The entertainment industry has been engaging in a long and fierce campaign
to make the writing of certain kinds of software illegal. In their view,
tools like DeCSS or Elcomsoft's eBook processor are to be outlawed simply
because they
can be used to violate copyrights. File sharing
software has also been targeted by this industry for the same reasons;
people can use that software to share copyrighted files. If the RIAA and
MPAA have their way, unrestricted file sharing systems would come under the
same sort of legal sanctions as DeCSS.
In this arena, however, the industry must work without one of its favorite
weapons. File sharing networks just move bits around, they do not actively
circumvent any sort of copy protection mechanism. As a result, they are
not exposed to the anti-circumvention clauses of the DMCA. So file sharing
networks must be fought with traditional copyright law. As last week's
ruling in the Grokster et al. case (available in
PDF format) shows, the studios are going to have a harder time. File
sharing networks, when properly constructed, are legal.
What are the attributes of legal file sharing software? From this ruling,
one concludes that such software must (1) have real non-infringing
uses, (2) not be based on a central server architecture, and
(3) not provide for control over what can or cannot be distributed
through the network.
The court was quite clear that the simple potential to infringe copyrights
was not enough to condemn the software or the companies distributing it:
Defendants distribute and support software, the users of which can
and do choose to employ it for both lawful and unlawful ends.
Grokster and StreamCast are not significantly different from
companies that sell home video recorders or copy machines, both of
which can be and are used to infringe copyrights.
Lawful uses of the software would not be enough, however, if the companies
were actively involved in the distribution of copyrighted materials. The
saving factor for the defendants here was that they do not maintain any
sort of central server or index of the files available in the network, and
are not involved in actual file transfers.
Users connect to the respective networks, select which files to
share, send and receive searches, and download files, all with no
material involvement of Defendants. If either Defendant closed
their doors and deactivated all computers within their control,
users of their products could continue sharing files with little or
no interruption.
Just as relevant is the fact that the the defendants had no control over
what their users were sharing:
Defendants provide software that communicates across networks that
are entirely outside Defendants' control. In the case of Grokster,
the network is the proprietary FastTrack network, which is clearly
not controlled by Defendant Grokster. In the case of StreamCast,
the network is Gnutella, the open-source nature of which apparently
places it outside the control of any single entity.
This is a lesson which has been taught by the American courts more than
once: control brings liability. If you do not have control over a system,
you have a defense against liability for what others do with that system.
There is no more convincing way of relinquishing control than by releasing
the software under a free license.
The plaintiffs put forward the claim that better control should have been
put into the defendants' software. The court did not buy it, however:
The doctrine of vicarious infringement does not contemplate
liability based upon the fact that a product could be made such
that it is less susceptible to unlawful use, where no control over
the user of the product exists.
Current law, in other words, does not require that products be made in such
a way that they cannot be used to infringe copyrights. Ed Felten has speculated
that the entertainment industry will soon make efforts to change the law.
This would be an unsurprising move, to say the least; that is, after all,
what the CBDTPA would do. As one LWN commenter pointed out, pressing for that
sort of law would break the RIAA's agreement with the BSA, where it said it
would not push for further anti-copying measures. Relying on that
agreement to hold sounds risky, however; chances are good that there will
be new legislative efforts in the near future.
Comments (2 posted)
The entertainment industry is certain to continue its attempts to obtain
the protection it wants from the Congress and the courts. But the industry
is also very interested in technical means of enforcing limited access to
its products. As Lawrence Lessig pointed out years ago, the software
running on our systems is the other component of the code which constrains
our actions. There's no shortage of people, governments, and corporations
who would like to use that code to control (and monitor) what we can do
with our systems and the products we purchase.
In most Linux users' view, there is little intersection between this sort
of digital rights management (DRM) code and free software. After all,
what's to keep us from simply yanking out any code which gets in the way of
what we want to do? So some people were surprised when Linus Torvalds
posted a message stating "I want to
make it clear that DRM is perfectly ok with Linux!"
There is, you see, a scenario where DRM software can be embedded within the
Linux kernel, and there is very little that can be done about it. It is
not that hard to build hardware that refuses to boot a kernel which has not
been signed with a particular private key. That kernel could restrict
access to devices, or refuse outright to run applications which have not
also been signed with a given key. Such a kernel could take away all of
the control we would otherwise have over our systems whether we like it or
not. Yes, whoever distributes the kernel
must provide source, but, without the private key (and, thus, the ability
to create a signed, binary kernel), a Linux user cannot make changes and
get them to run on the target system.
Linus gives two reasons for his position: distributing signed binaries is
acceptable under the GPL, and he does not want to be in a position of
saying what can or cannot be done with the Linux kernel.
The GPL argument is interesting. Anybody who distributes a GPL-licensed
program in binary form must make the associated source available. That
source is defined by the GPL as:
The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus
any associated interface definition files, plus the scripts used to
control compilation and installation of the executable.
One could well question whether a private key used to sign the binary is
covered by this language. Most commenters seem to think that it is not.
If the GPL has nothing to say about keys, then the distribution of signed
binaries (without the associated private keys) is clearly within the bounds
of the license.
If a private key is considered part of the program's installation
scripts, there could be a problem. Linus has stated his opinion, but he
cannot speak for the others who hold copyrights on code in the kernel. One
of those people could conceivably mount a legal challenge should he or she
object to the signed binary distribution. Kernel hackers in general seem
uninclined to make this sort of challenge, but one never knows.
Linus's other reason - not wanting to regulate what others can do with
Linux - goes to the core of the philosophy of free software. Any free (or
open source) software definition will include a statement that the license
cannot discriminate based on the use of the software. The purpose is to
exclude licenses that, say, prohibit use by the military, by people with the
wrong religion, citizens of certain countries, or drinkers of light beer.
Similarly, Linus does not want to discriminate against those who would only
allow certain software to run on their systems.
Besides, the techniques which implement DRM can also be used to implement a
higher level of security for Linux users. A system that can only run
signed executables is certainly going to be more secure than one which will
run any binary presented to it. Some users may well want that kind of
security, and they should be able to have it. It would be difficult to
allow this sort of use while simultaneously forbidding DRM uses.
