The seventh linux.conf.au, held in Sydney, has run its course. Your editor
has written several articles based on what was discussed there, but they do
not even begin to do justice to this event. In an attempt to fill in some
of the gaps, this article will cover some of the remaining high points,
from your editor's point of view.
One interesting talk was Jono Bacon's discussion of Jokosher, a relatively new entrant into
the crowded field of audio recording and editing tools. Jono wanted a
simple and useful tool to help in the creation of podcasts and his
particular variety of frenetic metal music, but the currently-available
studio tools were rather intimidating in their complexity. So he made a
new one, giving a lot of thought in the process to how it might actually be
used. Jokosher features a simpler waveform display, large buttons (easy
to hit by a standing guitarist), tools which don't clutter the display when
they are not relevant, etc. Version 0.2 is usable; there is a 0.9 release
coming soon. Your editor has not yet had a chance to play with Jokosher,
but it's on the list for that mythical day (always next month) when he has
some free time.
Virtualization was a hot topic at the event - registrations for the
associated miniconf exceeded those for the Debian miniconf, the first time
Debian has ever been upstaged. During the main conference, Rusty Russell,
Jeremy Fitzhardinge, Zachary Amsden, and Chris Wright all got together to
present the Lguest, Xen, and VMI technologies. It was good to see that many
developers from competing projects (competing for business as well as for
developers and mindshare) having fun together on stage, even if the short
time slot did not allow for the conveyance of a great deal of technical
information. Given the level of interest in Lguest, it really should have
had a session of its own. An unexpected lesson from this session concerned
the hazards of leaving a popup-enabled IRC client running on a
network-connected laptop during a presentation. One does not normally
expect one's slides to turn into a real-time wiki. The audience is to be
commended for its restrained and tasteful use of this new communication
path.
The kernel miniconf was well attended - to the point that it displaced
Debian from the largest room. Your editor attended a panel session where
various topics of interest were discussed. On Xen: "crap is good - it
shows you how not to do stuff." The ongoing maintenance of 2.6.16 was
described as "mostly irrelevant" and "a nice try." The developers
expressed their general happiness with the new development model, and Linus
Torvalds claimed that there would only be a 2.7 kernel when some smart new
hacker wrests control of the kernel away. David Miller noted that he does
miss the old development kernels, however; it is harder now to make major
changes which break things for long periods of time. There was also a
session on suspend and resume where a couple of laptops were made to work -
with Linus, at one point, getting up and jumping into the process.
A true high point of the conference was "Open Day," a sort of exhibit
populated by people doing truly interesting things with Linux and more.
The event was open to the public, with the hope that children, in
particular, would attend. The display of enthusiasm, ingenuity, and just
plain fun was breathtaking; it was an expression of the spirit which
infuses the entire conference. Open Day showed off games (TuxRacer,
Stepmania, Wesnoth, etc.), a home-made Segway-like device, serious amateur
rocketry, the Qtopia Green Phone, Blender, MythTV, and much more. RepRap was worth the price of admission by
itself; RepRap is a 3D printer which can create its own parts - and which
is powered by free software, of course.
The reaction from participants and attendees was strong - it is hard not to
be swept away by that many people passionately doing amazing things. Open Day is
a great addition to the LCA program; hopefully next year's conference will
do it again.
Andi Kleen talked about the "generations" of kernel hackers and how well
they work with the development process. The Janitor Generation does useful
work, but there needs to be better ways of graduating janitors to more
complex projects. The "login name tree" generation created a proliferation
of specialized kernel trees - useful before the arrival of BitKeeper, when
the patch submission process was much more lossy. The "Russian
mathematician" generation will be familiar to anybody who watches the
kernel lists; Andi suspects that some of them are actually a room full of
hackers working under a single name. The "deadline generation" has been
brought about by the new kernel development process: there is now
significant pressure for maintainers to get their patches in during the
brief merge window period. Andi complains that kernel development used to
be more relaxed before the merge window came into existence. The
"bugmaster generation," alas, does not exist yet; it's an opportunity for
somebody to become famous.
The final keynote was presented by Kathy Sierra, who is, perhaps, better
known in the Java community. She talked about how to create passionate
users - those who will put free software on their desktops and get their
friends to do it as well. The ideas presented are the sort which seem
obvious after the fact (help users "suck less" at what they do, provide
"levels" like games do to reward increasing expertise, make a supportive
community), but, all together, they make a compelling picture of how we can
develop more empathy for our users and bring more people in. The talk was
well received, and rightly so.
Linux.conf.au hit some interesting milestones this time around. At some
800 attendees, it was by far the largest LCA event yet. Even more
significant is the fact that a full 10% of those attendees were female.
Any community which feels that 10% female participation is worthy of
celebration clearly has some ground to cover yet, but that's where we
stand. 10% is a step in the right direction and a base from
which the community can work to fully include a group of people whose
energy and perspective is sorely needed.
It is hard to imagine an event better suited to bringing people into our
community in general. Your editor has attended quite a few Linux and free
software events on a number of continents, but there are few which bring
together the combination of serious technology, community, and flat-out fun
found at LCA. The LCA formula, which involves a fresh group of volunteers
running the show with guidance from past veterans, does well at preserving
a successful model while bringing in new energy and ideas. The result is
one of the most vibrant, vital, and (increasingly) important free software
events anywhere on the planet. Your editor hopes to be lucky enough to
report from LCA2008 (to be held in Melbourne) next year.
[Postscript: one of the standout performances in this nearly flawlessly run
conference is the group, led by Silvia Pfeiffer, which recorded the
presentations. Recordings hit the web site while the conference was still
open, and the rest are being added quickly. See the
program page to view the talks - in free formats, of course.]
Comments (4 posted)
Andrew Tanenbaum is a huge figure in the field of computer science;
developers who work in the area of operating systems tend to have at least
one of his books on their shelf. Linus Torvalds also occupies a prominent
position. But when these two people are discussed together, the topic is
![[Linus and Andrew]](/images/conf/lca2007/lt-ast-sm.jpg)
almost always the
famous
debate between the two which happened early in the history of Linux.
Mr. Tanenbaum called Linux "obsolete," and made it clear that he would not
have been proud to have Mr. Torvalds as a student; Linus made some choice
comments of his own in return.
So it was pleasant to see Andrew Tanenbaum introduced in Sydney by none
other than Linus Torvalds. According to Linus, Andrew introduced him to
Unix by way of Minix. Minix also convinced Linus (wrongly, he says) that
writing an operating system was not hard. The similarities between the
two, he said, far outweigh any differences they may have had.
The talk began with a quoting of Myhrvold's laws: (1) software is a
gas which expands to fill its container, and (2) software is getting
slower faster than hardware is getting faster. Software bloat, he says, is
a huge problem. He discussed the size of various Windows releases, ending
up with Windows XP at 60 million lines. Nobody, he says,
understands XP. That leads to situations where people - even those well
educated in computer science, do not understand their systems and cannot
fix them.
The way things should be, instead, is described by the "TV model."
Generally, one buys a television, plugs it in, and it just works for ten
years. The computer model, instead, goes something like this: buy the
computer, plug it in, install the service packs, install the security
patches, install the device drivers, install the anti-virus application,
install the anti-spyware system, and reboot...
...and it doesn't work. So call the helpdesk, wait on hold, and be told to
reinstall Windows. A recent article in the New York Times reported that
25% of computer users have become so upset with their systems that they
have hit them.
So what we want to do is to build more reliable systems. The working
definition of a reliable system is this: a typical heavy user never
experiences a single failure, and does not know anybody who has ever
experienced a failure. Some systems which can meet this definition now
include televisions, stereos, DVD players, cellular phones (though some in
the audience have had different experiences), and automobiles (at least,
with regard to the software systems they run). Reliability is possible,
and it is necessary: "Just ask Grandma."
As an aside, Mr. Tanenbaum asked whether Linux was more reliable than
Windows. His answer was "probably," based mainly on the fact that the
kernel is much smaller. Even so, doing some quick back-of-the-envelope
calculations, he concluded that there must be about 10,000 bugs in the
Linux kernel. So Linux has not yet achieved the level of reliability he is
looking for.
Is reliability achievable? It was noted that there are systems which can
survive hardware failures; RAID arrays and ECC memory were the examples
given. TCP/IP can survive lost packets, and CDROMs can handle all kinds of
read failures. What we need is a way to survive software failures too.
We'll have succeeded, he says, when no computer comes equipped with a reset
button.
It is time, says Mr. Tanenbaum, to rethink operating systems. Linux, for
how good it is, is really a better version of Multics, a system which dates
from the 1960's. It is time to refocus, bearing in mind that the
environment has changed. We have "nearly infinite" hardware, but we have
filled it with software weighed down with tons of useless features. This
software is slow, bloated, and buggy; it is a bad direction to have taken.
To achieve the TV model we need to build software which is small, modular,
and self-healing. In particular, it needs to be able to replace crashed
modules on the fly.
So we get into Andrew Tanenbaum's notion of "intelligent design," as
applied to software. The core rules are:
- Isolate components from each other so that they cannot interfere
with each other - or even communicate unless there is a reason to do
so.
- Stick to the "principle of least authority"; no component should have
more privilege than it needs to get its job done.
- The failure of one component should not cause others to fail.
- The health of components should be monitored; if one stops operating
properly, the system should know about it.
- One must be prepared to replace components in a running system.
There is a series of steps to take to apply these principles. The first is
to move all loadable modules out of the kernel; these include drivers,
filesystems, and more. Each should run as a separate process with limited
authority. He pointed out that this is beginning to happen with Linux with
the interest in user-space drivers - though it is not clear how far Linux
will go in that direction.
Then it's time to isolate I/O devices. One key to reliability is to do
away with memory-mapped I/O; it just brings too many race conditions and
opportunities for trouble. Access to devices is through I/O ports, and
that is strictly limited; device drivers can only work with the ports they
have been specifically authorized to use. Finally, DMA operations should
be constrained to memory areas which the driver has been authorized to
access; this requires a higher level of support from the hardware, however.
The third step is minimizing privileges to the greatest extent possible.
Kernel calls should be limited to those which are needed to get a job done;
device drivers, for example, should not be able to create new processes.
Communication between processes should be limited to those which truly need
to talk to each other. And, when dealing with communications, a faulty
receiver should never be able to block the sender.
Mr. Tanenbaum (with students) has set out to implement all of this in
Minix. He has had trouble with people continually asking for new features,
but, he has been "keeping it simple waiting for the messiah." That remark
was accompanied with a picture of Richard Stallman in full St. Ignucious
attire. Minix 3 has been completely redesigned with reliability in
mind; the current version does not have all of the features described, but
3.1.3 (due around March) will.
Minix is a microkernel system, so, at the bottom level, it has a very small
kernel. It handles interrupts, the core notion of processes, and the
system clock. There is a simple inter-process communication mechanism for
sending messages around the system. It is built on a request/reply
structure, so that the kernel always knows which requests have not yet been
acted upon.
There is also a simple kernel API for device drivers. These include
reading and writing I/O ports (drivers do not have direct access to ports),
setting interrupt policies, and copying data to and from a process's
virtual address space. For virtual address space access, the driver will
be constrained to a range of addresses explicitly authorized by the calling
process.
Everything else runs in user mode. Low-level user-mode processes include
the device drivers, filesystems, a process server, a "reincarnation
server," an information server, a data store, a network server
(implementing TCP/IP), and more. The reincarnation server's job is to be
the parent of all low-level system processes. It gets notified if any of
them die, and occasionally pings them to be sure that they are still
responsive. Should a process go away, a table of actions is consulted to
see how the system should respond; often that response involves restarting
the process.
If, for example, a disk driver dies, the reincarnation server will start a
new one. It will also tell the filesystem process(es) about the fact that
there is a new disk driver; the filesystems can then restart any requests
that had been outstanding at the time of the failure. Things pick up where
they were before. Disks are relatively easy to handle this way; servers
which maintain a higher level of internal or device state can be harder.
A key point is that most operating system failures in deployed systems tend
to result from transient events. If a race condition leads to the demise
of a device driver, that same race is unlikely to repeat after the driver
is restarted. Algorithmic errors which are repeatable will get fixed
eventually, but the transient problems can be much harder to track down.
So the next best thing is to be able to restart failing code and expect
that things will work better the second time.
There were a number of performance figures presented. Running disk
benchmarks while occasionally killing the driver had the unsurprising
result of hurting performance a bit - but the system continued to run.
Another set of numbers made the claim that the performance impact of the
microkernel architecture was on the order of 5-10%. It's worth noting that
not everybody buys those numbers; there were not a whole lot of details on
how they were generated.
In summary, Mr. Tanenbaum listed a number of goals for the Minix project.
Minix may well be applicable for high-reliability systems, and for embedded
applications as well. But, primarily, the purpose is to demonstrate the
the creation of ultra-reliable systems is possible.
The talk did show that it is possible to code systems which can isolate
certain kinds of faults and attempt to recover from them. It was an
entertaining and well-presented discussion. Your editor has not, however,
noticed a surge of sympathy for the idea of moving Linux over to a
microkernel architecture. So it is not clear whether the ideas presented
in this talk will have an influence over how Linux is developed in the
future.
Comments (87 posted)
The X Window System is, in some sense, the kernel of our graphical desktop
systems; it controls access to the hardware and ensures that applications
play well together. So the capabilities provided by X matter, and that
importance can only increase as free software developers work toward the
![[Keith Packard]](/images/conf/lca2007/keithp-sm.jpg)
creation of more complete and compelling desktop experiences. Keith
Packard gave a couple of talks at linux.conf.au in Sydney on where X is
going; your editor had no choice but to be there and listen.
In its early days, X would normally be run on some sort of Unix
workstation. The display hardware in use in those days was not normally
expected to change while X was running - or over the life of the system in
general. One connected The Monitor to The Adapter and things stayed that
way forevermore. So the X protocol was set up to enumerate all of the
available screens whenever an application made its connection. There was no
way to add more screens on the fly or change their geometry, and there was
no way to move windows from one screen to another. Fixing this was a hard
problem.
As graphics hardware has become more powerful and flexible, a number of
extensions have been developed in an attempt to provide proper support in
X. The Xinerama extension uses a clever technique: merging all of
the monitors into a single, large, virtual screen. Applications can then
move between monitors, because they think they are just moving around on
the same screen. The XFree86 VidModeExtension tried to address hardware
changes by allowing the video modes to be changed on the fly. Then along
came the first version of the Resize and Rotate (RandR) extension, which
tried to improve the handling of mode changes and implement rotation -
especially useful on handheld devices, where the screen can be used in both
landscape and portrait orientations. RandR 1.0 was limited by a policy
(imposed by the XFree86 maintainers) that the driver API could not be
changed; as a result it was nowhere near as flexible as its developers
would have liked.
All of this came together into "a kludge tower of extensions" which was
guaranteed to fall down, sooner or later.
Since then, the X Window System has come under new management and the need
for display flexibility has continued to grow. Enter RandR 1.2, soon
to come to an X server near you. The new RandR release comes with the
intention of being able to fully express (and use) the capabilities of the
hardware. All configuration options will be brought back together into a
single file, and they will all be adjustable at run time. Much of the
driver-specific code has been moved back into the core, allowing all
hardware to be configured in the same way. This was a much-needed change;
according to Keith there are currently five independent Xinerama
implementations in the X server.
RandR 1.2 uses a combination of new and old concepts. A "screen" retains
its current meaning, and the one big screen is still present. Each screen,
however, can work with one or more "CRT controllers," (CRTCs) each of which
grabs a rectangular portion of the big screen and sends it to a monitor
(highly unlikely to actually be a CRT anymore). Each CRTC, in turn, has
one or more outputs which connect to physical devices.
The flexibility of this approach was easily demonstrated on Keith's shiny
little laptop. The hardware is able to implement a 2K pixel square screen,
which is then scanned by three different CRTCs: the built-in display, the
video output, and the (unconnected) TV output. By default, they all look
at the same portion of the screen, but, with a little command line magic,
that can be changed. So Keith's laptop can display an entirely
different set of windows out of each CRTC; the video output can send his
talk slides to the projector while the laptop screen shows something else.
The display areas can overlap if desired.
If a new monitor is plugged into the system, the RandR code will detect the
event and react accordingly. The new output will be turned on and given
screen space according to whatever policy is in effect. If need be, the
user's desktop area will be expanded to cover a wider display. Similar
things happen if a monitor is removed. It all Just Works.
While he was at it, Keith extended RandR to cover some other useful
hardware capabilities. These include the ability to configure the gamma
lookup table, allowing for on-the-fly contrast and brightness adjustments.
Applications can get the monitor's EDID identification data, should they be
interested, and parameters like the brightness of the backlight can be
tweaked.
The current status is that the protocol and device-independent work are
done. The Intel driver works now, and the Radeon driver is "nearly
usable." This code is getting ready for people to use.
When most people will actually use this code depends on the release
schedule, however. At a separate talk (in the middle of the Debian
miniconf) Keith covered what's coming up from the X.org project.
