LWN.net Weekly Edition for March 27, 2003

The X Window System, past and future

The Jargon File defines X as "An over-sized, over-featured, over-engineered and incredibly over-complicated window system developed at MIT and widely used on Unix systems." The Unix Hater's Handbook states: "X Windows [sic] is the Iran-Contra of graphical user interfaces: a tragedy of political compromises, entangled alliances, marketing hype, and just plain greed." The "fortune" program shipped with most Linux distributions contains six extended diatribes against X, with delightful tidbits like: "The trailing edge of software technology.", "The greatest productivity aid since typhoid.", "You'll envy the dead.", and "Making the world safe for competing window systems.". And those are just from the first of six. The last dig quoted above is interesting, though, when confronted with one little fact: there are no competing window systems.

Most LWN readers will be aware by now of the current dispute over the direction of the XFree86 project. The next article will look at what is going on there, but, first, it's worth taking a moment to look at the absolute monopoly that X holds on Linux (and Unix) desktops.

As free software projects go, X is one of the older ones. The first X release, built with support from the company then known as Digital Equipment Corporation, came out of MIT in 1984. By the time X10 was released, the window system was beginning to be widely used outside of MIT, but it was X11 (released on September 15, 1987 - you could order it on nine-track tape) that established X as the definitive Unix windowing environment. Several vendors, wanting to support the continued development of a vendor-neutral windowing system, formed the X Consortium to further support development in 1988. The Consortium eventually lost its relevance when the Unix vendors decided they wanted to start "differentiating" their window systems, and the XFree86 project became the real core of X11 development. That, of course, is how things stand today.

X11 is certainly one of the longest-lasting major releases in software history; more than fifteen years later the X11 protocol maintains backward compatibility, and there has never been an X12 release.

Since the early days, X has been the target of severe criticism. Attackers claim that it is over-engineered and bloated. Its absolute refusal to dictate policy (or even provide a standard window manager) has led to wildly incompatible interfaces on the same desktop. X requires applications to deal with too much information about the underlying hardware. The network-based client/server protocol is slow and has led to security problems. There is no way to load code into the server itself. The server doesn't even maintain window contents, forcing applications to deal with "expose" events. And so on. X, it is said, is "vacuumware," it sucks, but succeeded because there was nothing else out there.

The above criticisms are, beyond doubt, not entirely lacking in merit. But the fact remains that X is the only viable windowing system for Unix-like systems. It pushed aside numerous proprietary systems (SunView was halfway out the door before Sun officially switched) and established itself as the standard across an amazing range of systems from different vendors. If X were truly that bad, a viable competitor would certainly have arisen in the 15 years since X11R1 was released. The few attempts (your editor once had the unfortunate experience of trying to program a project under NeWS) have sunk without a trace.

Why has X been so successful? Here's a few possible reasons:

• X actually does pretty well at hiding hardware details for many applications. But the ability (and, occasionally, requirement) to deal with the hardware allowed the writing of applications that behaved optimally on a wide range of systems.

• The X client/server protocol was unique; it enabled the separation of applications from the desktop where their interfaces were displayed. If you were a system admin who suddenly could easily monitor several servers on one screen, or a scientific user who could run supercomputer visualizations from your desktop, this was a big deal.

• The refusal to set policy allowed a great deal of experimentation in user interface policies. Lots of bad ideas (i.e. tiling window managers, Motif) were tried and discarded without having been wired into the window system itself. Even now, X provides a platform where competing visions of the desktop can be implemented and tried out.

• The built-in extensibility of the X11 protocol has allowed it to evolve over time without breaking compatibility with older applications.

• It works, and has for a long time.

Of course, one should not forget the other important reason why X succeeded back in the 1980's: it was free software.

So now X dominates the non-Windows desktop. Given the extent to which some people criticize X, one would assume there would be a whole set of development projects working to replace it. The fact that X works well and the existence of a large set of existing X applications present a daunting challenge to any potential replacement, however. Without a compelling reason to change (and rock-solid X compatibility), users are likely to remain with X for quite some time into the future. So it is not surprising that free software projects working on X replacements are not easy to find. There just isn't that much of an itch to scratch.

One group that is trying, however, is the Fresco project (formerly known as "Berlin"). Fresco's approach differs from that of X in many ways: user interface policy will be wired into the window system itself; more advanced rendering will be supported by the server; the API will be based on vector operations and will be resolution-independent; CORBA will be used as the network transport; and the whole thing will be built with heavy use of threading in mind. Potential users will need to be patient; according to the web site, "Fresco is only useful for demos (really cool demos though :)". Fresco announced its second milestone release on March 4.

Someday a project like Fresco may well succeed in displacing X from our desktops. Someday. Meanwhile, X will remain one of the crucial components of free operating systems like Linux. So the current disagreements over the direction of the XFree86 project are important.

Comments (17 posted)

The Future of XFree86

[This article was contributed by Joe 'Zonker' Brockmeier]

Sometimes a good argument is necessary to get everything out in the open and to make a little progress. That seems to be the case with the current XFree86 controversy.

If you haven't been following it, the furor started when XFree86 developer Keith Packard was ousted from the Core Team. Apparently, Packard was trying to start a fork of the project without discussing the issue with other Core Team members first. After the dust had settled, somewhat, the XFree86 Project's board issued an open invitation to discuss "Any topics...from those related to administrative and management issues through to technical issues." In just eight days, more than 700 messages have been sent to the list. A lot of ideas have been thrown around, including a joint statement from the GNOME and KDE projects.

Packard has now made public some of his complaints with the current status of the XFree86 Project. His "A Call For Open Governance Of X Development" posits that there are a number of problems with development of XFree86. Specifically, Packard writes that XFree86 suffers from limited development resources, slow release schedules, a lack of cooperation with other projects and a lack of information on how to get involved with XFree86 development. Packard concludes that XFree86 needs to be a community-governed project.

The XFree86 Project has already responded to Packard's complaint that there is a lack of information on becoming a developer by adding a prominent link to the front page titled "How to become an XFree86 Developer." Short and to the point, it nevertheless provides some guidance for interested developers: "Get and build the latest XFree86 code from the CVS repository, subscribe to the XFree86 developer list (devel@XFree86.org) and participate."

David Wexelblat, one of the Core Team members, notes that the issue of infrequent releases, at least in terms of card support, is a non-issue:

David Dawes, head of the XFree86 Board of Directors and leader of the core team has committed to tagging regular snapshots, every two weeks, of the CVS trunk. This doesn't address the question of more frequent stable releases, but it should provide a way for more people to be involved in testing XFree86 and providing feedback.

Wexelblat also disagrees that XFree86 should be community-governed. "There is no reason to change the meritocracy, other than to work on promoting sufficient people through it, of sufficient skill/quality/integridy [sic] to get the work done." Rich Murphey, another member of the XFree86 board, agrees that "sweat equity" is the best way to have influence on the direction of the project. "Join devel, write code, join core. That's how it works...I don't see a more effective solution than that."

Both Packard and Wexelblat agree that XFree86 could benefit from additional resources. Wexelblat raises the issue of poor support for XFree86 by commercial companies:

Given the importance of XFree86 to the long-term success of Linux on the desktop, now might be a good time for some of the Linux companies to step up support for XFree86. It seems clear that, regardless of other changes, XFree86 development will remain a meritocracy. However, the attention now being focused on the project is likely to produce some long-term benefits despite the initial unpleasantness.

Comments (8 posted)

Quick LWN update

Time flies... it is now six months since LWN began the subscription experiment. How do we know? Many of you signed up for six-month subscriptions, and those are now expiring. If you are one of those, it's time to be thinking about renewing; remember that prepaid subscriptions of ten months or longer get a 10% discount.

LWN's subscribers are the only thing keeping this site on the net; we thank you for your support.

Comments (15 posted)

Page editor: Jonathan Corbet

Security

Brief items

Relaxing with the XDR Vulnerability

[This article was contributed by Tom Owen]

A vulnerability in a library is unsettling. When the affected code is in glibc it seems like genuine grounds for alarm. Not only the library itself, but potentially every static-linked executable may need to be replaced or rebuilt, and it takes a very confident system administrator to swear to the link status of everything on the system.

These vulnerabilities do appear from time to time. Fortunately, it generally turns out that thought is a substitute for panicky rebuilds. The XDR vulnerability provides a handy example.

RPC (Remote Procedure Call) is an upper-layer network protocol developed by Sun as part of their vision of network-centric computing. Services offered via RPC appear to be simple functions which are called by applications; this system has been a key basis for many distributed applications, with NFS being the most famous. One obstacle to passing program data between hosts is the varying binary representation of basic data types like integers and floating point numbers. Ones-complement integers aren't much of a problem these days, but little and big endian byte orders are in use as are non-IEEE floating point formats. The solution used by Sun is for all hosts to convert data to and from a standard network representation; this representation is called "external data representation," or XDR.

The routines for XDR data conversion are included in glibc. One of these routines (xdr_array()) has a vulnerability where a crafted message can cause a buffer overflow. Finding out how much to worry about this vulnerability is really a matter of finding all of the uses of the XDR code in your system.

The place to start is with the new glibc itself. There's no good reason not to install this update -- it's insurance against changes in the future if nothing else. Another sensible precaution for any site is to ensure that RPC network traffic is stopped at the firewall. Running RPC across the public Internet is a fine security challenge, but not an obvious win. A complete block takes a bit of research as RPC ports sometimes vary from site to site, but blocking TCP and UDP for 111 (the portmapper) and 2049 (NFS) is a start. If RPC can't get in from outside then you won't be interpreting any external messages as XDR.

For many Linux sites RPC is needed to support NFS, or other services like NIS. That's the first stopping point -- all sites without NFS and without some other need for RPC-based services can stop now. Job done.

The next set of easy exits is for the bulk of those RPC and NFS sites.

Dynamic linking has its downside, but like most good ideas, its disadvantages turn out to be the same as its benefits. For certain, dynamic linking means that a working system can be silently wrecked by installing an application with an incompatible version of some library. But that same feature gets us out of trouble here -- if ever there was a library to link dynamically, glibc -- stable and ubiquitous -- is it.

Distributors that have published fixes are typically offering the updated library itself and perhaps some NFS daemons. Since most applications use dynamic linking with glibc, replacing that library is sufficient to close the vulnerability. For most sites, updating glibc is all that is required.

Everybody left counts as a programmer or a builder. Programmers will know whether they have a problem. The rest of us -- call us naive builders -- are the ones with the problem. It's here that we have to fall back on the safe course. If we truly can't tell whether we're using the XDR functions or static linking then, finally, it's time to rebuild and reinstall our applications.

Comments (3 posted)

New vulnerabilities

bonsai: multiple vulnerabilites

Package(s):	bonsai	CVE #(s):	CAN-2003-0152 CAN-2003-0153 CAN-2003-0154 CAN-2003-0155
Created:	March 21, 2003	Updated:	March 26, 2003
Description:	Remi Perrot fixed several security related bugs in bonsai, the Mozilla CVS query tool by web interface. Vulnerabilities include arbitrary code execution, cross-site scripting and access to configuration parameters. The Common Vulnerabilities and Exposures project identifies the following problems: CAN-2003-0152 - Remote execution of arbitrary commands as www-data CAN-2003-0153 - Absolute path disclosure CAN-2003-0154 - Cross site scriptiong attacks CAN-2003-0155 - Unauthenticated access to parameters page
Alerts:	Debian DSA-265-1 2003-03-21

Comments (none posted)

delegate - remote code execution vulnerability

Package(s):	delegate	CVE #(s):
Created:	March 20, 2003	Updated:	March 26, 2003
Description:	According to a SNS security advisory, a remote code execution vulnerability exists in the application level gateway DeleGate version 8.4.0 and earlier. Fetching a large robots.txt file through DeleGate HTTP proxy could result in a buffer overflow.
Alerts:	OpenPKG OpenPKG-SA-2003.023 2003-03-19

Comments (none posted)

evolution: multiple vulnerabilities

Package(s):	Evolution	CVE #(s):	CAN-2003-0128 CAN-2003-0129 CAN-2003-0130
Created:	March 21, 2003	Updated:	May 14, 2003
Description:	Multiple vulnerabilities have been found in Ximian's Evolution Mail User Agent, according to this CoreLabs advisory. "Three vulnerabilities were found that could lead to various forms of exploitation ranging from denying to users the ability to read email, provoke system unstability, bypassing security context checks for email content and possibly execution of arbitrary commands on vulnerable systems." Ximian Evolution is a personal and workgroup information management solution for Linux and UNIX-based systems. The software integrates email, calendaring, meeting scheduling, contact management, and task lists, in one application.
Alerts:	Conectiva CLA-2003:648 2003-05-14 Mandrake MDKSA-2003:045 2003-04-15 Yellow Dog YDU-20030409-2 2003-04-09 Red Hat RHSA-2003:108-03 2003-03-31 Red Hat RHSA-2003:108-02 2003-03-24 Gentoo 200303-18 2003-03-21 Red Hat RHSA-2003:108-01 2003-03-21

Comments (1 posted)

glibc: integer overflow in the xdrmem_getbytes() function

Package(s):	glibc krb5 dietlibc	CVE #(s):	CAN-2003-0028
Created:	March 21, 2003	Updated:	May 27, 2003
Description:	An integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, and glibc, allows remote attackers to execute arbitrary code via certain integer values in length fields See CAN-2003-0028 and CERT advisory CA-2003-10 for more information.
Alerts:	SuSE SuSE-SA:2003:027 2003-05-26 Slackware ssa:2003-141-03 2003-05-22 Conectiva CLA-2003:639 2003-05-05 Conectiva CLA-2003:633 2003-04-30 Immunix IMNX-2003-7+-009-01 2003-04-14 Debian DSA-282-1 2003-04-09 Gentoo 200303-29 2003-03-31 Debian DSA-272-1 2003-03-28 Trustix 2003-0014 2003-03-26 Mandrake MDKSA-2003:037 2003-03-25 Gentoo 200303-22 2003-03-25 Debian DSA-266-1 2003-03-17 Red Hat RHSA-2003:089-00 2003-03-19 Sorcerer SORCERER2003-03-20-2 2003-03-20 Sorcerer SORCERER2003-03-20-1 2003-03-20 EnGarde ESA-20030321-010 2003-03-21 SCO Group CSSA-2003-013.0 2003-03-19

Comments (3 posted)

ircii: buffer overflow vulnerability

Package(s):	ircii	CVE #(s):
Created:	March 20, 2003	Updated:	April 22, 2003
Description:	Timo Sirainen audited ircII based clients (see this Bugtraq post) and found some buffer overflow vulnerabilities in ircii-20020912.
Alerts:	Debian DSA-291-1 2003-04-22 Gentoo 200303-21 2003-03-24 OpenPKG OpenPKG-SA-2003.024 2003-03-19

Comments (none posted)

kerberos - cryptographic weakness

Package(s):	kerberos, heimdal, openafs	CVE #(s):	CAN-2003-0138 CAN-2003-0139
Created:	March 26, 2003	Updated:	May 27, 2003
Description:	Version 4 of the Kerberos protocol contains a cryptographic weakness which enables a chosen-plaintext attack. A suitably equipped attacker can impersonate any principal in the realm. Another weakness allows the creation of false Kerberos tickets. Given the weaknesses in the cryptography, cross-realm authentication cannot be performed in a secure way. OpenAFS kaserver implements version 4 of the Kerberos protocol, and therefore is also vulnerable.
Alerts:	Gentoo 200305-09 2003-05-27 Debian DSA-269-2 2003-04-09 Immunix IMNX-2003-7+-007-01 2003-04-07 Red Hat RHSA-2003:091-01 2003-04-02 Mandrake MDKSA-2003:043 2003-04-01 Gentoo 200303-28 2003-03-31 Gentoo 200303-26 2003-03-30 Debian DSA-273-1 2003-03-28 Red Hat RHSA-2003:051-01 2003-03-26 Debian DSA-269-1 2003-03-26