Ultimately, it comes down to what people are willing to buy. In an ideal
world, Linux-based systems which implement oppressive DRM schemes would
languish on the shelves, while those which are better suited to the needs
and wishes of their users will succeed. The sad fact is that things often
do not work that way; when products like DVD players, the Xbox, or Tivo are
what's available, that is what people will buy. The marketplace does not
work as well as one would like in this regard. But the GPL is not the tool
that can fix it.
Comments (22 posted)
[This article was contributed by Joe 'Zonker' Brockmeier]
The GNU Free
Documentation License (GFDL) may not be suitable if you're hoping to
have your documentation included in Debian "main."
The nature of the problem is described in this
proposed statement written by Anthony Towns. If adopted as an
"official" statement from the Debian project, GFDL-licensed documents will
find themselves excluded from the free portion of the Debian distribution.
The conflict between the GFDL and the Debian Free Software
Guidelines (DFSG) comes in when the author includes "Invariant"
sections or an Acknowledgements or Dedications section. These are described
in section 4 of the GFDL. Essentially, the GFDL requires that these
sections not be modified or removed, which goes against the (DFSG)
requirement that a license "must allow modifications and derived works."
One may avoid the conflict by simply not including the sections that are
troublesome, or by using another license. However, that may not satisfy some
authors and definitely doesn't solve the problem for documents already
accepted.
For many documents, this may not be a problem. If an author insists on
using the GFDL and one of the troublesome sections, users can simply
grab the documentation elsewhere or even as a Debian package just by
getting the package from the "non-free" collection of Debian packages.
However, when another program includes the documentation, it may make
things a bit trickier. According to Richard Braakman the GFDL puts a "wall between documentation and code."
The GFDL is incompatible with the GPL, and many of its requirements
don't translate well to functional software. This makes it difficult to
embed such documents into a program, for example in order to present
on-line help. In the other direction, many documents contain example
code, sometimes sizeable chunks of it, which will be unusable by default
unless specifically licensed otherwise.
Braakman also raises a few other issues that he considers problematic
with the GFDL. One that is interesting to note is the idea that
"languages other than English are poorly supported."
The GNU FDL defines special roles for several kinds of sections (such as
"History" and "Dedications"), but refers to these sections by their
names in English. A document under the GNU FDL will have to include a
section with the title "History", regardless of the language it's
written in.
One could ask whether the Debian project should make an exception for
documentation. The rules that apply to code may not work so well for
documentation, particularly when good documentation is even harder to
come by than good code. The Debian developers are not known for
compromising on their principles, however. It will be interesting to see
what the final
outcome of this discussion will be, but it looks entirely likely that
the Debian project may decide that one of the GNU Free licenses is, in
fact, not free enough.
Comments (6 posted)
The Linux Consultants Guide (once the Consultants HOWTO) is a longstanding
resource for Linux consultants who wish to get their names out to potential
clients. In recent times, this guide has been maintained by the folks at
Command Prompt; it is still
part of the Linux
Documentation Project collection.
It turns out that there is a price for being listed in the Guide, however:
commercial email from Command Prompt. This mail contains the following
text:
You have received this press release because you were are listed in
the Linux Consultants Guide database. If you do not wish to receive
communications from Command Prompt, Inc -- you may ask to be
removed from the Linux Consultants Guide.
The only way to avoid receiving spam from Command Prompt, in other words,
is to be removed from the Guide altogether.
We asked Command Prompt about this policy, and were told: "Nothing is
truly free, not even Linux. You have to pay somewhere, whether it be
mental/physical resources, money, time... but there is always a cost. Our
cost to our listers is communication." They also noted that this
policy "is not really published anywhere".
A commercial email every month or so could well be a fair price for
inclusion in the consultants database. But people should be informed of
the bargain before it is made. As it is, nobody who is receiving this
commercial mail has actually agreed to be on that list. Given that the
document's license also violates the Linux Documentation Project's
guidelines (it prohibits distribution in printed or modified form), one
could well ask if the Consultants Guide should still be part of the LDP
collection.
Comments (2 posted)
Page editor: Jonathan Corbet
Security
Brief items
As the spam situation continues to worsen, more people are looking farther
afield for potential solutions. Recently there has been a new surge in
interest in legal solutions. When all else fails, pass a law.
One of the
current approaches is the Lofgren law (backed by Lawrence Lessig)
which would require all spam to carry an "ADV:" tag in the subject
line. Recipients of untagged spam could report it to the U.S. Federal
Trade Commission, and, perhaps, receive a portion of any fines collected
from the spammer. The bill has numerous problems, including an overbroad
definition of "spam" and the fact that the FTC already is unable to do
anything about the vast number of complaints it receives.
The state of Virginia has taken things further with a law that makes
spamming with forged headers into a felony. Spammers could find themselves
spending the next five years contemplating the benefits of anatomical
enlargement in a prison cell. To qualify for this penalty, a spammer would
have to send out at least 10,000 messages with forged headers in a single
day.
Creating legal tools to shut down spammers may be helpful in a few cases,
but it is hard to see much long-term benefit coming from the legislative
approach. What reason is there to believe that the legal system will be
any more effective at shutting down spam than it is, say, at stopping the
distribution of DeCSS? Even after an international campaign making even
linking to DeCSS a crime, the DVD decryption software remains readily
accessible. When all a spammer needs is a dialup connection and an open
relay anywhere in the world, the effectiveness of any country's laws will
be limited.