Coming soon is the X server 1.2 release. This one looks mostly like a
maintenance release; Keith says that a lot of Coverity-found bugs have been
fixed. Things have been cleaned up to the point that this release has
40,000 fewer lines of code - but more functionality. Keith noted that the
policy of splitting the X drivers from the core server has not worked as
well as they would have liked. It adds a whole set of API compatibility
issues between the two, making it hard to develop and release improved
versions of the server. Keith now thinks that the Linux kernel developers
got it right by keeping drivers inside the kernel.
LibX11 1.1.1 is coming soon. The big change there is that the new XCB
interface is being used underneath the old Xlib API, making it easy to
migrate applications in an incremental manner.
Later on we can expect release 1.2.1 of the X server. This release will
include an EXA acceleration implementation "that actually works." The
RandR 1.2 code described above will also make its appearance here.
Further ahead, the 1.3 release (to be part of a general X.org 7.3 release)
will include significant ABI changes. A lot of the "PCI munging" is coming
out of the drivers. Yes, he said, this will mess up the proprietary NVidia
and ATI drivers. There will also be better support for hotplugging of
input devices.
There is a Mesa 6.5.2 release coming with OpenGL 2.0 API support. It also
has
a new memory manager which can work with the memory management unit found
in modern graphics cards; it can do things like map arbitrary regions of
host memory into the adapter's address space. Among other things, this
means that off-screen objects can be made writable, which will be a big
performance win.
On the Intel driver front, the mode setting code has been much improved in
recent times. Not surprisingly (considering that Keith works for Intel
these days), this driver is the first to have full RandR 1.2 support.
All outputs are fully supported, and EXA is as well. Intel has set a goal
of having drivers available for new chipsets on the day those chipsets are
launched. When asked if Intel planned to start selling discrete adapters,
he became very silent, however.
Looking further ahead, the X developers would like to move video card mode
setting into the kernel. There are a lot of reasons for doing this,
starting with simple robustness. It would also enable better suspend and
resume support, and better handling of panics: if the system goes into an
oops, an in-kernel mode-setting routine can switch back to a text mode,
allowing the oops text to actually be read. There is a lot of interest in
supporting multiple, simultaneous X sessions on the same screen without
using Linux virtual terminals; the goal here is to enable fast switching
between user accounts. And there is interest in H.264 acceleration,
facilitating the display of important things like HDTV. It seems that even
contemporary CPUs can have trouble keeping up with HDTV streams.
Overall, Keith painted a picture of a revitalized X project which is truly
beginning to hit its stride. A lot of work is being done toward the goals
of fully supporting current hardware and providing the foundation for the
creation of the best desktop available anywhere. One cannot help but look
forward to where things will go from here.
Comments (55 posted)
Page editor: Jonathan Corbet
Security
January 24, 2007
This article was contributed by Jake Edge.
A buzzword dense
press release
announcing a new open source project for 'identity management' is hardly
the kind of thing to set hearts to racing. The release did succeed
on one level, however, as it made us wonder what the
openLiberty project is and what it
can do for open source developers. Follow along as we try to shed
some light on the world of internet identities and the standards, protocols
and organizations involved.
An 'internet identity' means different things to different people; often
depending on how they want to use this identity information. A website
owner that allows comments has much less strict requirements for what an
identity is than a hospital or stock broker might have. Some identities
need to be tied to specific individuals, those used for e-commerce, for
instance, whereas others can have
pseudonymity.
Privacy concerns
also play a role in that a user does not necessarily always want to provide
the same information to all parties they want to establish an identity
with; LWN should not (and does not) require your government ID number
in order for one to post comments here, but a stock broker might very
well need it.
The sponsor of openLiberty is the
Liberty Alliance, which is a
consortium of vendors that seeks to provide standards for identity-based
web services. This organization was started by Sun Microsystems in 2001
as a competitor to Microsoft's Passport (aka
Windows Live ID)
single sign-on system. At the time, many were concerned that Microsoft
would become the gatekeeper of internet identity management and that would
likely guarantee that competitors were locked out. Sun put together around 30
vendors and some ideas they had been working on to form the alliance with
the plan to provide open, standards-based solutions for identity management.
Since that time, the alliance has come out with various specifications for
what is, by all accounts, a complex, centralized system for identity
management based around Security
Assertion Markup Language (SAML). SAML is an emerging OASIS standard
that describes the protocol for identity providers to communicate with
service providers to authenticate users. The alliance system is popular with
larger organizations that typically have tighter requirements for identity
management. Websites and services that have simpler needs have largely used
OpenID (LWN article
here) to facilitate single
sign-on.
The openLiberty project is an attempt to attract more interest, especially
from the open source community, in the Liberty system, presumably
to help drive more adoption. The website is a portal geared towards developing
open source libraries to implement various alliance specifications.
The first project is a java client library implementing the
Identity
Web Services Framework (ID-WSF) to provide single sign-on and other
identity-enabled web services. The portal has all the expected features:
a blog, a wiki, a mailing list, a source code repository (hosted by
sourceforge), etc.
As might be expected of a project that has just been announced, there are
few messages in the mailing list archive and the participant list appears
to be largely made up of Liberty Alliance members. Based on the wealth
of information available on the website, the project has already done a lot
of the groundwork to establish the portal. It remains to be seen if it
attracts a significant number of non-allied developers. Choosing a java
client library to start would seem to eliminate some sizable portion of
interested parties; other languages are on the roadmap and that might be
enough to lure in non-java developers.
An interesting convergence of identity management solutions seems to be going
on in the background right now. Proponents of the different systems all
see the benefits
of interoperability and there appear to be some efforts underway to allow
OpenID and Liberty to work together. There is even talk that
Microsoft may join the party and make some kind of effort to interoperate
with Liberty.
There are clear benefits to users in having one system to manage their
internet identity (or identities) across the universe of web services
they might wish to use. Simplicity of implementation for web service
providers and differing levels of security for different classes of service
are also good features to have. One of the ways to get there is by having
competing systems that can interoperate relatively transparently and it
seems like we may be headed in that direction.
Comments (1 posted)
New vulnerabilities
centericq: buffer overflow
| Package(s): | centericq |
CVE #(s): | CVE-2007-0160
|
| Created: | January 24, 2007 |
Updated: | January 24, 2007 |
| Description: |
The code in centericq which interfaces with the LiveJournal service suffers from a buffer overflow. This vulnerability is exploitable if a user can be convinced to connect to an unofficial LiveJournal server. |
| Alerts: |
|
Comments (none posted)
ed: symlink attack
| Package(s): | ed |
CVE #(s): | CVE-2006-6939
|
| Created: | January 19, 2007 |
Updated: | January 24, 2007 |
| Description: |
GNU ed before 0.3 allows local users to overwrite arbitrary files via a
symlink attack on temporary files, possibly in the open_sbuf function. |
| Alerts: |
|
Comments (none posted)
gtk2: denial of service
| Package(s): | gtk2 |
CVE #(s): | CVE-2007-0010
|
| Created: | January 24, 2007 |
Updated: | February 8, 2007 |
| Description: |
From the Red Hat advisory: A bug was found in the way the gtk2 GdkPixbufLoader() function processed
invalid input. Applications linked against gtk2 could crash if they
loaded a malformed image file. |
| Alerts: |
|
Comments (1 posted)
java: multiple vulnerabilities
| Package(s): | java |
CVE #(s): | CVE-2006-4339
CVE-2006-4790
CVE-2006-6731
CVE-2006-6736
CVE-2006-6737
CVE-2006-6745
|
| Created: | January 18, 2007 |
Updated: | June 4, 2010 |
| Description: |
java has multiple vulnerabilities, these include:
an RSA exponent padding attack vulnerability, two vulnerabilities
which allow untrusted applets to access data in other applets,
vulnerabilities that involve applets gaining privileges due to
serialization bugs in the JRE and buffer overflows in the java image
handling routines that can give attackers read/write/execute capabilities
for local files. |
| Alerts: |
|
Comments (1 posted)
netrik: insufficient escaping
| Package(s): | netrik |
CVE #(s): | CVE-2006-6678
|
| Created: | January 22, 2007 |
Updated: | January 24, 2007 |
| Description: |
It has been discovered that netrik, a text mode WWW browser with vi like
keybindings, doesn't properly sanitize temporary filenames when editing
textareas which could allow attackers to execute arbitrary commands via
shell metacharacters. |
| Alerts: |
|
Comments (none posted)
poppler: denial of service
| Package(s): | poppler |
CVE #(s): | CVE-2007-0104
|
| Created: | January 18, 2007 |
Updated: | January 26, 2007 |
| Description: |
Poppler, a PDF loader library does not limit the recursion depth of
the page model tree. If an attacker can trick a user into opening a
specially crafted PDF file, an infinite loop can be caused, leading
to a crash of the calling application. This also affects
kdegraphics and koffice. |
| Alerts: |
|
Comments (none posted)
squid: denial of service
| Package(s): | squid |
CVE #(s): | CVE-2007-0247
|
| Created: | January 18, 2007 |
Updated: | January 26, 2007 |
| Description: |
Squid, a web client proxy caching server, can be made to crash when
receiving certain FTP listings, leading to a denial of service. |
| Alerts: |
|
Comments (1 posted)
xine: format string vulnerabilities
| Package(s): | xine |
CVE #(s): | CVE-2007-0017
|
| Created: | January 23, 2007 |
Updated: | August 10, 2007 |
| Description: |
Multiple format string vulnerabilities in (1) the cdio_log_handler function
in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and
the (2) cdio_log_handler and (3) vcd_log_handler functions in
modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in
VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to
execute arbitrary code via format string specifiers in an invalid URI, as
demonstrated by a udp://-- URI in an M3U file. |
| Alerts: |
|
Comments (none posted)
xsupplicant: potential code execution
| Package(s): | xsupplicant |
CVE #(s): | CVE-2006-5601
|
| Created: | January 19, 2007 |
Updated: | January 24, 2007 |
| Description: |
A post-authentication stack overflow in the EAP handling could be used by
already authenticated attacker to overflow a stack buffer and so
potentially execute code. |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
acroread: multiple vulnerabilities
| Package(s): | acroread |
CVE #(s): | CVE-2006-5857
CVE-2007-0045
CVE-2007-0046
|
| Created: | January 11, 2007 |
Updated: | October 26, 2009 |
| Description: |
Adobes acrobat reader has the following vulnerabilities:
The Adobe Reader Plugin has a cross site scripting vulnerability that
can be triggered by processes malformed URLs. Arbitrary JavaScript can
be served by a malicious web server, leading to a cross-site scripting
attack.
Maliciously crafted PDF files can be used to trigger two vulnerabilities,
if an attacker can trick a user into viewing the files, arbitrary code
can be executed with the user's privileges. |
| Alerts: |
|
Comments (1 posted)
apache: cross-site scripting
| Package(s): | apache |
CVE #(s): | CVE-2006-3918
|
| Created: | August 9, 2006 |
Updated: | April 4, 2008 |
| Description: |
From the Red Hat advisory: "A bug was found in Apache where an invalid Expect header sent to the server
was returned to the user in an unescaped error message. This could
allow an attacker to perform a cross-site scripting attack if a victim was
tricked into connecting to a site and sending a carefully crafted Expect
header." |
| Alerts: |
|
Comments (none posted)
apache-mod_auth_kerb: off-by-one error
| Package(s): | apache-mod_auth_kerb |
CVE #(s): | CVE-2006-5989
|
| Created: | November 24, 2006 |
Updated: | January 23, 2007 |
| Description: |
An off-by-one error in the der_get_oid function in mod_auth_kerb 5.0 allows
remote attackers to cause a denial of service (crash) via a crafted
Kerberos message that triggers a heap-based buffer overflow in the
component array. |
| Alerts: |
|
Comments (none posted)
bind: denial of service
| Package(s): | bind |
CVE #(s): | CVE-2006-4095
CVE-2006-4096
|
| Created: | September 7, 2006 |
Updated: | February 1, 2007 |
| Description: |
Bind has two denial of service vulnerabilities.
Recursive servers queries for SIG records will trigger an assertion
failure if more than one RR set is returned.
An INSIST failure can be triggered by sending a large number of
recursive queries. |
| Alerts: |
|
Comments (none posted)
bluez-utils: hidd vulnerability
| Package(s): | bluez-utils |
CVE #(s): | CVE-2006-6899
|
| Created: | January 16, 2007 |
Updated: | May 14, 2007 |
| Description: |
hidd in BlueZ (bluez-utils) before 2.25 allows remote attackers to obtain
control of the Mouse and Keyboard Human Interface Device (HID) via a
certain configuration of two HID (PSM) endpoints, operating as a server,
aka HidAttack. |
| Alerts: |
|
Comments (none posted)
bugzilla: multiple vulnerabilities
| Package(s): | bugzilla |
CVE #(s): | CVE-2006-5453
CVE-2006-5454
CVE-2006-5455
|
| Created: | November 10, 2006 |
Updated: | August 28, 2007 |
| Description: |
Bugzilla has the following vulnerabilities:
Input data passed to various fields is not properly sanitized before
being passed back to users.
Users can gain unauthorized access to read attachment
descriptions while using diff mode.
HTTP GET and HTTP POST requests can be used to perform unauthorized
actions due to improper verification.
Input that is passed to showdependencygraph.cgi is not properly
sanitized before being returned to users. |
| Alerts: |
|
Comments (none posted)
busybox: insecure password generation
| Package(s): | busybox |
CVE #(s): | CVE-2006-1058
|
| Created: | May 5, 2006 |
Updated: | May 2, 2007 |
| Description: |
The BusyBox 1.1.1 passwd command does not use a proper salt when generating
passwords. This would create an instance where a brute force attack could
take very little time. |
| Alerts: |
|
Comments (2 posted)
cacti: multiple vulnerabilities
| Package(s): | cacti |
CVE #(s): | CVE-2006-6799
|
| Created: | January 1, 2007 |
Updated: | January 26, 2007 |
| Description: |
The network monitoring and graphing frontend Cacti has three vulnerabilities.
The cmd.php script allows command line usage and is also installed in a
web-accessible location. The cmd.php input is insufficiently sanitized,
a passed-in URL can be used to inject arbitrary SQL code.
The cmd.php script can be used by a remote attacker to execute arbitrary
shell commands via improperly sanitized results from SQL queries. |
| Alerts: |
|
Comments (none posted)
cpio: arbitrary code execution
| Package(s): | cpio |
CVE #(s): | CVE-2005-4268
|
| Created: | January 2, 2006 |
Updated: | March 17, 2010 |
| Description: |
Richard Harms discovered that cpio did not sufficiently validate file
properties when creating archives. Files with e. g. a very large size
caused a buffer overflow. By tricking a user or an automatic backup
system into putting a specially crafted file into a cpio archive, a
local attacker could probably exploit this to execute arbitrary code
with the privileges of the target user (which is likely root in an
automatic backup system). |
| Alerts: |
|
Comments (none posted)
vixie-cron: privilege escalation
| Package(s): | cron |
CVE #(s): | CVE-2006-2607
|
| Created: | May 31, 2006 |
Updated: | June 1, 2009 |
| Description: |
The Vixie cron daemon does not check the return code from setuid(); if that call can be made to fail, a local attacker may be able to execute commands as root. |
| Alerts: |
|
Comments (1 posted)
cscope: buffer overflows
| Package(s): | cscope |
CVE #(s): | CVE-2006-4262
|
| Created: | October 2, 2006 |
Updated: | June 16, 2009 |
| Description: |
Will Drewry of the Google Security Team discovered several buffer overflows
in cscope, a source browsing tool, which might lead to the execution of
arbitrary code. |
| Alerts: |
|
Comments (none posted)
cscope: buffer overflows
| Package(s): | cscope |
CVE #(s): | CVE-2004-2541
|
| Created: | May 22, 2006 |
Updated: | June 19, 2009 |
| Description: |
A buffer overflow in Cscope 15.5, and possibly multiple overflows, allows
remote attackers to execute arbitrary code via a C file with a long
#include line that is later browsed by the target. |
| Alerts: |
|
Comments (1 posted)
Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of Service
| Package(s): | cyrus-sasl |
CVE #(s): | CVE-2006-1721
|
| Created: | April 21, 2006 |
Updated: | September 4, 2007 |
| Description: |
Cyrus-SASL contains an unspecified vulnerability in the DIGEST-MD5
process that could lead to a Denial of Service. An attacker could possibly
exploit this vulnerability by sending specially crafted data stream to the
Cyrus-SASL server, resulting in a Denial of Service even if the attacker is
not able to authenticate. |
| Alerts: |
|
Comments (none posted)
dbus: denial of service
| Package(s): | dbus |
CVE #(s): | CVE-2006-6107
|
| Created: | December 15, 2006 |
Updated: | February 12, 2007 |
| Description: |
Unspecified vulnerability in the match_rule_equal function in bus/signals.c
in D-Bus before 1.0.2 allows local applications to remove match rules for
other applications and cause a denial of service (lost process messages). |
| Alerts: |
|
Comments (none posted)
dovecot: index cache file handling error
| Package(s): | dovecot |
CVE #(s): | CVE-2006-5973
|
| Created: | November 29, 2006 |
Updated: | May 8, 2007 |
| Description: |
The dovecot IMAP server has an error in its index cache file handling code which could be exploited by an authenticated user to execute arbitrary code. Only servers with the (non-default) mmap_disable=yes option setting are vulnerable. |
| Alerts: |
|
Comments (none posted)
elinks: arbitrary file access
| Package(s): | elinks |
CVE #(s): | CVE-2006-5925
|
| Created: | November 16, 2006 |
Updated: | October 22, 2009 |
| Description: |
The elinks text-mode browser has an arbitrary file access vulnerability
in the Elinks SMB protocol handler. If a user can be tricked into
visiting a specially crafted web page, arbitrary files may be read or
written with the user's permissions. |
| Alerts: |
|
Comments (none posted)
fetchmail: password disclosure and DOS
| Package(s): | fetchmail |
CVE #(s): | CVE-2006-5867
CVE-2006-5974
|
| Created: | January 10, 2007 |
Updated: | March 16, 2007 |
| Description: |
Fetchmail suffers from a password disclosure vulnerability due to a failure to use secure protocols (advisory) and a denial of service vulnerability (advisory). |
| Alerts: |
|
Comments (none posted)
ffmpeg: buffer overflows
| Package(s): | ffmpeg |
CVE #(s): | CVE-2006-4799
CVE-2006-4800
|
| Created: | September 14, 2006 |
Updated: | May 28, 2007 |
| Description: |
the AVI processing code in FFmpeg has a number of buffer overflow
vulnerabilities.