Comments (none posted)

mutt: buffer overflow in IMAP client code

Package(s):	mutt	CVE #(s):	CAN-2003-0140
Created:	March 21, 2003	Updated:	April 22, 2003
Description:	Core Security Technologies has found a remotely exploitable buffer overflow in mutt's IMAP client code. This Bugtraq post contains additional information. The problem has been fixed in Mutt 1.4.1 (stable) and 1.5.4 (unstable).
Alerts:	Conectiva CLA-2003:630 2003-04-22 Conectiva CLA-2003:626 2003-04-14 Debian DSA-274-2 2003-04-07 Red Hat RHSA-2003:109-03 2003-04-03 Mandrake MDKSA-2003:041 2003-04-01 Slackware sl-1049141887 2003-03-31 Slackware sl-1049038131 2003-03-30 Debian DSA-274-1 2003-03-28 Debian DSA-268-1 2003-03-25 Gentoo 200303-19 2003-03-22 SuSE SuSE-SA:2003:020 2003-03-24 OpenPKG OpenPKG-SA-2003.025 2003-03-20

Comments (none posted)

Updated vulnerabilities

apcupsd - remote root vulnerability and buffer overflows

Package(s):	apcupsd	CVE #(s):	CAN-2003-0098 CAN-2003-0099
Created:	February 24, 2003	Updated:	April 3, 2003
Description:	From the MandrakeSoft advisory: A remote root vulnerability in slave setups and some buffer overflows in the network information server code were discovered by the apcupsd developers. They have been fixed in the latest unstable version, 3.10.5 which contains additional enhancements like USB support, and the latest stable version, 3.8.6. There are a few changes that need to be noted, such as the port has changed from port 7000 to post 3551 for NIS, and the new config only allows access from the localhost. Users may need to modify their configuration files appropriately, depending upon their configuration.
Alerts:	Debian DSA-277-1 2003-04-03 SuSE SuSE-SA:2003:022 2003-03-26 SCO Group CSSA-2003-015.0 2003-03-25 Mandrake MDKSA-2003:018 2003-02-18 Gentoo 200302-13 2003-02-24

Comments (none posted)

Heap corruption vulnerability in at

Package(s):	at at, sudo, xchat	CVE #(s):	CAN-2002-0004
Created:	May 21, 2002	Updated:	May 15, 2003
Description:	The at command has a potentially exploitable heap corruption bug. (First LWN report:  January 17th).
Alerts:	EnGarde ESA-20030515-015 2003-05-15 Yellow Dog YDU-20020127-9 2002-01-27 SuSE SuSE-SA:2002:003 2001-01-16 Slackware sl-1011706104 2002-01-22 Red Hat RHSA-2002:015-15 2002-02-07 Red Hat RHSA-2002:015-13 2002-01-22 Mandrake MDKSA-2002:007 2002-01-18 Debian DSA-102-2 2002-01-18 Debian DSA-102-1 2002-01-16

Comments (none posted)

bind buffer overflow vulnerability in DNS resolver libraries

Package(s):	bind glibc	CVE #(s):	CAN-2002-0651 CAN-2002-0684
Created:	July 8, 2002	Updated:	October 1, 2003
Description:	The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1) include fixes for a libc related vulnerability which does not affect Linux. Updates from the Internet Software Consortium (ISC) are available from here. No release or branch of Openwall GNU/*/Linux (Owl) is known to be affected, due to Olaf Kirch's fixes for this problem getting into the GNU C library more than two years ago. Unfortunatly that does not mean that Linux systems are not vulnerable. Similar code, without Olaf Firch's fixes, is in the glibc getnetbyXXX functions. These functions are described in the SuSE alert as " used by very few applications only, such as ifconfig and ifuser, which makes exploits less likely." CERT Advisory: CA-2002-19 Buffer Overflow in Multiple DNS Resolver Libraries CAN-2002-0651 CAN-2002-0684
Alerts:	Mandrake MDKSA-2002:050 2002-08-13 Yellow Dog YDU-20020810-3 2002-08-10 Eridani ERISA-2002:035 2002-08-09 Red Hat RHSA-2002:133-13 2002-08-08 SCO Group CSSA-2002-034.0 2002-08-05 Yellow Dog YDU-20020801-2 2002-08-01 Eridani ERISA-2002:028 2002-07-25 Red Hat RHSA-2002:139-10 2002-07-22 EnGarde ESA-20020724-018 2002-07-24 Mandrake MDKSA-2002:043 2002-07-16 Trustix 2002-0061 2002-07-15 Gentoo glibc-20020713 2002-07-13 Conectiva CLA-2002:507 2002-07-11 SuSE SuSE-SA:2002:026 2002-07-09 OpenPKG OpenPKG-SA-2002.006 2002-07-04

Comments (1 posted)

BitchX - denial of service

Package(s):	BitchX	CVE #(s):
Created:	February 20, 2003	Updated:	May 26, 2003
Description:	From this Bugtraq posting: A denial of service vulnerability exists in BitchX. Sending a malformed RPL_NAMREPLY numeric 353 causes BitchX to segfault. This problem was reported to panasync@efnet#bitchx on Jan 30 2003, as of this writing we are unaware of any patches or workarounds provided by panasync and or any members of #bitchx
Alerts:	Conectiva CLA-2003:655 2003-05-26 Slackware ssa:2003-141-02 2003-05-22 Debian DSA-306-1 2003-05-19 Gentoo 200302-11 2003-02-20

Comments (none posted)

Canna server: exploitable buffer overrun

Package(s):	canna	CVE #(s):	CAN-2002-1158 CAN-2002-1159
Created:	December 10, 2002	Updated:	October 1, 2003
Description:	Canna is a kana-kanji conversion server which is necessary for Japanese language character input. A buffer overflow bug in the Canna server up to and including version 3.5b2 allows a local user to gain the privileges of the user 'bin' which could lead to further exploits. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1158 to this issue. A lack of validation of requests has been found that affects Canna version 3.6 and earlier. A malicious remote user could exploit this vulnerability to leak information, or cause a denial of service attack. (CAN-2002-1159) See also http://canna.sourceforge.jp/sec/Canna-2002-01.txt CAN-2002-1158 CAN-2002-1159
Alerts:	SCO Group CSSA-2003-005.0 2003-01-21 Debian DSA-224-1 2002-01-08 Gentoo 200212-8 2002-12-20 Red Hat RHSA-2002:246-18 2002-12-04

Comments (none posted)

CVS - exploitable double-free bug in the CVS server

Package(s):	cvs	CVE #(s):	CAN-2003-0015
Created:	January 20, 2003	Updated:	April 7, 2003
Description:	CVS is a version control system frequently used to manage source code repositories. During an audit of the CVS sources, Stefan Esser discovered an exploitable double-free bug in the CVS server. On servers which are configured to allow anonymous read-only access, this bug could be used by anonymous users to gain write privileges. Users with CVS write privileges can then use the Update-prog and Checkin-prog features to execute arbitrary commands on the server. All users of CVS are advised to upgrade to erratum packages which contain patches to correct the double-free bug. See also this CERT advisory
Alerts:	Immunix IMNX-2003-7+-004-01 2003-04-02 SCO Group CSSA-2003-006.0 2003-01-31 Yellow Dog YDU-20030127-6 2003-01-27 Conectiva CLA-2003:561 2003-01-23 SuSE SuSE-SA:2003:0007 2003-01-22 Slackware sl-1043242333 2003-01-22 Conectiva CLA-2003:560 2003-01-21 Debian DSA-233-1 2003-01-21 Gentoo 200301-12 2003-01-21 OpenPKG OpenPKG-SA-2003.004 2003-01-21 Mandrake MDKSA-2003:009 2003-01-20 Red Hat RHSA-2003:012-07 2003-01-20

Comments (none posted)

dhcp3 - ignored counter boundary

Package(s):	dhcp3	CVE #(s):	CAN-2003-0039
Created:	January 28, 2003	Updated:	April 5, 2003
Description:	Florian Lohoff discovered a bug in the dhcrelay causing it to send a continuing packet storm towards the configured DHCP server(s) in case of a malicious BOOTP packet, such as sent from buggy Cisco switches. When the dhcp-relay receives a BOOTP request it forwards the request to the DHCP server using the broadcast MAC address ff:ff:ff:ff:ff:ff which causes the network interface to reflect the packet back into the socket. To prevent loops the dhcrelay checks whether the relay-address is its own, in which case the packet would be dropped. In combination with a missing upper boundary for the hop counter an attacker can force the dhcp-relay to send a continuing packet storm towards the configured dhcp server(s). This patch introduces a new commandline switch ``-c maxcount'' and people are advised to start the dhcp-relay with ``dhcrelay -c 10'' or a smaller number, which will only create that many packets. The dhcrelay program from the ``dhcp'' package does not seem to be affected since DHCP packets are dropped if they were apparently relayed already.
Alerts:	Conectiva CLA-2003:616 2003-04-04 Red Hat RHSA-2003:034-01 2003-03-31 OpenPKG OpenPKG-SA-2003.012 2003-02-19 Debian DSA-245-1 2003-01-28

Comments (none posted)

dvips: command execution vulnerability

Package(s):	dvips	CVE #(s):	CAN-2002-0836
Created:	October 16, 2002	Updated:	June 10, 2003
Description:	The dvips utility uses the system() function improperly when managing fonts. An attacker who can craft the right sort of print job can use this vulnerability to execute commands under the UID used by the print system.
Alerts:	Immunix IMNX-2003-7+-016-01 2003-06-09 OpenPKG OpenPKG-SA-2002.015 2002-12-16 Debian DSA-207-1 2002-12-11 Conectiva CLA-2002:537 2002-10-29 Mandrake MDKSA-2002:071 2002-10-24 Mandrake MDKSA-2002:070 2002-10-23 Gentoo tetex-20021018 2002-10-18 Red Hat RHSA-2002:194-18 2002-10-08

Comments (none posted)

ethereal - format string vulnerability

Package(s):	ethereal	CVE #(s):	CAN-2003-0081
Created:	March 10, 2003	Updated:	June 12, 2003
Description:	The SOCKS dissector in Ethereal 0.9.9 is susceptible to a format string overflow. This vulnerability has been present in Ethereal since the SOCKS dissector was introduced in version 0.8.7. It was discovered by Georgi Guninski. Additionally, the NTLMSSP code is susceptible to a heap overflow. All users of Ethereal 0.9.9 and below are encouraged to upgrade. See the full advisory for additional information.
Alerts:	Mandrake MDKSA-2003:051 2003-03-24 Red Hat RHSA-2003:076-01 2003-04-23 Conectiva CLA-2003:627 2003-04-16 SuSE SuSE-SA:2003:019 2003-03-21 Debian DSA-258-1 2003-03-10 Gentoo 200303-10 2003-03-09

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail: buffer overflow

Package(s):	fetchmail	CVE #(s):	CAN-2002-1365
Created:	December 17, 2002	Updated:	October 20, 2003
Description:	Versions of fetchmail prior to 6.2.0 have (yet another) buffer overflow vulnerability which can be exploited remotely via a suitably crafted message. See this advisory for details.
Alerts:	Immunix IMNX-2003-7+-023-01 2003-10-17 Mandrake MDKSA-2003:011 2003-01-27 EnGarde ESA-20030127-002 2003-01-27 SCO Group CSSA-2003-001.0 2003-01-09 SuSE SuSE-SA:2003:001 2003-01-02 Debian DSA-216-1 2002-12-24 Red Hat RHSA-2002:293-09 2002-12-17 Conectiva CLA-2002:554 2002-12-16

Comments (3 posted)

file - memory allocation problem, stack overflow

Package(s):	file	CVE #(s):	CAN-2003-0102
Created:	March 4, 2003	Updated:	June 4, 2003
Description:	Jeff Johnson found a memory allocation problem and David Endler found a stack overflow corruption problem in the file "Automatic File Content Type Recognition Tool" version 3.41. Nalin Dahyabhai improved ELF section and program header handling in file version 3.40. The folks at OpenPKG believe that file versions without those modifications are vulnerable to memory allocation and stack overflow problems which put security at risk.
Alerts:	Immunix IMNX-2003-7+-012-01 2003-06-03 SCO Group CSSA-2003-018.0 2003-04-28 Mandrake MDKSA-2003:030-1 2003-04-17 Conectiva CLA-2003:617 2003-04-04 SuSE SuSE-SA:2003:017 2003-03-21 Debian DSA-260-1 2003-03-13 Gentoo 200303-8 2003-03-08 EnGarde ESA-20030307-008 2003-03-07 Red Hat RHSA-2003:086-07 2003-03-07 Mandrake MDKSA-2003:030 2003-03-06 OpenPKG OpenPKG-SA-2003.017 2003-03-04

Comments (none posted)

GNU fileutils race condition

Package(s):	fileutils ucdsnmp	CVE #(s):	CAN-2002-0435
Created:	May 21, 2002	Updated:	May 16, 2003
Description:	A race condition in rm may cause the root user to delete the whole filesystem. The problem exists in the version of rm in fileutils 4.1 stable and 4.1.6 development version. A patch is available. (First LWN report: May 2).
Alerts:	Immunix IMNX-2003-7+-010-01 2003-05-16 Red Hat RHSA-2003:015-05 2003-02-12 Trustix 2002-0052 2002-06-06 SuSE SuSE-SA:2002:012 2002-04-08 Mandrake MDKSA-2002:031 2002-05-16 SCO Group CSSA-2002-018.1 2002-05-13

Comments (none posted)

Potential remote root exploit in glibc

Package(s):	glibc	CVE #(s):	CAN-2002-0391
Created:	August 14, 2002	Updated:	June 30, 2003
Description:	Felix von Leitner, discovered a potential division by zero bug in code derived from the SunRPC library which is used in glibc.This bug could be exploited to gain unauthorized root access to software linking to glibc. Updating as soon as practical is a good idea. Because SunRPC-derived XDR libraries are used by a variety of vendors in a variety of applications, this defect may lead to a number of differing security problems. Exploiting this vulnerability will lead to denial of service, execution of arbitrary code, or the disclosure of sensitive information. CERT/CC Vulnerability Note VU#192995 Integer overflow in xdr_array() function when deserializing the XDR stream
Alerts:	Debian DSA-333-1 2003-06-27 Conectiva CLA-2002:535 2002-10-29 Trustix 2002-0070 2002-10-17 EnGarde ESA-20021003-021 2002-10-03 Gentoo glibc-20020927 2002-09-27 Gentoo dietlibc-20020927 2002-09-27 Debian DSA-149-2 2002-09-26 Mandrake MDKSA-2002:061 2002-09-23 Gentoo glibc-20020905 2002-09-05 SuSE SuSE-SA:2002:031 2002-08-30 Trustix 2002-0067 2002-08-13 Eridani ERISA-2002:036 2002-08-13 Red Hat RHSA-2002:166-07 2002-08-12 Debian DSA-149-1 2002-08-13