Comments (8 posted)
New vulnerabilities
balsa: imap code buffer overflow
Comments (none posted)
Bugzilla: several vulnerabilities.
| Package(s): | bugzilla |
CVE #(s): | |
| Created: | April 30, 2003 |
Updated: | May 21, 2003 |
| Description: |
The Bugzilla bug tracking system has a new set of vulnerabilities which can
lead to cross-site scripting and symlink attacks. Versions 2.16.3 and
2.17.4 contain the necessary fixes; see this
advisory for the details. |
| Alerts: |
|
Comments (none posted)
Monkey HTTPd Remote Buffer Overflow
| Package(s): | monkeyd |
CVE #(s): | |
| Created: | April 28, 2003 |
Updated: | April 30, 2003 |
| Description: |
A buffer overflow vulnerability exists in Monkey's handling of forms
submitted with the POST request method. The unchecked buffer lies in the
PostMethod() procedure. The advisory contains more information. |
| Alerts: |
|
Comments (none posted)
PoPTop: remotely exploitable buffer overflow
| Package(s): | pptpd |
CVE #(s): | CAN-2003-0213
|
| Created: | April 28, 2003 |
Updated: | June 6, 2003 |
| Description: |
The PoPToP PPTP server contains a remotely exploitable buffer overflow;
read the full
advisory for more information. |
| Alerts: |
|
Comments (none posted)
squirrelmail: more cross-site scripting vulnerabilities
| Package(s): | squirrelmail |
CVE #(s): | CAN-2003-0160
|
| Created: | April 24, 2003 |
Updated: | June 4, 2003 |
| Description: |
SquirrelMail is a webmail package written in PHP. Multiple vulnerabilities
have been found which affect versions of SquirrelMail shipped with Red Hat
Linux 8.0 and Red Hat Linux 9.
Cross-site scripting vulnerabilities in SquirrelMail version 1.2.10 and
earlier allow remote attackers to execute script as other Web users via
mailbox displays, message displays, or search results displays. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0160 to these issues.
All users are advised to upgrade to these errata packages containing
SquirrelMail version 1.2.11, which is not vulnerable to these issues. |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
apache 2.x: denial of service
| Package(s): | apache |
CVE #(s): | CAN-2003-0132
|
| Created: | April 9, 2003 |
Updated: | May 1, 2003 |
| Description: |
Apache 2.0.x (for <= 44) have a denial of service vulnerability; Apache 2.0.45 fixes the problem. |
| Alerts: |
|
Comments (1 posted)
Heap corruption vulnerability in at
| Package(s): | at at, sudo, xchat |
CVE #(s): | CAN-2002-0004
|
| Created: | May 21, 2002 |
Updated: | May 15, 2003 |
| Description: |
The at command has a
potentially exploitable heap corruption bug.
(First LWN report: January 17th).
|
| Alerts: |
|
Comments (none posted)
bind buffer overflow vulnerability in DNS resolver libraries
| Package(s): | bind glibc |
CVE #(s): | CAN-2002-0651
CAN-2002-0684
|
| Created: | July 8, 2002 |
Updated: | October 1, 2003 |
| Description: |
The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1)
include fixes for a libc related vulnerability which does not
affect Linux. Updates from
the Internet Software Consortium (ISC)
are available from here.
No release or branch of Openwall GNU/*/Linux (Owl) is known to be
affected, due to Olaf Kirch's fixes for this problem getting into the
GNU C library more than two years ago.
Unfortunatly that does not mean that Linux systems are not vulnerable.
Similar code, without Olaf Firch's fixes,
is in the glibc getnetbyXXX functions.
These functions are described in the SuSE alert as
"
used by very few applications only, such as ifconfig and ifuser,
which makes exploits less likely."
CERT Advisory: CA-2002-19
Buffer Overflow in Multiple DNS Resolver Libraries
CAN-2002-0651
CAN-2002-0684 |
| Alerts: |
|
Comments (1 posted)
BitchX - denial of service
| Package(s): | BitchX |
CVE #(s): | |
| Created: | February 20, 2003 |
Updated: | May 26, 2003 |
| Description: |
From this Bugtraq posting:
A denial of service vulnerability exists in BitchX. Sending a malformed
RPL_NAMREPLY numeric 353 causes BitchX to segfault. This problem was
reported to panasync@efnet#bitchx on Jan 30 2003, as of this writing we are
unaware of any patches or workarounds provided by panasync and or any
members of #bitchx |
| Alerts: |
|
Comments (none posted)
Canna server: exploitable buffer overrun
| Package(s): | canna |
CVE #(s): | CAN-2002-1158
CAN-2002-1159
|
| Created: | December 10, 2002 |
Updated: | October 1, 2003 |
| Description: |
Canna is a kana-kanji conversion server which is necessary for Japanese
language character input.
A buffer overflow bug in the Canna server up to and including version 3.5b2
allows a local user to gain the privileges of the user 'bin' which could
lead to further exploits. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2002-1158 to this issue.
A lack of validation of requests has been found that affects Canna version
3.6 and earlier. A malicious remote user could exploit this vulnerability
to leak information, or cause a denial of service attack. (CAN-2002-1159)
See also
http://canna.sourceforge.jp/sec/Canna-2002-01.txt
CAN-2002-1158
CAN-2002-1159 |
| Alerts: |
|
Comments (none posted)
dvips: command execution vulnerability
| Package(s): | dvips |
CVE #(s): | CAN-2002-0836
|
| Created: | October 16, 2002 |
Updated: | June 10, 2003 |
| Description: |
The dvips utility uses the system() function improperly when managing fonts. An attacker who can craft the right sort of print job can use this vulnerability to execute commands under the UID used by the print system. |
| Alerts: |
|
Comments (none posted)
ethereal - format string vulnerability
| Package(s): | ethereal |
CVE #(s): | CAN-2003-0081
|
| Created: | March 10, 2003 |
Updated: | June 12, 2003 |
| Description: |
The SOCKS dissector in Ethereal 0.9.9 is susceptible to a format string
overflow. This vulnerability has been present in Ethereal since the SOCKS
dissector was introduced in version 0.8.7. It was discovered by Georgi
Guninski. Additionally, the NTLMSSP code is susceptible to a heap
overflow. All users of Ethereal 0.9.9 and below are encouraged to upgrade.
See the full
advisory for additional information. |
| Alerts: |
|
Comments (none posted)
evolution: multiple vulnerabilities
| Package(s): | Evolution |
CVE #(s): | CAN-2003-0128
CAN-2003-0129
CAN-2003-0130
|
| Created: | March 21, 2003 |
Updated: | May 14, 2003 |
| Description: |
Multiple vulnerabilities have been found in Ximian's Evolution Mail User
Agent, according to this
CoreLabs advisory.