If an attacker can trick a user into loading a specially crafted
crafted AVI, arbitrary code can be executed with the user's privileges. |
| Alerts: |
|
Comments (2 posted)
Mozilla stuff: multiple vulnerabilities
Comments (none posted)
freeradius: several vulnerabilities
| Package(s): | freeradius |
CVE #(s): | CVE-2005-4745
CVE-2005-4746
|
| Created: | August 8, 2006 |
Updated: | April 24, 2007 |
| Description: |
Several remote vulnerabilities have been discovered in freeradius, a
high-performance RADIUS server, which may lead to SQL injection or denial
of service. |
| Alerts: |
|
Comments (none posted)
freetype: integer overflows
| Package(s): | freetype |
CVE #(s): | CVE-2006-0747
CVE-2006-1861
CVE-2006-2493
CVE-2006-2661
CVE-2006-3467
|
| Created: | June 8, 2006 |
Updated: | June 1, 2010 |
| Description: |
The FreeType library has several integer overflow vulnerabilities.
If a user can be tricked into installing a specially
crafted font file, arbitrary code can be executed with the privilege
of the user. |
| Alerts: |
|
Comments (none posted)
ftpd: privilege escalation
| Package(s): | ftpd |
CVE #(s): | CVE-2006-5778
|
| Created: | November 10, 2006 |
Updated: | February 14, 2007 |
| Description: |
Ftpd is vulnerable to a privilege escalation attack,
an incorrect seteuid() call can be used by an FTP user to gain
unauthorized access to files or directories. |
| Alerts: |
|
Comments (none posted)
gcc: file overwrite vulnerability
| Package(s): | gcc |
CVE #(s): | CVE-2006-3619
|
| Created: | September 6, 2006 |
Updated: | March 14, 2008 |
| Description: |
The fastjar utility found in the GNU compiler collection does not perform adequate file path checking, allowing the creation or overwriting of files outside of the current directory tree. |
| Alerts: |
|
Comments (none posted)
gdb: buffer overflow
| Package(s): | gdb |
CVE #(s): | CVE-2006-4146
|
| Created: | September 15, 2006 |
Updated: | June 12, 2007 |
| Description: |
A buffer overflow in dwarfread.c and dwarf2read.c debugging code in GNU
Debugger (GDB) 6.5 allows user-assisted attackers, or restricted users, to
execute arbitrary code via a crafted file with a location block
(DW_FORM_block) that contains a large number of operations. |
| Alerts: |
|
Comments (none posted)
gdm: improper file permissions
| Package(s): | gdm |
CVE #(s): | CVE-2006-1057
|
| Created: | April 19, 2006 |
Updated: | May 2, 2007 |
| Description: |
The .ICEauthority file may be created with the wrong ownership and permissions; gdm 2.14.2 fixes the problem. |
| Alerts: |
|
Comments (none posted)
gedit: format string vulnerability
| Package(s): | gedit |
CVE #(s): | CAN-2005-1686
|
| Created: | June 9, 2005 |
Updated: | February 5, 2009 |
| Description: |
A format string vulnerability has been discovered in gedit. Calling
the program with specially crafted file names caused a buffer
overflow, which could be exploited to execute arbitrary code with the
privileges of the gedit user. |
| Alerts: |
|
Comments (1 posted)
geoip: path traversal
| Package(s): | geoip |
CVE #(s): | CVE-2007-0159
|
| Created: | January 10, 2007 |
Updated: | January 24, 2007 |
| Description: |
Geoip fails to do sanity checking on returned filenames, opening up a path traversal vulnerability. |
| Alerts: |
|
Comments (none posted)
gnupg: stack overwrite
| Package(s): | gnupg |
CVE #(s): | CVE-2006-6235
|
| Created: | December 12, 2006 |
Updated: | March 13, 2007 |
| Description: |
A "stack overwrite" vulnerability in GnuPG (gpg) allows attackers to
execute arbitrary code via crafted OpenPGP packets that cause GnuPG to
dereference a function pointer from deallocated stack memory. |
| Alerts: |
|
Comments (3 posted)
grip: buffer overflow
| Package(s): | grip |
CVE #(s): | CAN-2005-0706
|
| Created: | March 10, 2005 |
Updated: | November 19, 2008 |
| Description: |
Grip, a CD ripper, has a buffer overflow vulnerability that can
occur when the CDDB server returns more than 16 matches. |
| Alerts: |
|
Comments (none posted)
gv: stack-based buffer overflow
| Package(s): | gv |
CVE #(s): | CVE-2006-5864
|
| Created: | November 20, 2006 |
Updated: | April 9, 2007 |
| Description: |
Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv
3.6.2, and possibly earlier versions, allows user-assisted attackers to
execute arbitrary code via a PostScript (PS) file with certain headers that
contain long comments, as demonstrated using the DocumentMedia header. |
| Alerts: |
|
Comments (none posted)
gzip: multiple vulnerabilities
| Package(s): | gzip |
CVE #(s): | CVE-2006-4334
CVE-2006-4335
CVE-2006-4336
CVE-2006-4337
CVE-2006-4338
|
| Created: | September 19, 2006 |
Updated: | January 20, 2010 |
| Description: |
Tavis Ormandy of the Google Security Team discovered two denial of service
flaws in the way gzip expanded archive files. If a victim expanded a
specially crafted archive, it could cause the gzip executable to hang or
crash.
Tavis Ormandy of the Google Security Team discovered several code execution
flaws in the way gzip expanded archive files. If a victim expanded a
specially crafted archive, it could cause the gzip executable to crash or
execute arbitrary code. |
| Alerts: |
|
Comments (1 posted)
horde-kronolith: local file inclusion
| Package(s): | horde-kronolith |
CVE #(s): | CVE-2006-6175
|
| Created: | January 17, 2007 |
Updated: | March 7, 2008 |
| Description: |
Kronolith contains a mistake in lib/FBView.php where a raw, unfiltered
string is used instead of a sanitized string to view local files. An
authenticated attacker could craft an HTTP GET request that uses directory
traversal techniques to execute any file on the web server as PHP code,
which could allow information disclosure or arbitrary code execution with
the rights of the user running the PHP application (usually the webserver
user). |
| Alerts: |
|
Comments (none posted)
imagemagick: buffer overflows
| Package(s): | imagemagick |
CVE #(s): | CVE-2006-5868
|
| Created: | November 28, 2006 |
Updated: | February 16, 2007 |
| Description: |
Daniel Kobras discovered multiple buffer overflows in ImageMagick's SGI
file format decoder. By tricking a user or an automated system into
processing a specially crafted SGI image, this could be exploited to
execute arbitrary code with the user's privileges. |
| Alerts: |
|
Comments (1 posted)
ImageMagick: buffer overflows
| Package(s): | ImageMagick |
CVE #(s): | CVE-2006-5456
|
| Created: | October 31, 2006 |
Updated: | March 8, 2007 |
| Description: |
Multiple buffer overflows in GraphicsMagick before 1.1.7 and ImageMagick
6.0.7 allow user-assisted attackers to cause a denial of service and
possibly execute execute arbitrary code via (1) a DCM image that is not
properly handled by the ReadDCMImage function in coders/dcm.c, or (2) a
PALM image that is not properly handled by the ReadPALMImage function in
coders/palm.c. |
| Alerts: |
|
Comments (2 posted)
imlib2: arbitrary code execution
| Package(s): | imlib2 |
CVE #(s): | CVE-2006-4806
CVE-2006-4807
CVE-2006-4808
CVE-2006-4809
|
| Created: | November 6, 2006 |
Updated: | August 13, 2007 |
| Description: |
M. Joonas Pihlaja discovered that imlib2 did not sufficiently verify the
validity of ARGB, JPG, LBM, PNG, PNM, TGA, and TIFF images. If a user
were tricked into viewing or processing a specially crafted image with
an application that uses imlib2, the flaws could be exploited to execute
arbitrary code with the user's privileges. |
| Alerts: |
|
Comments (none posted)
kdelibs: integer overflow
| Package(s): | kdelibs |
CVE #(s): | CVE-2006-4811
|
| Created: | October 18, 2006 |
Updated: | March 5, 2007 |
| Description: |
The KDE khtml library can pass untrusted parameters into Qt, allowing a hostile user to trigger an integer overflow there and execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
kdelibs: kate backup file permission leak
| Package(s): | kdelibs kate kwrite |
CVE #(s): | CAN-2005-1920
|
| Created: | July 19, 2005 |
Updated: | September 21, 2010 |
| Description: |
Kate / Kwrite, as shipped with KDE 3.2.x up to including 3.4.0, creates a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set. See this advisory for more information. |
| Alerts: |
|
Comments (1 posted)
kdenetwork: denial of service
| Package(s): | kdenetwork |
CVE #(s): | CVE-2006-6811
|
| Created: | January 11, 2007 |
Updated: | February 1, 2007 |
| Description: |
The KsIRC 1.3.12 utility in kdenetwork is vulnerable to a remote
denial of service attack that can be caused by a malicious IRC server
sending a long PRIVMSG string. This causes an assertion failure and
an associated NULL pointer dereference. |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-4623
|
| Created: | October 18, 2006 |
Updated: | November 14, 2007 |
| Description: |
The kernel DVB layer can be caused to crash with maliciously-formatted unidirectional lightweight encapsulation (ULE) data. |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-4535
CVE-2006-4538
|
| Created: | September 18, 2006 |
Updated: | January 5, 2009 |
| Description: |
Sridhar Samudrala discovered a local denial of service vulnerability
in the handling of SCTP sockets. By opening such a socket with a
special SO_LINGER value, a local attacker could exploit this to crash
the kernel. (CVE-2006-4535)
Kirill Korotaev discovered that the ELF loader on the ia64 and sparc
platforms did not sufficiently verify the memory layout. By attempting
to execute a specially crafted executable, a local user could exploit
this to crash the kernel. (CVE-2006-4538) |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-4572
CVE-2006-4997
|
| Created: | November 6, 2006 |
Updated: | January 17, 2007 |
| Description: |
Some vulnerabilities were discovered in the Linux 2.6 kernel:
There are possibly exploitable bugs in the netfilter for IPv6 code.
(CVE-2006-4572)
The ATM subsystem of the Linux kernel could allow a remote attacker to
cause a Denial of Service (panic) via unknown vectors that cause the ATM
subsystem to access the memory of socket buffers after they are freed.
(CVE-2006-4997) |
| Alerts: |
|
Comments (none posted)
kernel: denial of service by memory consumption
| Package(s): | kernel |
CVE #(s): | CVE-2006-2936
|
| Created: | July 17, 2006 |
Updated: | November 14, 2007 |
| Description: |
The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to
2.6.17, and possibly later versions, allows local users to cause a denial
of service (memory consumption) by writing more data to the serial port
than the driver can handle, which causes the data to be queued. |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-5757
|
| Created: | November 13, 2006 |
Updated: | November 14, 2007 |
| Description: |
From the MOKB-05-11-2006
advisory: "The ISO9660 filesystem handling code of the Linux
2.6.x kernel fails to properly handle corrupted data structures, leading to
an exploitable denial of service condition. This particular vulnerability
seems to be caused by a race condition and a signedness issue. When
performing a read operation on a corrupted ISO9660 fs stream, the
isofs_get_blocks() function will enter an infinite loop when
__find_get_block_slow() callback from sb_getblk() fails ("due to various
races between file io on the block device and getblk")." |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-2935
CVE-2006-4145
CVE-2006-3745
|
| Created: | September 1, 2006 |
Updated: | July 30, 2008 |
| Description: |
Previous versions of the kernel package are subject to several
vulnerabilities. Certain malformed UDF filesystems can cause the system to
crash (denial of service). Malformed CDROM firmware or USB storage devices
(such as USB keys) could cause system crash (denial of service), and if
they were intentionally malformed, can cause arbitrary code to run with
elevated privileges. In addition, the SCTP protocol is subject to a remote
system crash (denial of service) attack. |
| Alerts: |
|
Comments (none posted)
kernel: multiple vulnerabilities
| Package(s): | kernel |
CVE #(s): | CVE-2006-5749
CVE-2006-4814
CVE-2006-6106
|
| Created: | January 5, 2007 |
Updated: | January 8, 2009 |
| Description: |
A security issue has been reported in Linux kernel due to an error in
drivers/isdn/i4l/isdn_ppp.c as the "isdn_ppp_ccp_reset_alloc_state()"
function never initializes an event timer before scheduling it with the
"add_timer()" function.
The mincore function in the kernel does not properly lock access to user
space, which has unspecified impact and attack vectors, possibly related to
a deadlock.
Another vulnerability has been reported in Linux kernel caused by a
boundary error within the handling of incoming CAPI messages in
net/bluetooth/cmtp/capi.c. This can be exploited to overwrite certain
Kernel data structures. |
| Alerts: |
|
Comments (none posted)
koffice: integer overflow
| Package(s): | koffice |
CVE #(s): | CVE-2006-6120
|
| Created: | November 30, 2006 |
Updated: | February 20, 2007 |
| Description: |
The KOffice office suite has an integer overflow
vulnerability. If an attacker can trick a user into opening a
specially crafted PowerPoint (PPT) file, KOffice can be caused to crash or
possibly execute arbitrary code with the user's privileges. |
| Alerts: |
|
Comments (none posted)
krb5: uninitialized pointers
| Package(s): | krb5 |
CVE #(s): | CVE-2006-6143
CVE-2006-3084
|
| Created: | January 10, 2007 |
Updated: | July 7, 2010 |
| Description: |
The kdamind daemon can, in some situations, perform operations on uninitialized pointers. This bug could conceivably open up the system to a code execution attack by an unauthenticated remote attacker, but it appears to be difficult to exploit. See this advisory for details. |
| Alerts: |
|
Comments (1 posted)
krb5: local privilege escalation
| Package(s): | krb5 |
CVE #(s): | CVE-2006-3083
|
| Created: | August 9, 2006 |
Updated: | July 7, 2010 |
| Description: |
Some kerberos applications fail to check the results of setuid() calls, with the result that, if that call fails, they could continue to execute as root after thinking they had switched to a nonprivileged user. A local attacker who can cause these calls to fail (through resource exhaustion, presumably) could exploit this bug to gain root privileges. |
| Alerts: |
|
Comments (none posted)
libgadu: memory alignment bug
| Package(s): | libgadu |
CVE #(s): | CAN-2005-2370
|
| Created: | July 29, 2005 |
Updated: | June 25, 2007 |
| Description: |
Szymon Zygmunt and Michal Bartoszkiewicz discovered a memory alignment
error in libgadu (from ekg, console Gadu Gadu client, an instant
messaging program) which is included in gaim, a multi-protocol instant
messaging client, as well. This can not be exploited on the x86
architecture but on others, e.g. on Sparc and lead to a bus error,
in other words a denial of service.
|
| Alerts: |
|
Comments (none posted)
libgtop2: buffer overflow
| Package(s): | libgtop2 |
CVE #(s): | CVE-2007-0235
|
| Created: | January 15, 2007 |
Updated: | August 9, 2007 |
| Description: |
The /proc parsing routines in libgtop are vulnerable to a buffer overflow.
