LWN Weekly Edition
Leading itemsSecurity
Kernel development
Distributions
Development
Linux in the news
Announcements
->Multipage format
This page
Previous weekFollowing week
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
LWN.net Weekly Edition for August 23, 2007A pair of acquisitionsWhile much of the commercial world was watching the initial public offering of VMWare stock, a competitor was carefully pushing forward a different strategy. On August 15, Citrix announced its acquisition of XenSource, the company formed to commercialize the Xen hypervisor. At $500 million, it is a pricey purchase - Citrix guesses that XenSource will bring in $50 million in revenue in 2008, but at a cost of $60-70 million. So profits from XenSource, in the near term, will be virtualized as well; perhaps the plan is to make it up in volume.Those who fear that money cannot be made with free software might take comfort in a half-billion dollar acquisition of a free software company. Of course, XenSource is far from a pure free software operation. The kernel-level code is GPL-licensed, as is required; much of that code has recently, after a long delay, found its way into the mainline kernel. But the upper layers - the code for the management of virtualized systems - is highly proprietary. It is offered in a three-tier scheme, with the more expensive products un-crippling larger numbers of features. These products are where the revenue comes from. This acquisition is somewhat indicative of what is happening in the virtualization market. The low-level functionality is free, and is getting steadily more capable. But the tools for the administration of virtualized systems - a task of daunting complexity for sites running large numbers of virtual guests - are generally proprietary. It is the offerings at this level which give XenSource its value despite the fact that Xen's kernel-level support is increasingly surrounded by capable and arguably better-designed alternatives. For all practical purposes, the XenSource acquisition is just the purchase of yet another proprietary software company, Xen's free software origins notwithstanding. Perhaps more interesting is the acquisition of the ClamAV project by Sourcefire, the company behind the Snort intrusion detection system. ClamAV, a virus scanner, is a true free software project which, previously, had lacked a commercial component. Details have not been disclosed, but one assumes that the owners of ClamAV did not make out quite as well as the holders of XenSource stock. They did get jobs out of the deal, though; they will now continue their ClamAV work as Sourcefire employees. Who the owners are is, in this case, an interesting question. Projects led by developers with commercial ambitions typically require copyright assignments for any outside contributions. With ownership of 100% of the code base, selling a project (or taking it proprietary) is a relatively straightforward operation. ClamAV, however, is not one of those projects, and all contributors retained their copyrights. So Sourcefire does not own the entire ClamAV code base (or the equally important virus signature database). What it has acquired is the copyrights held by the primary contributors - a large part of the project, but not the whole thing. This ownership structure could be a bit of a challenge for Sourcefire going forward; part of the plan for making money from this deal involves making a commercially-licensed version of ClamAV available for vendors who wish to integrate ClamAV into their products without being bound by the GPL. To make this offering possible, Sourcefire will be digging through the code and the source code management system to weed out any code which it cannot relicense. If the developers involved have an accurate idea of how much code is involved, if they are thorough in eradicating it, and if they do not anger any outside contributors to the point that they wish to create trouble, this scheme could go well. If a misstep is made somewhere, the possibility of legal action and other unpleasant consequences is very real. For now, the stated plan is to continue to keep the entire code base and signature database available under the GPL. Sourcefire's Mike Guiterman says that the ClamAV user community has nothing to worry about:
In this case our (Sourcefire's) track record with Snort speaks for
itself. Sourcefire has never with held or delayed a feature in
Snort from the open source community. Snort releases and Sourcefire
commercial releases are in lock step.
It has been pointed out, though, that there is a bit more to Sourcefire's track record than stated above. Snort releases may happen "in lock step," but anybody who has not bought a Snort rules subscription must wait 30 days for rule updates. Like Snort, ClamAV uses a frequently-updated set of rules which are compared against incoming traffic to detect threats. So it would seem that the ClamAV signature database would be very much amenable to the same commercial treatment; that is, after all, how a number of other anti-virus companies do business. For now, though, all of the indications are that Sourcefire will not be creating a subscription service around ClamAV signature updates. Quite possibly the company feels that one reason for ClamAV's success is the presence of a wider community which can contribute those updates; putting signature updates behind a subscription gate would almost certainly cause community contributions to dry up. Rather than risk damaging the project it just bought, Sourcefire may have decided to seek revenue in other directions - for now, at least. With sufficient care, Sourcefire should be able to keep the ClamAV community together - and, perhaps, help it to grow further. Acquisition of a free software project is almost certain to bring change, but that change need not be bad. As we head steadily toward World Domination, we may well see more of these deals. One can only hope that the companies carrying out these acquisitions understand well that, in the absence of the wider community, all they can acquire is a lump of code. Preserving the value of a project acquisition requires preserving the community that goes with it. As long as this important fact is kept in mind, acquisitions can be ultimately beneficial to the affected projects and free software as a whole.
Large projects and decentralized developmentDevelopment using Git, with its decentralized model, is gaining proponents for projects beyond its Linux kernel heritage. Some recent threads on the kde-core-devel mailing list have been discussing how Git might be used by some developers without disrupting the Subversion (svn) infrastructure that is used by KDE. That conversation has broadened to consider how a large project like KDE might reorganize to take advantage of Git's strengths. It does not look like KDE is really considering a switch – they converted from CVS a little over two years ago – but the discussion is useful to anyone thinking about using Git. There are really two separate discussions taking place, the first concerns using Git without disrupting svn, while the second covers the larger issues of how to structure and use Git for a larger project. The two are intertwined as the "best practice" for a KDE-sized project is to convert incrementally. Smaller sub-projects, a particular KDE application for example, would use Git while still committing the changes back to the svn repository. Trying to do a wholesale conversion of a project the size of KDE, with many developers, testers, translators and users – not to mention millions of lines of code – would be something approaching impossible. For tracking an svn repository, while using Git locally, the git-svn tool is indispensable. It uses any of the svn protocols to check out a repository, optionally including branches and tags, and installing them as a Git repository. A developer then uses Git commands locally, using git-svn again when ready to update from or push changes to the svn repository. It is not a perfect fit, complaints about losing history in the conversion have been heard, but it does provide Git users a way to interact with svn. The decentralized nature of the Git development model is always a stumbling block for projects that are used to the single, central, repository model of svn and other revision control systems. Adam Treat invited a rather well-known expert on Git, with some small experience in applying it to large projects, to comment on some of the questions he and others had. Linus Torvalds, who is also a KDE user, responded, at length, with some very useful insights. Breaking the project into sub-projects is the first step:
So I'm hoping that if you guys are seriously considering git, you'd also
split up the KDE repository so that it's not one single huge one, but with
multiple smaller repositories (ie kdelibs might be one, and each major app
would be its own), and then using the git "submodule" support to tie it
all together.
Using the git-submodule command, a project can be broken up into many pieces, each with their own Git repository. Those separate repositories can then be stitched together into a "superproject" that understands how to handle a collection of repositories. If a change affects multiple modules, it can still be handled in an atomic way:
What happens is that you do a single commit in each submodule that is
atomic to that *private* copy of that submodule (and nobody will ever see
it on its own, since you'd not push it out), and then in the supermodule
you make *another* commit that updates the supermodule to all the changes
in each submodule.
See? It's totally atomic. Anybody that updates from the supermodule will get one supermodule commit, when that in turn fetches all the submodule changes, you never have any inconsistent state. Users of a development tree have differing needs, which Git supports by not requiring a central repository that all users must interact with. Torvalds believes that the development organization, not the tool, should determine which repositories are central:
I certainly agree that almost any project will want a "central" repository
in the sense that you want to have one canonical default source base that
people think of as the "primary" source base.
But that should not be a *technical* distinction, it should be a *social* one, if you see what I mean. The reason? Quite often, certain groups would know that there is a primary archive, but for various reasons would want to ignore that knowledge. For Linux, his kernel Git tree is the center, but for a variety of other users, the "stable" tree or distribution kernel trees for example, their repositories are the source. Those repositories can and do update from time to time from the main tree, but they control when and the users of those trees don't have to care. On the subject of mapping the current KDE practices to Git, Torvalds is, characteristically, not shy about expressing his opinion:
Hey, you can use your old model if you want to. git doesn't *force* you to
change. But trust me, once you start noticing how different groups can
have their own experimental branches, and can ask people to test stuff
that isn't ready for mainline yet, you'll see what the big deal is all
about.
Centralized _works_. It's just *inferior*. There is a clash of development models going on and Torvalds is pushing the kernel's model. His reasons are good, though they may not convince everyone, which is why Git tries hard to avoid forcing any particular style. As he did with open source development, Torvalds is trying to lead by example, while not forcing anyone to change. Reading the full threads including the entire posting by Torvalds will be very interesting to those who follow source code management issues. This culture clash, centralized and somewhat bureaucratic versus decentralized and freewheeling will come up again and again over the next few years. Torvalds seems to think the Git model will work most everywhere and his track record for making smart choices is good. It will be interesting to watch.
Microsoft's licenses: excerpts from a conversationMicrosoft recently submitted two licenses to the Open Source Initiative to be considered for approval as being truly open source. There have been a few themes which have come out of the subsequent discussion. One is that the licenses are generally seen as being compliant with the Open Source Definition, though their incompatibility with other licenses bothers a few people. Not everybody agrees that the Microsoft Permissive License (MS-PL) is truly "permissive," and some have asked for a name change. There have been some grumblings that the licenses offer no additional value in a time when the OSI is actively trying to reduce license proliferation.But, as can be seen below, the heated part of the conversation was about a different topic: can and should the OSI judge a license based on its origin? Without further ado...
Does this submission to the OSI mean that Microsoft will:
-- Chris DiBona
a) Stop using the market confusing term Shared Source If not, why should the OSI approve of your efforts? That of a company who has called those who use the licenses that OSI purports to defend a communist or a cancer? Why should we see this seeking of approval as anything but yet another attack in the guise of friendliness?
I'm unclear how some of your questions are related to our license
submissions, which is what I believe this list and the submission
process are designed to facilitate. You're questioning things such
as Microsoft's marketing terms, press quotes, where we put licenses
on our web site, and how we work with OEMs - none of which I could
find at http://opensource.org/docs/osd.