"Three vulnerabilities were found that could lead to various forms of
exploitation ranging from denying to users the ability to read email,
provoke system unstability, bypassing security context checks for email
content and possibly execution of arbitrary commands on vulnerable
systems."
Ximian Evolution is a personal and
workgroup information management solution for Linux and UNIX-based
systems. The software integrates email, calendaring, meeting scheduling,
contact management, and task lists, in one application. |
| Alerts: |
|
Comments (1 posted)
Filename disclosure vulnerability in fam
| Package(s): | fam |
CVE #(s): | CAN-2002-0875
|
| Created: | August 19, 2002 |
Updated: | January 5, 2005 |
| Description: |
"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible. |
| Alerts: |
|
Comments (none posted)
fetchmail: buffer overflow
| Package(s): | fetchmail |
CVE #(s): | CAN-2002-1365
|
| Created: | December 17, 2002 |
Updated: | October 20, 2003 |
| Description: |
Versions of fetchmail prior to 6.2.0 have (yet another) buffer overflow vulnerability which can be exploited remotely via a suitably crafted message. See this advisory for details. |
| Alerts: |
|
Comments (3 posted)
file - memory allocation problem, stack overflow
| Package(s): | file |
CVE #(s): | CAN-2003-0102
|
| Created: | March 4, 2003 |
Updated: | June 4, 2003 |
| Description: |
Jeff Johnson found a memory allocation problem and David Endler found a
stack overflow corruption problem in the file "Automatic File Content
Type Recognition Tool" version 3.41. Nalin Dahyabhai improved ELF section
and program header handling in file version 3.40. The folks at OpenPKG
believe that file versions without those modifications are vulnerable to
memory allocation and stack overflow problems which put security at risk. |
| Alerts: |
|
Comments (none posted)
GNU fileutils race condition
| Package(s): | fileutils ucdsnmp |
CVE #(s): | CAN-2002-0435
|
| Created: | May 21, 2002 |
Updated: | May 16, 2003 |
| Description: |
A race
condition in rm may cause the root user to delete the whole filesystem.
The problem exists in the version of rm in
fileutils
4.1 stable and 4.1.6 development version. A patch
is available.
(First LWN
report: May 2).
|
| Alerts: |
|
Comments (none posted)
gkrellm-newsticker - multiple vulnerabilities
| Package(s): | gkrellm-newsticker |
CVE #(s): | CAN-2003-0205
CAN-2003-0206
|
| Created: | April 23, 2003 |
Updated: | April 23, 2003 |
| Description: |
gkrellm-newsticker has two vulnerabilities: a denial of service problem and a failure to filter shell metacharacters which can allow an attacker to run arbitrary commands by way of a hostile (or compromised) news feed. |
| Alerts: |
|
Comments (none posted)
Potential remote root exploit in glibc
| Package(s): | glibc |
CVE #(s): | CAN-2002-0391
|
| Created: | August 14, 2002 |
Updated: | June 30, 2003 |
| Description: |
Felix von Leitner, discovered a
potential division by zero bug in
code derived from the SunRPC library which is used in glibc.This bug could be
exploited to gain unauthorized root access to software linking to glibc.
Updating as soon as practical is a good idea.
Because SunRPC-derived XDR libraries are used by a variety of vendors in a variety of applications, this defect may lead to a number of differing security problems. Exploiting this vulnerability will lead to denial of service, execution of arbitrary code, or the disclosure of sensitive information.
CERT/CC Vulnerability Note VU#192995 Integer
overflow in xdr_array() function when deserializing the XDR stream
|
| Alerts: |
|
Comments (none posted)
glibc: DNS stub resolvers contain buffer overflow vulnerability
| Package(s): | glibc |
CVE #(s): | CAN-2002-1146
|
| Created: | November 7, 2002 |
Updated: | February 5, 2004 |
| Description: |
DNS stub resolvers from multiple vendors contain a buffer overflow
vulnerability. The impact of this vulnerability appears to be limited to
denial of service. (See CERT Vulnerability Note
VU#738331)
The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such
as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer
size instead of the actual size when processing a DNS response, which
causes the stub resolvers to read past the actual boundary ("read buffer
overflow"), allowing remote attackers to cause a denial of service
(crash).
|
| Alerts: |
|
Comments (none posted)
glibc: integer overflow in the xdrmem_getbytes() function
| Package(s): | glibc krb5 dietlibc |
CVE #(s): | CAN-2003-0028
|
| Created: | March 21, 2003 |
Updated: | May 27, 2003 |
| Description: |
An integer overflow in the xdrmem_getbytes() function, and possibly other
functions, of XDR (external data representation) libraries derived from
SunRPC, including libnsl, libc, and glibc, allows remote attackers to
execute arbitrary code via certain integer values in length fields
See
CAN-2003-0028 and CERT advisory
CA-2003-10 for more information. |
| Alerts: |
|
Comments (3 posted)
gtkhtml: malformed messages cause crash
| Package(s): | gtkhtml |
CVE #(s): | CAN-2003-0133
CAN-2003-0541
|
| Created: | April 14, 2003 |
Updated: | April 18, 2005 |
| Description: |
GtkHTML is the HTML rendering widget used by the Evolution mail reader.
GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug
when handling HTML messages. Alan Cox discovered that certain malformed
messages could cause the Evolution mail component to crash. |
| Alerts: |
|
Comments (none posted)
IMP - SQL injection vulnerability
| Package(s): | imp |
CVE #(s): | CAN-2003-0025
|
| Created: | January 15, 2003 |
Updated: | July 8, 2003 |
| Description: |
The IMP IMAP server, versions 2.2.8 and prior, is vulnerable to SQL
injection; see this advisory for details.
Version 3.x is not vulnerable to this problem. |
| Alerts: |
|
Comments (1 posted)
kde: arbitrary code execution
| Package(s): | kde |
CVE #(s): | CAN-2003-0204
|
| Created: | April 10, 2003 |
Updated: | June 30, 2003 |
| Description: |
The KDE Security team has issued an advisory
on a vulnerability present in all versions of KDE that allow a remote
attacker to execute arbitrary commands under your account. KDE 3.0.5b and
KDE 3.1.1a have been released to address this problem. For KDE 2.2.2
patches to the KDE 2.2.2 sources have been made available.