If an attacker can run a process in a specially crafted long
path then trick a user into running gnome-system-monitor,
arbitrary code can be executed with the user's privileges. |
| Alerts: |
|
Comments (none posted)
libmodplug: boundary errors
| Package(s): | libmodplug |
CVE #(s): | CVE-2006-4192
|
| Created: | December 11, 2006 |
Updated: | May 4, 2011 |
| Description: |
Luigi Auriemma has reported various boundary errors in load_it.cpp and
a boundary error in the "CSoundFile::ReadSample()" function in
sndfile.cpp. A remote attacker can entice a user to read crafted modules
or ITP files, which may trigger a buffer overflow resulting in the
execution of arbitrary code with the privileges of the user running the
application. |
| Alerts: |
|
Comments (none posted)
libneon: denial of service
| Package(s): | libneon |
CVE #(s): | CVE-2007-0157
|
| Created: | January 13, 2007 |
Updated: | January 17, 2007 |
| Description: |
The URI parser in neon versions 0.26.0 through 0.26.2 has a
denial of service vulnerability. Remote servers can cause a crash
by sending a URI with non-ASCII characters. |
| Alerts: |
|
Comments (none posted)
libpng: buffer overflow
| Package(s): | libpng |
CVE #(s): | CVE-2006-3334
|
| Created: | July 19, 2006 |
Updated: | December 15, 2008 |
| Description: |
In pngrutil.c, the function png_decompress_chunk() allocates
insufficient space for an error message, potentially overwriting stack
data, leading to a buffer overflow. |
| Alerts: |
|
Comments (none posted)
libpng: heap based buffer overflow
| Package(s): | libpng |
CVE #(s): | CVE-2006-0481
|
| Created: | February 13, 2006 |
Updated: | December 15, 2008 |
| Description: |
A heap based buffer overflow bug was found in the way libpng strips alpha
channels from a PNG image. An attacker could create a carefully crafted PNG
image file in such a way that it could cause an application linked with
libpng to crash or execute arbitrary code when the file is opened by a
victim. |
| Alerts: |
|
Comments (1 posted)
libsoup: denial of service
| Package(s): | libsoup |
CVE #(s): | CVE-2006-5876
|
| Created: | January 13, 2007 |
Updated: | January 29, 2007 |
| Description: |
The libsoup HTTP library does not sanitize input sufficiently when
parsing HTTP headers. This can be exploited to cause a
denial of service. |
| Alerts: |
|
Comments (none posted)
libtiff: buffer overflow
| Package(s): | libtiff |
CVE #(s): | CVE-2006-2193
|
| Created: | June 15, 2006 |
Updated: | September 1, 2008 |
| Description: |
The t2p_write_pdf_string function in libtiff 3.8.2 and earlier is vulnerable
to a buffer overflow. Attackers can use a TIFF file with UTF-8 characters
in the DocumentName tag to overflow a buffer, causing a denial of service,
and possibly the execution of arbitrary code. |
| Alerts: |
|
Comments (none posted)
libvncserver: authentication bypass
| Package(s): | libvncserver |
CVE #(s): | CVE-2006-2450
|
| Created: | August 4, 2006 |
Updated: | March 19, 2007 |
| Description: |
LibVNCServer fails to properly validate protocol types effectively
letting users decide what protocol to use, such as "Type 1 - None".
LibVNCServer will accept this security type, even if it is not offered
by the server. |
| Alerts: |
|
Comments (none posted)
libxml2 - arbitrary code execution
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0110
|
| Created: | February 26, 2004 |
Updated: | August 19, 2009 |
| Description: |
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml2 uses special
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that
parses remote resources and allows them to influence the URL, then this
flaw could be used to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
libxml2: multiple buffer overflows
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0989
|
| Created: | October 28, 2004 |
Updated: | August 19, 2009 |
| Description: |
libxml2 prior to version 2.6.14 has multiple buffer overflow
vulnerabilities, if a local user passes a specially crafted
FTP URL, arbitrary code may be executed. |
| Alerts: |
|
Comments (none posted)
lynx: arbitrary command execution
| Package(s): | lynx |
CVE #(s): | CVE-2005-2929
|
| Created: | November 14, 2005 |
Updated: | September 14, 2009 |
| Description: |
An arbitrary command execute bug was found in the lynx "lynxcgi:" URI
handler. An attacker could create a web page redirecting to a malicious URL
which could execute arbitrary code as the user running lynx. |
| Alerts: |
|
Comments (none posted)
mono: source disclosure attack
| Package(s): | mono |
CVE #(s): | CVE-2006-6104
|
| Created: | December 21, 2006 |
Updated: | January 17, 2007 |
| Description: |
The Mono ASP.NET server XSP has a source disclosure attack vulnerability.
A malicious user can use this to acquire the source code of a server-side
application. |
| Alerts: |
|
Comments (none posted)
mysql: format string bug
| Package(s): | mysql |
CVE #(s): | CVE-2006-3469
|
| Created: | July 21, 2006 |
Updated: | July 30, 2008 |
| Description: |
Jean-David Maillefer discovered a format string bug in the
date_format() function's error reporting. By calling the function with
invalid arguments, an authenticated user could exploit this to crash
the server. |
| Alerts: |
|
Comments (none posted)
MySQL: privilege violations
| Package(s): | mysql |
CVE #(s): | CVE-2006-4031
CVE-2006-4226
|
| Created: | August 25, 2006 |
Updated: | July 30, 2008 |
| Description: |
MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access
a table through a previously created MERGE table, even after the user's
privileges are revoked for the original table, which might violate intended
security policy (CVE-2006-4031).
MySQL 4.1 before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run
on case-sensitive filesystems, allows remote authenticated users to create
or access a database when the database name differs only in case from a
database for which they have permissions (CVE-2006-4226). |
| Alerts: |
|
Comments (none posted)
MySQL: logging bypass
| Package(s): | mysql |
CVE #(s): | CVE-2006-0903
|
| Created: | April 4, 2006 |
Updated: | May 21, 2008 |
| Description: |
MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms
via SQL queries that contain the NULL character, which are not properly
handled by the mysql_real_query function. NOTE: this issue was originally
reported for the mysql_query function, but the vendor states that since
mysql_query expects a null character, this is not an issue for mysql_query. |
| Alerts: |
|
Comments (2 posted)
nbd: arbitrary code execution
| Package(s): | nbd |
CVE #(s): | CVE-2005-3534
|
| Created: | January 6, 2006 |
Updated: | March 7, 2011 |
| Description: |
Kurt Fitzner discovered that the NBD (network block device) server did not
correctly verify the maximum size of request packets. By sending specially
crafted large request packets, a remote attacker who is allowed to access
the server could exploit this to execute arbitrary code with root
privileges. |
| Alerts: |
|
Comments (none posted)
ncompress: buffer underflow
| Package(s): | ncompress |
CVE #(s): | CVE-2006-1168
|
| Created: | August 10, 2006 |
Updated: | February 21, 2012 |
| Description: |
The ncompress compression utility has a missing boundary check.
A local user can use a maliciously created file to cause a
a .bss buffer underflow. |
| Alerts: |
|
Comments (none posted)
oftpd: denial of service
| Package(s): | oftpd |
CVE #(s): | CVE-2006-6767
|
| Created: | January 16, 2007 |
Updated: | January 17, 2007 |
| Description: |
By specifying an unsupported address family in the arguments to a LPRT or
LPASV command, an assertion in oftpd will cause the daemon to abort.
Remote, unauthenticated attackers may be able to terminate any oftpd
process, denying service to legitimate users. |
| Alerts: |
|
Comments (none posted)
openldap: security bypass
| Package(s): | openldap |
CVE #(s): | CVE-2006-4600
|
| Created: | September 29, 2006 |
Updated: | June 12, 2007 |
| Description: |
slapd in OpenLDAP before 2.3.25 allows remote authenticated users with
selfwrite Access Control List (ACL) privileges to modify arbitrary
Distinguished Names (DN). |
| Alerts: |
|
Comments (none posted)
OpenSSH: denial of service
| Package(s): | openssh |
CVE #(s): | CVE-2006-4925
CVE-2006-5052
|
| Created: | October 6, 2006 |
Updated: | November 15, 2007 |
| Description: |
packet.c in ssh in OpenSSH allows remote attackers to cause a denial of
service (crash) by sending an invalid protocol sequence with
USERAUTH_SUCCESS before NEWKEYS, which causes newkeys[mode] to be NULL.
An unspecified vulnerability in portable OpenSSH before 4.4, when running
on some platforms, allows remote attackers to determine the validity of
usernames via unknown vectors involving a GSSAPI "authentication abort." |
| Alerts: |
|
Comments (none posted)
openssh: privilege separation issue
| Package(s): | openssh |
CVE #(s): | CVE-2006-5794
|
| Created: | November 8, 2006 |
Updated: | April 5, 2007 |
| Description: |
From the OpenSSH 4.5 announcement: "Fix a bug in the sshd privilege separation monitor that weakened its
verification of successful authentication. This bug is not known to
be exploitable in the absence of additional vulnerabilities." |
| Alerts: |
|
Comments (none posted)
openssh: remote denial of service
| Package(s): | openssh |
CVE #(s): | CVE-2006-4924
CVE-2006-5051
|
| Created: | September 27, 2006 |
Updated: | September 17, 2008 |
| Description: |
Openssh 4.4 fixes some
security issues, including a pre-authentication denial of service, an
unsafe signal hander and on portable OpenSSH a GSSAPI authentication abort
could be used to determine the validity of usernames on some platforms. |
| Alerts: |
|
Comments (none posted)
opera: multiple vulnerabilities
| Package(s): | opera |
CVE #(s): | CVE-2007-0126
CVE-2007-0127
|
| Created: | January 13, 2007 |
Updated: | January 17, 2007 |
| Description: |
The opera browser has a heap overflow vulnerability involving the DHT
markers in JPEG files. If a specially crafted JPEG files is read
on a web site, arbitrary code may be executed with the privileges of the
user.
Also, the createSVGTransformFromMatrix() function does not correctly
handle passed-in objects, this can be used to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
php: several vulnerabilities
| Package(s): | php |
CVE #(s): | CVE-2006-4481
CVE-2006-4484
CVE-2006-4485
|
| Created: | September 8, 2006 |
Updated: | June 13, 2008 |
| Description: |
The file_exists and imap_reopen functions in PHP before 5.1.5 do not check
for the safe_mode and open_basedir settings, which allows local users to
bypass the settings (CVE-2006-4481).
A buffer overflow in the LWZReadByte function in ext/gd/libgd/gd_gif_in.c
in the GD extension in PHP before 5.1.5 allows remote attackers to have an
unknown impact via a GIF file with input_code_size greater than
MAX_LWZ_BITS, which triggers an overflow when initializing the table array
(CVE-2006-4484).
The stripos function in PHP before 5.1.5 has unknown impact and attack
vectors related to an out-of-bounds read (CVE-2006-4485). |
| Alerts: |
|
Comments (1 posted)
php: buffer overflows
| Package(s): | php |
CVE #(s): | CVE-2006-5465
|
| Created: | November 3, 2006 |
Updated: | January 18, 2010 |
| Description: |
The Hardened-PHP Project discovered buffer overflows in
htmlentities/htmlspecialchars internal routines to the PHP Project. Of
course the whole purpose of these functions is to be filled with user
input. (The overflow can only be when UTF-8 is used) |
| Alerts: |
|
Comments (none posted)
phpbb2: missing input sanitizing
| Package(s): | phpbb2 |
CVE #(s): | CVE-2006-1896
|
| Created: | May 22, 2006 |
Updated: | February 11, 2008 |
| Description: |
It was discovered that phpbb2, a web based bulletin board, insufficiently
sanitizes values passed to the "Font Color 3" setting, which might lead to
the execution of injected code by admin users. |
| Alerts: |
|
Comments (none posted)
phpbb2: multiple vulnerabilities
| Package(s): | phpbb2 |
CVE #(s): | CVE-2005-3310
CVE-2005-3415
CVE-2005-3416
CVE-2005-3417
CVE-2005-3418
CVE-2005-3419
CVE-2005-3420
CVE-2005-3536
CVE-2005-3537
|
| Created: | December 22, 2005 |
Updated: | February 11, 2008 |
| Description: |
The phpbb2 web forum has a number of vulnerabilities including:
a web script injection problem, a protection mechanism bypass, a
security check bypass, a remote global variable bypass, cross site
scripting vulnerabilities, an SQL injection vulnerability,
a remote regular expression modification problem, missing input
sanitizing, and a missing request validation problem. |
| Alerts: |
|
Comments (none posted)
postgresql: SQL injection
| Package(s): | postgresql |
CVE #(s): | CVE-2006-2313
CVE-2006-2314
|
| Created: | May 24, 2006 |
Updated: | June 6, 2007 |
| Description: |
The PostgreSQL team has put out a set of "urgent updates" (in the form of the 7.3.15, 7.4.13, 8.0.8, and 8.1.4 releases) closing a
newly-discovered set of SQL injection issues. Details about the problem
can be found on the
technical information page; in short: multi-byte encodings can be used
to defeat normal string sanitizing techniques. The update fixes one problem
related to invalid multi-byte characters, but punts on another by simply
disallowing the old, unsafe technique of escaping single quotes with a
backslash. |
| Alerts: |
|
Comments (1 posted)
proftpd: denial of service
| Package(s): | proftpd |
CVE #(s): | CVE-2006-5815
|
| Created: | November 17, 2006 |
Updated: | January 24, 2007 |
| Description: |
A denial of service (DoS) vulnerability exists in the FTP server ProFTPD, up
to and including version 1.3.0. The flaw is due to both a potential bus
error and a definitive buffer overflow in the code which determines the FTP
command buffer size limit. The vulnerability can be exploited only if the
"CommandBufferSize" directive is explicitly used in the server
configuration. |
| Alerts: |
|
Comments (none posted)
proftpd: stack-based buffer overflow
| Package(s): | proftpd |
CVE #(s): | CVE-2006-6563
|
| Created: | December 18, 2006 |
Updated: | February 14, 2007 |
| Description: |
A vulnerability exists in the FTP server ProFTPD, versions up to and
including 1.3.0a. The vulnerability is caused by a stack-based buffer
overflow in the "pr_ctrls_recv_request" function of the "Controls"
feature. This is an optional feature of ProFTPD server which is by default
disabled in OpenPKG and probably other distributions. |
| Alerts: |
|
Comments (1 posted)
quake: buffer overflow
| Package(s): | quake3-bin |
CVE #(s): | CVE-2006-2236
|
| Created: | May 10, 2006 |
Updated: | January 12, 2009 |
| Description: |
Games based on the Quake 3 engine are vulnerable to a buffer overflow exploitable by a hostile game server. |
| Alerts: |
|
Comments (none posted)
rpm: arbitrary code execution
| Package(s): | rpm |
CVE #(s): | CVE-2006-5466
|
| Created: | November 6, 2006 |
Updated: | August 28, 2007 |
| Description: |
An error was found in the RPM library's handling of query reports. In
some locales, certain RPM packages would cause the library to crash. If
a user was tricked into querying a specially crafted RPM package, the
flaw could be exploited to execute arbitrary code with the user's
privileges. |
| Alerts: |
|
Comments (none posted)
shadow-utils: mailbox creation vulnerability
| Package(s): | shadow-utils |
CVE #(s): | CVE-2006-1174
|
| Created: | May 25, 2006 |
Updated: | June 12, 2007 |
| Description: |
The useradd tool from the shadow-utils package has a potential security
problem. When a new user's mailbox is created, the permissions are
set to random garbage from the stack, potentially allowing the
file to be read or written during the time before fchmod() is called. |
| Alerts: |
|
Comments (none posted)
squirrelmail: multiple cross-site scripting vulnerabilities
| Package(s): | squirrelmail |
CVE #(s): | CVE-2006-6142
|
| Created: | December 11, 2006 |
Updated: | January 31, 2007 |
| Description: |
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0
through 1.4.9 allow remote attackers to inject arbitrary web script or HTML
via the mailto parameter in webmail.php, the session and delete_draft
parameters in compose.php, and unspecified vectors involving "a shortcoming
in the magicHTML filter." |
| Alerts: |
|
Comments (none posted)
unzip: long file name buffer overflow
| Package(s): | unzip |
CVE #(s): | CVE-2005-4667
|
| Created: | February 6, 2006 |
Updated: | May 2, 2007 |
| Description: |
A buffer overflow in UnZip 5.50 and earlier allows local users to execute
arbitrary code via a long filename command line argument. NOTE: since the
overflow occurs in a non-setuid program, there are not many scenarios under
which it poses a vulnerability, unless unzip is passed long arguments when
it is invoked from other programs. |
| Alerts: |
|
Comments (1 posted)
w3c-libwww: possible stack overflow
| Package(s): | w3c-libwww |
CVE #(s): | CVE-2005-3183
|
| Created: | October 14, 2005 |
Updated: | May 2, 2007 |
| Description: |
xtensive testing of libwww's handling of multipart/byteranges content from
HTTP/1.1 servers revealed multiple logical flaws and bugs in
Library/src/HTBound.c |
| Alerts: |
|
Comments (1 posted)
wget: denial of service
| Package(s): | wget |
CVE #(s): | CVE-2006-6719
|
| Created: | January 11, 2007 |
Updated: | January 23, 2007 |
| Description: |
The wget http file retriever application has a problem with the
ftp_syst function in ftp-basic.c. A malicious FTP server which sends
a large number of blank 220 responses to the SYST command can cause
wget to crash, resulting in a denial of service. |
| Alerts: |
|
Comments (2 posted)
wordpress: multiple vulnerabilities
| Package(s): | wordpress |
CVE #(s): | CVE-2006-6808
CVE-2007-0107
CVE-2007-0109
|
| Created: | January 16, 2007 |
Updated: | January 17, 2007 |
| Description: |
When decoding trackbacks with alternate character sets, WordPress does
not correctly sanitize the entries before further modifying a SQL
query. WordPress also displays different error messages in wp-login.php
based upon whether or not a user exists. David Kierznowski has
discovered that WordPress fails to properly sanitize recent file
information in /wp-admin/templates.php before sending that information
to a browser. An attacker could inject arbitrary SQL into WordPress
database queries. An attacker could also determine if a WordPress user
existed by trying to login as that user, better facilitating brute force
attacks. Lastly, an attacker authenticated to view the administrative
section of a WordPress instance could try to edit a file with a malicious
filename; this may cause arbitrary HTML or JavaScript to be executed in
users' browsers viewing /wp-admin/templates.php. |
| Alerts: |
|
Comments (none posted)
xine-lib: buffer overflow
| Package(s): | xine-lib |
CVE #(s): | CVE-2006-6172
|
| Created: | December 5, 2006 |
Updated: | June 5, 2007 |
| Description: |
A buffer overflow was discovered in the Real Media input plugin in
xine-lib. If a user were tricked into loading a specially crafted stream
from a malicious server, the attacker could execute arbitrary code with the
user's privileges. |
| Alerts: |
|
Comments (none posted)
xine-lib: buffer overflow
| Package(s): | xine-lib |
CVE #(s): | CVE-2006-1664
|
| Created: | April 27, 2006 |
Updated: | February 27, 2008 |
| Description: |
xine-lib does an improper input data boundary check on
MPEG streams. A specially crafted MPEG file can be
created that can cause arbitrary code execution when the
file is accessed. |
| Alerts: |
|
Comments (none posted)
xine-ui: format string vulnerabilities
| Package(s): | xine-ui |
CVE #(s): | CVE-2006-2230
|
| Created: | June 9, 2006 |
Updated: | January 24, 2007 |
| Description: |
Several format string vulnerabilities have been discovered in xine-ui,
the user interface of the xine video player, which may cause a denial
of service. |
| Alerts: |
|
Comments (none posted)
xinit: race condition
| Package(s): | xinit |
CVE #(s): | CVE-2006-5214
|
| Created: | October 17, 2006 |
Updated: | August 9, 2007 |
| Description: |
A race condition allows local users to see error messages generated during
another user's X session. This could allow potentially sensitive
information to be leaked. |
| Alerts: |
|
Comments (1 posted)
X.org: local privilege escalations
| Package(s): | xorg-x11 |
CVE #(s): | CVE-2006-4447
|
| Created: | August 28, 2006 |
Updated: | April 30, 2007 |
| Description: |
Several X.org libraries and X.org itself contain system calls to
set*uid() functions, without checking their result. Local users could
deliberately exceed their assigned resource limits and elevate their
privileges after an unsuccessful set*uid() system call. This requires
resource limits to be enabled on the machine. |
| Alerts: |
|
Comments (none posted)
X.org: integer overflows
| Package(s): | xorg, xorg-server |
CVE #(s): | CVE-2006-6101
CVE-2006-6102
CVE-2006-6103
|
| Created: | January 10, 2007 |
Updated: | March 8, 2007 |
| Description: |
A number of integer overflows have turned up in the X.org server. Some of these overflows involve calls to alloca(), and thus make corruption of the stack relatively easy. This vulnerability is exploitable by anybody who can make a connection to the server, meaning that it is a local root exploit in most settings. See this advisory for details. |
| Alerts: |
|
Comments (none posted)
xpdf: buffer overflow
| Package(s): | xpdf |
CVE #(s): | CAN-2005-0064
|
| Created: | January 19, 2005 |
Updated: | March 15, 2007 |
| Description: |
iDEFENSE has found yet another xpdf buffer overflow; see this advisory for details. |
| Alerts: |
|
Comments (1 posted)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current 2.6 prepatch remains 2.6.20-rc5. Patches have started
flowing into the mainline git repository again, however - 250 or so of
them. These patches are mostly fixes, but there is also a set of patches
from the memory technology devices tree adding an AT91 NAND driver and the
"Cafe" NAND driver (for OLPC systems).