-- Bill Hilf
Be careful what you ask for. Do you really want everything RMS says about
the BSD and similar licenses to be on-topic for approval of future FSF
licenses? Should it be? Or should we do the right thing and restrict our
review to the licenses themselves?
-- Chris Travers
Hey, I can sympathize - personally, I really don't approve of the
FSF, and I'd love to see the OSI turn down the GPLv3.
-- Dag-Erling Smørgrav
Except I wouldn't, really, because then the OSI would lose every shred of credibility and quickly become irrelevant - just like it would if it failed to carefully consider the licenses submitted by Microsoft, or to approve them if they were found to adhere to the OSD.
This comes back to an old question on this list: is the OSI simply
responsible for mechanically approving licenses? Or is the OSI
responsible for, as it says on the web site, "maintaining the Open
Source Definition for the good of the community"? In my opinion,
which I acknowledge is not widely held, the good of the community does
not require approving every applicable license.
-- Ian Lance Taylor
That said, I personally would be in favor of approving the Microsoft licenses. I think it is overall a benefit to the community to acknowledge that code under these licenses is open source.
OSI's role is merely to certify the licences that meet OSD criteria, and
promote the concept of open source in general.
-- Rick Moen
The OSI board's anti-proliferation efforts appear to take them one
step beyond certification though. It would seem to be that
otherwise compliant licenses could be rejected if they simply
duplicate the terms or purpose of an existing license... I would
guess that a license
that copied the Apache license and replaced all instances of Apache
with some other abstract word would be rejected, no matter what the
compatibility matrix looked like. How about a license that had
exactly the same requirements as Apache, but restated them in a
completely different way? From there, what's the *smallest*
difference in licensing terms that would be worth adding yet
another license?
-- Brian Behlendorf
I think (as I thought two years ago) that this is a case where the
anti-proliferation rules should be set aside. We are dealing with an
organization that has the potential of being a major player in free and
open source software (and if they don't like the GPL, there are plenty
of other FLOSS-producing organizations that don't like it either).
If they can only bring themselves to release such software under their
own particular licenses, so much the worse; but not more the worse than
if they never released any FLOSS software at all
-- John Cowan
So the question becomes, should OSI discriminate? Will a farmer let
a fox into the henhouse if the fox puts on a chicken suit?
-- Groklaw
I think not. Not if he wants to have any chickens. A fox in a chicken suit is still a fox and is still planning to eat his chickens. So only a stupid farmer would reason that a fox in a chicken suit, even one made from real chicken feathers, should now be allowed to reside in his chicken coop with his tasty chickens. Farmers are supposed to consider what foxes are known to do to chickens and what a fox's motives and likely purpose might be in putting on a chicken suit and sweetly pawing on the door to the henhouse.
Over time, it will probably become obvious that MS-PL and MS-CL are
merely yet more additions to the horde of insignificant/redundant
licences that, nonetheless, do pass OSD muster. They aren't innovative
or particularly useful, though they do have the minor excellence of
brevity...
-- Rick Moen
There's really nothing new, here. However, if OSI were to surrender the integrity of its certification program, that would be something new, and particularly bad. Which is easily a sufficient reason for that not to occur. The actual decision must wait for the recommendation from the OSI license approval committee and the vote of the board of directors.
Security The Skype outageA recent outage at Voice over IP (VoIP) provider Skype has caused quite a stir. For nearly two days, users of the VoIP software could not make calls, which set off a storm of blog postings wondering about the cause. Skype released an official explanation that did not ring true to some, leading to further speculation. Sometime early Thursday, 16 August, Skype users could no longer authenticate and connect to the network. On Friday, right in the middle of the outage, a posting to Bugtraq purported to have information about the vulnerability that was being exploited to cause the outage. Skype has since categorically denied that any attack was responsible, but suspicions persist that the denial-of-service (DoS) vulnerability reported was actually responsible for the outage. On Monday, Skype posted the following to their Heartbeat blog:
On Thursday, 16th August 2007, the Skype peer-to-peer network became
unstable and suffered a critical disruption. The disruption was triggered
by a massive restart of our users' computers across the globe within a very short
timeframe as they re-booted after receiving a routine set of patches
through Windows Update.
Though they
never blamed Microsoft or the updates themselves, many in the media did it
for them, which led Skype to clarify
their explanation of the outage.
The high number of restarts affected Skype's network resources. This caused a flood of log-in requests, which, combined with the lack of peer-to-peer network resources, prompted a chain reaction that had a critical impact. The new message provided more details, but still remained mute on one of the central puzzles: why did updates on Tuesday cause an outage starting on Thursday? While they acknowledge a bug in their software, there is also no mention of how the situation was resolved, presumably through an automatic update of their own. Overall, the explanations are fairly thin on technical detail which allows others to conjecture to try and fill in the holes. There are many millions of Skype users – the software is available for Windows, OS X and x86 Linux – for the no-cost PC-to-PC calling as well as the other services that Skype does charge for. Hopefully the free users are not depending on the service, but there are companies which use Skype exclusively; an outage for two weekdays must have been rather painful. Certainly the landline and cellular phone companies have had their problems along the way, but those tend to be regional rather than worldwide. All software even minimally more complicated than "hello world" has bugs, and those bugs will be triggered in surprising ways. Taking the Skype "perfect storm" explanation at face value, it is nearly amazing that millions of reboots could result in a network storm so severe that it would take two days to resolve. Somehow, in the interface between the Skype's centralized authentication and their P2P routing code, things went horribly awry. It does, however, give one pause about the power of the near-monoculture in desktop operating systems. It is hard, but not completely impossible, to imagine a similar scenario for Linux boxes. To start with, it is uncommon that a software upgrade requires a reboot. Within the Linux user community, there is a wide range of kernel versions running, so even if there were a critical security fix that required "all" Linux kernels to be upgraded, it would not be very synchronized – the distributions tend to have different response times. This is a bit of a double-edged sword, of course, those varying response times could leave a hole that a worm or attacker could exploit. But, because Linux boxes are controlled by their owners rather than by their distribution provider, synchronized reboots are probably not a major cause for concern. Beyond monocultural issues, there is the question of how a P2P system can be taken down by the lack of a centralized resource, in this case credentials from an authentication server. That provides a single point of failure to what is supposed to be a robust architecture, resistant to exactly those kinds of problems. There are also those who wonder if the outage was caused by an "upgrade" mandated by the US government so that they can more easily monitor Skype calls. Skype is proprietary and closed source; there is no easy way to determine whether the problem has been fixed, or even whether the problem is being accurately described. If Skype decides, or is forced, to change their software to be more easily monitored, it will be hard to detect. It might look an awful lot like a multi-day outage that clears up somewhat mysteriously. Trusting closed source software for vital communications is not the best of plans, at least when there are alternatives. Free software would not necessarily avoid these kinds of problems, but a completely decentralized network with multiple clients sharing a protocol, but little else, would certainly be more resistant to this kind of outage. More importantly, it would also be more transparent. Over time, projects like openwengo, Linphone, Asterisk and others can hopefully provide those benefits to a larger audience
Brief items Ubuntu Servers Hijacked, Used to Launch Attack (eWeek)eWeek reports on a recent security breach of five Ubuntu-hosted community servers. "It was suggested during an IRC (Internet relay chat) meeting of the Ubuntu colocation team Aug. 14 that the source of the troubles might have been a Chinese IP address trying to log onto the servers by brute force "for a long time now it seems," said a participant. On Aug. 14, the community began to bring the machines back up in a safe state so that they could recover data from them. Unfortunately, according to Ubuntu Community Manager Jono Bacon, the servers were all found to be out of date, stuffed with Web software, and missing security patchesat least in the instances where it was easy to determine what version they're running. "An attacker could have gotten a shell through almost any of these sites," [Bacon] wrote in a posting, regarding a change to location server policy that resulted from the incident."