Comments (none posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

IMP - SQL injection vulnerability

Package(s):	imp	CVE #(s):	CAN-2003-0025
Created:	January 15, 2003	Updated:	July 8, 2003
Description:	The IMP IMAP server, versions 2.2.8 and prior, is vulnerable to SQL injection; see this advisory for details. Version 3.x is not vulnerable to this problem.
Alerts:	Conectiva CLA-2003:690 2003-07-08 SuSE SuSE-SA:2003:0008 2003-02-18 Debian DSA-229-2 2003-01-15

Comments (1 posted)

kernel - ptrace-related vulnerability

Package(s):	kernel	CVE #(s):	CAN-2003-0127
Created:	March 17, 2003	Updated:	June 30, 2003
Description:	Versions 2.2.x and 2.4.x of the Linux kernel contain a vulnerability in ptrace() which may be exploited by a local user to obtain root access. This announcement contains the details and a patch for 2.4.20. For 2.2 users, 2.2.25 has been released which contains the fix.
Alerts:	Debian DSA-336-2 2003-06-29 Debian DSA-336-1 2003-06-29 Debian DSA-332-1 2003-06-27 Red Hat RHSA-2003:098-03 2003-06-02 SCO Group CSSA-2003-020.0 2003-05-09 Mandrake MDKSA-2003:038-1 2003-04-09 Red Hat RHSA-2003:135-00 2003-04-08 Conectiva CLA-2003:618 2003-04-07 Debian DSA-276-1 2003-04-03 Mandrake MDKSA-2003:039 2003-03-27 Mandrake MDKSA-2003:038 2003-03-27 Debian DSA-270-1 2003-03-27 SuSE SuSE-SA:2003:021 2003-03-25 Gentoo 200303-17 2003-03-21 Sorcerer SORCERER2003-03-19 2003-03-20 Red Hat RHSA-2003:088-01 2003-03-20 EnGarde ESA-20030318-009 2003-03-18 Trustix 2003-0007 2003-03-18 Red Hat RHSA-2003:098-00 2003-03-17

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

lprold - buffer overflow in lprm

Package(s):	lprold lpd	CVE #(s):	CAN-2003-0144
Created:	March 13, 2003	Updated:	May 28, 2003
Description:	The lprm command of the printing package lprold contains a buffer overflow. This buffer overflow can be exploited by a local user, if the printer system is set up correctly, to gain root privileges.
Alerts:	Mandrake MDKSA-2003:059 2003-05-21 Debian DSA-267-2 2003-04-15 Debian DSA-275-1 2003-04-02 Debian DSA-267-1 2003-03-24 SuSE SuSE-SA:2003:0014 2003-03-13

Comments (none posted)

lxr - input validation error

Package(s):	lxr	CVE #(s):
Created:	March 19, 2003	Updated:	March 19, 2003
Description:	lxr fails to properly sanitize incoming filenames, with the result that an attacker can read arbitrary files on the system.
Alerts:	Debian DSA-264-1 2003-03-19

Comments (none posted)

lynx: CRLF injection vulnerability

Package(s):	lynx	CVE #(s):	CAN-2002-1405
Created:	November 19, 2002	Updated:	October 1, 2003
Description:	If lynx is given a url with some special characters on the command line, it will include faked headers in the HTTP query. This feature can be used to force scripts (that use Lynx for downloading files) to access the wrong site on a web server with multiple virtual hosts. CAN-2002-1405
Alerts:	Conectiva CLA-2003:720 2003-08-11 Mandrake MDKSA-2003:023 2003-02-24 OpenPKG OpenPKG-SA-2003.011 2003-02-18 Red Hat RHSA-2003:029-06 2003-02-12 Trustix 2002-0085 2002-12-19 Debian DSA-210-1 2002-12-13 SCO Group CSSA-2002-049.0 2002-11-18

Comments (none posted)

perl-MailTools: remote command execution

Package(s):	MailTools	CVE #(s):	CAN-2002-1271
Created:	November 5, 2002	Updated:	September 19, 2003
Description:	The SuSE Security Team reviewed critical Perl modules, including the Mail::Mailer package. This package contains a security hole which allows remote attackers to execute arbitrary commands in certain circumstances. This is due to the usage of mailx as default mailer which allows commands to be embedded in the mail body. Note that mail processing programs which use this package can be affected by this vulnerability; in particular, SpamAssassin is vulnerable if you use the -r or -w flags.
Alerts:	Debian DSA-386-1 2003-09-18 Gentoo 200302-01 2003-02-02 Mandrake MDKSA-2002:076 2002-11-07 Gentoo 200211-001 2002-11-06 SuSE SuSE-SA:2002:041 2002-11-05

Comments (none posted)

man - code execution vulnerability

Package(s):	man	CVE #(s):	CAN-2003-0124
Created:	March 19, 2003	Updated:	May 7, 2003
Description:	Versions of man prior to 1.51 contain a code execution vulnerability which can be exploited by a carefully crafted man file. See this advisory for the details.
Alerts:	Mandrake MDKSA-2003:054 2003-05-06 Red Hat RHSA-2003:133-01 2001-03-05 Conectiva CLA-2003:620 2003-04-07 Gentoo 200303-13 2003-03-18

Comments (none posted)

micq: Denial of service

Package(s):	micq	CVE #(s):
Created:	December 13, 2002	Updated:	April 24, 2003
Description:	Rüdiger Kuhlmann, upstream developer of mICQ, a text based ICQ client, discovered a problem in mICQ. Receiving certain ICQ message types that do not contain the required 0xFE seperator causes all versions to crash.
Alerts:	Red Hat RHSA-2003:118-01 2003-04-24 Debian DSA-211-1 2002-12-13

Comments (none posted)

MySQL: multiple vulnerabilities

Package(s):	mysql	CVE #(s):
Created:	December 13, 2002	Updated:	April 10, 2003
Description:	The MySQL database server has several buffer overflow and integer bounds checking vulnerabilities which can lead to denial of service attacks, and, possibily, remote code execution. See this e-matters advisory for details. Version 3.23.54 fixes the problems.
Alerts:	Immunix IMNX-2003-7+-008-01 2003-04-08 EnGarde ESA-20030127-001 2003-01-27 Red Hat RHSA-2002:288-22 2003-01-15 SuSE SuSE-SA:2003:003 2003-01-02 Trustix 2002-0086 2002-12-19 Mandrake MDKSA-2002:087 2002-12-18 Debian DSA-212-1 2002-12-17 Conectiva CLA-2002:555 2002-12-17 OpenPKG OpenPKG-SA-2002.013 2002-12-16 Gentoo 200212-2 2002-12-15 EnGarde ESA-20021213-033 2002-12-13

Comments (none posted)

mysql - configuration file vulnerability

Package(s):	mysql mysqld	CVE #(s):	CAN-2003-0150
Created:	March 18, 2003	Updated:	May 16, 2003
Description:	According to a report on BugTraq, a vulnerability exists in version 3.23.55 and earlier versions of the MySQL server. If the MySQL server is launched by root, as it is often done by system startup scripts, any database users with the "FILE" privilege can write a configuration file (usually my.cnf) that causes the MySQL server to run under an arbitrary user id, including the user id of the super-user, on the next restart.
Alerts:	Debian DSA-303-1 2003-05-15 Mandrake MDKSA-2003:057 2003-05-14 Red Hat RHSA-2003:093-02 2002-03-05 Red Hat RHSA-2003:093-01 2003-04-29 EnGarde ESA-20030324-012 2003-03-24 Gentoo 200303-14 2003-03-18 OpenPKG OpenPKG-SA-2003.022 2003-03-18 Trustix 2003-0009 2003-03-18

Comments (none posted)

nethack: buffer overflow

Package(s):	nethack, slashem, falconseye	CVE #(s):	CAN-2003-0358 CAN-2003-0359
Created:	February 18, 2003	Updated:	July 15, 2003
Description:	Overflowing a buffer in nethack may lead to privilege escalation to games uid. Read the the full advisory for the details. Note that falconseye does not contain the file permission error CAN-2003-0359 which affected some other nethack packages.
Alerts:	Debian DSA-350-1 2003-07-15 Debian DSA-316-3 2003-06-17 Debian DSA-316-2 2003-06-11 Debian DSA-316-1 2003-06-11 Gentoo 200302-08 2003-02-18

Comments (none posted)

NetPBM: math overflow errors

Package(s):	NetPBM	CVE #(s):	CAN-2003-0146
Created:	March 17, 2003	Updated:	May 27, 2003
Description:	Al Viro and Alan Cox discovered several maths overflow errors in NetPBM, a set of graphics conversion tools. These programs are not installed setuid root but are often installed to prepare data for processing. These vulnerabilities may allow remote attackers to cause a denial of service or execute arbitrary code.
Alerts:	Conectiva CLA-2003:656 2003-05-27 Red Hat RHSA-2003:060-01 2003-04-03 Mandrake MDKSA-2003:036 2003-03-25 Debian DSA-263-1 2003-03-17

Comments (none posted)

netscape-flash: buffer overflow

Package(s):	netscape-flash	CVE #(s):
Created:	March 10, 2003	Updated:	June 20, 2003
Description:	Potentially exploitable buffer overflows exist in the Macromedia Flash Player. The full advisory is here. "The cumulative security patch is available today and addresses the potential for exploits surrounding buffer overflows (read/write) and sandbox integrity within the player, which might allow malicious users to gain access to a user's computer. The possibility of running native code on a users machine is a theoretical exploit, and extremely difficult to execute in practice. There are no known examples of running such native code from Macromedia Flash movies; however, even though this issue is difficult and theoretical in nature only, we are encouraging users to upgrade."
Alerts:	Red Hat RHSA-2003:026-01 2003-06-20 Gentoo 200303-9 2003-03-09

Comments (none posted)

net-snmp: denial of service vulnerability

Package(s):	net-snmp	CVE #(s):	CAN-2002-1170
Created:	December 17, 2002	Updated:	November 7, 2003
Description:	The SNMP daemon included in the Net-SNMP package versions 5.0.1 through 5.0.4 can be caused to crash if it is sent a specially crafted packet.
Alerts:	Conectiva CLA-2003:778 2003-11-07 Red Hat RHSA-2002:228-11 2002-12-17

Comments (none posted)

openssl: local and remote extraction of RSA private key

Package(s):	openssl, apache, mod_ssl	CVE #(s):	CAN-2003-0147
Created:	March 18, 2003	Updated:	May 22, 2003
Description:	David Brumley and Dan Boneh of Stanford University have researched and documented a timing attack on OpenSSL which allows local and remote attackers to extract the RSA private key of a server. The OpenSSL RSA implementation is generally vulnerable to these type of attacks unless RSA blinding has been turned on. See this paper (pdf format) for additional details. Typically, RSA blinding is not enabled by OpenSSL based applications, mainly because it is not obvious how to do so when using OpenSSL to provide SSL/TLS. This problem affects mostly all applications using OpenSSL and have to be rebuilded against the fixed OpenSSL version (where RSA blinding is now enabled by default) or have to enable RSA blinding explicitly their own. The performance impact of RSA blinding appears to be small (a few percent only) and the RSA functionality is still fully compatible. The Common Vulnerabilities and Exposures (CVE) project assigned the id CAN-2003-0147 to the problem.
Alerts:	Slackware ssa:2003-141-05 2003-05-22 Debian DSA-288-1 2003-04-17 Conectiva CLA-2003:625 2003-04-10 SuSE SuSE-SA:2003:024 2003-04-04 Red Hat RHSA-2003:101-01 2003-04-01 Immunix IMNX-2003-7+-001-01 2003-03-26 Trustix 2003-0013 2003-03-26 Mandrake MDKSA-2003:035 2003-03-25 Gentoo 200303-24 2003-03-25 Gentoo 200303-23 2003-03-25 Gentoo 200303-20 2003-03-24 SCO Group CSSA-2003-014.0 2003-03-21 Sorcerer SORCERER2003-03-21-0 2003-03-21 OpenPKG OpenPKG-SA-2003.026 2003-03-20 EnGarde ESA-20030320-010 2003-03-20 Gentoo 200303-15 2003-03-20 Trustix 2003-0010 2003-03-18 OpenPKG OpenPKG-SA-2003.020 2003-03-18 OpenPKG OpenPKG-SA-2003.019 2003-03-18

Comments (none posted)

pam_xauth: root exploit

Package(s):	pam_xauth	CVE #(s):	CAN-2002-1160
Created:	February 13, 2003	Updated:	July 10, 2003
Description:	The pam_xauth module is used to forward xauth information from user to user in applications such as 'su'. Andreas Beck discovered that versions of pam_xauth supplied with Red Hat Linux since version 7.1 would forward authorization information from the root account to unprivileged users. This could be used by a local attacker to gain access to an administrator's X session. In order to exploit this vulnerability, the attacker would have to get the administrator, as root, to use su to the account belonging to the attacker.
Alerts:	Conectiva CLA-2003:693 2003-07-10 Mandrake MDKSA-2003:017-1 2003-04-28 Red Hat RHSA-2003:035-10 2003-02-12

Comments (none posted)

PHP: vulnerability in mail function

Package(s):	php	CVE #(s):	CAN-2002-0985 CAN-2002-0986
Created:	November 13, 2002	Updated:	October 1, 2003
Description:	Two vulnerabilities exists in the mail() PHP function. The first one allows the execution of any program/script bypassing safe_mode restriction, the second one may give an open-relay script if the mail() function is not carefully used in PHP scripts. See this Bugtraq report for more details. Note that this is a different vulnerability than the previous PHP mail() problem, which affected versions through 4.1.0. CAN-2002-0985 CAN-2002-0986
Alerts:	SCO Group CSSA-2003-008.0 2003-03-04 Gentoo 200211-005 2002-11-20 EnGarde ESA-20021122-031 2002-11-22 Conectiva CLA-2002:545 2002-11-13 Red Hat RHSA-2002:213-06 2002-11-11

Comments (none posted)

PostgreSQL - more buffer overflows

Package(s):	postgresql	CVE #(s):
Created:	February 12, 2003	Updated:	November 7, 2003
Description:	A new set of buffer overflows has been discovered in PostgreSQL 7.2.2; they affect the circle_poly(), path_encode(), and path_addr() functions. Exploiting these overflows requires that the attacker first obtain a connection to the PostgreSQL server.
Alerts:	Debian DSA-397-1 2003-11-07 Immunix IMNX-2003-7+-005-01 2003-04-08 Trustix 2003-0004 2003-02-20 Mandrake MDKSA-2002:062-1 2003-02-11

Comments (1 posted)

Local arbitrary code execution vulnerability in Python

Package(s):	python	CVE #(s):	CAN-2002-1119
Created:	August 28, 2002	Updated:	October 1, 2003
Description:	Zack Weinberg discovered that os._execvpe from os.py uses a predictable name which could lead to execution of arbitrary code. According to the Debian advisory, the problem was present in Python versions 1.5, 2.1 and 2.2. CAN-2002-1119
Alerts:	Red Hat RHSA-2002:202-33 2003-02-12 OpenPKG OpenPKG-SA-2003.006 2003-01-23 Red Hat RHSA-2002:202-25 2003-01-21 Mandrake MDKSA-2002:082-1 2002-12-09 Mandrake MDKSA-2002:082 2002-11-25 SCO Group CSSA-2002-045.0 2002-11-14 Trustix 2002-0073 2002-10-17 Gentoo python-20021003 2002-10-03 Conectiva CLA-2002:527 2002-10-01 Debian DSA-159-2 2002-09-09 Debian DSA-159-1 2002-08-28