For older kernels: 2.6.16.38 was released on
January 21; it includes fixes for several security problems.
Comments (none posted)
Kernel development news
Linux cannot be said to suffer from a shortage of virtualization
solutions. What is harder to come by, however, is a paravirtualization
system which is amenable to relatively easy understanding. A relatively
recent entrant into the field, however, changes that situation
significantly. With just 6,000 lines (including the user-space code),
Rusty Russell's hypervisor
implementation,
lguest
(pronounced
rʌs.ti'vai.zər), provides a
full, if spartan paravirtualization mechanism for Linux.
The core of lguest is the lg loadable module. At initialization
time, this module allocates a chunk of memory and maps it into the kernel's
address space just above the vmalloc area - at the top, in other words. A
small hypervisor is loaded into this area; it's a bit of assembly code
which mainly concerns itself with switching between the kernel and the
virtualized guest. Switching involves playing with the page tables - what
looks like virtual memory to the host kernel is physical memory to the
guest - and managing register contents.
The hypervisor will be present in the guest systems' virtual address spaces
as well. Allowing a guest to modify the hypervisor would be bad news,
however, as that would enable the guest to escape its virtual sandbox.
Since the guest kernel will run in ring 1, normal i386 page protection
won't keep it from messing with the hypervisor code. So, instead, the
venerable segmentation mechanism is used to keep that code out of reach.
The lg module also implements the basics for a virtualized I/O
subsystem. At the lowest level, there is a "DMA" mechanism which really
just copies memory between buffers. A DMA buffer can be bound to a given
address; an attempt to perform DMA to that address then copies the memory
into the buffer. The DMA areas can be in memory which is shared between
guests, in which case the data will be copied from one guest to another and
the receiving guest will get an interrupt; this is how inter-guest
networking is implemented. If no shared DMA area is found, DMA transfers
are, instead, referred to the user-space hypervisor (described below) for
execution. Simple disk and console drivers exist as well.
Finally, the lg module implements a controlling interface accessed
via /proc/lguest - a feature which might just have to be changed
before lguest goes into the mainline. The user-space hypervisor creates a
guest by writing an "initialize" command to this file, specifying the
memory range to use, where to find the kernel, etc. This interface can
also be used to receive and execute DMA operations and send interrupts to
the guest system. Interestingly, the way to actually cause the guest to
run is to read from the control file; execution will continue until the
guest blocks on something requiring user-space attention.
Also on the kernel side is a paravirt_ops implementation
for working with the lguest hypervisor; it must be built into any
kernel which will be run as a guest. At system initialization time, this
code looks for a special signature left by the hypervisor at guest startup;
if the signature is present, it means the kernel is running under lguest.
In that situation, the lguest-specific paravirt_ops will be
installed, enabling the kernel to run properly as a guest.
The last component of the system is the user-mode hypervisor client. Its job is
to allocate a range of memory which will become the guest's "physical"
memory; the guest's kernel image is then mapped into that memory range.
The client code itself has been specially linked to sit high in the virtual
address space, leaving room for the guest system below. Once that guest
system is in place, the user-mode client performs its read on the control
file, causing the guest to boot.
A
file on the host system can become a disk image for the guest, with the
user-mode client handling the "DMA" requests to move blocks back and forth.
Network devices can be set up to perform communication between guests. The
lg network driver can also work in a loopback mode, connecting an
internal network device to a TAP device configured on the host; in this
way, guests can bind to ports and run servers.
With sufficient imagination, how all of this comes together can be seen in
the diagram to the right. The lguest client starts the process, running in
user space on the host. It allocates the memory indicated by the blue box,
which is to become the guest's virtualized physical memory, then maps in
the guest kernel. Once the user-mode client reads from
/proc/lguest, the page tables and segment descriptors are tweaked
to make the blue box seem like the entire system, and control is passed to
the guest kernel. The guest can request some services via the kernel-space
hypervisor code; for everything else, control is returned to the user-mode
client.
That is a fairly complete description of what lguest can do. There is no
Xen-style live migration, no UML-style copy-on-write disk devices, no
resource usage management beyond what the kernel already provides, etc. As
Rusty put it at linux.conf.au, lguest eschews fancy features in favor of
cute pictures of puppies. The simplicity of this code is certainly one of
its most attractive qualities; it is easy to understand and to play with.
It should have a rather easier path into the kernel than some of the other
hypervisor implementations out there. Whether it can stay simple once
people start trying to do real work with it remains to be seen.
Comments (7 posted)
This is the fifth article in the irregular LWN series on writing video
drivers for Linux. Those who have not yet read
the introductory article may
want to start there.
Before any application can work with a video device, it must come to an
understanding with the driver about how video data will be formatted. This
negotiation can be a rather complex process, resulting from the facts that
(1) video hardware varies widely in the formats it can handle, and
(2) performing format transformations in the kernel is frowned upon.
So the application must be able to find out what formats are supported by
the hardware and set up a configuration which is workable for everybody
involved. This article will cover the basics of how formats are described;
the next installment will get into the API implemented by V4L2 drivers to
negotiate formats with applications.
Colorspaces
A colorspace is, in broad terms, the coordinate system used to
describe colors. There are several of them defined by the V4L2
specification, but only two are used in any broad way. They are:
- V4L2_COLORSPACE_SRGB. The [red, green, blue] tuples familiar
to many developers are covered under this colorspace. They provide a
simple intensity value for each of the primary colors which, when
mixed together, create the illusion of a wide range of colors. There
are a number of ways of representing RGB values, as we will see below.
This colorspace also covers the set of YUV and YCbCr representations.
This representation derives from the need for early color
television signals to be displayable on monochrome TV sets. So the
Y (or "luminance") value is a simple brightness value; when
displayed alone, it yields a grayscale image. The U and V (or Cb and
Cr) "chrominance" values describe the blue and red components of the
color; green can be derived by subtracting those components from the
luminance. Conversion between YUV and RGB is not entirely
straightforward, however; there are several formulas to
choose from.
Note that YUV and YCbCr are not exactly the same thing, though the
terms are often used interchangeably.
- V4L2_COLORSPACE_SMPTE170M is for analog color representations
used in NTSC or PAL television signals. TV tuners will often produce
data in this colorspace.
Quite a few other colorspaces exist; most of them are variants of
television-related standards. See this page from the V4L2
specification for the full list.
Packed and planar
As we have seen, pixel values are expressed as tuples, usually consisting
of RGB or YUV values. There are two commonly-used ways of organizing those
tuples into an image:
- Packed formats store all of the values for one pixel together
in memory.
- Planar formats separate each component out into a separate
array. Thus a planar YUV format will have all of the Y values stored
contiguously in one array, the U values in another, and the V values
in a third. The planes are usually stored contiguously in a single
buffer, but it does not have to be that way.
Packed formats might be more commonly used, especially with RGB formats,
but both types can be generated
by hardware and requested by applications. If the video device
supports both packed and planar formats, the driver should make them both
available to user space.
Fourcc codes
Color formats are described within the V4L2 API using the venerable
"fourcc" code mechanism. These codes are 32-bit values, generated from
four ASCII characters. As such, they have the advantages of being easily
passed around and being human-readable. When a color format code reads,
for example, 'RGB4', there is no need to go look it up in a
table.
Note that fourcc codes are used in a lot of different settings, some of
which predate Linux. The MPlayer application uses them internally. fourcc
refers only to the coding mechanism, however, and says nothing about which
codes are actually used - MPlayer has a translation function for converting
between its fourcc codes and those used by V4L2.
RGB formats
In the format descriptions shown below, bytes are always listed in memory
order - least significant bytes first on a little-endian machine. The
least significant bit of each byte is on the right; for each color field,
the lighter-shaded bit is the most significant.
| Name | fourcc | Byte 0 | Byte 1 | Byte
2 | Byte 3 |
| V4L2_PIX_FORMAT_RGB332 |
RGB1 |
|
| | |
| V4L2_PIX_FORMAT_RGB444 |
R444 |
|
|
| |
| V4L2_PIX_FORMAT_RGB555 |
RGB0 |
|
|
| |
| V4L2_PIX_FORMAT_RGB565 |
RGBP |
|
|
| |
| V4L2_PIX_FORMAT_RGB555X |
RGBQ |
|
|
| |
| V4L2_PIX_FORMAT_RGB565X |
RGBR |
|
|
| |
| V4L2_PIX_FORMAT_BGR24 |
BGR3 |
|
|
|
|
| V4L2_PIX_FORMAT_RGB24 |
RGB3 |
|
|
|
|
| V4L2_PIX_FORMAT_BGR32 |
BGR4 |
|
|
|
|
| V4L2_PIX_FORMAT_RGB32 |
RGB4 |
|
|
|
|
| V4L2_PIX_FORMAT_SBGGR8 |
BA81 |
|
|
|
|
|
|
|
|
|
|
When formats with empty space (shown in gray, above) are used, applications
may use that space for an alpha (transparency) value.
The final format above is the "Bayer" format, which is generally something
very close to the real data from the sensor found in most cameras. There
are green values for every pixel, but blue and red only for every other
pixel. Essentially, green carries the more important intensity
information, with red and blue being interpolated across the pixels where
they are missing. This is a pattern we will see again with the YUV formats.
YUV formats
The packed YUV formats will be shown first. The key for reading this table
is:
- = Y (intensity)
- = U (Cb)
- = V (Cr)
| Name | fourcc | Byte 0 | Byte 1 | Byte
2 | Byte 3 |
| V4L2_PIX_FORMAT_GREY |
GREY |
|
| | |
| V4L2_PIX_FORMAT_YUYV |
YUYV |
|
|
|
|
| V4L2_PIX_FORMAT_UYVY |
UYVY |
|
|
|
|
| V4L2_PIX_FORMAT_Y41P |
Y41P |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
There are several planar YUV formats in use as well. Drawing them all out
does not help much, so we'll go with one example. The commonly-used
"YUV 4:2:2" format (V4L2_PIX_FMT_YUV422, fourcc
422P) uses three separate arrays. A 4x4 image would be
represented like this:
| Y plane: |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
| U plane: |
|
|
|
|
|
|
|
|
|
| |
| V plane: |
|
|
|
|
|
|
|
|
|
As with the Bayer format, YUV 4:2:2 has one U and one V value for every
other Y value; displaying the image requires interpolating across the
missing values. The other planar YUV
formats are:
- V4L2_PIX_FMT_YUV420: the YUV 4:2:0 format, with one U and one
V value for every four Y values. U and V must be interpolated in both
the horizontal and vertical directions. The planes are stored in
Y-U-V order, as with the example above.
- V4L2_PIX_FMT_YVU420: like YUV 4:2:0, except that the
positions of the U and V arrays are swapped.
- V4L2_PIX_FMT_YUV410: A single U and V value for each sixteen
Y values. The arrays are in the order Y-U-V.
- V4L2_PIX_FMT_YVU410: A single U and V value for each sixteen
Y values. The arrays are in the order Y-V-U.
A few other YUV formats exist, but they are rarely used; see this page for the
full list.
Other formats
A couple of formats which might be useful for some drivers are:
- V4L2_PIX_FMT_JPEG: a vaguely-defined JPEG stream; a little
more information can be found here.
- V4L2_PIX_FMT_MPEG: an MPEG stream. There are a few variants
on the MPEG stream format; controlling these streams will be discussed in a
future installment.
There are a number of other, miscellaneous formats, some of them
proprietary; this
page has a list of them.
Describing formats
Now that we have an understanding of color formats, we can take a look at
how the V4L2 API describes image formats in general. The key structure
here is struct v4l2_pix_format (defined in
<linux/videodev2.h>, which contains these fields:
- __u32 width: the width of the image in pixels.
- __u32 height: the height of the image in pixels.
- __u32 pixelformat: the fourcc code describing the image
format.
- enum v4l2_field field: many image sources will interlace the
data - transferring all of the even scan lines first, followed by the
odd lines. Real camera devices normally do not do interlacing. The
V4L2 API allows the application to work with interlaced fields in a surprising
number of ways. Common values include V4L2_FIELD_NONE
(fields are not interlaced), V4l2_FIELD_TOP (top field only),
or V4L2_FIELD_ANY (don't care). See this page for a
full list.
- __u32 bytesperline: the number of bytes between two adjacent
scan lines. It includes any padding the device may require. For
planar formats, this value describes the largest (Y) plane.
- __u32 sizeimage: the size of the buffer required to hold the
full image.
- enum v4l2_colorspace colorspace: the colorspace being used.
All together, these parameters describe a buffer of video data in a
reasonably complete manner. An application can fill out a
v4l2_pix_format structure asking for just about any sort of format
that a user-space developer can imagine. On the driver side, however,
things have to be restrained to the formats the hardware can work with. So
every V4L2 application must go through a negotiation process with the
driver in an attempt to arrive at an image format that is both supported by
the hardware and adequate for the application's needs. The next
installment in this series will describe how this
negotiation works from the device driver's point of view.
Comments (10 posted)
Patches and updates
Kernel trees
Core kernel code
Device drivers
Documentation
Filesystems and block I/O
Janitorial
Memory management
Networking
Virtualization and containers
Miscellaneous
Page editor: Jonathan Corbet
Distributions
Last year, the Fedora Core distribution went through a process of auditing
the licenses on every package it distributed. This long task, handled by
Tom Callaway, led to a number of changes as programs with problematic
licensing were discovered. Among other things, the cdrecord package was
reverted to an earlier version and the openmotif library was dropped
altogether. It was not a lot of fun, and some users were upset by what
seemed to them to be an exercise in excessive free software zealotry. But
the end result was worthwhile: Fedora Core could claim, with a high level
of confidence, that it was a 100% free distribution.