KDE uses Ghostscript software for processing of PostScript (PS) and PDF
files in a way that allows for the execution of arbitrary commands that can
be contained in such files.
An attacker can prepare a malicious PostScript or PDF file which will
provide the attacker with access to the victim's account and privileges
when the victim opens this malicious file for viewing or when the victim
browses a directory containing such malicious file and has file previews
enabled.
An attacker can provide malicious files remotely to a victim in an e-mail,
as part of a webpage, via an ftp server and possible other means. |
| Alerts: |
|
Comments (none posted)
kerberos - cryptographic weakness
| Package(s): | kerberos, heimdal, openafs |
CVE #(s): | CAN-2003-0138
CAN-2003-0139
|
| Created: | March 26, 2003 |
Updated: | May 27, 2003 |
| Description: |
Version 4 of the Kerberos protocol contains a cryptographic weakness which enables a chosen-plaintext attack. A suitably equipped attacker can impersonate any principal in the realm. Another weakness allows the creation of false Kerberos tickets. Given the weaknesses in the cryptography, cross-realm authentication cannot be performed in a secure way.
OpenAFS
kaserver implements version 4 of the Kerberos protocol, and therefore
is also vulnerable. |
| Alerts: |
|
Comments (none posted)
kernel - ptrace-related vulnerability
| Package(s): | kernel |
CVE #(s): | CAN-2003-0127
|
| Created: | March 17, 2003 |
Updated: | June 30, 2003 |
| Description: |
Versions 2.2.x and 2.4.x of the Linux kernel contain a vulnerability in
ptrace() which may be exploited by a local user to obtain root
access. This announcement contains the
details and a patch for 2.4.20. For 2.2 users, 2.2.25 has been released
which contains the fix. |
| Alerts: |
|
Comments (none posted)
kernel-utils: setuid vulnerability
| Package(s): | kernel-utils |
CVE #(s): | CAN-2003-0019
|
| Created: | February 7, 2003 |
Updated: | January 21, 2005 |
| Description: |
The kernel-utils package contains several utilities that can be used to
control the kernel or machine hardware. In Red Hat Linux 8.0 this package
contains user mode linux (UML) utilities.
The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was
incorrectly shipped setuid root. This could allow local users to control
certain network interfaces, add and remove arp entries and routes, and put
interfaces in and out of promiscuous mode.
All users of the kernel-utils package should update to these packages that
contain a version of uml_net that is not setuid root.
Alternatively, as a work-around to this vulnerability issue the following
command as root:
chmod -s /usr/bin/uml_net |
| Alerts: |
|
Comments (none posted)
libpng, libpng3: buffer overflow
| Package(s): | libpng, libpng3 |
CVE #(s): | CAN-2002-1363
|
| Created: | December 19, 2002 |
Updated: | July 14, 2004 |
| Description: |
Glenn Randers-Pehrson discovered a problem in connection with 16-bit
samples from libpng, an interface for reading and writing PNG
(Portable Network Graphics) format files. The starting offsets for
the loops are calculated incorrectly which causes a buffer overrun
beyond the beginning of the row buffer. |
| Alerts: |
|
Comments (none posted)
LPRng: insecure temporary file
| Package(s): | LPRng |
CVE #(s): | CAN-2003-0136
|
| Created: | April 14, 2003 |
Updated: | June 16, 2003 |
| Description: |
Karol Lewandowski discovered that psbanner, a printer filter that
creates a PostScript format banner and is part of LPRng, insecurely
creates a temporary file for debugging purpose when it is configured
as filter. The program does not check whether this file already
exists or is linked to another place writes its current environment
and called arguments to the file unconditionally with the user id
daemon. |
| Alerts: |
|
Comments (none posted)
lprold - buffer overflow in lprm
| Package(s): | lprold lpd |
CVE #(s): | CAN-2003-0144
|
| Created: | March 13, 2003 |
Updated: | May 28, 2003 |
| Description: |
The lprm command of the printing package lprold contains a buffer
overflow. This buffer overflow can be exploited by a local user, if the
printer system is set up correctly, to gain root privileges. |
| Alerts: |
|
Comments (none posted)
lynx: CRLF injection vulnerability
| Package(s): | lynx |
CVE #(s): | CAN-2002-1405
|
| Created: | November 19, 2002 |
Updated: | October 1, 2003 |
| Description: |
If lynx is given a url with some special characters on the command line, it
will include faked headers in the HTTP query. This feature can be used to
force scripts (that use Lynx for downloading files) to access the wrong
site on a web server with multiple virtual hosts.
CAN-2002-1405 |
| Alerts: |
|
Comments (none posted)
perl-MailTools: remote command execution
| Package(s): | MailTools |
CVE #(s): | CAN-2002-1271
|
| Created: | November 5, 2002 |
Updated: | September 19, 2003 |
| Description: |
The SuSE Security Team reviewed critical Perl modules, including the
Mail::Mailer package. This package contains a security hole which allows
remote attackers to execute arbitrary commands in certain circumstances.
This is due to the usage of mailx as default mailer which allows commands
to be embedded in the mail body.
Note that mail processing programs which use this package can be affected by this vulnerability; in particular, SpamAssassin is vulnerable if you use the -r or -w flags.
|
| Alerts: |
|
Comments (none posted)
man - code execution vulnerability
| Package(s): | man |
CVE #(s): | CAN-2003-0124
|
| Created: | March 19, 2003 |
Updated: | May 7, 2003 |
| Description: |
Versions of man prior to 1.51 contain a code execution vulnerability which can be exploited by a carefully crafted man file. See this advisory for the details. |
| Alerts: |
|
Comments (none posted)
mgetty spool permission
| Package(s): | mgetty |
CVE #(s): | CAN-2002-1391
CAN-2002-1392
|
| Created: | April 8, 2003 |
Updated: | May 13, 2003 |
| Description: |
mgetty is a getty replacement for use with data and fax modems.
mgetty can be configured to run an external program to decide whether or
not to answer an incoming call based on Caller ID information. Unpatched
versions of mgetty prior to 1.1.29 would overflow an internal buffer if the
caller name reported by the modem was too long.