Comments (none posted)

qpopper - buffer overflow

Package(s):	qpopper	CVE #(s):	CAN-2003-0143
Created:	March 12, 2003	Updated:	March 21, 2003
Description:	As reported in this advisory, qpopper 4.0.x contains a buffer overflow vulnerability which may be exploited remotely - but only by an attacker possessing a valid username and password.
Alerts:	SuSE SuSE-SA:2003:018 2003-03-21 Gentoo 200303-12 2003-03-17 OpenPKG OpenPKG-SA-2003.018 2003-03-14 Debian DSA-259-1 2003-03-12

Comments (none posted)

rxvt - vulnerabilities in the handling of escape sequences

Package(s):	rxvt	CVE #(s):	CAN-2003-0022 CAN-2003-0023 CAN-2003-0066
Created:	March 17, 2003	Updated:	March 26, 2003
Description:	Rxvt is a color VT102 terminal emulator for the X Window System. A number of issues have been found in the escape sequence handling of Rxvt. These could be potentially exploited if an attacker can cause carefully crafted escape sequences to be displayed on a rxvt terminal being used by their victim. One of the features which most terminal emulators support is the ability for the shell to set the title of the window using an escape sequence. Certain xterm variants, including rxvt, also provide an escape sequence for reporting the current window title. This essentially takes the current title and places it directly on the command line. Since it is not possible to embed a carriage return into the window title itself, the attacker would have to convince the victim to hit enter for it to process the title as a command, although the attacker can perform a number of actions to increase the likelyhood of this happening. The "screen dump" feature in rxvt 2.7.8 allows attackers to overwrite arbitrary files via a certain character escape sequence when it is echoed to a user's terminal, e.g. when the user views a file containing the malicious sequence. The menuBar feature in rxvt 2.7.8 allows attackers to modify menu options and execute arbitrary commands via a certain character escape sequence that inserts the commands into the menu. Users of Rxvt are advised to upgrade to these errata packages which contain a patch to disable the title reporting functionality and patches to correct the other issues.
Alerts:	Mandrake MDKSA-2003:034 2003-03-25 Gentoo 200303-16 2003-03-20 Red Hat RHSA-2003:054-00 2003-03-17

Comments (none posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

samba - exploitable buffer overruns

Package(s):	samba	CVE #(s):	CAN-2003-0085 CAN-2003-0086
Created:	March 17, 2003	Updated:	April 4, 2003
Description:	The SuSE security audit team, in particular Sebastian Krahmer has found a flaw in the Samba main smbd code which could allow an external attacker to remotely and anonymously gain Super User (root) privileges on a server running a Samba server. This flaw exists in previous versions of Samba from 2.0.x to 2.2.7a inclusive. This is a serious problem and all sites should either upgrade to Samba 2.2.8 immediately or prohibit access to TCP ports 139 and 445. Advice created by Andrew Tridgell, the leader of the Samba Team, on how to protect an unpatched Samba server is given at the end of this section. The SMB/CIFS protocol implemented by Samba is vulnerable to many attacks, even without specific security holes. The TCP ports 139 and the new port 445 (used by Win2k and the Samba 3.0 alpha code in particular) should never be exposed to untrusted networks. See this article for more information. Samba-TNG users should update to version 0.3.1.
Alerts:	Conectiva CLA-2003:615 2003-04-04 Immunix IMNX-2003-7+-003-01 2003-03-31 Red Hat RHSA-2003:095-03 2003-04-01 Red Hat RHSA-2003:095-02 2003-03-25 SuSE SuSE-SA:2003:016 2003-03-19 Trustix 2003-0011 2003-03-18 Red Hat RHSA-2003:095-01 2003-03-17 OpenPKG OpenPKG-SA-2003.021 2003-03-18 Sorcerer SORCERER2003-03-17 2003-03-17 Gentoo 200303-11 2003-03-17 Slackware sl-1047827401 2003-03-16 Mandrake MDKSA-2003:032 2003-03-15 Debian DSA-262-1 2003-03-15

Comments (none posted)

slocate - buffer overflow

Package(s):	slocate	CVE #(s):	CAN-2003-0056
Created:	February 5, 2003	Updated:	May 8, 2003
Description:	version 2.6 (at least) of slocate contains a buffer overflow vulnerability which could lead to a local exploit; see this advisory for the details.
Alerts:	Conectiva CLA-2003:643 2003-05-08 SCO Group CSSA-2003-009.0 2003-03-06 Debian DSA-252-1 2003-02-21 Mandrake MDKSA-2003:015 2003-02-05 Gentoo 200302-02 2003-02-02

Comments (none posted)

snort - buffer overflow

Package(s):	snort	CVE #(s):	CAN-2003-0033
Created:	March 5, 2003	Updated:	April 4, 2003
Description:	A buffer overflow in the snort intrusion detection system can lead to remote code execution and/or disabling of intrusion detection. The 1.9.1 release fixes the problem. See this advisory for more information.
Alerts:	Conectiva CLA-2003:613 2003-04-04 Sorcerer SORCERER2003-03-06-1 2003-03-06 EnGarde ESA-20030307-007 2003-03-07 Mandrake MDKSA-2003:029 2003-03-06 Gentoo 200303-6 2003-03-06

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tcpdump - infinite loop

Package(s):	tcpdump	CVE #(s):	CAN-2003-0108
Created:	February 28, 2003	Updated:	May 1, 2003
Description:	Andrew Griffiths and iDEFENSE Labs discovered a problem in tcpdump, a powerful tool for network monitoring and data acquisition. An attacker is able to send a specially crafted network packet which causes tcpdump to enter an infinite loop. In addition to the above problem the tcpdump developers discovered a potential infinite loop when parsing malformed BGP packets. They also discovered a buffer overflow that can be exploited with certain malformed NFS packets.
Alerts:	EnGarde ESA-20030430-014 2003-04-30 Red Hat RHSA-2003:032-01 2003-04-23 Conectiva CLA-2003:629 2003-04-22 Debian DSA-261-1 2003-03-14 SuSE SuSE-SA:2003:0015 2003-03-13 Gentoo 200303-5 2003-03-05 OpenPKG OpenPKG-SA-2003.014 2003-03-04 Mandrake MDKSA-2003:027 2003-03-03 Debian DSA-255-1 2003-02-27

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

typespeed: buffer overflow

Package(s):	typespeed	CVE #(s):
Created:	January 1, 2003	Updated:	June 17, 2003
Description:	A problem has been discovered in the typespeed, a game that lets you measure your typematic speed. By overflowing a buffer a local attacker could execute arbitrary commands under the group id games.
Alerts:	Debian DSA-322-1 2003-06-16 Debian DSA-217-1 2002-12-27

Comments (none posted)

vim - modeline vulnerability

Package(s):	vim	CVE #(s):	CAN-2002-1377
Created:	January 16, 2003	Updated:	February 10, 2004
Description:	VIM allows a user to set the modeline differently for each edited text file by placing special comments in the files. Georgi Guninski found that these comments can be carefully crafted in order to call external programs. This could allow an attacker to create a text file such that when it is opened arbitrary commands are executed.
Alerts:	Conectiva CLA-2004:812 2004-02-10 Mandrake MDKSA-2003:012 2003-02-03 Yellow Dog YDU-20030127-3 2003-01-27 Gentoo 200301-13 2003-01-22 OpenPKG OpenPKG-SA-2003.003 2003-01-21 Red Hat RHSA-2002:297-17 2003-01-15

Comments (4 posted)

vnc - replay and cookie vulnerabilities

Package(s):	vnc	CVE #(s):	CAN-2002-1336 CAN-2002-1511
Created:	February 21, 2003	Updated:	May 5, 2003
Description:	VNC is a tool for providing a remote graphical user interface. Two vulnerabilities have been found in versions of VNC shipped by Red Hat. The VNC server acts as an X server, but the script for starting it generates an MIT X cookie (which is used for X authentication) without using a strong enough random number generator. This could allow an attacker to be able to more easily guess the authentication cookie. The VNC DES authentication scheme is implemented using a challenge-response architecture, producing a random and different challenge for each authentication attempt. A bug in the function for generating the random challenge caused the random seed to get reset to the current time on every authentication attempt. Therefore, two authentication attempts within the same second could receive the same challenge. An eavesdropper could exploit this vulnerability by replaying the response, thereby gaining authentication. All users of VNC are advised to upgrade to these erratum packages, which contain patches to correct these issues.
Alerts:	Conectiva CLA-2003:640 2003-05-05 Mandrake MDKSA-2003:022 2003-02-24 Gentoo 200302-16 2003-02-24 Gentoo 200302-15 2003-02-24 Red Hat RHSA-2003:041-12 2003-02-20

Comments (none posted)

eterm, vte: dangerous interception of escape sequences

Package(s):	vte, eterm	CVE #(s):	CAN-2003-0021 CAN-2003-0068 CAN-2003-0070
Created:	March 3, 2003	Updated:	April 1, 2003
Description:	From the advisory: "Many of the features supported by popular terminal emulator software can be abused when un-trusted data is displayed on the screen. The impact of this abuse can range from annoying screen garbage to a complete system compromise. All of the issues below are actually documented features, anyone who takes the time to read over the man pages or source code could use them to carry out an attack."
Alerts:	Mandrake MDKSA-2003:040 2003-04-01 Gentoo 200303-1 2003-03-03 Gentoo 200303-2 2003-03-03

Comments (none posted)

wget:directory traversal bug

Package(s):	wget	CVE #(s):	CAN-2002-1344
Created:	December 10, 2002	Updated:	October 1, 2003
Description:	Versions of wget prior to 1.8.2-4 contain a bug that permits a malicious FTP server to create or overwrite files anywhere on the local file system. FTP clients must check to see if an FTP server's response to the NLST command includes any directory information along with the list of filenames required by the FTP protocol (RFC 959, section 4.1.3). If the FTP client fails to do so, a malicious FTP server can send filenames beginning with '/' or containing '/../' which can be used to direct a vulnerable FTP client to write files (such as .forward, .rhosts, .shosts, etc.) that can then be used for later attacks against the client machine. See also this Bugtraq article from 1997. CAN-2002-1344
Alerts:	Immunix IMNX-2003-7+-011-01 2003-06-03 OpenPKG OpenPKG-SA-2003.007 2003-01-23 SCO Group CSSA-2003-003.0 2003-01-16 Gentoo 200212-7 2002-12-20 Trustix 2002-0089 2002-12-19 Conectiva CLA-2002:552 2002-12-13 Debian DSA-209-1 2002-12-12 Mandrake MDKSA-2002:086 2002-12-11 Red Hat RHSA-2002:229-10 2002-12-04

Comments (none posted)

Problems with libgtop_daemon

Package(s):	wuftpd libgtop	CVE #(s):
Created:	May 21, 2002	Updated:	May 7, 2003
Description:	The libgtop_daemon package is a GNOME program which makes system information available remotely. LWN reported the remotely exploitable format string and buffer overflow vulnerabilities in that package on December 6th. On November 28th disabling the libgtop_daemon on systems where it is running until an update is available. Many Linux systems do not run libgtop by default, but applying the update is a good idea anyway.
Alerts:	Debian DSA-301-1 2003-05-07 Mandrake MDKSA-2001:094 2001-12-19 Debian DSA-098-1 2002-01-09 Conectiva CLA-2002:448 2002-01-03

Comments (1 posted)

Wwwoffle remote privilege escalation vulnerability

Package(s):	wwwoffle	CVE #(s):	CAN-2002-0818
Created:	August 14, 2002	Updated:	October 1, 2003
Description:	The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests with negative Content Length values. "It is believed that an attacker could exploit this bug to gain remote wwwrun access to the system wwwoffled is running on." CAN-2002-0818
Alerts:	SCO Group CSSA-2002-048.0 2002-11-18 Debian DSA-144-1 2002-08-06 SuSE SuSE-SA:2002:029 2002-08-01

Comments (none posted)

zlib 1.1.4 has buffer overrun

Package(s):	zlib	CVE #(s):	CAN-2003-0107
Created:	February 25, 2003	Updated:	April 29, 2003
Description:	From this Bugtraq posting: "zlib contains a function called gzprintf(). This is similar in behaviour to fprintf() except that by default, this function will smash the stack if called with arguments that expand to more than Z_PRINTF_BUFSIZE (=4096 by default) bytes."
Alerts:	Red Hat RHSA-2003:079-01 2003-04-29 Conectiva CLA-2003:619 2003-04-07 Gentoo 200303-25 2003-03-28 Mandrake MDKSA-2003:033 2003-03-18 SCO Group CSSA-2003-011.0 2003-03-10 OpenPKG OpenPKG-SA-2003.015 2003-03-04 Sorcerer SORCERER2003-08-25 2003-02-25

Comments (none posted)

Resources

CERT Quarterly Summary

CERT has sent out its quarterly summary listing the vulnerabilities that it sees being most frequently exploited. Along with a number of Windows issues, this summary lists the sendmail buffer overflow, the Samba vulnerability, and the CVS and SSH bugs.

Full Story (comments: none)

Stopping DDOS Attacks (Linux Journal)

The Linux Journal has an article on dealing with distributed denial of service attacks. "What about getting the Feds involved? In the GRC.com case I mentioned above, the FBI was totally uninterested. Of course, this case occurred in May 2001. It seems that the new Department of Homeland Security is somewhat more interested in such things. Then again, this is the same outfit that sat on the recent Sendmail vulnerability for two+ months. Hackers everywhere are justifiably skeptical."

Comments (none posted)

Events

DEF CON 0x0b call for papers

The call for papers for DEF CON 0x0b has gone out. "We are also continuing to improve speaker quality. It is no longer enough to have green hair and an attitude."

Full Story (comments: none)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current development kernel is 2.5.66, which came out on March 24. This large patch contains a great many small fixes. It also has some more IDE changes, some ext3 performance improvements, the 32-bit dev_t preparatory patches (see last week's Kernel Page and below), more devfs chopping, the new sys_epoll() API (covered briefly here two weeks ago), a big framebuffer update, an ALSA update, and an XFS update. See Linus's announcement or the long-format changelog for the details.

Linus's BitKeeper repository contains an XFS update, a USB update, and a number of architecture updates (ARM, SPARC64, x86-64, PPC64).

The current prepatch from Alan Cox is 2.5.65-ac3, which adds another set of small fixes.

The current stable kernel is 2.4.20; Marcelo tried to catch us by releasing 2.4.21-pre6 late on Wednesday, but we're on to him. This release contains many fixes of course (including a large set from the -ac tree and the ptrace() fix) and some architecture updates. The first 2.4.21 release candidate is apparently coming soon.

There has been some significant disagreement over whether 2.4.21 should be rushed out with the fix for the ptrace() vulnerability. Numerous people, it is said, run kernels obtained from kernel.org, but do not follow the mailing list closely enough to pick up needed security patches. Rather than leave those people vulnerable, a new release (containing, perhaps, only the security fix) should be made available as soon as possible. On the other side, it is argued that distributors have made patched kernels available, and anybody who is concerned can patch their kernels themselves.

The apparent resolution is that there will not be an expedited 2.4.21 release with the fix. Certainly no such kernel has been released; Marcelo has been completely silent on the matter.