New vulnerabilities kdebase: several vulnerabilities
kernel: several vulnerabilities
nvidia-drivers: insecure file permissions
rsync: off-by-one errors
sysstat: insecure temporary files
tor: compromised anonymity
Updated vulnerabilities acroread: multiple vulnerabilities
apache2: information disclosure
apache: multiple vulnerabilities
apache: cross-site scripting
Asterisk: two SIP denial of service vulnerabilities
avahi: denial of service
bind: DNS cache poisoning
bochs: buffer overflow
bugzilla: multiple vulnerabilities
centericq: buffer overflows
clamav: denial of service
cpio: arbitrary code execution
vixie-cron: privilege escalation
cscope: buffer overflows
cscope: buffer overflows
cups: denial of service
gpdf: integer overflow
Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of Service
dovecot: privilege escalation
dovecot: directory traversal
elinks: code execution
elinks: arbitrary file access
emacs21: denial of service
evolution: format string error
evolution-data-server: malicious server arbitrary code execution
pop mail man-in-the-middle attacks
file: integer overflow
firebird: buffer overflow
firefox: multiple vulnerabilities
firefox: multiple vulnerabilities
firefox, thunderbird, seamonkey: multiple vulnerabilities
flac123: arbitrary code execution
freetype: arbitrary code execution
freetype: integer overflows
gcc: file overwrite vulnerability
gd: buffer overflow
gd: multiple vulnerabilities
gd: denial of service
gdm: denial of service
gedit: format string vulnerability
gimp: multiple vulnerabilities
grip: buffer overflow
gzip: multiple vulnerabilities
HelixPlayer: arbitrary code execution
horde-kronolith: local file inclusion
ImageMagick: integer overflows
ipsec-tools: denial of service
jasper: denial of service
java: multiple vulnerabilities
java-1.5.0-sun: multiple vulnerabilities
kdebase: information leak
kdelibs: kate backup file permission leak
kernel: denial of service
kernel: denial of service
kernel: denial of service
kernel: multiple vulnerabilities
kernel: denial of service
kernel: denial of service
kernel: denial of service
kernel: denial of service by memory consumption
kernel: denial of service
kernel: several vulnerabilities
kernel: signal handling flaw on PPC
kernel: several vulnerabilities
kernel: denial of service
kernel: denial of service
kernel: multiple vulnerabilities
krb5: multiple vulnerabilities
krb5: uninitialized pointers
krb5: local privilege escalation
krb5: multiple vulnerabilities
ktorrent: incorrect validation
lftp: shell command execution
libarchive: pax extension header vulnerabilities
libexif: integer overflow
libmodplug: boundary errors
libphp-phpmailer: command execution
libpng: denial of service
libpng: buffer overflow
libpng: heap based buffer overflow
libtiff: buffer overflow
libvorbis: multiple memory corruption flaws
libxml2 - arbitrary code execution
libxml2: multiple buffer overflows
lighttpd: denial of service
lookup-el: insecure temporary file
lynx: arbitrary command execution
mod_jk: proxy bypass
moin: arbitrary JavaScript execution
moodle: cross-site scripting
mplayer: buffer overflow
mydns: buffer overflows
mysql: denial of service
mysql: format string bug
MySQL: privilege violations
mysql: multiple vulnerabilities
MySQL: logging bypass
nbd: arbitrary code execution
ncompress: buffer underflow
nginx: cross site scripting
OpenOffice.org: arbitrary code execution
OpenSSH: denial of service
openssh: remote denial of service
openssl: private key attack
pam: privilege escalation
perl-Net-DNS: predictable id sequence
php: multiple vulnerabilities
php: several vulnerabilities
php: multiple vulnerabilities
php: buffer overflows
phpbb2: missing input sanitizing
phpbb2: multiple vulnerabilities
phpPgAdmin: cross-site scripting
phpwiki: remote code execution
pptpd: denial of service
proftpd: authentication bypass
pulseaudio: denial of service
python: information disclosure
qemu: multiple vulnerabilities
qt: arbitrary code execution
qt: "/../" injection
qtpfsgui: arbitrary code execution
quake: buffer overflow
redhat-cluster-suite: denial of service
rpm: arbitrary code execution
slocate: information disclosure
snort: remote arbitrary code execution
squirrelmail: arbitrary code execution
Sun JDK/JRE: multiple vulnerabilities
tcpdump: integer overflow
tcpdump: denial of service
terminal: arbitrary code execution
tetex: buffer overflow
tomcat: directory traversal
tomcat: cross-site scripting
vim: arbitrary code execution
vixie-cron: weak permissions may cause errors
vlc: several vulnerabilities
wireshark: multiple vulnerabilities
XFree86 X.org: integer overflows
xfsdump: insecure temp dir
xine-lib: arbitrary code execution
xine-lib: buffer overflow
xmms: BMP handling vulnerability
X.org: temp file vulnerability
xvid: array indexing vulnerabilities
zziplib: buffer overflow
Page editor: Jake Edge Kernel development Brief items Kernel release statusThe current 2.6 prepatch remains 2.6.23-rc3; the 2.6.23-rc4 release is somewhat overdue as of this writing. There has been a steady flow of fixes into the mainline git repository over the last week.The current -mm tree is 2.6.23-rc3-mm1. Recent changes to -mm include the long-awaited ath5k wireless driver (mac80211-based support for Atheros 5xxx wireless cards), a long list of x86_64 patches, a new PID namespaces patch, and the PIE executable randomization patch from ExecShield. The current stable 2.6 kernel is 2.6.22.4, released on August 20. This one contains a single patch - a security fix for the signal vulnerability which allows, under some circumstances, an arbitrary signal to be sent to a setuid process. (Note that the 2.6.22.5 process has already begun with that update being due on or after the 23rd). For older kernels: 2.6.20.16 was released on August 16 with a couple dozen fixes. The next 2.6.20 stable update is currently in review; it is a large patch set with quite a few fixes.
Kernel development news Quotes of the week
Why can DOS delete an infinite number of files and rm can't?
Because rm was written using the "vi" editor and it causes brain
damage and that's why after 20 years rm hasn't caught up with del.
-- Marc Perkel has solutions for all our
problems
Asserting that critics should patch the holes in your handwaving is
unlikely to impress anybody; arrogance is not in short supply
around here and yours is not even original.
-- Al Viro responds (thanks to Dag Bakke).
Distributed storageEvgeniy Polyakov is not an easily discouraged developer. He has been the source of a great deal of interesting kernel code - including a network channels implementation, an asynchronous crypto framework, the kevent subsystem, the "network tree" memory management layer, and the netlink connector code. Of all of those patches, only the netlink connector has made it into the mainline kernel - and that was back in 2005. Undeterred, Evgeniy has come forward with another significant patch set for consideration. His ambitions are no lower this time around: he would like to replace much of the functionality offered by the device mapper, iSCSI, and network block device (NBD) layers. He calls the new subsystem distributed storage, or DST for short. The goal is to allow the creation of high-performance storage networks in a reliable and easy manner.At the lowest level, the DST code implements a simple network protocol which allows block devices to be exported across a network. The number of operations supported is small: block read and write operations and a "how big is your disk?" information request is about it. But it is intended to be fast, non-blocking, and able to function without copying the data on the way through. The zero-copy nature of the code allows it to perform I/O operations with no memory allocations at all - though the underlying network subsystem might do some allocations of its own. There is no data integrity checking built into the DST networking layer; it relies on the networking code to handle that aspect of things. There is also no real security support at all. If a block device is exported for use in DST, it is exported to anybody who can reach the host. The addition of explicit export lists could certainly be done in the future, but, for now, hosts exporting drives via DST are probably best not exposed to anything beyond an immediate local network. The upper layer of the DST code enables the creation of local disks. A simple ioctl() call would create a local disk from a remote drive, essentially reproducing the functionality offered by NBD. Evgeniy claims better performance than NBD, though, with non-blocking processing, no user-space threads, and a lack of busy-wait loops. There is also a simple failure recovery mechanism which will reconnect to remote hosts which go away temporarily. Beyond that, though, the DST code can be used to join multiple devices - both local and remote - into larger arrays. There are currently two algorithms available: linear and mirrored. In a linear array, each device is added to the end of what looks like a much larger block device. The mirroring algorithm replicates data across each device to provide redundancy and generally faster read performance. There is infrastructure in place for tracking which blocks must be updated on each component of a mirrored array, so if one device drops out for a while it can be quickly brought up to date on its return. Interestingly, that information is not stored on each component; this is presented as a feature, in that one part of a mirrored array can be removed and mounted independently as a sort of snapshot. Block information also does not appear, in this iteration, to be stored persistently anywhere, meaning that a crash of the DST server could make recovery of an inconsistent mirrored array difficult or impossible. Storage arrays created with DST can, in turn, be exported for use in other arrays. So a series of drives located on a fast local network can be combined in a sort of tree structure into one large, redundant array of disks. There is no support for the creation of higher-level RAID arrays at this time. Support for more algorithms is on the "to do" list, though Evgeniy has said that the Reed-Solomon codes used for traditional RAID are not fast enough for distributed arrays. He suggests that WEAVER codes might be used instead. At this level, DST looks much like the device mapper and MD layers already supported by Linux. Evgeniy claims that the DST code is better in that it does all processing in a non-blocking manner, works with more network protocols, has simple automatic configuration, does not copy data, and can perform operations with no memory allocations. The zero-allocation feature is important in situations where deadlocks are a worry - and they are often a worry when remote storage is in use. Making the entire DST stack safe against memory-allocation deadlocks would require some support in the network layer as well - but, predictably, Evgeniy has some ideas for how that can be done. This patch set is clearly in a very early state; quite a bit of work would be required before it would be ready for production use with data that somebody actually cares about. Like all of Evgeniy's patches, DST contains a number of interesting ideas. If the remaining little details can be taken care of, the DST code could eventually reach a point where it is seen as a useful addition to the Linux storage subsystem.
Who maintains this file?Kernel developers are generally encouraged to split patches into small pieces before posting them to the mailing lists. Making each change self-contained and easy to understand helps reviewers do their job and is thus a good thing. That said, anybody who doubted that one can get too much of a good thing surely learned the truth when Joe Perches submitted this patch set made up of almost 550 patches, all to the same file. It is fair to say that this deluge of patches was not universally welcomed.Packaging aside, the ultimate goal of Joe's patch was not particularly controversial: he would like to make it possible to easily find out who is the maintainer of a specific file in the kernel tree. So, for each entry in the MAINTAINERS file, he added one or more lines with patterns describing which files belong to that entry. With that information in place, his get_maintainer.pl script can quickly identify who is responsible for any file in the tree. No more digging through MAINTAINERS or trying to extract email addresses from copyright notices in the source. It's an appealing idea, but nobody seems to be entirely clear on how to implement it. Keeping this information in a central file has a number of obvious disadvantages. It would clearly go out of date quickly, for example. The MAINTAINERS file tends to get stale as it is; the chances of it being patched for every new or renamed file seem quite small. If developers, contrary to expectations, do keep this file up to date, one can expect large numbers of conflicts as all the resulting patches try to touch the same file. The patch conflict problem could be mitigated by splitting up the MAINTAINERS file into per-directory versions, much like what was done with the kernel configuration file in the past. There are now over 400 Kconfig files in the mainline tree; some developers have expressed dismay at the idea of similar numbers of MAINTAINERS files being scattered around the tree. And, in any case, per-directory files aren't much more likely to be updated than the single, central file. So around came another idea: why not just put the maintainer information into the source files? The result would be nicely split documentation which gets put in front of the relevant developers every time they edit the file. The record for maintenance of documentation in the code is far from perfect, but it is much better than the record for completely out-of-line documentation. One question which comes up when this approach is considered is whether the resulting information should go into the binary kernel image or not. It would be easy to define a new tag like:
MODULE_MAINTAINER("Your name here");
The provided information could then go into a special section in the kernel image where special tools could find it. Doing things this way would make it possible for people who don't have a kernel tree handy to look up a maintainer. On the other hand, it would bloat the kernel image and fix information in a binary, widely-distributed form where it could persist long after it goes out of date. So ex-maintainers could continue receiving mail for years after they have changed all of the relevant documentation. An alternative would be to just put the maintainer information at the top of the file as a comment. Then it would only be in the source, and would, presumably, be relatively easy to keep up to date. At least, until, say, a mailing list for a major subsystem moves and all of the associated source files have to be changed. For example, Adrian Bunk noted that the move of the netdev mailing list to vger would have forced patches to about 1300 files. Yet another approach is to find a way to store the information in the git repository. Git already maintains quite a bit of metadata about source files; to some it seems natural to add maintainer information as well. So far, the git developers have not shown a lot of appetite for adding this sort of feature. But Linus did point out that one could already use git to a similar effect with a simple command:
Do a script like this:
#!/bin/sh git log --since=6.months.ago -- "$@" | grep -i '^ [-a-z]*by:.*@' | sort | uniq -c | sort -r -n | head and it gives you a rather good picture of who is involved with a particular subdirectory or file. The advantage of doing things this way is that the resulting output gives a current picture of who has actually been working on a file - a picture which requires no explicit maintenance at all. That list of people is probably a much better group to send copies of patches to than whoever might be listed in a maintainers file; they are the ones who know about what is happening in that part of the tree now. No real resolution has been reached on this topic. It may be that Linus's approach may be the one taken by default; it already works without the need to merge any patches at all. The question may well stay around for a while, though. Approximately 2,000 developers put patches into the mainline over the course of one year; keeping track of which of those developers is the best to notify of changes to a particular file is never going to be easy.
