a variety of categories. Awards will be given out in 21 categories this
year, including Distribution of the Year, Browser of the Year, Office Suite
of the Year, Desktop Environment of the Year and Database of the Year. The
polls will close on February 18th and the winners will be announced shortly
after.
Comments (none posted)
Surveys
KDE.News
has announced
a new
survey
for BasKet Note Pads.
"
The aim of the BasKet Usability Project is to improve the usability of the BasKet Note Pads tool. Usability, as I (the project maintainer) see it, not only depends on the user interface, but also on the underlying assumptions that are made about the users and their context of use. So, knowledge of users, their contexts and claims are of vital importance for improving usability."
Comments (none posted)
Education and Certification
Sys Admin has published a free
Samba quiz.
"
Samba is one of those technologies that you must know if you are working with integration today. Its importance is such that it is a focal point of the newly announced LPIC-3 certification from the Linux Professional Institute. Following are fifty questions on general aspects of Samba that anyone working with it at an advanced level should know. Good luck (answers are at the end of the article)!"
Comments (none posted)
Calls for Presentations
A call for participation has gone out for
ICMC 2007,
the International Computer Music Conference.
"
We are pleased to announce the general call for submission to the
International
Computer Music Conference 2007, which will take place at Holmen Island in
Copenhagen
starting Monday, August 27 and ending Saturday, September 1st, 2007.
We invite original contributions in all areas of the computer music
field in a number of formats. We are also open to any proposal,
and encourage all submissions, including those that do not fit the
categories below."
The submission deadline is April 30.
Full Story (comments: none)
A
call for papers has gone out for SambaXP 2007.
"
From April 23th to 25th 2007 developers and users will meet again in Goettingen, Germany at the sixth international SAMBA conference, the "samba eXPerience 2007"." Papers are due by February 5.
Comments (none posted)
The next
ShmooCon will take place in
Washington DC on March 23-25, 2007. Papers are due by mid January.
Full Story (comments: none)
O'Reilly has announced the 2007 Tools of Change for Publishing Conference
along with a call for proposals.
"
To raise the level of technology knowledge in the
publishing industry and to provide a meeting ground for those leading the
charge into the future of publishing, O'Reilly Media is launching the
first Tools of Change for Publishing (TOC) Conference. The TOC Conference
will take place June 18-20, 2007 in San Jose, California. The call for
participation is now open; proposals are due no later than January 22,
2007."
Full Story (comments: none)
Upcoming Events
The European Patent Conference will take place in
Brussels, Belgium on January 24, 2007.
"
EUPACO-1 is the second in a series of events aimed at constructing a
new European patent system through dialogue and collaboration based on
research and data."
Full Story (comments: none)
A call for location has gone out for the 2007 OpenOffice.org Conference.
"
The annual OpenOffice.org Conference (OOoCon) continues to go from
strength to strength, with this year's glittering event in Lyon,
France attracting over 600 registrations and enjoying a civic
reception laid on by the Mayor of Lyon in the historic town hall.
Can your team do even better next year?"
The deadline for choosing the location has been extended to January 31, 2007.
Full Story (comments: none)
Events: January 11, 2007 to March 12, 2007
The following event listing is taken from the
LWN.net Calendar.