Comments (11 posted)

Kernel development news

Toward a larger dev_t

The 2.5.66 kernel includes Andries Brouwer's patches clearing the path for an expansion of the dev_t device number type. A small number of problems have been found, but the changes are working for most people. Andrew Morton has gone a little further and actually changed dev_t to 32-bits in his -mm tree; predictably, the number of problems found there has been a little higher. As a whole, though, the transition appears to be going relatively smoothly.

Badari Pulavarty decided that it was time to play with the possibilities of a larger device number type; he posted this patch which makes the SCSI disk driver make full use of the expanded minor number range. Testing with 4000 virtual disks, with 50 real drives at the end of the range, worked - for the most part. Some scaling problems did turn up, however.

The most significant one appears to be in the request queue mechanism. When the kernel wants to issue a block I/O request, the block subsystem needs to be able to set it up quickly. In particular, memory allocations are best avoided at that point; it's possible that the system is out of memory and the kernel is doing I/O in an attempt to free up some space. Trying to allocate memory at that point can lead to deadlocks. So the block subsystem sets aside a number of pre-allocated request structures for every request queue (and there is typically one request queue for each physical drive in the system). That number varies depending on the amount of memory on the system; it can be as low as 32, and as high as 256. Request structures run about 144 bytes each. So, if one assumes that a system hosting 4000 disks really should be equipped with a fair amount of memory, the block subsystem will set aside about a million request structures, at a cost of about 150MB. And that is just the beginning; the deadline I/O scheduler augments each request structure with a separate deadline_rq structure. Other overheads exist as well.

The end result is that, when the number of disks gets large, a great deal of memory (which must all be in the low memory zone on 32-bit processors) gets tied up in request queues. As Andrew Morton pointed out, with 4000 disks, enough request structures have been allocated to represent 200GB of current I/O requests. That, perhaps, is a bit more than is really needed in most situations.

The solution, as hacked up by Jens Axboe, is to go to a more dynamic scheme for the allocation of request structures. The mempool mechanism is used to keep an absolute minimum number of request structures available for each queue; all the rest are allocated as needed and freed afterwards. This patch will probably go through a few more iterations, but the immediate scalability problem has been addressed.

Meanwhile, not everybody is entirely happy with the direction of the dev_t changes for char devices. In particular, Roman Zippel, who has apparently given up on getting the module changes backed out, has now posted a series of patches backing out the char device changes and substituting his approach. That approach includes maintaining the (currently unused) char device hashing scheme and getting rid of the new register_chrdev_region() function. There is, he claims, no particular need to split char minor number ranges into regions, as there is with block devices. Roman's patches have created some discussion, but there does not appear to be a great deal of pressure for a change in direction at this time.

There has also been a bit of discussion on how big the new dev_t should be. The plan has been to expand it to 32 bits; 12 for the major number, and 20 for the minor number. That is the way Linus has wanted to do it, but he recently has made noises about being open to the idea of making dev_t even larger. If dev_t were to go to 64 bits, with 32 each for major and minor numbers, there would be little need to worry about running out of device numbers for some time into the future. This decision may not be made for a while; once the work to support the dev_t expansion has been done, setting it to one size or another is a relatively simple task.

Comments (6 posted)

Various short topics

Discussion on linux-kernel this week touched on a number of topics that, while worth a mention, don't necessarily justify a full article of their own. Here's a few of them:

Deprecating the .gz format. Peter Anvin would like to get rid of the .gz files on kernel.org. The bzip2 format has been around for quite some time and is far more space efficient; it would seem that eliminating the older format would be relatively uncontroversial. Such is not the case, however; users protested that the bzip2 format is slower, is not supported on Windows, and so on. The end result is that the gzip files will remain for some time yet.

kbugs.org is now showing over 1400 potential bugs found with the rapidly-evolving smatch system. A number of these are real, and fixes are beginning to find their way into the mainline kernel.

The Stanford Checker team has also been posting errors; the latest set points out places where kernel code is directly dereferencing user-supplied pointers. That kind of mistake can lead to all kinds of problems, of course, including security issues. The discussion led to a suggestion that the kernel use a different type for user-space pointers, so that this kind error could be caught directly by the compiler. The idea makes some sense; kernel code currently does not formally distinguish between user-space, kernel-space, and physical address pointers. Clarifying the difference between them could catch a lot of mistakes. This sort of change seems unlikely at this point in 2.5, however.

The object-based reverse mapping VM patch was covered here back in February. The object-based rmap code does not work with anonymous memory (memory which is not mapped to a file somewhere), however, meaning that this memory must still be managed with PTE chains. Hugh Dickins has posted a new set of patches which extend the object-based approach to anonymous memory as well. The patch was included in the -mm tree for a while, and seems to work without trouble. The only problem is: it doesn't actually help performance very much. Most anonymous memory only shows up in one page table, so its PTE chain overhead is essentially zero. So this patch has been dropped, though useful pieces of it may eventually find their way into the tree.

The IDE todo list has been posted by Alan Cox. This list is important in that it affects most Linux users; it also documents some of the remaining tasks to be done on the way to a 2.6 release. There's a few drivers needing thorough audits (and some that don't work at all yet), more hotplug work, documentation, and a number of other tasks yet to be done.

SMP overhead and rwlocks. Andrew Morton has noted that a simple write test takes twice as long on an SMP system as on a uniprocessor system. The culprit, of course, is the extra locking overhead. Reader-writer locks (rwlocks) have been singled out as particular problem; it turns out that they are slower than regular spinlocks, and they tend to mask problems where locks are simply being held for too long. There is a chance that rwlocks will be removed before 2.6 comes out.

Comments (1 posted)

Driver porting

Driver porting: the BIO structure

This article is part of the LWN Porting Drivers to 2.6 series.

The block layer in 2.4 (and prior) kernels was organized around the buffer head data structure. The limits of buffer heads have long been clear, however. It is hard to create a truly high-performance block I/O subsystem when the underlying buffer head structure forces each I/O request to be split into 512-byte chunks. So one of the first items on the 2.5 block "todo" list was the creation of a way to represent block I/O requests that supported higher performance and greater flexibility. The result was the new BIO structure.

BIO basics

As with most real-world code, the BIO structure incorporates a fair number of tricky details. The core of the structure (as defined in <linux/bio.h>) is not that complicated, however; it is as appears in the diagram to the right. The BIO structure itself contains the usual collection of housekeeping information, along with a pointer (bi_io_vec) pointing to an array of bio_vec structures. This array represents the (possibly multiple) segments which make up this I/O request. There is also an index (bi_idx) giving an offset into the bi_io_vec array; we'll get into its use shortly.

The bio_vec structure itself has a simple definition:

    struct bio_vec {
	struct page	*bv_page;
	unsigned int	bv_len;
	unsigned int	bv_offset;
    };

As is increasingly the case with internal kernel data structures, the BIO now tracks data buffers using struct page pointers. There are some implications of this change for driver writers:

• Data buffers for block transfers can be anywhere - kernel or user space. The driver author need not be concerned about the ultimate source or destination of the data.

• These buffers could be in high memory, unless the driver author has explicitly requested that bounce buffers be used (Request Queues I covers how to do that). The driver author cannot count on the existence of a kernel-space mapping for the buffer unless one has been created explicitly.

• More than ever, block I/O operations are scatter/gather operations, with data coming from multiple, dispersed buffers.

At first glance, the BIO structure may seem more difficult to work with than the old buffer head, which provided a nice kernel virtual address for a single chunk of data. Working with BIOs is not hard, however.

Getting request information from a BIO

A driver author could use the information above (along with the other BIO fields) to get the needed information out of the structure without too much trouble. As a general rule, however, direct access to the bio_vec array is discouraged. A set of accessor routines has been provided which hides the details of how the BIO structure works and eases access to that structure. Use of these routines will make the driver author's job easier, and, with luck, will enable a driver to keep working in the face of future block I/O changes.

So how does one get request information from the BIO structure? The beginning sector for the entire BIO is in the bi_sector field - there is no accessor function for that. The total size of the operation is in bi_size (in bytes). One can also get the total size in sectors with:

    bio_sectors(struct bio *bio);

The function (macro, actually):

    int bio_data_dir(struct bio *bio);

returns either READ or WRITE, depending on what type of operation is encapsulated by this BIO.

Almost everything else requires working through the bio_vec array. The encouraged way of doing that is to use the special bio_for_each_segment macro:

    int segno;
    struct bio_vec *bvec;

    bio_for_each_segment(bvec, bio, segno) {
	/* Do something with this segment */
    }

Within the loop, the integer variable segno will be the current index into the array, and bvec will point to the current bio_vec structure. Usually the driver programmer need not use either variable; instead, a new set of macros is available for use within this sort of loop:

struct page *bio_page(struct bio *bio)

Returns a pointer to the current page structure.

int bio_offset(struct bio *bio)

Returns the offset within the current page for this operation. Block I/O operations are often page-aligned, but that is not always the case.

int bio_cur_sectors(struct bio *bio)

The number of sectors to transfer for this bio_vec.

char *bio_data(struct bio *bio)

Returns the kernel virtual address for the data buffer. Note that this address will only exist if the buffer is not in high memory.

char *bvec_kmap_irq(struct bio_vec *bvec, unsigned long *flags)

This function returns a kernel virtual address which can be used to access the data buffer pointed to by the given bio_vec entry; it also disables interrupts and returns an atomic kmap - so the driver should not sleep until bvec_kunmap_irq() has been called. Note that the flags argument is a pointer value, which is a departure for the usual convention for macros which disable interrupts.

void bvec_kunmap_irq(char *buffer, unsigned long *flags);

Undo a mapping which was created with bvec_kmap_irq().

char *bio_kmap_irq(struct bio *bio, unsigned long *flags);

This function is a wrapper around bvec_kmap_irq(); it returns a mapping for the current bio_vec entry in the given bio. There is, of course, a corresponding bio_kunmap_irq().

char *__bio_kmap_atomic(struct bio *bio, int i, enum km_type type)

Use kmap_atomic() to obtain a kernel virtual address for the i^th buffer in the bio; the kmap slot designated by type will be used.

void __bio_kunmap_atomic(char *addr, enum km_type type)

Return a kernel virtual address obtained with __bio_kmap_atomic().

A little detail which is worth noting: all of bio_data(), bvec_kmap_irq(), and bio_kmap_irq() add the segment offset (bio_offset(bio)) to the address before returning it. It is tempting to add the offset separately, but that is an error which leads to weird problems. Trust me.

Completing I/O

Given the information from the BIO, each block driver should be able to arrange a transfer to or from its particular device. Note that a helper function (blk_rq_map_sg()) exists which makes it easy to set up DMA scatter/gather lists from a block request; we'll get into that when we look at request queue management.

When the operation is complete, the driver must inform the block subsystem of that fact. That is done with bio_endio():

    void bio_endio(struct bio *bio, unsigned int nbytes, int error);

Here, bio is the BIO of interest, nbytes is the number of bytes actually transferred, and error indicates the status of the operation; it should be zero for a successful transfer, and a negative error code otherwise.

Other BIO details

The bi_private field in the BIO structure is not used by the block subsystem, and is available for the owner of the structure to use. Drivers do not own BIOs passed in to their request function and should not touch bi_private there. If your driver creates its own BIO structures (using the functions listed below, usually), then the bi_private field in those BIOs is available to it.

As mentioned above, the bi_idx BIO field is an index into the bi_io_vec array. This index is maintained for a couple of reasons. One is that it can be used to keep track of partially-complete operations. But this field (along with bi_vcnt, which says how many bio_vec entries are to be processed) can also be used to split a BIO into multiple chunks. Using this facility, a RAID or volume manager driver can "clone" a BIO into multiple structures all pointing at different parts of the bio_vec array. The operation is quick and efficient, and allows a large operation to be quickly dispatched across a number of physical drives.

To clone a BIO in this way, use:

    struct bio *bio_clone(struct bio *bio, int gfp_mask);

bio_clone() creates a second BIO pointing to the same bio_vec array as the original. This function uses the given gfp_mask when allocating memory.

BIO structures contain reference counts; the structure is released when the reference count hits zero. Drivers normally need not manipulate BIO reference counts, but, should the need arise, functions exist in the usual form:

    void bio_get(struct bio *bio);
    void bio_put(struct bio *bio);

Numerous other functions exist for working with BIO structures; most of the functions not covered here are involved with creating BIOs. More information can be found in <linux/bio.h> and block/biodoc.txt in the kernel documentation directory.

Comments (15 posted)

Patches and updates

Kernel trees

• Linus Torvalds: Linux 2.5.66. (March 24, 2003)

• Andrew Morton: 2.5.66-mm1. (March 26, 2003)

• Alan Cox: Linux 2.5.65-ac2. (March 21, 2003)

• Alan Cox: Linux 2.5.65-ac3. (March 23, 2003)

• Andrew Morton: 2.5.65-mm3. (March 21, 2003)

• Andrew Morton: 2.5.65-mm4. (March 23, 2003)

• Stephen Hemminger: 2.5.65-osdl1. (March 25, 2003)

• Martin J. Bligh: 2.5.64-mjb2 (scalability / NUMA patchset). (March 24, 2003)

• Marcelo Tosatti: Linux 2.4.21-pre6. (March 27, 2003)

• J.A. Magallon: Linux-2.4.21-pre5-jam1. (March 24, 2003)

Build system

• Randy.Dunlap: in-kernel config for 2.5.65. (March 21, 2003)

Core kernel code

• Roman Zippel: alternative dev patch. (March 21, 2003)

• Roman Zippel: revert register_chrdev_region change. (March 24, 2003)

• Roman Zippel: restore character device hash. (March 24, 2003)

• Roman Zippel: remove character device array. (March 24, 2003)

• Andries.Brouwer@cwi.nl: 64-bit kdev_t - just for playing. (March 27, 2003)

• Ingo Molnar: sched-2.5.66-A2, scheduler enhancements. (March 25, 2003)

• Andy Pfiffer: kexec for 2.5.66 available. (March 26, 2003)

• Rusty Russell: __try_module_get(). (March 26, 2003)

• john stultz: linux-2.5.66_monotonic-clock_A2. (March 26, 2003)

Development tools

• Keith Owens: Announce: ksymoops 2.4.9 is available. (March 21, 2003)

• Robert Williamson: Mid-month LTP release made.. (March 22, 2003)

• John Levon: Module load notification take 3. (March 25, 2003)

• John Levon: Module load notification take 3. (March 25, 2003)

• Selbak, Rolla N: Open POSIX Test Suite 0.9.0. (March 25, 2003)

Device drivers

• Adam J. Richter: small devfs patch for 2.5.65, plan to replace /sbin/hotplug. (March 21, 2003)

• James Simmons: Frmaebuffer updates.. (March 23, 2003)

• mikpe@csd.uu.se: perfctr-2.5.1 released. (March 23, 2003)

• Greg KH: USB changes for 2.5.66. (March 26, 2003)

• Adam Belay: PnP Changes for 2.5.66. (March 26, 2003)

Filesystems and block I/O

• Florin Malita: LUFS (Linux Userland File System) 0.9.5 released. (March 24, 2003)

• Badari Pulavarty: 2.5.65 patch to support > 256 disks. (March 25, 2003)

• Jens Axboe: Dynamic block request allocation. (March 26, 2003)

• Dave Kleikamp: JFS 1.1.2. (March 26, 2003)

Memory management

• William Lee Irwin III: pgcl-2.5.65-2. (March 21, 2003)

• William Lee Irwin III: pgcl-2.5.66-1. (March 25, 2003)

• Hugh Dickins: anobjrmap 1/6 rmap.h. (March 21, 2003)

• Hugh Dickins: anobjrmap 2/6 mapping. (March 21, 2003)

• Hugh Dickins: anobjrmap 3/6 unchained. (March 21, 2003)

• Hugh Dickins: anobjrmap 4/6 anonmm. (March 21, 2003)

• Hugh Dickins: anobjrmap 5/6 rechained. (March 21, 2003)

• Hugh Dickins: anobjrmap 6/6 arches. (March 21, 2003)

Architecture-specific

• Andries.Brouwer@cwi.nl: - struct stat - Attention all arch maintainers. (March 24, 2003)

Security-related

• Jari Ruusu: Announce loop-AES-v1.7c file/swap crypto package. (March 26, 2003)

Benchmarks and bugs

• Sowmya Adiga: AIM9 benchmark result for kernel 2.5.65. (March 21, 2003)

• Sowmya Adiga: unixbench result for kernel 2.5.65. (March 21, 2003)

• Con Kolivas: 2.5.65-mm3,4 with contest. (March 24, 2003)

Miscellaneous

• Matthias Andree: lk-changelog.pl 0.83. (March 21, 2003)

• Matthias Andree: lk-changelog.pl 0.85. (March 26, 2003)

• Alan Cox: IDE todo list. (March 22, 2003)

• Keith Owens: Announce: modutils 2.4.24 is available. (March 23, 2003)

Page editor: Jonathan Corbet

Distributions

News and Editorials

The Significance of Red Hat Linux 9

[This article was contributed by Ladislav Bodnar]

The announcement from Red Hat about the upcoming release of Red Hat Linux 9 has caught many by surprise. In the past, Red Hat, Inc has stubbornly refused to pre-announce any release, whether final or development, giving all who inquired the usual "released when ready" talk. The version number was also unexpected as many had thought that this release would be labeled 8.1 rather than 9.