Network transmit batchingAt the core of most network drivers is the hard_start_xmit() method, which is called once for every packet which is to be transmitted. This method will normally acquire locks and insert the packet into the adapter's transmit queue. As a rule, outgoing packets do not accumulate in the kernel; they are handed to the driver, one at a time, when they are ready to go. There are times, though, when packets cannot be handed off immediately. If, for example, the hardware transmit queue is currently full, the networking subsystem will have to hold on to the packet until things clear out. Once the driver is able to accept packets for the device again, the one-at-a-time behavior will resume.The networking developers are always looking for ways to squeeze a little more performance from their code. Krishna Kumar took a look at the behavior described above and wondered: why not pass the list of accumulated packets to the driver in a single call? Batching of transmission operations in this way has the potential to minimize the cost of locking and device preparation overhead, making packet transmission as a whole more efficient. To explore this idea, Krishna has posted a few versions of the SKB batching patch set. Implementing SKB batching requires a couple of driver API changes - but they are small and only required for batching-aware drivers. The first step is to set the NETIF_F_BATCH_SKBS bit in the features field of the net_device structure. That flag tells the network stack that the driver can handle batched transmissions. The prototype for hard_start_xmit() is:
int (*hard_start_xmit)(struct sk_buff *skb, struct net_device *dev);
That prototype does not change, but a driver which has indicated that batching is acceptable for dev may find its hard_start_xmit() method called with skb set to NULL. The NULL value is an indication that there is a batch of packets to transmit; that batch will be found enqueued on the (new) list found at dev->skb_blist. So the (much simplified) form of a batching-aware driver's hard_start_xmit() function will look something like:
driver_specific_locking_and_setup();
if (skb)
ret = send_a_packet(internal_dev, skb);
else {
while ((skb = __skb_dequeue(dev->skb_blist)) != NULL) {
ret = send_a_packet(internal_dev, skb);
if (ret)
break;
}
}
driver_specific_cleanup();
The reality of the situation can be a bit more complicated, especially if the driver implements optimizations like suppressing completion interrupts until the last packet of the batch has been sent. But the core of the change is as described here - not a whole lot to it. As of this writing, the networking developers are still trying to determine what the performance effects of this patch are. There is particular interest in seeing how batching compares with TCP segmentation offloading, which is also, at its core, a transmission batching mechanism. The proof is very much in the benchmarks for a patch like this; if the results are good enough, the patch will likely be merged.
Patches and updates Kernel trees
Core kernel code
Development tools
Device drivers
Documentation
Filesystems and block I/O
Memory management
Networking
Architecture-specific
Security-related
Virtualization and containers
Miscellaneous
Page editor: Jonathan Corbet Distributions News and Editorials Debian's anniversaryOn August 16, 1993 Ian Murdock announced "the imminent completion of a brand-new Linux release, which I'm calling the Debian Linux Release."Versions 0.01 through 0.90 were released over the next few months, with 0.91 release in January 1994 followed by two 0.93Rx releases in 1995. The number of developers grew and many of the policy and procedures that are used today have their roots in these earlier times, when each package was assigned a developer and a new master server was donated to Debian by HP. New package management tools dpkg and dselect were the first new tools developed for Debian. The beginnings of Ian's vision of an easy-to-update system. By the time the first official 1.x version was released (June 17, 1996), Ian Murdock was no longer the Debian Leader. Bruce Perens took over that role in March 1996. Bruce was working at Pixar at that time and the movie Toy Story was produced by Pixar, so it came to be that Debian releases are named after Toy Story characters, beginning with Debian 1.1 "Buzz". Overall, Debian today stacks up pretty well with Ian's early vision. In some ways it has exceeded anything that could be imagined in 1993. It can be installed as a sleek and slim system, though with nearly 19,000 packages just an apt-get away, an installation may not stay so slim. A stable Debian install will not contain the most up-to-date of everything, but then for many people running Debian on production servers, that is a good thing. Debian unstable "sid" does provide the up-to-date and easily updatable system Ian wanted to create. Back in 1993 many people didn't have Internet connections, or had very slow dial-up modems. Part of Ian's vision was to make it easy for the non-connected to get packages and updates. These days that is no longer a priority, though it is always possible to obtain installation CDs. Debian's Social Contract has guided thousands of volunteers to create perhaps the largest repository of free/open source software anywhere. So thanks Ian, and to all the volunteers that make Debian great. Historical facts for this article came from A Brief History of Debian.
New Releases Ark Linux releases 2007.1Ark Linux has released 2007.1 and 2007.1 Live. The release includes KDE 3.5.7, OpenOffice.org 2.2.1 with full KDE integration, glibc 2.6.1, gcc 4.2.1, Xorg 7.3, amaroK 1.4.7, better hardware detection, and many bug fixes and updates.
Debian GNU/Linux 4.0 updatedThe Debian project has announced the first update of its stable distribution Debian GNU/Linux 4.0 "etch". This update mainly adds corrections for security problems to the stable release, along with a few adjustment to serious problems. The first update also corrects a few important issues that have been noticed too late in the release process.
Announcing Opyum 0.0.2 for FedoraOpyum 0.0.2 is the first stable release of a new Offline Package Manager for Fedora. Opyum was developed by Debarshi Ray as part of the Summer of Code.
SmoothWall Express 3.0 ReleasedSmoothWall Express 3.0 has been released. SmoothWall is a hardened distribution intended for use on dedicated router/firewall systems. New features include ClamAV email filtering, tools for filtering (and recording!) instant messaging sessions, real-time statistics, time-based traffic blocking, a developer edition, and more.
New Distributions LinuxMCELinuxMCE is a free, open source distribution based on Kubuntu. It includes a complete whole-house media solution with PVR and distributed media, and the most advanced smarthome solution available. It is stable, easy to use, and requires no knowledge of Linux and only basic computer skills. The current version is 0704.
Distribution Newsletters Fedora Weekly News Issue 101The Fedora Weekly News for August 13, 2007 is out. Ask Fedora looks at "Location For Menu Entries And Customization" and "64-bit Java Plugin". Also "Fedora Daily Package Articles in Chinese", "MediaWiki - Collaborative publishing", "RenRot - Rename and rotate photos", "Wednesday Why: Logins and Sessions", "GKrellM - System monitoring tool", "TaxiPilot - Drive a Space Taxi" and "Fedora Daily Package Weekly Video Summary", and other topics.
Gentoo Weekly NewsletterThe Gentoo Weekly Newsletter for August 13, 2007 covers LWE San Francisco, Simplified Chinese Gentoo Handbook, Gentoo Screenshot Contest and more.
Ubuntu Weekly News: Issue #53The Ubuntu Weekly Newsletter for August 18, 2007 covers Celebratory Hug Day for GNOME, updates on compromised community servers and LoCo options, LinuxMCE Media Centre addon for Kubuntu, the Portuguese Team's effort to put FOSS in schools, and much much more.
DistroWatch Weekly, Issue 216The DistroWatch Weekly for August 20, 2007 is out. "Another busy week of beta testing ahead, with Mandriva, openSUSE and Ubuntu all readying their latest development builds to be released later this week. In the news section: the Ubuntu developers worry about regressions in Compiz Fusion, Puppy Linux introduces experimental features, NimbleX delivers a world's first 100 MB live CD with KDE, and Trustix Secure Linux finds itself being slowly abandoned - both by its developers and its users. In the featured article of the week we'll take a look at the current status of Gentoo Linux and question the project's ever increasing complexity."
Newsletters and articles of interest Ark Linux Releases 2007.1 and Announces KDE 4 Plans (KDE.News)KDE.News looks forward to Ark Linux 2007.2, which will preview KDE 4.0. "The release of Ark Linux 2007.1 also marks the beginning of the development cycle for Ark Linux 2007.2 - over the next few days, we will upgrade our development tree "dockyard-devel" to snapshots of the upcoming KDE 4.0 desktop. Ark Linux 2007.2 is expected to be released shortly after KDE 4.0 - a pre-release for developers and people who are curious about KDE 4.0 will be made available as soon as the migration is complete."
Technalign releases new community based distribution, Pioneer Linux (DesktopLinux)DesktopLinux looks at Technalign, the company behind Pioneer Linux. "Technalign, developers of both the community and commercial Pioneer Linux operating systems, recently announced the release of Pioneer Explorer 1.0 and the Programs folder. In the past, Technalign built its Linux distributions from Ubuntu, Debian and MEPIS codebases. While this new distribution still shows its Ubuntu/Debian roots, it's now going in its own direction."
Distribution reviews Freespire aspires, but fails to inspire (Linux.com)Linux.com has a review of Freespire. "Freespire, the free as in beer version of the Linspire Linux distribution, this month released Freespire 2.0, the first version of the operating system based on the popular Ubuntu distribution, and the first to contain proprietary codecs and drivers. Despite its attractive appearance, it left me with mixed feelings."