But Fedora Core has seen its last release. The upcoming Fedora 7
release will include a great many packages which have not been through the
license audit process. Fedora's commitment to free software has not
changed, but its ability to be sure that nothing in the distribution
has a non-free license has gone away. All of the code which went into
Extras, and which is now part of Fedora, is supposed to be free, and almost
all of it certainly is. But there might just be a surprise or two in
there.
So it looks like the license audit process needs to start all over again.
Auditing Extras has been on the project's "we'll get around to that" list
for some time, but the merging of the repositories has brought a new
urgency to the task. In this context, Tom Callaway has announced the beginning of the
Extras audit.
There's just one little problem: Extras is a rather larger set of packages
than Core was. So Tom is asking for help:
Sound like fun? Well, no. But it is something that we do need
volunteers to help with. So, if you're interested in taking on this
challenge, let me know. The more people we can get to help in this
task, the quicker it will be completed. We have about 2550 source
packages to check.
This would be a good opportunity for anybody with an interest in Fedora to
help out; coding skills are not required. What is required is the ability
to look over the files in a source distribution - not just the COPYING file
- and make sure that the licenses presented there are consistent and free.
In the short term, Fedora would help itself tremendously by putting
together some sort of checklist for those who would participate in the
auditing process. Longer term, the project may need something like the
debian-legal community - a group not known for letting non-free licenses
slip by. For that matter, a package which is free for Debian should also
be free for Fedora, and vice versa. Maybe distributors should consider
working together to avoid duplication of effort while ensuring that
everything they are shipping is free software.
Comments (3 posted)
New Releases
The Fedora Unity Project has announced the release of new ISO Re-Spins (DVD
and CD Sets) of Fedora Core 6. These Re-Spin ISOs are based on Fedora Core
6 and all updates released as of January 11th, 2007. The ISO images are
available for i386 and x86_64 architectures via BitTorrent. PPC images
should also be available, but will have had only limited testing.
Full Story (comments: none)
Gamix is Mandriva-based Linux build
that facilitates the creation of boot CDs so developers may create Gamix
versions of their original software. Basesystem Beta 3 is available as an
ISO download.
Full Story (comments: none)
Novell has
announced
the release (under the GPL) of the openSUSE build service code. There is
also a tool named KIWI which is useful for the creation of system images. "
As
a result, open source developers can more quickly build a Linux
distribution that meets their particular use case, rigorously test it to
ensure product quality, and easily package it for quick
installation." More information can be found on the
Build Service page.
Comments (none posted)
Distribution News
Mandriva has announced a new Mandriva Linux release schedule. The consumer
oriented products will go to a 6 month release cycle. The corporate
product line will remain on an 18 to 24 month cycle with a 5-year support
lifetime. "
This spring, Mandriva users will enjoy a new version of
Mandriva Linux. Built on the current Mandriva development branch, this new
version will provide up-to-date and newly released open source
software. Also expect some new breakthrough technology, to be announced
shortly. The name for this new version is Mandriva Spring."
Full Story (comments: 19)
The second UbuCon, an Ubuntu user and developer event, will be held at
Google's New York City offices on February 16. "
February 16 will be
a special day for Ubuntu users and the Ubuntu curious. If you're already an
Ubuntu user, come on by - tell your story of how you're using Ubuntu Linux;
help out at the installfest; or just hang out with some interesting
people. If you're not an Ubuntu user, then here is your chance to learn
what the fuss is about."
Full Story (comments: none)
New Distributions
BOSS (Bharat Operating System
Solutions) is a Linux distribution developed by the National Resource
Centre For Free/Open Source Software in India. It's based on Debian and
made specifically for the Indian environment with a pleasing Desktop
environment coupled with Indian language support (Bengali, Gujarati, Hindi,
Punjabi, Telugu and Tamil so far) and other packages that are most relevant
for use in the government domain. Subsequent versions will support the
educational domain and eventually add support for all 22 of India's
languages. The BOSS 1.0 live CD was recently
announced.
Comments (none posted)
Distribution Newsletters
The Debian Weekly News for January 23, 2007 is out. Topics include Erinn
Clark, co-founder and leader of Debian Women and in the top 10 of girl geeks,
Chris Fearnley's rebuttal to Steven J. Vaughan-Nichols argument that Debian
is in trouble, Debian and the one Laptop per Child Project, French
DebianEdu Developers Meeting, Debian's History 2006, Debian-Installer for
Sony PS3, Woody Distribution archived, and much more.
Full Story (comments: 1)
The
Fedora
Weekly News for January 22, 2007 covers Fedora Unity releases updated
Fedora Core 6 Re-Spins, Fedora LiveCD On-Demand Service, Flash Player
9.0.31.0 released for i386 Linux, Fluendo makes proprietary codecs
available to Linux users, Fedora 7: The Linux Knight in Shining Armor?, and
several other topics.
Comments (none posted)
The Ubuntu Weekly Newsletter December 14, 2007 covers the recent community
council meeting, herd 2 release, the new screencast team, the new
xubuntu-users mailing list, Ubuntu Forums weekly update, bug stats,
upcoming meetings and events, Ubuntu-Women IRC Meeting, feisty changes,
Main Inclusion Requests, weekly quiz update, and much more.
Full Story (comments: none)
The
DistroWatch
Weekly for January 22, 2007 is out. "
Continuing the post-release
coverage of FreeBSD 6.2, this week's issue brings an exclusive interview
with Matteo Riondato, a FreeBSD developer and the release engineer of the
FreeSBIE live CD. The news section then delivers the usual round-up of
miscellaneous news from the distribution world, including a story about the
upcoming release of Mandriva "Metisse" edition with a new 3D-enabled
desktop environment. Also in the same section, PCLinuxOS launches the first
experimental release of the distribution's 2007 version, Fedora Unity
announces new, up-to-date re-spins of Fedora Core 6, gNewSense prepares for
the release of version 1.1 - now also with KDE, and the T2 project
introduces a new minimalist rescue live CD with uClibc. Finally, we are
pleased to present BOSS GNU/Linux, a new Indian distribution with the noble
goal of providing complete support for India's 22 official
languages."
Comments (none posted)
Package updates
Updates for
Fedora Core 6:
hal-cups-utils (bug fix update),
ghostscript (bug fix update),
diffstat (new version fixes a crash),
coreutils (bug fix),
device-mapper (update to latest stable
release),
lvm2 (update to latest stable
release),
lvm2-cluster (update to latest
stable release),
elfutils (update to
0.125),
man (bug fix),
hplip (update to 1.6.12),
cups (bug fix),
logrotate (bug fix),
scim-bridge (update to 0.4.9),
scim-tables (update to 0.5.7),
selinux-policy (bug fixes),
libgpod (update to 0.4.2),
spamassassin (bug fixes),
rhythmbox (update to 0.9.7),
libxslt (upstream release 1.1.20)
Updates for Fedora Core 5: device-mapper (update to latest stable
release), lvm2 (update to latest stable
release), screen (bug fixes), spamassassin (bug fixes)
Comments (none posted)
Updates for
Mandriva Linux 2007.0:
glibc (bug fix, sparc64 updates, Unicode 5.0
support),
mozilla-firefox (fixes x86_64
packages),
mandriva-doc (fix broken links
in Help buttons).
Comments (none posted)
Updates for
rPath Linux 1:
group-devel,
group-text-tools (include rMake tool),
filesystem (include the /sys directory).
Comments (none posted)
Updates for
Ubuntu 6.10:
cli-common
(automated backport upload),
lzma
(automated backport upload),
dosemu-freedos
(automated backport upload),
flexbackup
(automated backport upload),
beagle
(automated backport upload),
mailman
(automated backport upload),
gajim
(automated backport upload),
supertux
(automated backport upload),
wine
(automated backport upload),
ubuntu-docs
(stable release update),
libnss-ldap (bug
fix),
xdg-utils (Dash shell bug fixes),
idjc (bug fix),
eclipse (bug fixes),
totem (upload to edgy-updates),
glibc (propagate to edgy-updates from
edgy-proposed),
gnome-hearts (bug fixes),
rpy (bug fixes),
kdbus (bug fixes),
kiso (bug fixes),
siege (bug fixes),
wxwidgets2 (bug fix),
apt (bug fix),
popularity-contest (bug fixes),
kxdocker (bug fixes),
qpsmtpd (bug fix),
update-manager (bug fix),
linux-source-2.6.17 (initial release of a line
of kernels for edgy-proposed),
obconf (bug
fix),
evolution-jescs (bug fix),
flashplugin-nonfree (automated backport
upload),
xfce4-xkb-plugin (bug fixes),
cinepaint (bug fixes),
spampd (bug fixes),
update-notifier (bug fix),
curl (bug fixes),
glibc (bug fix).
Updates for Ubuntu 6.06 LTS: gnome-commander (new upstream release), liferea (automated backport upload), dosbox (automated backport upload), langpack-locales (upload to dapper-updates),
glibc (propagate to dapper-updates from
dapper-proposed), flashplugin-nonfree
(automated backport upload), linux-source-2.6.15 (initial release of a line
of kernels for dapper-proposed), qpsmtpd
(bug fix), dosemu (bug fixes).
Comments (none posted)
Distribution reviews
tuxmachines.org
reviews
the recently released beta of PCLinuxOS 2007. "
The time is drawing
near. The highly anticipated release of the all new PCLOS is right around
the corner. Tex and the gang are uploading a beta to mirrors for public
testing, but this lucky gal has been running an early beta on my new laptop
for a coupla weeks now. I know, I can feel it in my bones, that this
release will cause quite a stir. PCLOS already has one of the most loyal
fan-bases in the game, but this release will bring more users than ever. I
even think some larger distros will be feeling a bit of dread as
announcements go out. Not only is the all new PCLOS the most beautiful yet,
but it is updated to include some of the latest and greatest software
available - all on top of an all new modern code base. Development has been
long and hard, but the results will soon be known far and wide. Here's a
bit of a sneak peek for those interested."
Comments (none posted)
Dmitri Popov
reviews the Knoppix 5.1.1 live CD on Linux.com
"
The new year has brought a new release of the Knoppix live CD. Along with the usual updates to application software, the most noticeable change in version 5.1.1 is the inclusion of the Beryl 3-D desktop with the Emerald theming engine.
Since support for Beryl is still experimental, the 3-D desktop is provided in Knoppix as an option. To enable it, you have to use the knoppix desktop=beryl cheat code on boot. Considering the current status of Beryl, the new 3-D desktop works surprisingly well; it starts without any problems on a lowly Acer TravelMate 243 laptop with an Intel 82855 GM integrated graphics controller, and it feels snappy and is a joy to use."
Comments (none posted)
PolishLinux.org
reviews
Dreamlinux 2.2 MME. "
Dreamlinux is an operating system that boots
from a Live-CD with the option to install on a hard drive as
well. Dreamlinux is not just another Live-CD based on Debian, it's not
another distro coming with XFCE 4.4. Dreamlinux 2.2 MME is a polished
multimedia system from which Xubuntu developers could really learn a lot
and which has the potential to demolish Windows Multimedia Center as far as
the functionality is concerned. This review concerns Dreamlinux 2.2
Multimedia Edition."
Comments (none posted)
DesktopLinux
takes a look
at Damn Small Linux 3.2. "
DSL boasts a nearly complete desktop that
includes XMMS (MP3, and MPEG), an FTP client, a links-hacked web browser,
spreadsheet, email, spellcheck (US English), a word processor, three
editors (Nedit, nVi, Zile [emacs clone]), Naim (AIM, ICQ, IRC), SSH/SCP
server and client, a web server, calculator, and USB support. It soon will
have PCMCIA support, as well, the team said."
Comments (none posted)
Page editor: Rebecca Sobol
Development
The GNOME release team
announced
their decisions for modules to be included, removed and retracted
in the upcoming version 2.18 of the
GNOME desktop project.
The release team had a meeting this week. Among other things, we
talked about the proposed modules for GNOME 2.18. Here are the decisions
that, in our opinion, reflect the consensus in the community.
Here is what to expect in the area of new modules:
GNOME Devtools:
"Our end goal is to create an easy to use and powerful environment for developing applications. This means having an environment that the user can tailor to his or her needs, and that fits in with the developer's way of working.
Our basic strategy is to build small, well defined components that will work together to form a complete environment."
GNOME Devhelp: a component of GNOME Devtools which includes
full indexing of books in XML, the GtkHTML HTML viewer, the ability to
search by functions, structures and macros, automatic completion,
transparent HTTP support with GnomeVFS, command line search via Bonobo
and including Emacs integration, a simple installer for books, print
support, multiple zoom levels and vi support.
Seahorse:
"Seahorse is a GNOME application for managing encryption keys. It also integrates with nautilus, gedit and other places for encryption, decryption and other operations.
With seahorse you can Encrypt/decrypt/sign files and text,
Manage your keys and keyring,
Synchronize your keys and your keyring with keyservers,
Sign keys and publish,
Cache your passphrase so you don't have to keep typing it,
Backup your keys and keyring,
Add an image in any GDK supported format as a OpenGPG photo ID
Create SSH keys, configure them, cache them."
Nm-applet, which is the visible component of
NetworkManager:
"Networking on Linux right now is painful for the mobile desktop user, especially in comparison to other operating systems. A laptop user should never need to use the command line or configuration files to manage their network; it should "Just Work" as automatically as possible and intrude as little as possible into the user's workflow. NetworkManager attempts to make networking invisible. When moving into areas you've been before, NetworkManager automatically connects to the last network the user chose to connect to. Likewise, when back at the desk, NetworkManager will switch to the faster, more reliable wired network connection."
Glade-3:
"Glade is a RAD tool to enable quick & easy development of user interfaces for the GTK+ toolkit and the GNOME desktop environment, released under the GNU GPL License.
The user interfaces designed in Glade are saved as XML, and by using the libglade library these can be loaded by applications dynamically as needed.
By using libglade, Glade XML files can be used in numerous programming languages including C, C++, Java, Perl, Python, C#, Pike, Ruby, Haskell, Objective Caml and Scheme. Adding support for other languages is easy too."
The modules that have been retracted for possible later inclusion are:
Gnome Scan, a project
whose goal is to add scanner capabilities across the desktop applications,
the Tracker
search and index tool and
MonoDevelop, a
GNOME IDE for C# and other .NET languages.
The list of removed modules includes gnome-main-menu and the
Anjuta DevStudio,
a C/C++ IDE. Anjuta has been removed because the stable version is
unmaintained and the development version is not ready yet.
Comments (6 posted)
System Applications
Database Software
The January 21, 2007 edition of the PostgreSQL Weekly News
is online with the latest PostgreSQL DBMS articles and resources.
Full Story (comments: none)
Version 3.3.11 of the
SQLite DBMS is out.
"
Version 3.3.11 fixes for a few more problems in version 3.3.9 that version 3.3.10 failed to catch. Upgrading is recommended."
Comments (1 posted)
Embedded Systems
Version 1.4.0 of BusyBox, a collection of command line utilities for
embedded systems, is out with a lot of new capabilities and bug fixes.
"
Since this is a x.x.0 release, it probably is a bit less "stable" than usual."
Comments (none posted)
Web Site Development
Version 0.95.1 of the Django web development platform
has been announced.
"
We've just rolled out Django 0.95.1, a new minor release of Django which includes fixes for several bugs discovered in the original 0.95 release". Upgrades are recommended.
Comments (none posted)
Version 1.2 of the Rails web development platform
has been announced.
"
We got the RESTful flavor with new encouragement for resource-oriented architectures. Were taking mime types, HTTP status codes, and multiple representations of the same resource serious. And of course theres the international pizzazz of multibyte-safe UTF-8 wrangling.
Thats just some of the headliner features. On top of that, theres an absolutely staggering amount of polish being dished out."
Comments (none posted)
Deepak Vohra
uses XML within Ruby on Rails on O'Reilly's XML.com.
"
Ruby on Rails is a database-based web framework. An XML document may be created and parsed with Ruby on Rails. Rails provides a Ruby library called Builder to generate XML markup. The Builder package contains class Builder::XmlMarkup to generate an XML document. In this article, we will create an XML document from a database table with the Builder library."
Comments (none posted)
Mark Eagle
looks at Stripes on O'Reilly.
"
Stripes is an open source, action-based Java web framework designed around the principles that web development should be simple and productive for developers. Traditional Java web development focused on versatility through decoupling, which resulted in multiple configuration files, additional objects, and other fragmented resources. These difficulties subjected many developers to a higher learning curve and reduced productivity. As a result, some Java developers have been lured away by non-Java frameworks such as Ruby on Rails or Django. Java web frameworks, like Stripes, are beginning to learn from the successes of alternative frameworks that streamline development. This article will show how Stripes distinguishes itself from other action based Java web frameworks, such as Struts, while supplying some of the simplicity available in Ruby on Rails."
Comments (none posted)
Miscellaneous
Version 0.0.21 of Tina POS, a point of sale application for touch screens,
has been announced. Changes include:
New database support: Oracle,
Better user/role management,
New binary package with better third party libraries support,
Third party libraries upgrade and
Many bugs fixed.