At first glance these changes might seem insignificant. But a closer look reveals that there are reasons why they come into effect at this point in time and some of these changes will have substantial impact on enterprises.

Firstly, let's look at the significance of that "9". Of all Linux distributions out there, Red Hat is the only one that maintains a technically and logically justified versioning scheme, as opposed to a scheme driven by marketing. Historically, Red Hat only increased the major version number if the new release broke binary compatibility with the previous one. The binary compatibility was, to a large extent, defined by the the glibc library and if we look at the last few years' worth of releases, we will see that Red Hat 6 series shipped with glibc 2.1.x, Red Hat 7 series with glibc 2.2.x and Red Hat 8.0 with a pre-release version of glibc 2.3.

Red Hat 9 will ship with glibc 2.3.2. However, there is something else that breaks the binary compatibility in this case and that something is called NPTL (Native POSIX Thread Library). What is NPTL? A comprehensive white paper (in PDF format) explains all the technical details, but in layman's terms, NPTL is a much improved new library for threading of processes which takes into account capabilities of modern processors. This library, developed by Red Hat, is designed to replace the existing library written back in 1996. (See also LWN's coverage of NTPL from last September).

As a result of introducing NPTL, many applications compatible with previous Red Hat releases will no longer work on Red Hat Linux 9. Some of the implications are explained in this mailing list post. The poster (Red Hat's Matt Wilson) also points out another interesting fact: the Enterprise Linux series of products has freed the company to put newer technology into the base "Red Hat Linux" distribution. Red Hat Linux is starting to look like the final proving ground before software moves into the (more stable) Enterprise distributions.

Also note the missing ".0" from the version number. This has possibly something to do with market perception (whether it is correct or not is a different matter) that x.0 releases are generally buggy and unsuitable for deployment on servers. Whatever the meaning, this is not a new tactic for Red Hat; Red Hat Linux 7 also lacked a ".0".

The quick succession of major number releases was noted by many Red Hat Certified Engineers (RHCE). Up until now the validity of the rather pricey, but highly valued RHCE certificates was limited to two major releases. Red Hat was quick to react with a policy change: "The validity period for all RHCEs and RHCTs is now officially pegged to the release of the Enterprise product commercially available at the time certification was earned, and certification shall be current until after one (1) major release of the Enterprise product." More details are available here.

All these changes, together with the recently announced restrictions on free access to Red Hat Networks and reduction of support periods are designed with one goal in mind: to increase Red Hat's revenue. Despite some voices of criticism, one cannot blame the company. Red Hat Linux has become the dominant Linux OS on servers and there are possibly thousands of enterprises around the world that use Red Hat's products without ever paying a single cent to Red Hat. The time has come to collect the toll.

As Red Hat tightens the screws, the small and medium enterprises with limited IT budgets -- especially in the current economic climate -- are the ones that are being affected and might even re-evaluate their needs. But do they have alternatives? After all, there are so many Linux distributions, so why use Red Hat? The awful truth is that, for many customers, the alternatives are not particularly appealing. Mandrake and SuSE, despite their ranges of enterprise products, are still perceived as distributions for desktops. Slackware's total lack of interest and ability to market and provide commercial support for their otherwise excellent server product leaves it as a viable choice only for experienced Linux enthusiasts, rather than medium-skilled system administrators. The only other alternative is Debian. But for Debian to make inroads into server rooms, corporations would have to learn to live with a product made by volunteers in their spare time, without any commercial interests. And that's something that is unlikely to happen on a large scale.

Comments (16 posted)

Distribution News

Debian GNU/Linux

The March 25 issue of the Debian Weekly News is out; it looks at the Project Leader election, Trusted Debian, live filesystem CDs, and several other topics.

Debian Planet looks at the Debian Desktop User's Guide, a project to bring up-to-date and effective documentation to new Debian users.

In this Linux Journal article, the author installs and configures Debian's sid (unstable) on his laptop. "Debian has a reputation for being difficult to install. Although this is not necessarily true, Debian's installer is a far cry from the fully automated installers of distributions such as Mandrake and Red Hat. However, there is a benefit to your extra labor: much more control of how the system is laid out, which packages are installed and which kernel features are enabled or disabled. This gives you the freedom to have a system completely tailored to your specific needs."

Debian Planet covers MiniWoody, a modified and updated version of the Debian Woody 3.0 release in order to fit on the confines of a 180MB CD.

A new version of Debian Developer's Packages Overview has been announced. The new version fixes most of the opened bugs and provides many new features.

Comments (none posted)

Mandrake Linux

MandrakeSoft has announced the release of Mandrake Linux 9.1. There's lots of new stuff, of course, including yet another simplified graphical installer, the "MandrakeGalaxy" theme, Apache 2, and more.

The ext2/ext3 partition format in Mandrake Linux 9.1 is not compatible with older Mandrake Linux releases, so new packages are available for some older distributions so that, for example, a 9.0 system can mount a 9.1-formatted ext2 or ext3 partition.

Comments (none posted)

Red Hat Linux 9 announced

Members of the Red Hat Network have been notified that they will be able to download Red Hat Linux 9 ISOs beginning March 31, 2003. The new version should be in stores the week after that.

Comments (18 posted)

SuSE Linux Ships its First Server Product for Intel Itanium 2 Processors

SuSE Linux Enterprise Server 8 for the Intel Itanium Processor Family will be available by the end of March and has been choosen to drive parts of the scientific computing system "TeraGrid" accessible to thousands of scientists across the USA.

Full Story (comments: none)

Gentoo Weekly Newsletter -- Volume 2, Issue 12

The Gentoo Weekly Newsletter for the week of March 24, 2003 is out. Topics this week: How to become a Gentoo developer; Changes in the way Gentoo Linux supports CFLAGS; and errata from last week's issue.

Full Story (comments: none)

Desktop/LX Deluxe Garners Highly Commended Award from PCW Magazine

The Lycoris Team recieved a 'Highly Commended' award from Personal Computer World Magazine for Desktop/LX. PCW gave Desktop/LX Deluxe a four out of five star overall rating and called the operating system "easy to install, accessible and well configured."

Full Story (comments: none)

GNU-Darwin anti-war blackout continues

GNU Darwin has blacked out its home page in protest of a U.S. invasion of Iraq. Paradoxically they have experienced a surge in subscription proceeds and CDR sales.

Full Story (comments: none)

New Distributions

Damn Small Linux

Damn Small Linux is a business card size (50MB) Linux distribution based on Knoppix. Despite its miniscule size it strives to have a functional and easy to use desktop. The initial freshmeat announcement for version 0.1 was released March 19, 2003.

Comments (none posted)

LinuxConsole

LinuxConsole is live Linux CD that can be used to plays games, music, videos, browse the Web, disks, burn CDs and more.

Full Story (comments: none)

Minor distribution updates

CRUX

CRUX has released v1.1 with minor feature enhancements. "Changes: Basic support for IPv6 was added. A kernel ptrace security patch was added. Pkgconfig and freetype2 packages were added. About 50 other packages were updated, such as XFree86 4.3, Glibc 2.3.2, GCC 3.2.2, and Mozilla 1.3."

Comments (none posted)

DeLi Linux

DeLi Linux has released v0.2 with minor bugfixes. "Changes: Kernel 2.2.25 has been added, and some bugfixes in the base package were made. There is a slightl reorganization of the base package. Some packages were upgraded, such as dillo 0.7 and GNU Ghostscript 7.05."

Comments (none posted)

KNOPPIX

KNOPPIX has released v3.2-2003-03-21 with major feature enhancements. "Changes: The Samba, Mozilla, IceWM, larswm, Kismet, Evolution, fontconfig, gnome-pilot, cpuburn, dvd+rw-tools, and OpenOffice packages were updated. KDE 3.1 was included, bugfixes were made, and some of the older games and packages were cleaned up."

Comments (none posted)

LinuxInstall.org

The LinuxInstall.org Project has released v3.0rc2. "Changes: This release features the 2.4.18-27.8.0 kernel with NTFS support, 31 security updates, Mozilla 1.3.0, Evolution 1.2.3, the complete set of Red Hat 8.0 manuals in HTML, Acrobat Reader 5.06 with a Mozilla plugin, Real Player 8.0 with a Mozilla plugin, Flash Player 6.0.79 with a Mozilla plugin, the Microsoft TrueType Core Fonts for Web, Xmms 1.2.7, Xine 0.9.19 with libdvdcss, and a dual-boot configuration with NTFS/FAT32 support."

Comments (none posted)

OpenNA Linux

OpenNA Linux has released RC2 with major feature enhancements. "Changes: This version is devoted to bugfixes, improvements, and general polish of the upcoming major 1.0 stable release."

Comments (none posted)

VectorLinux

VectorLinux has released v3.2 of its SOHO development branch with major feature enhancements. "Changes: This release updates to Vector Linux 3.2 base. There is a brand new auto installer that configures all hardware without user intervention. All applications have been updated to the latest versions including KDE-3.1, Ximian Evolution, GNUCash, OpenOffice, XMMS, Phoenix, and Opera."

Comments (none posted)

Warewulf

Warewulf has released v1.10 with minor feature enhancements. "Changes: This release adds support in dhcp-build for PXE/Etherbooting (/etc/warewulf/node.conf now takes an additional configuration item "pxeboot" to support this), support in dhcp-build for node-specific Warewulf RAMDISK boot images (the node.conf parameter is "bootimg", and it overrides the default; this is just the first stage, and it has not been documented yet), and support for SWAP monitoring. The output of "wwmon" and "wwstat" has been modified."

Comments (none posted)

Webfish Linux

Webfish Linux has released v1.0pre1 with major feature enhancements. "Changes: This release incorporates new packages such as glibc-2.2.5 and gcc-3.2.2."

Comments (none posted)

Distribution reviews

Red Hat Linux 9 - World's First Look at Shrike (OSNews)

OSNews reviews Red Hat Linux 9. "So what's different about it? Well, for starters (pun intended) the start menu is now far better arranged than the clumsy bloated mess in Red Hat Linux 8.0. It's now clearly laid out and there is even a handy 'recent documents' shortcut called 'open recent' on the menu. Nothing new to Windows users but it's nice to finally see it in Red Hat Linux. Once again, Gnome is the default DE and Bluecurve is the default theme so overall it looks remarkably similar to Red Hat Linux 8.0."

Comments (none posted)

Page editor: Rebecca Sobol

Development

OpenOffice.org 1.1 beta released

Version 1.1 beta of the OpenOffice office suite has been released.

Some of the more important new capabilities include:

• New import/export formats including PDF, Macromedia Flash, DocBook, XML.
• Support for Complex Text Layout and vertical languages.
• Better Java integration including big speed improvements.
• Accessibility support throughout the suite.
• Support for add-on components.
• Preliminary support for recovering damaged files.
• MySQL data source support.
• Better online help information.

This long list of changes details many other new features. OpenOffice is doing a good job of closing in on the capabilities of Microsoft Office, this release should help to make Linux a stronger desktop contender.

Comments (none posted)

System Applications

Audio Projects

ALSA 0.9.2 released

Version 0.9.2 of the ALSA driver, library and utils packages have been released. A number of bug fixes have been included.

Full Story (comments: none)

PyJack 0.1 Released

The initial release of PyJack, version 0.1, is available. "This is a Python module which provides an interface to the Jack Audio Server. It is possible to access the Jack graph to manipulate port connections, monitor graph change events, and to perform soft-realtime audio capture and playback using Numeric Python arrays."

Full Story (comments: none)

Ogg Traffic

The March 24, 2003 edition of Ogg Traffic is available with the latest Ogg Vorbis audio compression software news. Discussion topics include: Status Updates, Speex goes 1.0, Xiph.org goes 501(c)3, and New Icecast2 Binary for Win32.

Comments (none posted)

Speex 1.0 released

Version 1.0 of the Speex audio codec has been released. See the announcement for the whole story.

Comments (none posted)

CORBA

omniORB 4.0.1 and omniORBpy 2.1 released

New versions of omniORB and omniOrbpy, the high performance CORBA ORB for C++ and Python, have been released. Change information is in the source code.

Comments (none posted)

Database Software

MySQL 4.0.12 declared stable

Version 4.0.12 of the MySQL database is available for download. "MySQL Version 4.0.12 has been declared stable for production use in March 2003. This means that only bugfixes are done for the 4.0 release series, and only critical bugfixes for the older 3.23 series." Thanks to Bryan Henderson.

See the release announcement for more information.

Comments (none posted)

Education

Linux in Education Report

Issue #92 of the Linux in Education Report is out. Topics include: developing educational boards for GCompris, the first Schoolforge IRC meeting, OpenStudio's progress, a web based reading game, an essay on Software Engineering with Linux, the Site@School content management system, and more.

Comments (none posted)

Electronics

gerbv 0.13 released

Version 0.13 of gerbv, the Gerber file viewer has been released by the gEDA project. This is a bug fix release, see the announcement for details.

Comments (none posted)

Mail Software

Mozilla Minotaur Project Formally Launched (MozillaZine)

MozillaZine covers the release of Mozilla Minotaur. "In a newsgroup posting, Scott MacGregor has formally announced the launch of Minotaur, a project to create a stand-alone mail client based on the Mozilla suite's Mail & Newsgroups component."

Comments (none posted)

Printing

Foomatic 3.0.0beta2 released

Version 3.0.0beta2 of the Foomatic printer support database has been released. "This will be the last beta release before the final release of Foomatic 3.0.0 in around two weeks (at least not later than first of May). This release does not contain any major new features; it mainly fixes bugs and improves the Adobe-compliance of the generated PPD files."

Comments (none posted)

Web Site Development

Analog 5.32 released

Version 5.32 of the Analog web server log file analyzer is available. The changes include recognition of the Safari and Camino browsers, a new logformat specification, and more.