Page editor: Rebecca Sobol Development Google Summer of Code: Mozilla ProjectsThis is the fifth in LWN's series of Google Summer of Code (GSoC) 2007 articles. The first four articles covered the program launch, Ubuntu's projects, the OpenMRS organization, and one student who is tackling Direct3D 10 support for Wine. After breaking into the Google Summer of Code last year, Mozilla is back again as a major mentoring organization. They were delegated nine projects last year and are hosting ten this year, the sixteenth most of the 137 participating organizations in the GSoC 2007. Moreover, due to the mainstream popularity of Firefox and Thunderbird, the code that Mozilla's students are developing this summer will likely be among the most visible of any organization's. This summer's code is made all the more interesting by the concurrent ramp up in development prompted by the impending release of Firefox 3. Read on to learn about four of this prominent mentoring organization's most interesting projects and hear from both the students and the mentors as they rush to complete their projects by Google's final code deadline on August 20th. Nick Kreeger's "Enable Roaming Support in Thunderbird" (mentored by David Bienvenu) Student Nick Kreeger has a great idea for anyone that reads their email with Thunderbird, Seamonkey, or his own Mac OSX mail client Correo from multiple computers at home, work, and anywhere else. Kreeger is integrating functionality into the Mail/News framework component that will allow all Mozilla-based email clients to synchronize preferences and address books through IMAP and POP accounts, though the feature must be integrated into the interface of each application. Kreeger has already coded the core roaming service for Mail/News with full support for IMAP (POP support is "coming along smoothly"). He will begin developing a Thunderbird interface to the service before the end of the GSoC, but he notes that it may wind up in an extension. The synchronization is performed by passing email messages through the user's mail account. The message will either contain a list of the changes a user has made to his preferences and address book or, after a set number of those "delta messages," a full copy of the data for good measure. In an IMAP setup, these messages will be sequestered from users in hidden-unsubscribed folders, while for POP the mail client will simply hide the messages in the inbox. The core roaming service sends and retrieves these updates from the server and notifies the interface when new data is available. Kreeger notes, "We want to expand this synchronization to include saved searches, RSS feeds, mail filters, .newsrc files, tag definitions, views, and more." He also intends to deliver full documentation on his code, but perhaps not until after the GSoC deadline. A simple security precaution should keep at bay the potential security risk presented by accepting emails as application configurations. He explains, "We are planning to implement a PIN system for signing update messages in a similar fashion to how you can sign a messages with a certificate in Thunderbird." Project updates can be found on Kreeger's blog. The student recently graduated with a a Bachelors Degree in Information and Computer Science (Software Engineering Emphasis) from Park University near Kansas City, MO. Mentor David Bienvenu, who Kreeger credits with developing the concept behind the project, is a Mozilla module owner for the Thunderbird project and the Mail/News component. Kunal Jain's "Places: Indexing Visited Pages" (mentored by Dietrich Ayala) Student Kunal Jain is vying to resolve one of Firefox's longstanding feature requests, full-text search for visited pages. While Firefox derivative Flock has beat him to the punch by using CLucene for full text search, Jain is seeking a lighter-weight solution that will integrate seamlessly with the SQLite database which is already being used in Firefox 3's Places bookmarking and history system. He settled on the FTS2 SQLite module and has developed a detailed strategy for its implementation. The full text search feature will hook into the Places query system via the existing nsNavHistoryQuery class, which allows for searches constrained by date and time. The nsNavFullTextIndex class will be responsible for calling FTS2 to rifle through visited pages for search terms, and will index them when called by nsNavFullTextIndexHelper upon page request events. One last class, nsNavFullTextTokenizer, is a wrapper for FTS 2's tokenizer that will prepare web pages for indexing by recognizing important terms and stripping HTML tags. Jain's design underwent substantial renovation during the GSoC before reaching its final form. Mentor Dietrich Ayala writes, "We had to re-orient the design as the understanding of SQLite's internals increased. We had terrific input from a hacker on SQLite's full-text-indexing module, which was quite helpful." Unfortunately, not everything has gone as hoped for the project. As of August 8th, the design had been reworked and finalized, but no code had been written due to time-restricting duties at the student's job. Jain insists that he would like to have a prototype ready by the end of the GSoC, but Ayala is not confident that it will be ready for inclusion in Firefox 3 when the code freeze begins on September fifth. Nonetheless, both mentor and student are pleased to present to the community with a strong foundation from which this valuable and widely-requested feature can be implemented correctly, perhaps for Firefox 4. Ayala explains, "This has been on Mozilla's radar for a long time, and it's great that Kunal has been able to lay the foundation for making this happen." Jain stresses that he will continue contributing to Mozilla past the impending GSoC deadline. Project updates may be found at his project's page on the Mozilla wiki. Kunal Jain recently graduated with a Bachelor of Technology, Information Technology degree from Sri Venkateswara College of Engineering in Chennai, India. Dietrich Ayala has been a developer with Firefox since February of 2006 and has been involved with the session restore feature and, pertinently, Places. Benjamin Karel "JPEG2000 Support for Firefox" (mentored by Stuart Parmenter) JPEG2000, the revamped JPEG format with "state-of-the-art compression techniques based on wavelet technology," was introduced about seven years ago. While the merits of JPEG2000 for various applications are debatable, its arguably higher image quality at high compression rates would seem to make it a good fit for the web. While compression and decompression are costlier with JPEG2000, the price of bandwidth versus processor time may justify the newer format for everyday web applications. Unfortunately, JPEG2000 support among browsers remains a rarity. Computer Imaging developer Mike Chaney argued two years ago on the reputable Steve's Digicams that "software manufacturers... are waiting for camera manufacturers to start supporting JPEG2000 as a native format in cameras and other devices. In turn, the camera manufacturers are waiting for global acceptance of the format in tools like web browsers, image management tools, photo editors, and other software." The situation today seems identical to that at the time of his writing and, indeed, to the climate surrounding the release of JPEG2000 seven years ago - just look at the Mozilla bug report (assigned to mentor Stuart Parmenter) where, year after year, users encourage Firefox to "stand out from the crowd" with JPEG2000 support. This summer, student Benjamin Karel has done his part to spur mainstream JPEG2000 support. He has developed an extension for rendering JPEG 2000 which is compatible with both Firefox 2 and 3 (the codebase for them is the same, though he notes that each version requires a separate extension). His extension implements the free software JasPer decoder and can correctly render all nine JPEG2000 conformance test files, though Karel raises issue with JasPer's documentation and some aspects of its compatibility with particular caveats of the JPEG2000 specification. Despite various time-consuming personal obligations and wisdom tooth surgery, his project has been a success. Nonetheless, roadblocks remain to the mainstream adoption of JPEG2000, even among the distinct subset of web users which Firefox represents. Both Karel and Parmenter agree that it would be inappropriate to integrate the feature with the Firefox trunk where it would see more widespread use than as an extension. Karel's code would add about 150KB to the browser's famously stingy download size and contribute that much more to Mozilla's support obligations. Karel notes that his code would be more likely to be accepted if the state of JPEG2000 support was better in graphics editing tools, but he admits, "It's a chicken-and-egg problem, yes, but it's not Mozilla's problem. Their job is to spend their limited resources as efficiently as possible." Parmenter says, "Once the extension gets published we can get a lot more eyes on it and get some of that additional testing we would want before shipping it with our main product." Karel would like to develop an image-decoder finding service for Firefox that would recommend extensions like his own when users come up against an unsupported image format. Parmenter adds, "I would love to see an extension for things such as HD Photo and TIFF." It seems likely that Mozilla will elect to use a model like this for supporting burgeoning image formats in their sheltered flagship product. Karel's blog carries updates on his project. Karel is an undergraduate Computer Science student at the University of Delaware, while Parmenter is a Mozilla veteran since 1998, heavily involved in nearly every aspect of their products' graphics technology. Edward Lee's "Link Fingerprints" (mentored by Gervase Markham) Over two years ago, now, mentor Gervase Markham posted an ingenious idea to his blog. Even the best of us, he realized, are often too lazy to compare the checksums that are posted alongside Linux ISOs and other content online. Others may not even be aware of the process. The consequence is corrupted downloads and an increased risk for trojaned files being exchanged over the Internet. His solution was to include the checksum as metadata in the URL of the file itself so that browser download managers could automatically verify files. The implementation would not affect older browsers and those which choose not to support it and would appear transparent to users. Having been involved with the Firefox community for a few years as a bug sweeper, student Edward Lee jumped on the old idea this summer in order to give himself a crash course on the browser's codebase. Lee developed the idea into a draft specification for the Internet Engineering Task Force. His submitted design states that the checksum would be included as a fragment identifier, meaning that it would be information appended to a URL specifically for the user agent (web browser or download manager). URLs with link fingerprints would look like this: http://mirror.com/file#hash(sha256:abc123). While any hashing algorithm could be supported in this fashion, Lee chose to encourage initial standardization around sha256. A file's hash would be calculated incrementally while downloading so that it could be compared immediately once transferred. In the uncommon event that the file fails to verify with the checksum, the user would be notified and advised to alert the content provider. By the mid-term evaluation deadline on July 9th, Lee had an implementation of the system working and tested. He had integrated his code with Necko, Mozilla's low-lying networking library whose features automatically filter up to Firefox, Thunderbird, and other products built on the Mozilla Platform. Soon afterward, Lee writes, things came to a halt: "The decision to not implement Link Fingerprints in Necko came from Brendan Eich (Mozilla CTO) and Christian Biesinger (Necko module owner) who felt that implementing this non-standardized feature in a way that coupled itself closely to the networking code would potentially hurt everything else built on top of Necko in the long run." After some fidgeting with different implementations, the project was more or less abandoned. Meanwhile, Lee notes critical reception from the IETF community: "Major complaints include unnecessarily overloading the URI with additional metadata in a way that would make it difficult for new uses of the fragment identifier for other MIME types, as well as using the fragment identifier for a purpose that it wasn't intended for." While things seem bleak for link fingerprinting, Markham does indicate that there is some interest among download manager developers and there remains a slight possibility that the feature will eventually appear in the Firefox 3 download manager. Updates may be found on Mozilla's Bugzilla entry for Link Fingerprints. Lee has been able to expend his newfound familiarity with the Firefox codebase into other development areas. He has begun working on features for the Firefox 3 download manager and the new JavaScript engine ActionMonkey. He reports favorably of his experience with the project: "For those interested in hacking on Firefox, it turns out it's not too difficult to do so; just hop on IRC and ask around and people are bound to help if one asks nicely and remains patient." Lee will begin pursuing a Ph.D. in Computer Architecture/Compilers this Fall at the University of Illinois at Urbana Champaign. Markham has been, in his own words, a "Loose Cannon" at Mozilla since January 2000, principally involved with project governance.