Comments (none posted)
Desktop Applications
Audio Applications
KDE.News
has announced
issue #5 of the
Amarok Weekly Newsletter:
"
This issue covers the
fine tuning of the scoring algorithm, new fadeout options, configurable
playlist color, as well as new handy tool for editing filters. Traditionally, with tips included."
Comments (none posted)
Release 2.0 beta 11.1 of
Ardour, a multi-track audio workstation,
has been announced.
"
With several crash fixes, a smattering of minor featurettes, a tubful of bugs squashed and a whole dose of community support comes 2.0 beta11.1."
Comments (none posted)
Version 1.18 of the
eSpeak
text to speech converter has been released, it adds
asynchronous modes, two command-line invocation methods, a new
voice variants feature, new languages and more.
Comments (none posted)
Business Applications
Version 1.2 of
MaklerPlus,
an online real estate catalog system, is available.
"
In this version some bugs were fixed, including some installation problems. The French translation of the layout is included. The function fast contact sends the inquiries directly to the object advertisers, with a copy to the email of the managers of MaklerPlus."
Comments (none posted)
CAD
Stable version 1.18B of
Varkon, a CAD system,
has been announced.
"
VARKON can be used as a traditional CAD-system with drafting, modelling and visualization if you want to but the real power of VARKON is in parametric modelling and CAD applications development. VARKON includes interactive parametric modelling in 2D or 3D but also the unique MBS programming language integrated in the graphical environment."
Comments (none posted)
Data Visualization
Development release 5.7.2 of
PLplot, a library of
scientific plotting functions, is available. The
change log lists the new capabilities.
"
This is a routine development release of PLplot. It represents the ongoing
efforts of the community to improve the PLplot plotting package."
Comments (none posted)
Desktop Environments
The following new GNOME software has been announced this week:
You can find more new GNOME software releases at
gnomefiles.org.
Comments (none posted)
The following new KDE software has been announced this week:
You can find more new KDE software releases at
kde-apps.org.
Comments (none posted)
KDE.News
looks forward to the KDE4 job tracker. "
Picture it as a cross between the Firefox download manager and the KDE printer queue, except that there is no real restriction on what type of jobs can be monitored. The way it works is that each KDE 4 app that has a progress dialog adds a flag for something called an Observer. Then, a separate application can observe any running Jobs, displaying progress and even adding certain actions (like 'Cancel Download') which can be submitted back to the application that actually has the progress dialog."
Comments (none posted)
The January 21, 2007 edition of the
KDE Commit-Digest has been
announced.
The content summary says:
"
KHangman becomes the latest application to
migrate to SVG-based scalable interface rendering. KOpenBabel is merged and
the beginnings of a 3d navigation system in Kalzium. Work expands in the
Umbrello/KPlato Student Mentoring program. Support for the ComicBook Archive
and other improvements in okular. Work on Picture, Video and Krita "Flake"
shapes in KOffice. Improvements in both the KDE 3.5 and 4.0 versions of
Konsole. Language detection in Sonnet continues to mature. Import of concept
code demos in Decibel. "Simple-search" user interface work, and support for
indexing binary data fields in Strigi. "liveui" moves back into kdelibs.
dbmodeler, a database schema modelling application (part of the Season of
KDE), is renamed "grama"."
Comments (none posted)
Xfce 4.4 has been released. The
release
announcement has pointers to screenshots and download information.
Full Story (comments: 1)
The following new Xorg software has been announced this week:
More information can be found on the
X.Org Foundation wiki.
Comments (none posted)
Financial Applications
Version 2.6.23 of SQL-Ledger, a web-based accounting system,
has been announced. Changes include:
"
fixed formatting error for "ship" field when European number format is in use".
Comments (none posted)
Games
The WorldForge game project has
announced
the release of version 0.5.11 of Cyphesis.
"
Cyphesis is a small to medium scale server for WorldForge games, with builtin AI. This version includes the demo game Mason which is currently in development. This release is intended for server administrators wishing to run a Mason server and World developers developing new worlds or game systems."
Comments (none posted)
Mail Clients
MozillaZine
notes that the second Thunderbird 2 beta release is out. "
Features new to Thunderbird 2 include message tags, folder views, session
navigation history, a visual refresh of the theme, and improved new mail
notification alerts." See
the release notes for more information.
Comments (5 posted)
Web Browsers
Version 1.1 of
SeaMonkey, an internet application suite with a web browser,
e-mail, newsgroup and IRC clients and an HTML editor, is out.
"
Powered by the same engine as Firefox 2 and the upcoming Thunderbird 2, SeaMonkey 1.1 includes numerous enhancements including more visible security indicators in the browser and enhanced phishing detection for e-mail, a new tagging system for e-mail that supersedes labels, support for multi-line tooltips in web pages, and previews images in tab tooltips. Other changes include inline spell checking in the browser, an updated version of ChatZilla, and a significantly improved startup script on Linux."
Comments (1 posted)
Miscellaneous
Version 1.0.4 of the bzip2 compression utility is out with bug fixes and
other improvements.
Full Story (comments: none)
Languages and Tools
Caml
The January 23, 2007 edition of the Caml Weekly News
is out with new Caml language articles.
Full Story (comments: none)
JSP
Scott Raymond
covers Prototype 1.5 on O'Reilly's XML.com.
"
The latest release of Ruby on Rails, version 1.2, was announced last week to great fanfare. But the announcement might have overshadowed news of a simultaneous release: version 1.5 of Prototype, the popular JavaScript library. Despite the synchronization and developer overlap between the two projects, nothing about Prototype depends on Railsit's perfectly suitable for use with any server-side technology. In fact, Prototype has amassed a huge user base beyond the Rails communityfrom dozens of Web 2.0 startups to household names like Apple, NBC, and Gucci."
Comments (1 posted)
Perl
The January 21, 2007 edition of the
Weekly Perl 6 mailing list summary is out with coverage of the latest
Perl 6 developments.
Comments (none posted)
Python
Brian McConnell
writes about Python in an O'Reilly article.
"
What happens when programming stops being fun? What do you do when juggling
dependencies and worrying about installation issues takes all of the joy out
of writing code for other people? You can stop coding... or you can try to
address the underlying problems. Brian McConnell postulates an enhancement
of the Python language to make programming as fun as it was in the
BASIC-in-ROM minicomputer days."
Comments (none posted)
Tcl/Tk
The January 22, 2007 edition of the Tcl-URL! is online with new
Tcl/Tk articles and resources.
Full Story (comments: none)
Libraries
Release 1.2.4 of cairomm, a C++ API for the cairo graphics library, is out
with a bug fix.
Full Story (comments: none)
3.99.0 development release 3.99.0 of IT++
has been announced.
"
IT++ is a C++ library of mathematical, signal processing and communication system routines/functions. Its main use is in simulation of communication systems or for performing research in the area of communications.
It has been over 10 months since the first release of IT++ 3.10.x stable series was released. During this period a lot of new functionality and improvements have been committed to the main branch (trunk) of the IT++ SVN repository. Therefore, we decided to publish a set of development releases as 3.99.x series before preparing a new stable branch 4.0.x."
Comments (none posted)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
Groklaw
investigates the openness of the OOXML (OpenXML) document standard.
"
From what I've been reading, which I'll
share with you, I think it's time to ask ourselves some serious questions:
does OOXML really qualify as a standard? Or is it yet another
monopoly-enabler in the guise of a standard? It's a good time to ask,
because it turns out that we are right now in the window of time where
contradictions in the OOXML standard can be reported by member bodies
of the ISO/IEC Joint Technical Committee 1. February 5 is the deadline,
so now is the time to bring such to their attention."
Comments (9 posted)
Joel Spolsky
looks at what
went wrong with Chandler as reflected in the new book
Dreaming in
Code. "
Still, it's a great look at one particular type of
software project: the kind that ends up spinning and spinning its wheels
without really going anywhere because the vision was too grand and the
details were a little short. Near as I can tell, Chandler's original
vision was pretty much just to be 'revolutionary.' Well, I don't know
about you, but I can't code 'revolutionary.' I need more details to
write code."
Comments (9 posted)
Trade Shows and Conferences
Joe 'Zonker' Brockmeier
covers day
two at linux.conf.au. "
The seventh Linux.conf.au (LCA) continued
Tuesday at the Kensington campus of the University of New South Wales in
Sydney, Australia, with miniconferences and a keynote by Christopher
Blizzard. Blizzard spoke about interface design for the One Laptop Per
Child (OLPC) project, and how to be relevant to users. He ventured into
slightly dangerous territory, saying that part of being "relevant" means
being able to "move the needle" -- that is, increase adoption -- and asked,
"How many years now has it been 'the year of the Linux desktop'?""
Comments (1 posted)
ComputerPartner
covers an LCA talk by LWN's Jonathan Corbet.
"
Two years after his 2005 Kernel Report, Colorado-based Linux developer Jonathan Corbet returned to Australia's linux.conf.au conference in Sydney this week to discuss recent enhancements to the open source operating system.
Corbet said the next release, kernel 2.6.20, will include a whole lot of new drivers, including a USB vision driver which will bring support for USB Web cams.
"Linux hardware support is better than ever and it supports more hardware natively out-of-the-box than any other operating system," he said. "The biggest problem is vendors that won't release drivers or specifications.""
Comments (8 posted)
Joe 'Zonker' Brockmeier
reports
from sunny Sydney. "
The seventh Linux.conf.au continued Thursday at
the Kensington campus of the University of New South Wales in Sydney with
talks, tutorials, and Open Day. I didn't attend as many talks on Thursday
as I did during the first half of the week because I had my own talk to
deliver at 11 a.m. on marketing open source projects. You can view it
online, along with most of the other talks. I've encountered very few
"drone and point" talks at LCA 2007, perhaps thanks to a presentation at
the speaker's dinner on Monday on improving presentations and making them
more engaging."
Comments (none posted)
The SCO Problem
Linux-Watch
examines
SCO's recently released fourth quarter financial report.
"
SCO's revenue for the fourth quarter of fiscal year 2006 was $7.349 million, a decline of over a million dollars from $8.528 million for the comparable quarter of the prior year. The company managed to staunch its losses to a degree. The net loss for the quarter was $3.743 million, or $0.18 per diluted common share, as compared to a net loss of $3.431 million, or $0.19 per diluted common share, for the comparable quarter of the prior year. Darl McBride, president and CEO said in a conference call that "The decrease in revenue was primarily attributable to continued competitive pressures on the company's Unix products and services.""
Comments (2 posted)
Companies
LinuxDevices
reports that
SageTV LLC and Linspire are collaborating on the SageTV Media Center
Version 6. "
SageTV Media Center software lets users watch, pause,
and record TV programs on their Linux PCs, and provides a single user
interface for accessing online video as well as personal music, photos, and
videos stored on a PC or network. The optional SageTV Placeshifter, ala
Slingbox, now also enables users to access their PC-based media library on
any Internet-connected Linspire PC."
Comments (none posted)
Linux Adoption
The Hindu
reports on a draft information technology policy being discussed
in Kerala, India.
"
The policy stresses that Free and Open Source Software (FOSS) will be used in e-governance projects. Open standards such as Unicode and Open Document Format and Open Architectures will be followed in e-governance projects to avoid total dependence on select vendors. The Government proposed to develop the State as the FOSS destination in the country. It will provide special incentives to companies developing FOSS."
(Thanks to Joseph Vimal.)
Comments (none posted)
Legal
ZDNet UK
reports that Alan Cox addressed a House of Lords hearing on the topic
of software security liability.
"
Cox said that it would be difficult to make open-source developers liable for their code because of the nature of open-source software development. As developers share code around the community, responsibility is collective. "Potentially there's no way to enforce liability," he said.
The question of open-source liability becomes more complex because of how the code is used, added Cox. Open-source code is generally given away, but companies use that code to develop their own products. Cox said that there was a question of how liability would move from the initial developers to the companies."
Comments (22 posted)
Interviews
SourceForge has named Rosegarden the December 2006 project of the month.
The
article
includes an interview with the developers. "
Why and how did you
get started? Chris: The first Rosegarden project was a university
project that started at the end of 1993 at the University of Bath. I just
kept working on it after I left university. The current program is a
separate project that we made a fresh start on (complete with SourceForge
page!) at the start of 2000. But we already knew each other by then and had
been working together for a while." (Found on
KDE.News)
Comments (3 posted)
KDE.News
has announced
a new
interview
in the People Behind KDE series, this one features Daniel Molkentin.
"
For the next interview in the fortnightly People Behind KDE series we meet a developer who has unfinished business with midges, someone who prefers bullets to stars -- tonight's star of People Behind KDE is Daniel Molkentin."
Comments (none posted)
Cutting Free has
an
interview with the founders of the gNewSense distribution. "
The
co-founders of gNewSense, Paul O'Malley & Brian Brazil, very kindly
agreed to give an interview. As usual, it was conducted by email. It's
great to have their two differing perspectives. Between them, they provide
a balance that is probably responsible for the success of gNewSense. Their
passion is also quite evident. They tell us what gNewSense is about, where
it's going, and why their distribution maintenance tool, "Builder", is so
invaluable." (Thanks to Joey Schulze)
Comments (4 posted)
Dave Phillips'
looks
at Rui Nuno Capela's Linux sound & music software catalog and talks
with Rui Capela. "
Rui Capela's software has appeared in this column
many times. I've written about it directly (see At the Sounding Edge: Using
QSynth and QJackCtl and HDRs and DAWs For Linux: The New Breed) and it
shows up in almost every article I write. I'm not exaggerating when I state
that Rui's programs have become indispensable components here at Studio
Dave, so naturally I'm interested in the mind behind it all. In this entry
I'll recap the nature and state of Rui's software, after which we'll meet
the man himself in another lively interview here at the sounding
edge."
Comments (none posted)
IBM developerWorks
talks
with David Jencks about Apache Geronimo security. "
A
full-service application server like Apache Geronimo needs to have a
full-service security implementation, and that means more than just
supporting SSL connections. It means securing the internal requests made
within an application. In this installment, David Jencks talks to the
renegade about the current and future view of Geronimo's security
implementation."
Comments (none posted)
Resources
Tim O'Reilly has published
a summary of sales in the computer book market with some interesting
trend graphics.
"
Bright spots in the market include SQL Server and to a lesser extent MySQL, as well as data warehousing and data analysis; open source programming languages Python and Ruby; "Linux Other" (which really these days means Ubuntu); and software engineering topics like project management, agile programming, object oriented programming, and user interface design; Cisco; and .Net programming."
Comments (none posted)
HowtoForge
sets up
a Linux box as a dial-in server. "
This document describes how to
attach modems to a Linux box and allow it to receive calls to connect users
to the network. Its like being your own ISP (Internet Service Provider). If
your Linux box is connected to the Internet, then the users will also be
connected to the Internet. Your Linux box becomes a router. This is also
known as RAS (Remote Access Services) in the Microsoft world. In the Linux
world its called PPP (Point to Point Protocol)."
Comments (1 posted)
Linux Journal
looks
at customizing OpenOffice.org. "
OpenOffice.org includes dozens
of options for how it behaves. Available from Tools > Options, they are
divided into general settings for the entire office suite and settings
particular to each application. General settings are available under the
general headings of OpenOffice.org, Load/Save, and Language
Settings."
Comments (none posted)
nixCraft presents
a tutorial on setting Samba share permissions.
"
Samba comes with different types of permissions for share. Try to remember few things about UNIX and Samba permissions.
(a) Linux system permissions take precedence over Samba permissions. For example if a directory does not have Linux write permission, setting samba writeable = Yes (see below) will not allow to write to shared directory / share.
(b) The filesystem permission cannot be take priority over Samba permission."
Comments (none posted)
Reviews
Joe 'Zonker' Brockmeier
reviews
Amarok on Linux.com.
"
So, you got the new iPod that you wanted for Christmas, but you're no fan of iTunes. No problem -- you can cast off your iTunes chains and manage your music entirely with Linux using Amarok. Amarok gives you everything you need to manage your music, from playing to burning music CDs to managing your portable music player."
Comments (none posted)
Linux.com
looks at
FreeNAS. "
FreeNAS is a small, powerful, full-featured implementation
of FreeBSD as a network-attached storage device. (It also happens to be
January's Project of the Month at SourceForge.net.) If you're a Linux user
like me, the BSD-speak used for devices and such might give you pause, but
other than that small caveat, installation and usage shouldn't be a
problem. It's powerful enough to be used in the enterprise, but it's
friendly enough so that even a typical home office user can take advantage
of it. Here's how I created an easy-to-use NAS device for rsync backups and
FTP server on my LAN."
Comments (1 posted)
PC World has run
a reasonably
comprehensive review of several free music players. "
The way
Amarok presents your music library stands in stark contrast to the approach
of the Gnome apps I've covered thus far. Albums are grouped by artist in a
hierarchical listing. A search box provides instantaneous filtering--the
fastest in any app I tested. And The Beatles are alphabetized under
'B.'"