Additionally, the faxspool script supplied with versions of mgetty prior to
1.1.29 used a simple permissions scheme to allow or deny fax transmission
privileges. This scheme was easily circumvented because the spooling
directory used for outgoing faxes was world-writable. |
| Alerts: |
|
Comments (none posted)
micq: Denial of service
| Package(s): | micq |
CVE #(s): | |
| Created: | December 13, 2002 |
Updated: | April 24, 2003 |
| Description: |
Rüdiger Kuhlmann, upstream developer of mICQ, a text based ICQ client,
discovered a problem in mICQ. Receiving certain ICQ message types
that do not contain the required 0xFE seperator causes all versions to
crash. |
| Alerts: |
|
Comments (none posted)
mime-support: insecure temporary file creation
| Package(s): | mime-support |
CVE #(s): | |
| Created: | April 22, 2003 |
Updated: | April 30, 2003 |
| Description: |
Colin Phipps discovered several problems in mime-support, that contains
support programs for the MIME control files 'mime.types' and 'mailcap'.
When a temporary file is to be used it is created insecurely, allowing
an attacker to overwrite arbitrary under the user id of the person
executing run-mailcap, most probably root. Additionally the program did
not properly escape shell escape characters when executing a command.
This is unlikely to be exploitable, though. |
| Alerts: |
|
Comments (none posted)
mysql - configuration file vulnerability
| Package(s): | mysql mysqld |
CVE #(s): | CAN-2003-0150
|
| Created: | March 18, 2003 |
Updated: | May 16, 2003 |
| Description: |
According to a
report on BugTraq, a vulnerability exists in
version 3.23.55 and earlier versions of the MySQL server. If the MySQL server is
launched by root, as it is often done by system startup scripts, any
database users with the "FILE" privilege can write a configuration file
(usually my.cnf) that causes the MySQL server to run under an arbitrary
user id, including the user id of the super-user, on the next restart. |
| Alerts: |
|
Comments (none posted)
nethack: buffer overflow
| Package(s): | nethack, slashem, falconseye |
CVE #(s): | CAN-2003-0358
CAN-2003-0359
|
| Created: | February 18, 2003 |
Updated: | July 15, 2003 |
| Description: |
Overflowing a buffer in nethack may lead to privilege escalation to games
uid.
Read the the full advisory for the details.
Note that falconseye does not contain the file permission error
CAN-2003-0359 which affected some other nethack packages. |
| Alerts: |
|
Comments (none posted)
NetPBM: math overflow errors
| Package(s): | NetPBM |
CVE #(s): | CAN-2003-0146
|
| Created: | March 17, 2003 |
Updated: | May 27, 2003 |
| Description: |
Al Viro and Alan Cox discovered several maths overflow errors in
NetPBM, a set of graphics conversion tools. These programs are not
installed setuid root but are often installed to prepare data for
processing. These vulnerabilities may allow remote attackers to cause
a denial of service or execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
netscape-flash: buffer overflow
| Package(s): | netscape-flash |
CVE #(s): | |
| Created: | March 10, 2003 |
Updated: | June 20, 2003 |
| Description: |
Potentially exploitable buffer overflows exist in the Macromedia Flash
Player. The full advisory is here.
"The cumulative security patch is available today and addresses the
potential for exploits surrounding buffer overflows (read/write) and
sandbox integrity within the player, which might allow malicious users to
gain access to a user's computer. The possibility of running native code on
a users machine is a theoretical exploit, and extremely difficult to
execute in practice. There are no known examples of running such native
code from Macromedia Flash movies; however, even though this issue is
difficult and theoretical in nature only, we are encouraging users to
upgrade." |
| Alerts: |
|
Comments (none posted)
net-snmp: denial of service vulnerability
| Package(s): | net-snmp |
CVE #(s): | CAN-2002-1170
|
| Created: | December 17, 2002 |
Updated: | November 7, 2003 |
| Description: |
The SNMP daemon included in the Net-SNMP package versions 5.0.1 through
5.0.4 can be caused to crash if it is sent a specially crafted packet. |
| Alerts: |
|
Comments (none posted)
openssl: local and remote extraction of RSA private key
| Package(s): | openssl, apache, mod_ssl |
CVE #(s): | CAN-2003-0147
|
| Created: | March 18, 2003 |
Updated: | May 22, 2003 |
| Description: |
David Brumley and Dan Boneh of Stanford University have researched and
documented a timing attack on OpenSSL which allows local and remote
attackers to extract the RSA private key of a server. The OpenSSL RSA
implementation is generally vulnerable to these type of attacks unless RSA
blinding has been turned on. See this
paper (pdf format) for additional details.
Typically, RSA blinding is not enabled by OpenSSL based applications,
mainly because it is not obvious how to do so when using OpenSSL to provide
SSL/TLS. This problem affects mostly all applications using OpenSSL and
have to be rebuilded against the fixed OpenSSL version (where RSA blinding
is now enabled by default) or have to enable RSA blinding explicitly their
own.
The performance impact of RSA blinding appears to be small (a few percent
only) and the RSA functionality is still fully compatible. The Common
Vulnerabilities and Exposures (CVE) project assigned the id
CAN-2003-0147 to the problem. |
| Alerts: |
|
Comments (none posted)
pam_xauth: root exploit
| Package(s): | pam_xauth |
CVE #(s): | CAN-2002-1160
|
| Created: | February 13, 2003 |
Updated: | July 10, 2003 |
| Description: |
The pam_xauth module is used to forward xauth information from user to user
in applications such as 'su'.