System Applications Backup Software Areca Backup v5.3.1 is available (SourceForge)Version 5.3.1 of Areca Backup has been announced. "Areca Backup is a file backup tool written in java. It supports data compression & encryption, incremental backup, file history explorer and many other features. Areca Backup also includes a transaction mechanism which guarantees your backups' integrity".
Database Software phpMyAdmin 2.11.0 is released (SourceForge)Version 2.11.0 of phpMyAdmin, a web-based MySQL administration tool, has been announced. "Welcome to phpMyAdmin 2.11, which will probably be the last series supporting PHP 4. This version supports creating VIEWs from query results and can manage triggers, procedures and functions. It also supports MySQL 5.0.37 query profiling and has an improved interface for servers hosting thousands of databases and tables."
PostgreSQL Weekly NewsThe August 19, 2007 edition of the PostgreSQL Weekly News is online with the latest PostgreSQL DBMS articles and resources.
Filesystem Utilities announcing Allmydata-Tahoe v0.5Version 0.5 of Allmydata-Tahoe, a secure, decentralized storage grid, is out with several new capabilities. "With Tahoe, you can store your files in a distributed way across a set of computers, such that if some of the computers fail or become unavailable, you can still retrieve your data from the remaining computers. You can also securely share your files with other users. This release is targeted at hackers and users who are willing to use a text-oriented web user interface, or a command-line user interface."
TestDisk version 6.8 announcedStable version 6.8 of TestDisk has been announced. "TestDisk is a tool to check and undelete partitions. It works with the following partitions: FAT12, FAT16, FAT32, Linux (EXT2/EXT3/HFS/JFS/RFS/XFS), LInux Raid, Linux swap, NTFS (Windows), BeFS (BeOS), UFS (BSD), and Netware NSS."
Interoperability Samba 3.0.25c available for downloadVersion 3.0.25c of Samba has been announced. "This is the latest production release of the Samba 3.0.25 code base and is the version that servers should be run for for all current bug fixes. Major bug fixes included in Samba 3.0.25c are: File sharing with Widows 9x clients. Winbind running out of file descriptors due to stalled child processes. MS-DFS interoperability issues."
Web Site Development Gallery 1.5.7 released (SourceForge)Version 1.5.7 of Gallery has been announced. "Gallery is a slick Web-based photo album written using PHP. It is easy to install, includes a config wizard, and provides users with the ability to create and maintain their own albums in the album collection via an intuitive Web interface. Photo management includes automatic thumbnail creation, image resizing, rotation, ordering, captioning and more. Albums can have read, write, and caption permissions per individual authenticated user for an additional level of privacy."
Plone 3.0 releasedVersion 3.0 of Plone - a Zope-based content management system - has been released. New features include much improved version management, tighter security, Ajax-based editing, and much more. See the community announcement, the Plone 3.0 feature list, or the press release for details.
Django RoundupThe August 19, 2007 edition of the Django Roundup covers the latest news from the Django web platform.
Miscellaneous Supervisor 3.0a1 releasedVersion 3.0a1 of Supervisor, a Python-based UNIX process controller, has been announced. "v3.0a1 is a major feature release version. Most of the features were commissioned by Maintainable Software . As well as contributing development funding, members of Maintainable have contributed a good deal of code to the supervisor codebase." (Thanks to Chris McDonough).
Desktop Applications Audio Applications TkEca 4.2.0 releasedVersion 4.2.0 of TkEca, a GUI interface to the ecasound audio utility, is out with a long list of new features.
BitTorrent Applications Azureus 3.0.2.0 released (SourceForge)Version 3.0.2.0 of Azureus, a cross-platform bittorrent client, has been announced. "Azureus 3.0.2.0 brings the version numbering back into line and should reduce confusion over which 2.x version maps to which 3.x version. Existing 2.x users will get the classic UI, while new and existing 3.x users will get the Vuze client UI, with the option to switch back to the 2.x UI if you choose."
Business Applications JasperServer 2.0.1 released (SourceForge)Version 2.0.1 of JasperServer is available with some new capabilities and bug fixes. "JasperServer is a business intelligence platform based on JasperReports. It is a Web and Web services based application for reporting, data analysis (OLAP UI and server) and data integration."
OrangeHRM 2.2.0.2 released (SourceForge)Version 2.2.0.2 of OrangeHRM has been announced. "The new version of OrangeHRM Open Source Human Resource Management has just been released. The OrangeHRM 2.2.0.2 contains the improvements of upgrade software and eliminates the bugs that were noticed while trying to update OrangeHRM to the latest stable 2.2 release. The version also contains the bug fixes for the bugs reported in PIM module as well as the bugs, related to using the application applying different language pack."
What's the Matter with JMatter? (O'Reilly)Eitan Suez introduces JMatter on O'Reilly. "JMatter proposes that you, the developer of a small business application, concern yourself primarily with the business logic or the domain in question, for example, say we're developing a solution for a school, perhaps to administer or manage a curriculum. Alternatively, perhaps we're trying to write a system to better manage parts at an automotive shop, or perhaps we're dealing with real estate properties for sale. You get the picture. JMatter further proposes that you consider most software development tasks that are not directly related to the business domain (such as persistence, writing the user interface, authentication, deployment, and more) as plumbing: it's someone else's job. In fact it's JMatter's job."
Desktop Environments GARNOME 2.19.90 announcedVersion 2.19.90 of GARNOME, the bleeding-edge GNOME distribution, is out. "This release includes all of GNOME 2.19.90 plus a bunch of updates that were released after the GNOME freeze date."
GNOME 2.19.90 releasedVersion 2.19.90 of GNOME, also called GNOME 2.20.0 Beta 1, is out. "This is our seventh development release on our road towards GNOME 2.20.0, which will be released in September 2007. New features are still arriving, so your mission is simple : Go download it. Go compile it. Go test it. And go hack on it, document it, translate it, fix it."
GNOME Software AnnouncementsThe following new GNOME software has been announced this week:
KDE Commit-Digest (KDE.News)The August 19, 2007 edition of the KDE Commit-Digest has been announced. The content summary says: "The Summer of Code for 2007 nears its end. Implementation of more features in the Step physics simulation package. More graphical game themes in KMahjongg, KWin4 KShisen, KGoldRunner and KJumpingCube. The start of a new game, KDiplomacy. More development in the Blitz graphics library. Lyrics Plasma applet and other interface work for Amarok 2. The start of the implementation of panels, and a clipboard engine in Plasma. More features in the ODBC Data Sources KControl module. Animation support in the Raptor menu..."
Quickies: Amarok 1.4.7, MEPIS KDE 4, Desktop Survey, Lugradio Talk (KDE.News)KDE.News has published a new Quickies article with the following topics: "Amarok 1.4.7 was released with improved collection backend, new streams, altered icon and bugfixes. The annual Desktoplinux.org Survey is under way. MEPIS released a KDE 4 Beta 1 live DVD using packages from Kubuntu. The videos from Lugradio Live are up including Ben Lambs' Conquering the Desktop with KDE 4. Finally, following the 10th anniversary of the free desktop last year, congratulations to another project which has gained double figures in age, but whatever did happen to those Scheme applets?"
KDE Software AnnouncementsThe following new KDE software has been announced this week:
XFree86 Release 4.7.0Release 4.7.0 of XFree86 has been announced. Changes include security fixes, video driver enhancements, XKB updates, X Server and Extension updates, Library, Client and Utility updates and more. See the release notes for details.
Xorg Software AnnouncementsThe following new Xorg software has been announced this week:
Encryption Software GnuPG 2.0.6 releasedVersion 2.0.6 GnuPG has been announced. "This is maintenance release with a few minor enhancements. The GNU Privacy Guard (GnuPG) is GNU's tool for secure communication and data storage. It can be used to encrypt data, create digital signatures, help authenticating using Secure Shell and to provide a framework for public key cryptography."
Games KoLmafia version 11.4 released (SourceForge)Version 11.4 of KoLmafia has been announced. "KoLmafia is a cross-platform desktop tool which interfaces with the online adventure game, Kingdom of Loathing. KoLmafia is written in Java (J2SE 1.4 compliant), with binary releases in JAR format."
Robocode 1.4 released (SourceForge)Version 1.4 of Robocode has been announced. "Robocode is a Java based programming game, where the goal is to develop robot battle tank to battle against competitor tanks. The moto of Robocode is: Build the best, destroy the rest! Robocode requires a Java SE 5.0 Runtime Environment (JRE) to run."
Medical Applications Mirth 1.6 released (LinuxMedNews)LinuxMedNews has announced the release of Mirth 1.6, a health information system. "This is a significant upgrade which includes both critical bug fixes and new features. The functionality and stability of existing connectors has been improved to fully integrate with even more third-party systems. The user interface has also been enhanced to make channel development and maintenance even easier. Additionally, this release includes NCPDP support, real-time connection monitoring and plug-in functionality."
Multimedia MediaInfo 0.7.5.2 released (SourceForge)Version 0.7.5.2 of MediaInfo has been announced. "MediaInfo supplies technical and tag information about video or audio files (MKV/AVI/MOV/MPEG1, 2, 4/M4A/M4V/MP3/AAC/RM/...) There are several versions: Graphical interface, Command line, or DLL for third-party software develo[p]ers (like emule). GUI is multi-language. In this release: Correction of crashes in the PPC version, better Linux handling, some bugs correction."