Comments (12 posted)
Linux-Watch
looks at OVIS,
an open-source software tool that provides intelligent, real-time
monitoring of computer clusters. "
OVIS 1.1 takes a statistical
approach to the problem of computational platform monitoring and
analysis. Traditionally, cluster monitoring tools keep an eye on
manufacturer-specified, "absolute" thresholds. OVIS takes a new tack. It
observes the overall statistical properties and environmental effects of a
cluster, characterizing individual device behaviors and comparing them to a
large number of statistically similar devices."
Comments (none posted)
Nathan Willis
takes a look at
Psiphon on NewsForge.
"
Last month, Toronto-based civic activists at The Citizen Lab released a new
open source secure Web browsing tool designed to let people in repressive
countries tunnel through government Internet filters. Known as Psiphon, the
program allows users with unfiltered Internet access to provide a private,
SSL-encrypted Web proxy for use by individuals in firewalled countries." Linux binaries of Psion are in the works, but have not
yet been released.
Comments (none posted)
Miscellaneous
Glyn Moody
looks at
some recent announcements in this Linux Journal article. "
Wow: has
there ever been a month in computing like this one? A January
distinguished by not one major announcement, not two, but four significant
events that will surely go down as milestones in the history of
technology."
Comments (34 posted)
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
The Free Software Foundation Europe has become the legal guardian of the
OpenSwarm project. "
Anastasios Hatzis, the developer behind the
OpenSwarm model-driven development platform for Python applications, lead
the process of assigning copyright to FSFE. "My company - HATZIS
Edelstahlbearbeitung GmbH - wanted to foster a development community around
the OpenSwarm technology while also underwriting our commitment to Free
Software," said Anastasios. "The FLA has provided us with an excellent way
to ensure code coherency and a framework for long-term
development.""
Full Story (comments: 1)
Gamix is an effort to create a Linux-based
gaming platform; it is based on the Mandriva distribution. There are some
limits to its openness, since it specifies an NVidia graphics adapter. A
beta release of the Gamix platform is now
available for
download for those who would like to try it out.
Meanwhile, the Open Game
Console consortium is working on a platform of its own; see this proposal for
details. It, too, uses some closed components; the software will be based
on an unspecified Linux distribution. (Thanks to Per Ekström).
Comments (11 posted)
Liberty Alliance has announced the openLiberty Project, a global open
source initiative formed to provide open source developers with tools for
integrating the privacy and security capabilities of Liberty Federation and
Liberty Web Services into a variety of new identity-based services. The
initial focus is on delivering ID-WSF Web Services Consumer (WSC) libraries
to allow open source developers to incorporate SAML 2.0 functionality into Web
services applications. openLiberty.org is bringing together the resources
developers need to more easily and quickly build open source identity-based
Full Story (comments: 3)
The schedule for the release of the truly open OpenMoko phone is out. Some
developers will get phones in February; the rest of us will be able to buy
one starting on March 11 (for US$350). Click below for the details.
Full Story (comments: 7)
The Open Source Development Laboratory and the Free Standards Group have
sent out
a
press release stating their intent to merge; the
combined group will be known as the Linux Foundation. "
The Linux
Foundation, which continues to sponsor the work of Linux creator Linus
Torvalds, employs a shared resources strategy - much like
open source development itself - to collaborate on platform
development while enhancing the Linux market for end users, the community,
developers and industry."
Comments (none posted)
Commercial announcements
ActiveState
has announced the release of Komodo IDE version 4.0.
"
With this release, developers can now create entire web applicationsserver, browser, and the HTTP conversation that connects themwithin a single unified workspace.
Komodo IDE enables developers to write, debug, share and organize quality code in a customizable programming environment. With 4.0, Komodo's support for dynamic languages such as Perl, PHP, Python, Ruby and Tcl, is extended to browser-side languages including JavaScript, CSS, HTML and XML."
Comments (none posted)
Centeris Corporation has announced Likewise Identity 3.0, a
crossplatform identity management system.
"
Centeris Corporation, a pioneer in developing software for
easy management of Linux® servers in a Microsoft® Windows® network, today introduced Likewise
Identity 3.0, a crossplatform identity management solution that provides seamless integration of
Linux and UNIX users and systems with Microsoft Active Directory."
Full Story (comments: none)
Linspire, Inc. has
announced the availability of the SageTV Media Center Version
6 for Linspire and Freespire.
"
SageTV Media Center software lets users watch, pause and record TV programs
on their desktop and living room Linux PCs and provides a single user
interface for accessing online video as well as personal music, photos and
videos stored on the personal computer. The optional SageTV Placeshifter
also enables users to access their home TV and entire PC-based media
library on any Internet-connected Linspire PC at home or away from home."
Comments (none posted)
Enomaly, Inc. has announced a significant new release of its Enomalism
virtualization administrative management dashboard for Xen Hypervisor
3.0x. The free update and immediate availability of version 0.6 software
adds important new improvements and features to the web-based
administrative tool.
Full Story (comments: none)
Linspire, Inc. has
announced
plans to make its CNR ("Click 'N Run") digital download and software
management service available to several of the most popular desktop Linux
distributions in 2007. "
Previously available only for Linspire and
Freespire desktop Linux users, the CNR Service will begin providing users
of other desktop Linux distributions a free and easy way to access over
20,000 desktop Linux products, packages and libraries, all with a single
mouse click."
Comments (9 posted)
Macraigor Systems is the latest company to join the Eclipse Foundation.
"
Macraigor Systems today announced the immediate
availability of a free Eclipse-compliant embedded debugging solution with
sample Eclipse projects that run on many standard evaluation boards. This
provides embedded systems engineers with an integrated platform for
developing and debugging embedded systems using the widely supported Eclipse platform.
Macraigor Systems today also announced that the company was joining the
Eclipse Foundation as an Add-In Provider."
Full Story (comments: none)
SugarCRM Inc. has
announced a partnership with CareBrains Inc.
"
In response
to growing demand for Sugar commercial open source products in the Japanese
market, SugarCRM and CareBrains are providing CareBrains partners access to
SugarCRM partner program benefits, which include special partner Japanese
language pack access, resell rights to Sugar commercial versions, and fully
localized sales and marketing tools."
Comments (none posted)
Sun Microsystems, Inc. has
announced new third party support and contributions to
the NetBeans 5.5 Integrated Development Environment.
"
This includes
the general availability of the NetBeans Mobility Pack for Connected Device
Configuration (CDC) 5.5, which features significant code contributions from
Ricoh Corporation. In addition, collaborative software development
specialist Intland Software has joined the NetBeans Strategic Partner
Program and created a new plug-in for its CodeBeamer technology for the
NetBeans 5.5 IDE, which is already being used by the United States
Department of Agriculture."
Comments (none posted)
SWsoft has announced that it is now in control of Parallels.
"
The combination of SWsoft and Parallels means that we are the only company
in the world to provide a complete suite of virtualization and automation
software that includes operating system virtualization (Virtuozzo), desktop
virtual machine technology (Parallels) and our range of automation solutions
across all major computing platforms including Windows, Linux, MacOS and
beyond."
Full Story (comments: none)
Terracotta, Inc. has announced the release of Open Terracotta 2.2, an
open-source Java clustering solution.
"
"Open Terracotta provides a very simple, transparent way to program Java applications that scale
well without the headache of JEE and EJBs. The value of Terracottas clustering approach is to
allow developers to focus on the logic of their own software using plain Java and basic data
structures with less time devoted to complex APIs dictated by the application server vendor in the
name of scalability and availability," commented Prosper Nwankpa, co-founder of Xuqa.com, one of
the fastest growing social gaming sites on the Internet."
Full Story (comments: none)
Themis Computer and Terra Soft Solutions are collaborating to deliver
a Linux distribution for the Themis 6U VMEbus TPPC64 single board
computer line.
"
"We are pleased to play a vital role in the delivery of Themis' PowerPC
970-based product" stated Kai Staats, CEO of Terra Soft Solutions. "Themis'
TPPC64 is an excellent host for our leadership LINUX platform, offering
high-density, high performance computing, combined with the full features of
a single board computer, including audio and video", Mr. Staats added."
Full Story (comments: none)
Xandros has announced the availability of the boxed version of
Xandros Desktop - Professional.
"
Available as
a download since December, the new enterprise desktop features Bluetooth wireless support, desktop
search and ISV support. It also provides seamless compatibility with Windows, Linux and UNIX
networks including Windows domain authentication, plus support for logon scripts, group policy
profiles and Microsoft Exchange. Xandros Desktop - Professional is available for a list price of
USD 99.99."
Full Story (comments: none)
New Books
O'Reilly has published the book
Ajax on Rails by Scott Raymond.
Full Story (comments: none)
Resources
OpenOffice.org has announced the
ODF Toolkit Project.
"
[W]e are inviting developers everywhere to take the source of the
world's leading Free and Open office productivity suite in bold new
directions. These may include technologies that engage tools for
collaboration, communication and content creation of every kind; tools that
will complement and even transcend the already powerful productivity
suite. The anchor of this new project is the OpenDocument Format (ODF),
the ISO and OASIS standard format for office applications and the most
flexible and adaptable format for the future."
Full Story (comments: 2)
Contests and Awards
GnomeDesktop.org
has announced a logo contest for Hybrid Share.
"
Hybrid Share is a simple
(User Friendly) Mono C#/Gtk# Application that allow Mac, Windows and Linux
Users To Share Files. The Application is extensible via Plugins, so you can
Talk with connected people, check your mailbox or other things that plugins
could do."
Comments (none posted)
The fourth PyWeek Python game programming challenge
has been announced.
"
The next challenge is PyWeek 4, "Four Yorkshiremen", which will run in the first week of April.
The theme for the latest challenge was "The Disappearing Act"".
Registration will open in March.
Comments (none posted)
Education and Certification
Corgan Enterprises has announced a two-day, on-site training course for
GNU Radio software
and
USRP (Universal Software Radio Peripheral) users.
Full Story (comments: none)
Free Electrons has announced some USB device driver training materials.
"
Free Electrons, a training and consulting company in Free and Open
Source Software for embedded systems, has just released a new set of
free training slides on USB device driver development:
http://free-electrons.com/news/news.2007-01-21."
Full Story (comments: none)
The Linux Professional Institute has announced its newest training
affiliate, DRI / Lisbon, Portugal.
"
DRI was established in
1999 and specializes in IT infrastructure projects and web applications for
the Portuguese market."
Full Story (comments: none)
Event Reports
Terra Soft covers the first three days of the Cell processor "hack-a-thon".
"
Following an intense day of learning, Saturday night found a half dozen
individuals defending the earth from alien invasion via networked PS3s.
Robert Cook of Southern Georgia University states, "The blizzard outside is
nothing compared to the maelstrom of intellectual give-and-take at Terra
Soft's HPC Hack-A-Thon. The result is a rare free flow of ideas. Vendors are
modifying product specs and offerings on-the-fly based on feedback from
workshop attendees. Action items were piling up faster than the snow outside."
Full Story (comments: none)
Upcoming Events
The 2007 Gelato ICE Conference has been announced.
"
On the eve of our fifth anniversary, the Gelato Federation is proud to announce the opening of
registration for the Gelato ICE: Itanium Conference & Expo to be held on April 15-18, 2007, in
San Jose, California."
Full Story (comments: none)
IDG World Expo has
announced
that LinuxWorld OpenSolutions Summit will tackle the subject of Linux on
the Desktop. The OpenSolutions Summit is scheduled to take place February
14-15, 2007, at the New York Marriott Marquis.
Comments (none posted)
The next EU PyPy sprint
has been announced, it will take place between February 25 and March 5, 2007 in Hildesheim, Germany.
"
Some two years and some thousands of commits later, the EU
project period of the PyPy project
is about to close ... and a new period to begin: we are going
for a sprint of three days of focusing on EU reports and
administrative issues, and another three day sprint of happy
hacking on the numerous interesting open ends of PyPy,
the source code."
Comments (none posted)
The 2007 Open Source Think Tank has been
announced.
"
The Open Source Think Tank
is accepting applications to attend the second annual gathering of leading
industry insiders for three days of hands-on, brainstorm-style sessions
addressing the future of open source software and commerce.
The annual conference, "Think Tank 2007: The Future of Commercial Open
Source," is an exclusive, invitation-only event being held March 8 - 10 at
the Silverado Country Club in Napa, California. Participation is limited to
120 people."
Comments (none posted)
Events: February 1, 2007 to April 2, 2007
The following event listing is taken from the
LWN.net Calendar.
| Date(s) | Event | Location |
January 30 February 1 |
Solutions Linux Expo |
Paris, France |
February 1 February 2 |
LinuxDays Luxembourg |
Luxembourg, Luxembourg |
| February 2 |
FUDCon Boston 2007 |
Boston, MA, USA |
February 7 February 9 |
Free Software World Conference 3.0 |
Badajoz, Spain |
February 7 February 9 |
Xorg Developer's Conference |
Santa Clara, CA, USA |
| February 9 |
Women In Open Source |
Los Angeles, USA |
| February 9 |
Open Source Health Care Summit |
Los Angeles, USA |
February 10 February 11 |
2007 Southern California Linux Expo |
Los Angeles, USA |
February 12 February 13 |
Vancouver PHP Conference |
Vancouver, BC, Canada |
February 12 February 13 |
Linux Storage and Filesystem Workshop |
San Jose, CA, USA |
February 12 February 16 |
Ruby on Rails Bootcamp Training |
Atlanta, USA |
February 12 February 15 |
3GSM World Congress 2007 |
Barcelona, Spain |
February 14 February 15 |
LinuxWorld OpenSolutions Summit |
New York, NY, USA |
| February 15 |
TiE Open Source Summit |
Pittsburgh, PA, USA |
| February 16 |
The Ubucon New York |
New York, NY, USA |
February 19 February 23 |
DebianEDU DevCamp |
Soissons, France |
| February 22 |
PyCon Tutorial Day |
Addison, Texas, |
| February 22 |
CELF Japan Linux Technical Jamboree #13 |
Tokyo, Japan |
February 22 February 24 |
OpenMind 2007 |
San Giorgio a Cremano, Naples, Italy |
February 23 February 25 |
PyCon 2007 |
Addison, Texas, |
| February 23 |
PHP Conference UK 2007 |
London, England |
February 24 February 25 |
Free and Open Source Software Developers' European Meeting |
Brussels, Belgium |
February 24 February 25 |
Java/DevJam/2007/Fosdem |
Brussels, Belgium |
February 26 March 1 |
PyCon Sprints |
Addison, Texas, |
February 26 March 2 |
PHP5 Bootcamp Training at the Big Nerd Ranch |
Atlanta, Georgia, USA |
February 27 March 1 |
O'Reilly Emerging Telephony Conference |
San Francisco, CA, |
February 27 March 2 |
EUSecWest Applied Security Conference |
London, UK |
February 28 March 2 |
Network and Distributed System Security Symposium |
San Diego, CA, USA |
March 2 March 3 |
LinuxForum 2007 |
Copenhagen, Denmark |
March 3 March 8 |
O'Reilly Emerging Technology Conference |
San Diego, CA, USA |
March 5 March 8 |
EclipseCon 2007 |
Santa Clara, CA, USA |
March 5 March 6 |
Karlsruhe Workshop on Software Radios |
Karlsruhe, Germany |
March 8 March 10 |
2007 Open Source Think Tank |
Napa, CA, USA |
March 10 March 13 |
Camp 5 Advanced Zope3 Training |
Charlotte, North Carolina, USA |
March 12 March 16 |
QCon |
London, England |
March 12 March 16 |
Third Annual Security Enhanced Linux Symposium |
Baltimore, US |
March 12 March 14 |
BOSSA Conference |
Porto de Galinhas, Brazil |
March 13 March 14 |
The Linux Foundation Japan Symposium |
Tokyo, Japan |
March 14 March 16 |
PHP Quebec Conference |
Montreal, Canada |
March 14 March 17 |
Barbeque Sprint for Plone3 |
Charlotte, North Carolina, USA |
March 15 March 21 |
CeBIT computer fair |
Hannover, Germany |
March 16 March 17 |
MountainWest RubyConf |
Salt Lake City, USA |
March 18 March 23 |
Novell BrainShare 2007 |
Salt Lake City, Utah, USA |
March 19 March 21 |
UKUUG LISA/Spring Conference 2007 |
Manchester, UK |
March 22 March 25 |
Linux Audio Conference |
Berlin, Germany |
March 23 March 25 |
ShmooCon |
Washington DC, USA |
March 23 March 25 |
Guademy |
Coruña, Spain |
| March 24 |
FSF Associate Membership Meeting |
Cambridge, MA, USA |
March 26 March 29 |
Emerging Technology Conference |
San Diego, CA, USA |
April 1 April 4 |
International Lisp Conference 2007 |
Cambridge, England |
April 1 April 5 |
Embedded Systems Conference |
San Jose, CA, USA |
| April 1 |
GPLv3: Improving a Great Licence (discussion draft 3) |
Brussels, Belgium |
If your event does not appear here, please
tell us about it.
Audio and Video programs
A podcast done with and about the Jokosher audio editor
is available.
"
A sample podcast recorded by Jono Bacon has been recorded, edited, mixed and exported entirely in Jokosher. The podcast shows the kind of recording you can do in Jokosher with recorded audio, imported audio, fades and cuts. The process of recording the show also unveiled a number of bugs which have been fixed within hours of them being recorded."
Comments (none posted)
Page editor: Forrest Cook