Comments (none posted)

Quixote 0.6 beta 5 available

In the march toward version 0.6, version 0.6 beta 5 of the Quixote web application framework has been released.

Comments (none posted)

ZConfig 1.0 released

Version 1.0 of Zconfig, a Zope configuration library, is available. "ZConfig's model is very different from the model support by the ConfigParser module found in Python's standard library, and is more suitable to configuration-intensive applications."

Full Story (comments: none)

Web Services

Squeezing SOAP (IBM developerWorks)

Brian D Goodman covers the use of GZIP and SOAP on IBM's developerWorks. "GZIP encoding over HTTP is pretty much old school. "Been there, done that" is the attitude of most. However, if you have been working with a few of the current SOAP implementations, you'll find that they don't take advantage of it. While knowing they will eventually come around, if you are building real world Web service solutions and want a performance boost, GZIP is for you."

Comments (none posted)

Miscellaneous

heartbeat 1.0.2 released

Version 1.0.2 of heartbeat has been released by the High-Availability Linux Project. "This release contains a number of minor bug fixes, and is compatible with Red Hat 8.0."

Full Story (comments: none)

Desktop Applications

Audio Applications

Audacity 1.1.3 released

Version 1.1.3 of the Audacity multi-platform sound editor is available. "This version adds a gain and pan control to every track, supports high-quality resampling, and has many other new features and bug fixes." See the release notes for details.

Comments (none posted)

ecasound 2.2.2 released

Version 2.2.2 of Ecasound, a multi-track audio processing utility, has been released. "A new native Python implementation of the ECI API has been added to the package. Ecasound.el (ecasound-emacs) has been updated to version 0.8.2. Oggs and mp3s can be now streamed directly from network. Author information is now visible in the LADSPA plugin descriptions. Changes in ALSA-0.9 support improve usability of ecasound with the new ALSA dmix PCM plugin." Some important bug fixes are also included.

Full Story (comments: none)

galan-0.2.14 released

Version 0.2-14 of galan has been announced. "galan is another modular synthesizer. It supports sub patches like pd and jmax. But has separation of mesh and Controls. It also supports OpenGL Scene Graphs which can be controlled by your audio data, the sequencers etc..."

Full Story (comments: none)

Hydrogen 0.7.6 available

Version 0.7.6 of Hydrogen, a Gnu/Linux drum machine, is available.

Full Story (comments: none)

Wave Composer Not Toilet (wcnt)

A new modular audio synthesis program known by the amusing name of Wave Composer Not Toilet (wcnt), is available. "Wav Composer Not Toilet is another modular synthesis program, but unlike many others does not work in real time at all. wcnt gives you sequencing, sampling, and synthesis without the need for fast hardware, although a little patience is required!"

Full Story (comments: none)

Desktop Environments

Bonobo support for Vim (GnomeDesktop)

A developer patch of the Vim editor for bonobo has been announced. "Take a look at the project page".

Comments (none posted)

KDE 3.1.1: It's not Odd at all! ;-)

KDE.News reports on the release of KDE 3.1.1, the first maintenance release of the KDE 3.1 release series.

Comments (1 posted)

KDE-CVS-Digest for March 21, 2003

The March 21, 2003 edition of the KDE-CVS-Digest is out. "KDE 3.1.1 released, a WYSIWYG mode for Quanta, many bugfixes in KMail, KWin, Kicker and Konqueror."

Comments (none posted)

KDE Accessibility 1.0 is Here + Interview

KDE.News reports on the release of the first stable version of the KDE Accessibility module, which includes the KMagnifier, KMouseTool, and KMouth accessibility aids.

Comments (none posted)

Gnome and KDE viewpoint on the future of the X Window System (GnomeDesktop)

A group of developers from both the GNOME and KDE projects comment on the future of the X Window System. "We acknowledge the dedication of the XFree86 project in providing us a free and innovative implementation of the X11 industry standard, something we benefit from on a daily basis. Therefore, we want to share our joint point of view with the community."

Comments (9 posted)

Sawfish 1.3 Released

Version 1.3 of the Sawfish (formerly Sawmill) window manager has been announced.

New features in this version include:

• Implementation of the EMWH "show desktop" mode.
• Changes to client window gravity when reparenting windows.
• Support for the EWMH SKIP_TASKBAR' state.
• New muliple properties for window history keys.
• Multi-thread awareness for more placement modes.
• Updated language translations.
• Lots of bug fixes including GTK 2.2 compilation support.

Sawfish 1.3 is available for download here.

Comments (none posted)

Games

GNOME-games, the future and maintainership (GnomeDesktop)

Ross Burton writes about his progress on gnome-games 2.4.0. "I have started to prune the games for gnome-games 2.4.0, the first development release 2.3.0 was just released with gnibbles, gnobots2, iagno2 and xbill removed."

Comments (none posted)

Graphics

GIMP 1.3.13 Released (GnomeDesktop)

The FootNotes site has an announcement for version 1.3.13 of the development release of the GIMP, a powerful graphical manipulation program.

Comments (none posted)

Interoperability

wine20030318 available

Version 20030318 of Wine has been announced. Changes include direct sound improvements, support for file locking, progress on the kernel/ntdll separation, and bug fixes.

Comments (none posted)

Wine Weekly News

Issue #162 of the Wine Weekly News is out. Topics include: Wine-20030318, File Locking, .NET Success, DPRINTF to TRACE Conversion, Finding DLL Imports, and Completely Broken Test App.

Comments (1 posted)

Office Applications

AbiWord 1.1.4 released. (GnomeDesktop)

FootNotes has an announcement for the release of AbiWord version 1.1.4. "This version of AbiWord is basically feature complete for the final 2.0. It offers substantial new features and tons of bug fixes over 1.1.3.

Comments (none posted)

AbiWord Weekly News

Issue #136 of the AbiWord Weekly News is out, with the latest AbiWord word processor development news. "Smell that? It's the sweet sent of Wisconsin Maple Syrup and a new release cycle! The latest stable that's just come out, 1.0.5, is about to be joined by a new developers' build, 1.1.4. The Latest Releases page will be updated with information for both on the evening of 1.1.4's release (probably by 6pm CT Sunday). Large portions of the on-list discussions focus on the two releases while commits focus towards bug squashing."

Comments (none posted)

Balsa-2.0.10 and Balsa-1.4.3 released (GnomeDesktop)

Two new versions of the Balsa email client have been released. "Balsa team would like to officially announce balsa-2.0.10 and balsa-1.4.3 releases. Both releases are available at balsa.gnome.org. balsa-1.4.3 is based on GNOME1 libraries. balsa-2.0.10 is a GNOME2 port.

Comments (none posted)

Evolution 1.2.3 Released (GnomeDesktop)

GnomeDesktop reports on the release of Ximian Evolution 1.2.3. This update includes some security related bug fixes.

See the release notes for additional details.

Comments (none posted)

GNOME Ticker 0.4 released (GnomeDesktop)

Footnotes has the announcement for the initial release of GNOME Ticker, a stock market ticker application.

Comments (none posted)

Languages and Tools

Caml

Caml Weekly News

The March 25, 2003 edition of the Caml Weekly News is available with the latest Caml language news.

Full Story (comments: none)

Java

Java Swing: Menus and Toolbars, Part 7 (O'ReillyNet)

O'Reilly is running part 7 in the series on Java Swing. "In the final part of this book excerpt series on Swing menus and toolbars from Java Swing, 2nd Edition, learn how to use toolbars."

Comments (none posted)

Taming your Tomcat: Filtering tricks for Tomcat 5 (IBM developerWorks)

Sing Li shows how to work with Tomcat 5 on IBM's developerWorks. "The new Tomcat 5 server takes filters to a new level of deployment flexibility. Tomcat 5's support for the upcoming Servlet 2.4 and JSP 2.0 specifications gives filter writers a new way to integrate and deploy these flexible components -- tapping directly into the request dispatcher's operations. In this article, Sing Li takes you on a guided tour of the new enhancement and gives you some hands-on training. See how Tomcat 5 can benefit Web application frameworks and lead ultimately to the design of maintainable high-performance systems."

Comments (none posted)

Lisp

SBCL 0.7.14 released

SBCL (Steel Bank Common Lisp) version 0.7.14 is available. "This version provides a better implementation of SXHASH on simple bit vectors, no longer ignores type declarations for special variables, and fixes a number of bugs and other issues."

Full Story (comments: none)

Perl

This Week on perl5-porters (use Perl)

The March 17-23, 2003 edition of This Week on perl5-porters is out. "Read on for the short notes I've taken about all those recent developments -- pack(), FETCH()es, threads port, et al."

Comments (none posted)

PHP

PHP Weekly Summary

Topics on this week's PHP Weekly Summary include: 64 bit issues, continued, Undocumented .ini options, superglobals with Zend Engine 2, htmlentities() Cyrillic support, error docref, and ICU extension.

Comments (none posted)

Python

Dr. Dobb's Python-URL!

The Dr. Dobb's Python-URL for March 24, 2003 is available, with weekly news and links for the Python community.

Full Story (comments: none)

Ruby

Ruby-GNOME2-0.4.0 is released! (GnomeDesktop)

Version 0.4.0 of Ruby-GNOME2, the Ruby language bindings for GNOME 2 has been released. "The biggest additions includes Win32 support, support for more Gtk widgets, and the usual set of bug-fixes."

Comments (none posted)

The Ruby Weekly News

Topics on this week's Ruby Weekly News include: Ruby Tutorial v0.3, Strong advantages over Python, XML too hard (YAML opportunity?), and lots of new Ruby software.

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The March 24, 2003 edition of Dr. Dobb's Tcl-URL! is available with the latest Tcl/Tk development news.

Full Story (comments: none)

XML

An XML Hero Reconsiders? (O'Reilly)

Kendall Grant Clark looks at whether XML is too difficult on O'Reilly. "In a recent weblog entry, one which has been picked up by Slashdot, Bray asks whether XML has become too hard for programmers. Faced with writing code "to process arbitrary incoming XML", Bray confesses that the experience was "irritating, time-consuming, and error-prone" -- quite an admission from someone as instrumental in the creation of XML as Bray. The point here -- before someone accuses me of hero worship -- isn't that Tim Bray is always right. He isn't. The point is that when Tim Bray starts talking about XML's problems, it makes sense for the XML development community to pay some attention."

Comments (none posted)

XMLTP/L, XMLTP Light (Linux Journal)

Linux Journal looks at XMLTP Light. "XMLTP/L, or XMLTP Light, is a lightweight RPC protocol that uses XML to encode the stream of data. XMLTP/L has been designed to do fast RPC calls over an intranet, within an enterprise. More specifically, the first purpose of XMLTP/L is to forward transactions (RPCs) to a database server. But, it also can be used to do method calls to any server that follows the common RPC technique introduced by XML-RPC and older client/server protocols."

Comments (none posted)

The Road to XHTML 2.0: MIME Types (O'Reilly)

Mark Pilgrim writes about the migration to XHMTL 2.0 on O'Reilly. "Now here's a dirty little secret: browsers aren't actually treating your XHTML as XML. Your validated, correctly DOCTYPE'd, completely standards compliant XHTML markup is being treated as if it were still HTML with a few weird slashes in places they don't belong.
Why? The answer is MIME types."

Comments (none posted)

Miscellaneous

Gnome C++ development with Gtkmm2 (DevChannel)

DevChannel has an article on the C++ wrapper libraries for the GNOME C framework. "There are many powerful tools and libraries available to take advantage of the GNU Network Object Modeling Environment(GNOME). This article will introduce the C++ wrapper libraries for the GNOME foundation's GNOME C framework. In this article, the term Gtkmm should be taken to mean the entire family of libraries that make up Gtkmm/Gnomemm."

Comments (none posted)

Space-Based Programming (O'Reilly)

Bernhard Angerer introduces space-based programming on O'Reilly. "'Space-based programming' heralds a new way of building distributed applications. The dominant methods of distributed programming are based on remote procedure calls (RPC), most notably embodied in the technologies CORBA, EJB, and COM/DCOM. Space architecture supplies a surprisingly compact model that completely replaces the RPC paradigm. Its inherent, minimalistic approach predisposes it to a wide range of applications while endowing it with the advantages of modularity, scalability, and source code economy."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Hacker says he leaked info on Unix flaw (News.com)

News.com reports that a hacker claims to have stolen three unreleased security advisories from a corporate computer and posted them to a public mailing list. "The online vandal, who uses the monicker "Hack4Life," said Wednesday that he stole advisories detailing flaws in a common set of Unix code, the Kerberos authentication system and some implementations of encryption for Web sites. He claims to have stolen them from a firm that had been working with the Computer Emergency Response Team (CERT) Coordination Center, a clearinghouse for security information."

Comments (5 posted)

XFree86 dust-up questions X11 model (Register)

Here's the Register's take on the split in the XFree86 project. "Key Linux kernel developer Alan Cox agreed that the project needed a wake-up call, but didn't think a splinter project by Packard could cause too much harm: "X has to evolve, X has to do cool stuff, X has to let people break stuff, X has to delegate trust to driver maintainers far more," he wrote. "To me it doesn't matter if Keith and friends spin off an "Xperimental" or XFree itself changes, but that change is vital to the future of X11.""

Comments (16 posted)

Trade Shows and Conferences

Open Source in Government Conference Wrapup (NewsForge)

NewsForge covers the recent "Open Standards/Open Source for National and Local eGovernment Programs in the U.S. and EU" conference held in Washington DC last week. "One GSA (General Services Administration) representative felt that this conference's primary benefit was that it showed him he was not alone; that there was more open source being used in more places within the federal government than he had thought. Not only that, he said he learned some helpful tricks from some of the sessions and -- best of all -- hooked up with several people from other agencies whose needs are similar to his, with whom he can cooperate on several projects, thereby increasing development and deployment efficiency even more."

Comments (none posted)

Companies

Intel plans Linux support for Centrino (News.com)

News.com reports on Intel's plans to support Linux on Centrino. "Although the Linux support software for Centrino is working at Intel's labs, it hasn't been fully tested and full completion of the project hinges on the timing of requirements from computer makers, company spokesman Scott McLaughlin said Monday."

Comments (7 posted)

Lindows CEO attacks Intel's Centrino Linux lockout (Register)

The Register looks into allegations made by Lindows.com CEO Michael Robertson. "Intel is going through a major internal struggle over desktop Linux, and the pro-Microsoft marketing droids are currently winning, according to Lindows.com CEO Michael Robertson. As evidence, Robertson puts forward the lack of Linux support for Centrino, the mysterious blocking of his company's request to participate in an Intel roadshow, and the last minute pullout of Intel speakers at his Desktop Linux Summit earlier this year."

Comments (24 posted)

Red Hat slips into the red (News.com)

News.com looks at Red Hat's quarterly results and prospects for the near future. "Even though [Red Hat Linux 9] will boost Red Hat revenue, the company's attention will remain on the premium product, Chief Executive Matthew Szulik said in an interview. 'You're not going to see any aggressive promotion with it,' he said. Advertising and promotion might increase sales, but it also increases expenses 'in a business that is not that interesting to the company,' Szulik said."