Andreas Beck discovered that versions of pam_xauth supplied with Red Hat
Linux since version 7.1 would forward authorization information from the
root account to unprivileged users. This could be used by a local attacker
to gain access to an administrator's X session. In order to exploit this
vulnerability, the attacker would have to get the administrator, as root,
to use su to the account belonging to the attacker. |
| Alerts: |
|
Comments (none posted)
PHP: vulnerability in mail function
| Package(s): | php |
CVE #(s): | CAN-2002-0985
CAN-2002-0986
|
| Created: | November 13, 2002 |
Updated: | October 1, 2003 |
| Description: |
Two vulnerabilities exists in the mail() PHP function. The first one allows
the execution of any program/script bypassing safe_mode restriction, the
second one may give an open-relay script if the mail() function is not
carefully used in PHP scripts. See this Bugtraq
report for more details. Note that this is a different vulnerability than the previous PHP mail() problem, which affected versions through 4.1.0.
CAN-2002-0985
CAN-2002-0986 |
| Alerts: |
|
Comments (none posted)
PostgreSQL - more buffer overflows
| Package(s): | postgresql |
CVE #(s): | |
| Created: | February 12, 2003 |
Updated: | November 7, 2003 |
| Description: |
A new set of buffer overflows has been discovered in PostgreSQL 7.2.2; they affect the circle_poly(), path_encode(), and path_addr() functions. Exploiting these overflows requires that the attacker first obtain a connection to the PostgreSQL server. |
| Alerts: |
|
Comments (1 posted)
Local arbitrary code execution vulnerability in Python
| Package(s): | python |
CVE #(s): | CAN-2002-1119
|
| Created: | August 28, 2002 |
Updated: | October 1, 2003 |
| Description: |
Zack Weinberg discovered that
os._execvpe from os.py uses a predictable name which could lead
to execution of arbitrary code. According to the Debian
advisory, the problem
was present in Python versions 1.5, 2.1 and 2.2.
CAN-2002-1119 |
| Alerts: |
|
Comments (none posted)
rinetd: incorrect memory resizing
| Package(s): | rinetd |
CVE #(s): | CAN-2003-0212
|
| Created: | April 17, 2003 |
Updated: | April 23, 2003 |
| Description: |
Sam Hocevar discovered a security problem in rinetd, an IP connection
redirection server. When the connection list is full, rinetd resizes the
list in order to store the new incoming connection. However, this is done
improperly, resulting in a denial of service and potentially execution of
arbitrary code. |
| Alerts: |
|
Comments (none posted)
Multiple-use vulnerability in Safe.pm
| Package(s): | Safe.pm |
CVE #(s): | CAN-2002-1323
|
| Created: | October 9, 2002 |
Updated: | February 20, 2004 |
| Description: |
usePerl has a
description of a vulnerability in the Safe.pm Perl module. It seems
that if a Safe compartment is used more than once, it ceases to be safe.
The problem is fixed in Safe 2.08. |
| Alerts: |
|
Comments (none posted)
samba: remotely-exploitable buffer overrun
| Package(s): | samba |
CVE #(s): | CAN-2003-0201
CAN-2003-0196
|
| Created: | April 7, 2003 |
Updated: | May 2, 2003 |
| Description: |
Digital Defense Inc. has sent out an
advisory describing another remotely-exploitable buffer overrun in the
Samba server; all versions through 2.2.8 or 2.0.10 (or Samba-TNG 0.3.2) are
vulnerable. The Samba team has released Samba
2.2.8a with a fix for the problem; there is also a patch available for
the 2.0 series. An exploit is said to be circulating already, so applying
patches quickly would be a good idea. |
| Alerts: |
|
Comments (none posted)
sendmail - buffer overrun
| Package(s): | sendmail |
CVE #(s): | CAN-2003-0161
|
| Created: | March 31, 2003 |
Updated: | April 30, 2003 |
| Description: |
There is yet another buffer overrun in sendmail; this one was discovered by Michal Zalewski.
From the CERT Advisory:
"There is a vulnerability in sendmail that can be exploited to cause
a denial-of-service condition and could allow a remote attacker to
execute arbitrary code with the privileges of the sendmail daemon,
typically root." Sendmail 8.12.9 was released with a fix for the problem. |
| Alerts: |
|
Comments (none posted)
slocate - buffer overflow
| Package(s): | slocate |
CVE #(s): | CAN-2003-0056
|
| Created: | February 5, 2003 |
Updated: | May 8, 2003 |
| Description: |
version 2.6 (at least) of slocate contains a buffer overflow vulnerability which could lead to a local exploit; see this advisory for the details.
|
| Alerts: |
|
Comments (none posted)
snort - multiple vulnerabilities
| Package(s): | snort |
CVE #(s): | CAN-2003-0029
CAN-2003-0033
|
| Created: | April 23, 2003 |
Updated: | May 7, 2003 |
| Description: |
Versions of the snort intrusion detection system through 2.0-rc1 contain buffer and heap overflow vulnerabilities which could lead to remote code execution. Sites running snort are advised to upgrade to 2.0.0 as soon as possible; see this CERT advisory for more information. |
| Alerts: |
|
Comments (none posted)
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip |
CVE #(s): | CAN-2001-1267
CAN-2001-1268
CAN-2001-1269
CAN-2002-0399
|
| Created: | October 1, 2002 |
Updated: | April 10, 2006 |
| Description: |
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability. |
| Alerts: |
|
Comments (1 posted)
tcpdump - infinite loop
| Package(s): | tcpdump |
CVE #(s): | CAN-2003-0108
|
| Created: | February 28, 2003 |
Updated: | May 1, 2003 |
| Description: |
Andrew Griffiths and iDEFENSE Labs discovered a problem in tcpdump, a
powerful tool for network monitoring and data acquisition. An
attacker is able to send a specially crafted network packet which
causes tcpdump to enter an infinite loop.