Music Applications horgand 1.10 releasedVersion 1.10 of horgand, an organ synthesizer, is out. "New features including percussion drawbars, new DSP chorus effect and delay line buffers that coexist with rotary effect, restore program and visual settings each session, JACK support improved reducing CPU usage and new presets."
midish 0.3.0 releasedVersion 0.3.0 of midish, a shell-like MIDI sequencer/filter, is out. "Changes include: Support for 14bit controller and NRPN/RPN events has been added. Now the complete MIDI state can be restored at any song position. Two tracks can be merged resolving all conflicts. New editing functions always keep controllers/bender in a consistent state. Improved documentation, usability and code quality."
Miscellaneous Magstriper 0.2 released (SourceForge)Initial release version 0.2 of Magstripper is available. "Magstripper is a magnetic card reader and decoder that takes raw waveform information from a magnetic audio head and processes it via a mic input. It also includes a multi-user access control system with the ability to control a magnetic strike."
PocketSphinx 0.4, SphinxBase 0.3 released (SourceForge)Version 0.4 of PocketSphinx has been announced. "Sphinx is a speaker-independent large vocabulary continuous speech recognizer released under a BSD style license. It is also a collection of open source tools and resources that allows researchers and developers to build speech recognition systems. The latest release of PocketSphinx is now available. It requires SphinxBase 0.3, which has been released simultaneously." Version 0.7 of the associated Sphinx3 has also been announced.
PyKeylogger 0.8.2 released (SourceForge)Version 0.8.2 of PyKeylogger has been announced. "PyKeylogger is a simple keylogger written in python. It is primarily designed for personal backup purposes, rather than stealth keylogging (though it can do that, too). It does not raise any trust issues, since it is a short python script that you can easily examine. This is a bugfix release."
Languages and Tools JSP Advanced JavaScript II (O'ReillyNet)O'Reilly has published part two in a series on advanced JavaScript. "Continuing on from the first part of this series, Howard Feldman dives deeper into all the ways you can morph your web pages with a little JavaScript magic. This month he shows us how to swap photos, do tabbed panes, expand and contract tree lists, and do drop-and-drag item ordering."
Python Python-URL! - weekly Python news and linksThe August 20, 2007 edition of the Python-URL! is online with a new collection of Python article links.
Tcl/Tk Tcl-URL! - weekly Tcl news and linksThe August 22, 2007 edition of the Tcl-URL! is online with new Tcl/Tk articles and resources.
XML XForms, XML Schema, and ROX (O'Reilly)Kurt Cagle writes about XForms, XML Schema and ROX on O'Reilly's XML.com. ""If I have an XML schema, is there any way that I can work with that schema to build forms for populating instances of that schema?" Over the years, I've seen a number of variations on this same question, and generally for a pretty good reason. It takes a lot of work to create a schema in the first place, but when you're done, what you end up with, in general, is something that seems like it should be good to generate something; you have data type information, constraint information, enumerations, and enough other pieces that it would seem that making forms from them should be a cake walk. However, the process is generally fraught with more land mines than you might expect."
Version Control GIT 1.5.2.5 announcedVersion 1.5.2.5 of GIT has been announced. "Although 1.5.3 has been in -rc cycle for quite some time, there was a rather nasty data corruption bug discovered, so here is primarily to push that fix out."
Page editor: Forrest Cook Linux in the news Recommended Reading How many Linux desktop users are there? (DesktopLinux)DesktopLinux looks at a project to count desktop Linux users. "Desktop operating systems numbers, even when gathered by top research companies, such as IDG and Gartner, are often a bit fuzzy. When it comes to uncommon desktop operating systems, like Linux, the numbers often amount to little more than an educated guess. Now, a new open-source program, statix, promises to give accurate data on how many Linux desktops are actually in use."
Selling software that sells itself: An interview with Matt Asay (LinuxWorld)Don Marti interviews Matt Asay. "Open source is changing not just how companies make software, but how they sell it. Alfresco's Matt Asay explains the new sales cycle and the skills that today's software sales people need to close deals."
Linus Torvalds interview (EFYTimes.com)EFYTimes.com has an interview with Linus Torvalds. "Did Microsoft's Men In Black ever met Linus Torvalds? But why is he so critical of GPLv3? Why does he slam Subversion? What would happen to the kernel development if he chooses to do something else more important? These are some of the questions Linux/open source community from around the globe wanted to ask Linus. And, here is Linus candid and blunt, and at times diplomatic, answering your questions. Check if the question you wanted to ask to the father of Linux is here and what does he have to say..."
Trade Shows and Conferences Hands-on Linux training at SHARE (Linux.com)Nathan Willis covers the SHARE conference on Linux.com. "San Diego -- Mainframe programmers and sysadmins get more than just sales pitches and informational talks at SHARE this week -- they also get real-world training. I sat in on a number of educational sessions and hands-on labs at the conference, taught by engineers from IBM, Novell, and independent software vendors."
The SCO Problem Judge Kimball Sets the Rules of the Road for SCO v. Novell (Groklaw)Groklaw covers the process for the remainder of the SCO v. Novell trial. "But September 17 at 8:30 AM is the date set for the trial to begin. Judge Kimball states in this document that while it was originally pencilled in to last 3 weeks, it should be 'substantially shorter' now."
Companies Novell: 'We're not SCO' and we won't sue (Computerworld UK)Computerworld UK reports on comments made by Novell spokesman Bruce Lowry after the recent SCO/IBM court ruling. "Lowry said the ruling means "the cloud has lifted over Linux." Users and distributors of the open-source OS finally can breathe a sigh of relief that they are not in violation of Unix copyrights. "We don't believe there is Unix in Linux," Lowry said. "We've been fighting that all along. It wouldn't be consistent for Novell to say, 'Oh gosh, now that this has been confirmed, we're going to suddenly take a different position' and sue companies for copyright infringement.""
Is VMware too close to Linux? (The Register)The Register looks at VMWare's IPO, which could be in trouble before it happens. "Writing on his blog VentureCake, Linux specialist Mike MacCana thinks he might have found a bit of rust on VMware's shining armor. He claims that VMware's ESX server is derived from Linux, and therefore is not legally re-distributable as proprietary software."
Xandros + Microsoft Deal Gives Linux E-mail Server a Second Chance (BetaNews)BetaNews examines the history behind the Microsoft/Xandros partnership and the Scalix email server. "In the latest stage of a collaboration that's looking more and more like it was planned to work out this way months ago, Microsoft announced today the extent of the intellectual property it's licensing to newly acquired Linux client Xandros. In addition to some systems management protocols, it's getting access to ActiveSync, a crown jewel of Microsoft IP that may come just in time to resuscitate Xandros' newest division."
Yahoo challenge to Google has roots in open source (Baseline)Baseline Magazine takes a look at Hadoop. "If you want to get your hands on an open source version of some of Google's core technologies, maybe you should ask Yahoo. Yahoo has emerged as one of a major sponsor of Hadoop, an open source project that aims to replicate Google's techniques for storing and processing large amounts of data distributed across hundreds or thousands of commodity PCs (see Baseline's report: How Google Works). Last year, Hadoop project founder Doug Cutting became a Yahoo employee, and at July's Oscon open source conference he and Yahoo's director of grid computing Eric Baldeschwieler detailed how they are applying the technology."
Interviews People Behind KDE: Summer of Code 2007 (2/4) (KDE.News)KDE.News introduces this People Behind KDE interview with some of the Summer of Code participants. "People Behind KDE releases the second of in its series of four interviews with students who are working on KDE as part of the Google Summer of Code 2007 - meet Bertjan Broeksema, Carlos Licea, Pierre Ducroquet and Gavin Beatty!"
Plone Foundation unwraps major content management release (LinuxWorld)LinuxWorld talks with Plone co-founder Alexander Limi about the Plone 3.0 release. "Versioning was the single most requested feature by Plone's user community, Limi said. As changes are made in online content, Plone 3.0 now automatically keeps track of those alterations, providing a trail of who edited what information as well as the ability to roll back to earlier versions of the content."
Resources Troubleshooting Linux Audio, Part 3 (Linux Journal)Dave Phillips has the final installment in his Troubleshooting Linux Audio series. "At last we reach the final installment of this series, the question & answer stage in which we'll consider some of the common problems encountered with audio and MIDI on Linux, along with some common and perhaps not-so-common solutions to those problems. We've looked at some indispensable items for your Linux system troubleshooting toolkit, now let's see how they are applied."
Hardening your systems with Bastille Linux (Linux.com)Linux.com takes a look at Bastille. "System administrators need to secure their systems while avoiding locking them down so strictly that they become useless. Bastille is a software tool that eases the process of hardening a Linux system, giving you the choice of what to lock down and what not to, depending on your security requirements. It bundles many of the tasks routinely done to securely configure a Linux system into one package."
How Linux became a mobile phone OS (LinuxDevices)LinuxDevices has announced a new paper on the Linux transformation to the embedded space. "Linux started out on desktops and servers, but has now shipped on about 20 million mobile phones. Ever wonder how it made the jump? In a new whitepaper, embedded industry pioneer Jim Ready offers a concise technical retrospective on Linux's transition into a mobile phone OS."
A step-by-step guide to building a new SELinux policy module (Red Hat Magazine)Red Hat Magazine provides a howto on building SELinux policies. "Before we start, lets review why we work with policy modules. In the past, in order to modify the current SELinux policy on a system running Red Hat Enterprise Linux 4, a system administrator would have had to to download the policy source, edit the policy source code, and rebuild and install the policy using tools like make install. The introduction of policy modules made this process easier and less error-prone. A system administrator could use the audit2allow utility to generate policy module updates directly from audit.log error messages. These modules function in a way similar to kernel modules in that they enable system administrators to modify part of the policy (a specific module) without having to rebuild the entire thing."
Reviews Open Source Stack Delivers The Most Affordable EMR (LinuxMedNews)LinuxMedNews looks at Waiting Room Solutions version 3.0. "Waiting Room Solutions Version 3.0 is a CCHIT certified EMR and Practice Management system. It was completely built on open source technologies of Linux, Apache, MySQL and PHP. Without the extra costs of paying expensive Microsoft or third party licensing fees, this service can be offered to the physician's office through the Internet in the SaaS model at an extremely affordable price."