| Date(s) | Event | Location |
January 11 January 12 |
Foundations of Open Media Software |
Sydney, Australia |
January 15 January 20 |
linux.conf.au 2007 |
Sydney, Australia, |
January 20 January 26 |
Cell Hack-a-thon |
Loveland, CO, USA |
January 23 January 26 |
Open Source Meets Business |
Nürnberg, Germany |
| January 24 |
European Patent Conference |
Brussels, Belgium |
January 30 February 1 |
Solutions Linux Expo |
Paris, France |
February 1 February 2 |
LinuxDays Luxembourg |
Luxembourg, Luxembourg |
| February 2 |
FUDCon Boston 2007 |
Boston, MA, USA |
February 7 February 9 |
Free Software World Conference 3.0 |
Badajoz, Spain |
February 7 February 9 |
Xorg Developer's Conference |
Santa Clara, CA, USA |
| February 9 |
Women In Open Source |
Los Angeles, USA |
| February 9 |
Open Source Health Care Summit |
Los Angeles, USA |
February 10 February 11 |
2007 Southern California Linux Expo |
Los Angeles, USA |
February 12 February 13 |
Vancouver PHP Conference |
Vancouver, BC, Canada |
February 12 February 13 |
Linux Storage and Filesystem Workshop |
San Jose, CA, USA |
February 12 February 16 |
Ruby on Rails Bootcamp Training |
Atlanta, USA |
February 12 February 15 |
3GSM World Congress 2007 |
Barcelona, Spain |
February 14 February 15 |
LinuxWorld OpenSolutions Summit |
New York, NY, USA |
| February 15 |
TiE Open Source Summit |
Pittsburgh, PA, USA |
| February 16 |
The Ubucon New York |
New York, NY, USA |
February 19 February 23 |
DebianEDU DevCamp |
Soissons, France |
| February 22 |
PyCon Tutorial Day |
Addison, Texas, |
| February 22 |
CELF Japan Linux Technical Jamboree #13 |
Tokyo, Japan |
February 22 February 24 |
OpenMind 2007 |
San Giorgio a Cremano, Naples, Italy |
February 23 February 25 |
PyCon 2007 |
Addison, Texas, |
| February 23 |
PHP Conference UK 2007 |
London, England |
February 24 February 25 |
Free and Open Source Software Developers' European Meeting |
Brussels, Belgium |
February 24 February 25 |
Java/DevJam/2007/Fosdem |
Brussels, Belgium |
February 26 March 1 |
PyCon Sprints |
Addison, Texas, |
February 26 March 2 |
PHP5 Bootcamp Training at the Big Nerd Ranch |
Atlanta, Georgia, USA |
February 27 March 1 |
O'Reilly Emerging Telephony Conference |
San Francisco, CA, |
February 27 March 2 |
EUSecWest Applied Security Conference |
London, UK |
February 28 March 2 |
Network and Distributed System Security Symposium |
San Diego, CA, USA |
March 2 March 3 |
LinuxForum 2007 |
Copenhagen, Denmark |
March 3 March 8 |
O'Reilly Emerging Technology Conference |
San Diego, CA, USA |
March 5 March 8 |
EclipseCon 2007 |
Santa Clara, CA, USA |
March 5 March 6 |
Karlsruhe Workshop on Software Radios |
Karlsruhe, Germany |
March 8 March 10 |
2007 Open Source Think Tank |
Napa, CA, USA |
March 10 March 13 |
Camp 5 Advanced Zope3 Training |
Charlotte, North Carolina, USA |
If your event does not appear here, please
tell us about it.
Web sites
The
GNU Herds site has been launched.
"
GNU Herds is a not-for-profit and true-democratic association which
aims to encourage the professional development of Free Software
contributors."
Full Story (comments: none)
Page editor: Forrest Cook
Letters to the editor
| From: |
| James Rich <james-AT-eaerich.com> |
| To: |
| letters-AT-lwn.net |
| Subject: |
| Recent comments |
| Date: |
| Wed, 27 Dec 2006 13:59:38 -0700 (MST) |
Dear Editor,
Recent comments posted to articles on LWN have not been of the usual
quality I have come to expect from LWN readers. A number of comments have
been rude, used foul language, and consisted of personal attacks and
childish name calling. I would like to ask LWN readers to please
carefully consider their comments before posting them. LWN is not the
place for such behaviour. The Internet is certainly large enough that
such comments can find a more suitable forum.
James Rich
It's not the software that's free; it's you.
- billyskank on Groklaw
Comments (14 posted)
Page editor: Jonathan Corbet