Comments (2 posted)

Linux Adoption

A provincial German town drops Microsoft for Linux (Boston.com)

Boston.com looks at the German city of Schwaebisch Hall, which is switching over to Linux. "The open-source software can be freely copied by the more than 400 new Linux users employed by Schwaebisch Hall, which is encouraging them to copy the software on their work computers for home use... By year's end Schwaebisch Hall, working with Nuremberg-based SuSE and IBM Germany, will have switched all 300 desktop computers and 15 servers recording tax payments, business licenses and library checkout records." (Thanks to Ashwin N.)

Comments (none posted)

Linux lines up its best shot (vnunet)

Vnunet thinks the Linux revolution is still a long ways off. "There is no shortage of pundits who believe that Linux is taking off. IDC, Gartner, Aberdeen and the Robert Francis Group all predict a massive upsurge in the employment of Linux, at some stage soon. That said, whenever analysts agree on something, they are usually wrong."

Comments (6 posted)

Legal

Public to chime in on copyright law (News.com)

News.com reports that the Library of Congress' Copyright Office will hold a series of public hearings to decide what changes, if any, should be made to the section of the DMCA that restricts bypassing copy-protection schemes. "Anyone with strong feelings about the DMCA, one way or another, may submit a request by Apr. 1 to testify during the public forums, the Copyright Office said in its announcement. The hearing dates in the U.S. capital will be Apr. 11, Apr. 15 and May 2. The dates and locations in California have not been set yet."

Comments (none posted)

Resources

Ten Security Checks for PHP, Part 1 (O'ReillyNet)

O'ReillyNet looks into building a secure web site with PHP. "It is extremely easy to write applications that contain unintentional security holes. This is demonstrated by the range of common web applications, including PHPMyAdmin, PHPShop and FreeTrade, that have contained major security holes. The source code is often required to identify these holes, but it is common to make the source code of these applications available to the public. This article provides five steps to help identify or avoid such security holes in applications written using PHP."

Comments (none posted)

Reviews

Time for Users to Start Testing 2.5 (Linux Journal)

Linux Journal looks at the 2.5 Linux kernel. "A lot of people ask me, "When do you think the 2.6 kernel will be released?" My response to that question usually is, "Well, how well is the 2.5 kernel working for you?" Inevitably, during the resulting conversation where I plead with the person to please at least run the kernel once on their hardware, they respond with one of the following reasons why they have not tried 2.5:"

Comments (15 posted)

Red Hat liberates low-end Linux (News.com)

News.com looks at the upcoming Red Hat 9 release. "The Raleigh, N.C.-based company has just completed splitting its product line in two: the slow-changing premium Red Hat Enterprise Linux version for businesses and the free Red Hat Linux version for enthusiasts. Establishing the RHEL option for conservative customers freed up Red Hat to accept more flexibility with the RHL line, said Matt Wilson, manager of Red Hat's base operating system, in an interview Tuesday."

Comments (6 posted)

Mozilla Tightens Up (eWeek)

eWeek evaluates Mozilla version 1.3. "Mozilla 1.3 also includes a demonstration of a capability, code-named Midas, that will be supported in future versions of the browser. Midas lets Web developers add rich-text editable controls to pages using standard script commands. We found this feature interesting but were not sure why it was included--there are already standards-based ways to do basically the same thing across all browsers."

Comments (none posted)

An update on RTLinux (LinuxDevices)

LinuxDevices.com delves into RTLinux. "The RTLinux dual-kernel operating system was first introduced back in 1995. Today, RTLinux is well known worldwide as a means to gain "hard real-time" performance from a Linux-based system environment. In this article, Victor Yodaiken, Michael Barabanov, and Cort Dougan -- three key figures in the creation, evolution, and maintenance of RTLinux -- summarize the state of RTLinux eight years later."

Comments (none posted)

Miscellaneous

Too cool for secure code (Register)

Jon Lasser takes programmers to task for insecure software in The Register. "It would be nice if we could expect that our programmers would act more like airline pilots than fighter pilots: that they acknowledge, and accept, the responsibility that they take for the well-being of others. Until they take this step, I doubt that the quality and security of the code that we all rely on will improve."

Comments (18 posted)

Page editor: Forrest Cook

Announcements

Commercial announcements

ActiveState and O'Reilly join up

ActiveState and O'Reilly have announced a deal wherein O'Reilly's "Safari Bookshelf" will be bundled with ActiveState's Programmer Network offerings.

Full Story (comments: none)

Dell and Oracle power Louisiana's state-of-the-art justice system in Baton Rouge

Dell and Oracle have announced that they will be providing Linux systems for Louisiana's Nineteenth Judicial District Court, to be used for providing real-time access to public records.

Full Story (comments: none)

Hitachi Announces Strategic Partnership with Codehost Inc. (LinuxMedNews)

Hitachi and Codehost, Inc have announced a Linux-related partnership. "The Hitachi Internet Platform Business Unit, a part of Hitachi, Ltd. (NYSE: HIT) and Linux software developer Codehost, Inc. today announced a software development agreement for wireless tablets running the Linux operating system."

Comments (none posted)

Record number of students in IBM's Second Linux Scholar Challenge

The Indian Institute of Technology (IIT) in Delhi, India has been named the top winner of IBM's Second Linux Scholar Challenge. The university has been awarded a 16-node IBM eServer(tm) xSeries(tm) cluster running Linux. IIT received the highest overall average score among student winners from the 646 universities that enrolled in the challenge.

Full Story (comments: none)

JBoss Group distributes profits to developers

The JBoss Group has sent out a press release stating that it has distributed some of its profits to 37 developers who have contributed code to JBoss. "The Compensation Plan is our way of rewarding the open source JBoss developers, whether or not they work for JBoss Group, giving them a stake in the company's future, as well as offering them cash awards based on annual profit-sharing."

Comments (none posted)

MySQL Version 4.0 Dubbed ''Production''; MySQL AB Confirms Version 4.0.12 Ready for all Application Areas

MySQL AB has sent out a press release stating that MySQL 4.0.12 is "ready for any MySQL deployment." "Even though proven development releases of 4.0 have been out for well over a year, we know that many MySQL users have been waiting for it to go production before upgrading. Now that it's been thoroughly tested by thousands of users, with no major bugs having been found in many months, we are confident that version 4.0 can be used reliably in any MySQL implementation..."

Comments (none posted)

Red Hat Linux hard at work

Here are two press releases showing wins for Red Hat. The first is from RackSaver, which has provided a BladeRack system to the Mars Space Flight Facility at Arizona State University. The Mars Space Flight Facility's new BladeRack is a 50-node, dual AMD 2000+ processor-powered system, running Red Hat Linux Version 7.3.

Dell and Oracle announced the delivery of integrated solutions to Louisiana's Nineteenth Judicial District Court. These Dell servers run Oracle9i Database with Real Application Clusters and Oracle9i Application Server on Red Hat Linux Advanced Server.

Comments (7 posted)

Red Hat's fourth-quarter results

Red Hat, Inc. has announced its fourth-quarter results. The bottom line is that the company essentially broke even on $25.9 million in revenue. The release also notes that Red Hat has now sold 16,500 "Red Hat Enterprise Linux AS" subscriptions, and shipped 5,000 copies of the new enterprise workstation product.

Comments (3 posted)

Linux gives your phone a voice!

Looking for a new phone? Zultys Technologies announced immediate availability of its ZIP 4x4 IP phone. "The ZIP 4x4 is built 100 percent on open technologies and runs on a highly stable real time Linux operating system. It is compatible with any IP telephony system using SIP (Session Initiation Protocol), with support for advanced features such as line-rate Ethernet switching, voice encryption, and five-way conferencing."

Full Story (comments: 1)

Wing IDE 1.1.9 Released (ZopeMembers)

Zope Members News has an announcement for version 1.1.9 of the Wing IDE for Python. "Wing IDE is a commercial development environment for the Python programming language. Wing's powerful editor, source browser, and graphical debugger speed Zope-based software development."

Comments (none posted)

Upcoming Events

The UK Python Conference 2003

The UK Python Conference 2003 will be held in Oxford, England on April 2 and 3, 2003. Guido van Rossum will deliver the keynote speech.

Full Story (comments: none)

Tcl/Tk Conference CFP

A Call For Papers has gone out for the 10th annual Tcl/Tk conference. The event will be held from July 29 to Aug 2, 2003, papers are due in by May 15.

Full Story (comments: none)

Linux in Education Spring Conference

The Linux in Education Spring Conference will be held on April 5, 2003 in Grand Prairie, Texas.

Comments (none posted)

Minutes of the mozilla.org Staff Meeting (MozillaZine)

MozillaZine has posted the minutes of the March 19, 2003 mozilla.org staff meeting.

Comments (none posted)

O'Reilly Open Source Convention registration opens

Registration has started for the O'Reilly Open Source Convention, which will be happening July 7 to 11 in Portland, Oregon.

Full Story (comments: none)

Mark-Jason Dominus coming to Washington, DC Perl M (use Perl)

Use Perl mentions that Mark-Jason Dominus will give a talk at the American Geophysical Union in Washington, D.C. on April 8.

Comments (none posted)

Zope3 UK Sprint (ZopeMembers)

The Zope 3 Sprint has been announced. The event will take place at the University of Bristol, England from April 12-15, 2003.

Comments (none posted)

Events: March 27 - May 22, 2003

Date	Event	Location
March 27 - 28, 2003	PyCon DC 2003	(George Washington University)Washington DC
March 29, 2003	First Hungarian PHP Conference	Budapest, Hungary
March 31 - April 2, 2003	2nd USENIX Conference on File and Storage Technologies(FAST '03)	(Cathedral Hill Hotel)San Francisco, CA
April 2 - 3, 2003	The UK Python Conference	(Holiday Inn Oxford)Oxford, England
April 5, 2003	Linux In Education Spring Conference	(Grand Prairie High School)Grand Prairie, Texas
April 10 - 12, 2003	MySQL Users Conference & Expo 2003	(Doubletree Hotel)San Jose, California
April 13 - 17, 2003	RSA Conference 2003	(Moscone Center)San Francisco, CA
April 14 - 15, 2003	Samba eXPerience 2003	(Hotel Freizeit)Göttingen, Germany
April 15 - 16, 2003	LinuxUser & Developer Expo 2003	Birmingham, UK
April 22 - 26, 2003	Embedded Systems Conference(ESC)	(Moscone Convention Center)San Francisco, CA
April 22 - 25, 2003	The O'Reilly Emerging Technology Conference	(Westin, Santa Clara)Santa Clara, CA
April 23 - 25, 2003	PHPCon East 2003	(Park Central Hotel)New York, NY
April 28 - 30, 2003	Real World Linux 2003	(Metro Toronto Convention Centre)Toronto, Canada
May 3, 2003	International Conference on Software Engineering 2003	Portland, Oregon
May 8 - 9, 2003	International PHP Conference, 2003	Amsterdam, the Netherlands
May 11 - 14, 2003	The International Symposium on High Performance Computing Systems and Applications(HPCS 2003)	(Sherbrooke Delta Hotel)Quebec, Canada
May 11, 2003	Yet Another Perl Conference, Israel(YAPC::Israel::2003)	(C.R.I.)Haifa, Israel
May 15 - 16, 2003	YAPC::Canada	(Carleton University)Ottawa, Canada

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook

Letters to the editor

XFree86 needs a Fork

From:		anandsr@hss.hns.com
To:		letters@lwn.net
Subject:		XFree86 needs a Fork
Date:		Sat, 22 Mar 2003 12:17:28 +0530

 
 
Hi,
 
I don't know anything about the development of XF86. But after reading just
a little bit of material I can realize that that is what is required. I am
surprised that nobody did it for so long. Kudos to Keith Packard for taking
the plunge, I hope he succeeds in revitalizing X, under whatever name he
brings it out.
 
I think you don't need any more reasons for a fork than Mike Harris's diary,
http://www.advogato.org/person/mharris/diary.html?start=5
 
In the Open Source World a project is only successful if it can attract a
large no. of developers. The larger the pool of developers the larger the
project. It doesn't matter how many users you have, because they do not
contribute. If they did they would be developers. Xfree86 has a meagre 250
developers, and only 14 are allowed to make a change after reviewing.
This is pathetically low for a project of XF86 size. This can only mean two
things, you don't even need to know anything else for this conclusion.
 
1) Current Development model of XF86 sucks and it sucks really really hard.
2) Current Developers aren't accepting outside help. They either think they
are the best and nobody can do a better job than themselves, or they think
that allowing other people in will reduce their importance. The first shows
a psychological problem the other is a measure of incompetence.
 
If 2) wasn't true 1) would have been solved. So there is a distinct necessity
of creating a fork.
 
The best thing about Open Source Projects is that if the current developers
are not doing justice to a project then you have the option to fork.
 
I hope Keith will be able to pool in a large no. of developers and hopefully
they will be able to move ahead of current XF86 within a short time.
 
I also desperately need a properly working driver for my i830M chipset, which
is not working even after almost 2 years of updates.
 
thanks,
-anandsr
 

Comments (3 posted)

Alternatives to Red Hat Update

From:		Alex Hornby <alex@hornby.org.uk>
To:		letters@lwn.net
Subject:		Alternatives to Red Hat Update
Date:		26 Mar 2003 11:09:16 +0000

Hi,
 
With the recent changes to red hat's update and support policy it may be
useful to draw readers attention to alternative methods of auto applying
updates to red hat systems.
 
Many people will already be familiar with Ximian's Red Carpet tool.
However, whilst this is free to use as a client, to publish software via
this mechanism one needs an agreement with Ximian.
 
One alternative which hasn't recieved as much attention is apt for rpm,
which I obtained from http://freshrpms.net/apt/ . This provides debian
style auto updates for red hat users. In addition to the command line
there is a gtk 2 GUI for apt called Synaptic available on the same site
which provides an alternative to red-carpet or the up2date tool.
 
The main advantages of apt for rpm I have found are:
 
* Free as in beer _and_ free of hassle. No registrations required.
 
* Open backend - anyone can put up an apt repository. This has two main
benefits:
 
* I've successfully done kernel upgrades using apt - something
red-carpet seems to baulk at.
 
* Software developers can set up their own apt site. For an example of
this in action see: http://gstreamer.net/releases/redhat/ . This is not
the case for people wishing to distribute by Red Hat up2date or Ximian
red-carpet.
 
* Not dependant on the fate of any one commercial entity. (e.g. what
happens to the red-carpet backend if Ximian goes under or has a change
of corporate policy)
 
The only disadvantage I can see is that apt4rpm and synaptic are not
installed by default by Red Hat (a problem they share with red-carpet).
 
Regards,
Alex Hornby.
 
PS Whilst on the subject of updates, I've found that rpm 4.1.1 from
ftp://ftp.rpm.org/pub/rpm/test-4.1.1 seems to cure the "rpm locks up"
problem I and others have been having with RedHat 8.0
 
--
Alex Hornby | See http://www.hornby.org.uk/

Comments (5 posted)

Why aren't we calling SCO names?

From:		"Arthur Torrey (no spam please!)" <atorrey@cybercom.net>
To:		letters@lwn.net
Subject:		Why aren't we calling SCO names?
Date:		Thu, 20 Mar 2003 22:27:56 -0500

  As a mild side note on the SCO lawsuit, I'm surprised that nobody seems to
have started calling SCO funny names the way folks do MicroShaft... My
girlfriend is a principle software engineer who has been in the business for
over 20 years. One of her first jobs involved doing development on SCO boxes,
and she said they were commonly reffered to back then as "Spoiled Child
Operations" - In light of the current events, the name seems due for a
revival...
 
  ART

Comments (2 posted)

Page editor: Jonathan Corbet