Fine-tune RSS feeds with ListGarden (Linux.com)Linux.com reviews ListGarden. "Most Web publishing systems on the market can automatically generate RSS feeds, but there are situations where you might want to have fine-grained control over your RSS feeds. For example, you might want to provide alternative RSS item descriptions, or to manually select which RSS items to publish. While you can code an RSS feed by hand, you'd be better off using a dedicated tool like ListGarden. It can help you to not only create and manage RSS feeds, but also to do more advanced tasks like publish the feeds on a remote server, back up the feeds, generate an HTML page, and much more."
Miscellaneous LinuxMCE Partners with KDE for New Release (KDE.News)Aaron J. Seigo writes about a collaboration between developers of the LinuxMCE media solution and KDE Plasma. "LinuxMCE uses X.org's window compositing functionality to provide a simple to use fullscreen interface that is blended on top of the media being played. This interface is a key focus of LinuxMCE according to lead developer Paul Webber. "The traditional PC user interface doesn't work well on a TV. So a different interface is needed, which is called the '10 foot' interface (in reference to the fact that people interact with media devices such as televisions from a distance). The '10 foot' interface is still in the same state as the desktop was pre 1983. There is no standardisation and each application has to figure out how to present its functionality to a user.""
Linux Standard Base Broadens ISV Support (OpenEnterprise1)OpenEnterprise1 looks at ISV support for the LSB. "The non-profit Free Standards Group is getting big support from ISVs for its latest effort to make sure Linux doesn't split into a variety of non-conformant versions. The FSG project, called the Linux Standards Base (LSB), already a core standard among Linux platform vendors, is gaining support from commercial and Open Source software makers -- including IBM, Novell Oracle, Veritas and MySQL."
Bringing the free software message to TV (Linux.com)Bruce Byfield talks up GNU/Linux on TV. "As a former course designer and academic, I used to be experienced in talking in front of people. However, one thing I hadn't done until now is appear on television. That, more than anything, is why I agreed to appear on the computer show Lab with Leo Laporte in a five-minute spot about the GNU/Linux desktop. The show is scheduled to appear October 11 on G4TechTV in Canada and the How-To Channel in Australia, with my spot being posted to Google Video on the same day. I won't know if I look savvy or imbecilic until I see how the segment is edited, but the experience taught me several points about appearing on TV in general, and evangelizing for GNU/Linux in the studio in particular."
Page editor: Forrest Cook Announcements Non-Commercial announcements New job and expert lists on elinux wikiNew job and expert lists are being hosted on the elinux wiki. "In an attempt to try something new (but which we've discussed for some time now), we have added a job and expert list to the new embedded Linux wiki. These are meant to be places where companies with embedded linux work (either contract work or full-time positions) can post them, and for Linux developers to post their job skills. Posting and access to these pages is free of charge."
GNOME turns 10The GNOME community is celebrating ten years of existence. "A one month, world-wide celebration of GNOME's tenth anniversary begins this week, culminating in mid-September with Software Freedom Day and the release of GNOME 2.20. During the celebration month, GNOME contributors will create a scrapbook wiki recording their ten year history, and a commemorative cookery book with 'Open Source' recipes contributed by GNOME community members from around the world."
NIHs National Database for Autism Research deploys with OpenClinica (LinuxMedNews)LinuxMedNews reports on the use of OpenClinica, an open-source web-based electronic data capture platform for clinical research, by the NIH National Database for Autism. "The National Database for Autism Research, or NDAR, is a collaborative biomedical informatics system created by the National Institutes of Health to provide a common, nationwide resource to support and accelerate research on autism. NDAR will make it easier and faster for researchers to gather, evaluate, and share autism research data from a variety of sources."
Commercial announcements Levanta launches free Linux management virtual applianceLevanta has launched their Intrepid VM Linux Management Appliance. "Levanta® (www.levanta.com), the leader in Linux data center automation, today announced the release of the Intrepid VM Linux Management Appliance. The Intrepid VM is a VMware appliance version of the award-winning Levanta Intrepid line of Linux life-cycle management products, which automate provisioning, change control, migration and disaster recovery processes for Linux systems."
New Matrox Graphics 1.4.5 Linux Drivers Provide Enhanced Features for Thin Client UsersMatrox Graphics has introduced new 1.4.5 Linux drivers providing enhanced features and additional support to its Matrox EpicA TC2 and EpicA TC4 multi-display graphics cards for thin computing.
OpenEMR HQ Launches total EMR Solution (LinuxMedNews)LinuxMedNews has announced the launch of OpenEMR HQ. "September 1, 2007 will see the official launch of OpenEMR HQ, a solutions provider offering several "enterprise level" EMR solutions to small to mid-sized clinics. The service will offer both hosted and on-site installations of the OpenEMR electronic medical records software package and a pre-configured, semi-managed appliance called "EMR-RACK" which promises to offer clinics an easy and affordable way to implement OpenEMR."
Citrix acquires XenSourceCitrix Systems has announced a definitive agreement to acquire XenSource, for approximately $500 million in a combination of cash and stock, which includes the assumption of approximately $107 million in unvested stock options. (Thanks to Nathan Lutchansky)
Sourcefire buys ClamAVSourcefire has announced the acquisition of the ClamAV anti-virus project. "Under terms of the transaction, Sourcefire has acquired the ClamAV project and related trademarks, as well as the copyrights held by the five principal members of the ClamAV team including project founder Tomasz Kojm. Sourcefire will also assume control of the open source ClamAV project including the ClamAV.org domain, web site and web site content and the ClamAV Sourceforge project page." The announcement posted to the ClamAV list says: "The core team will continue to lead the advancement of ClamAV and the CVD as employees of Sourcefire. Both the ClamAV engine and the signature database will remain under GPL." (Thanks to Alan J. Wylie).
New Books JavaScript and DHTML Cookbook, 2nd Ed--New from O'Reilly MediaO'Reilly has published the book JavaScript & DHTML Cookbook, 2nd Edition by Danny Goodman.
Programming Collective Intelligence--New from O'ReillyO'Reilly has published the book Programming Collective Intelligence by Toby Segaran.
Contests and Awards Submit your review and win a year's technical support on 64 StudioThe 64 Studio Ltd. company will give away a technical support package for the 64 Studio multimedia distribution in exchange for reviews. "To enter this contest, all you have to do is download 64 Studio (either 64-bit or 32-bit), try it on your own computer, and write up your experiences. We're looking for the most insightful review, so just writing "64 Studio rocks!" will not win you the prize :-)"
Surveys Git User's Survey 2007A User's Survey is being held for the Git version control system. "We would like to ask you a few questions about your use of the GIT version control system. This survey is mainly to understand who is using GIT, how and why. The results will be discussed on the git mailing list and published to the GIT wiki at http://git.or.cz/gitwiki/GitSurvey2007. We'll close the survey in three weeks starting from 20 August 2007, on 10 September 2007."
Education and Certification LPI to host discounted exam labs in England and Sweden in SeptemberThe Linux Professional Institute will hold exams in England and Sweden in September. "The Linux Professional Institute (LPI), the premier Linux certification organization worldwide, will provide discounted certification testing at LinuxConf Europe on Tuesday September 4th in Cambridge, England and at the Linux Summit Sweden, Wednesday, September 5 in Stockholm."
LPI Certification Exams top 150,000 worldwideThe Linux Professional Institute has announced the giving of 150,000 Linux certification exams. "Jim Lacey, President and CEO of the Linux Professional Institute noted the organization's notable growth in the last two years: "In February 2005, five years after our program's inception, we announced that we had achieved 75,000 exams worldwide. In half that time we have doubled the number. This demonstrates the growing momentum and importance of Linux professionalism in the IT industry. Furthermore, it firmly establishes LPI as the global leader in Linux certification.""
Calls for Presentations Call for Papers: 5th Karlsruhe Workshop on Software RadiosA call for papers has gone out for the 5th Karlsruhe Workshop on Software Radios. "The event will be held on March 5-6, 2008 in Karlsruhe, located in the southwest of Germany. This will be a great opportunity to bring the GNU Radio Community together." Submissions are due by November 30, 2007.
CFP: LCA SysAdmin MiniconfLinux.conf.au 2008 (starting January 28 in Melbourne) is beginning to take shape, and the list of miniconfs has been posted. One of them - the system administration miniconf - has posted its call for participation; click below for the details.
No cON Name 2007 - Call for PapersA call for papers has gone out for No cON Name 2007. The event will take place in Palma de Mallorca, Spain on October 11-13, 2007, the submission deadline is September 20.
ToorCon 9 CFPA call for papers has gone out for ToorCon 9, a hacker conference. "Papers and presentations are being accepted for ToorCon 9 to be held at the Convention Center in San Diego, CA on October 19th-21st, 2007. Please email your submissions to cfp [at] toorcon.org; submissions will be accepted until September 9th, 2007."
Upcoming Events Register now for the OpenOffice.org Annual Conference (OOoCon)The OpenOffice.org Annual Conference will take place in Barcelona, Spain on September 19-21, 2007. "Highlights this year include keynotes from Louis Suarez-Potts and Hu Cai Yong. Louis Suarez-Potts, Community Manager for OpenOffice.org at Sun Microsystems, will present a paper about "OpenOffice.org 3.0 and beyond". Hu Cai Yong is CEO of the Community's newest major corporate sponsor, Redflag CH2000, and will be challenging delegates to think truly global: "designing good applications for the citizens of the world means thinking beyond technology"."
Events: August 30, 2007 to October 29, 2007The following event listing is taken from the LWN.net Calendar.
If your event does not appear here, please tell us about it. Web sites MacForge.net: Now Over 45,000 Mac Open Source ProjectsMacTech(r) Magazine has announced that its MacForge(tm) Mac open source project index now has over 45,000 projects. MacForge.net was created for not only the experienced open source user, but to introduce the Mac technical community to the wonderful array of projects available.
Page editor: Forrest Cook
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