In addition to the above problem the tcpdump developers discovered a
potential infinite loop when parsing malformed BGP packets. They also
discovered a buffer overflow that can be exploited with certain
malformed NFS packets. |
| Alerts: |
|
Comments (none posted)
Multiple vendor telnetd vulnerability
| Package(s): | telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5 |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | October 5, 2004 |
| Description: |
This vulnerability,
originally thought to be confined to BSD-derived systems, was first covered
in the July 26th Security
Summary. It is now known that Linux telnet daemons are vulnerable as
well.
|
| Alerts: |
|
Comments (none posted)
typespeed: buffer overflow
| Package(s): | typespeed |
CVE #(s): | |
| Created: | January 1, 2003 |
Updated: | June 17, 2003 |
| Description: |
A problem has been discovered in the typespeed, a game that lets you
measure your typematic speed. By overflowing a buffer a local
attacker could execute arbitrary commands under the group id games. |
| Alerts: |
|
Comments (none posted)
vim - modeline vulnerability
| Package(s): | vim |
CVE #(s): | CAN-2002-1377
|
| Created: | January 16, 2003 |
Updated: | February 10, 2004 |
| Description: |
VIM allows a user to set the modeline differently for each edited text file
by placing special comments in the files. Georgi Guninski found that these
comments can be carefully crafted in order to call external programs. This
could allow an attacker to create a text file such that when it is opened
arbitrary commands are executed. |
| Alerts: |
|
Comments (4 posted)
vixie-cron: Local vulnerability
| Package(s): | vixie-cron |
CVE #(s): | CVE-2001-0559
|
| Created: | April 17, 2003 |
Updated: | October 3, 2003 |
| Description: |
From the ISS
advisory:
"Vixie Cron is a scheduling daemon that ships with several Linux
distributions. Vixie Cron version 3.0pl1 could allow a local attacker to
gain root privileges. Crontab fails to properly drop privileges in certain
cases after a crontab modification operation. A local attacker could
exploit this vulnerability to gain root privileges on the system since
crontab is installed setuid root."
Note: this vulnerability is dated May 07 2001, and was first mentioned in
LWN on the May 10,
2001 security page. |
| Alerts: |
|
Comments (none posted)
vnc - replay and cookie vulnerabilities
| Package(s): | vnc |
CVE #(s): | CAN-2002-1336
CAN-2002-1511
|
| Created: | February 21, 2003 |
Updated: | May 5, 2003 |
| Description: |
VNC is a tool for providing a remote graphical user interface. Two
vulnerabilities have been found in versions of VNC shipped by Red Hat.
The VNC server acts as an X server, but the script for starting it
generates an MIT X cookie (which is used for X authentication) without
using a strong enough random number generator. This could allow an
attacker to be able to more easily guess the authentication cookie.
The VNC DES authentication scheme is implemented using a challenge-response
architecture, producing a random and different challenge for each
authentication attempt. A bug in the function for generating the random
challenge caused the random seed to get reset to the current time on every
authentication attempt. Therefore, two authentication attempts within the
same second could receive the same challenge. An eavesdropper could
exploit this vulnerability by replaying the response, thereby gaining
authentication.
All users of VNC are advised to upgrade to these erratum packages, which
contain patches to correct these issues. |
| Alerts: |
|
Comments (none posted)
wget:directory traversal bug
| Package(s): | wget |
CVE #(s): | CAN-2002-1344
|
| Created: | December 10, 2002 |
Updated: | October 1, 2003 |
| Description: |
Versions of wget prior to 1.8.2-4 contain a bug that permits a malicious
FTP server to create or overwrite files anywhere on the local file system.
FTP clients must check to see if an FTP server's response to the NLST
command includes any directory information along with the list of filenames
required by the FTP protocol (RFC 959, section 4.1.3).
If the FTP client fails to do so, a malicious FTP server can send filenames
beginning with '/' or containing '/../' which can be used to direct a
vulnerable FTP client to write files (such as .forward, .rhosts, .shosts,
etc.) that can then be used for later attacks against the client machine.
See also
this Bugtraq article from 1997.
CAN-2002-1344 |
| Alerts: |
|
Comments (none posted)
Problems with libgtop_daemon
| Package(s): | wuftpd libgtop |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | May 7, 2003 |
| Description: |
The libgtop_daemon package is a GNOME
program which makes system information available remotely.
LWN reported the remotely exploitable format
string and buffer overflow vulnerabilities in that package
on December 6th.
On November 28th
disabling the libgtop_daemon on systems where it is running until
an update is available.
Many Linux systems do not run
libgtop by default, but applying the update is a good idea anyway.
|
| Alerts: |
|
Comments (1 posted)
Wwwoffle remote privilege escalation vulnerability
| Package(s): | wwwoffle |
CVE #(s): | CAN-2002-0818
|
| Created: | August 14, 2002 |
Updated: | October 1, 2003 |
| Description: |
The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests
with negative Content Length values.
"It is believed
that an attacker could exploit this bug to gain remote wwwrun access
to the system wwwoffled is running on."
CAN-2002-0818 |
| Alerts: |
|
Comments (none posted)
zlib 1.1.4 has buffer overrun
| Package(s): | zlib |
CVE #(s): | CAN-2003-0107
|
| Created: | February 25, 2003 |
Updated: | April 29, 2003 |
| Description: |
From this Bugtraq
posting:
"zlib contains a function called gzprintf(). This is similar in
behaviour to fprintf() except that by default, this function will smash the
stack if called with arguments that expand to more than Z_PRINTF_BUFSIZE
(=4096 by default) bytes." |
| Alerts: |
|
Comments (none posted)
Events
The Chaos Communication Club Camp is happening near Berlin on August 7
through 10. The call for papers has gone out, with papers due by
July 1. "
Lectures are expected to be highly relevant in practice or better be
darn funny. Sales droids have been known to disappear without traces
on past events."
Full Story (comments: none)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current development kernel remains 2.5.68; Linus has made no
releases since April 19. His BitKeeper repository is full of new
patches, however, including a FireWire update, some IDE cleanups, more
devfs cleanups, a rework of the driver core class code, some new libfs
helpers which make it easier to create in-kernel virtual filesystems, a big
tty layer cleanup, a change to the interrupt handler prototype (see
last week's LWN Kernel Page),
runtime barrier instruction patching (which allows optimal
performance on different processors without the need to ship multiple
kernels), more preparation for an expanded dev_t type,
some swapoff improvements, a new set of memory allocation flags (also
covered last week), and numerous other fixes and updates.
The current stable kernel is 2.4.20; Marcelo has promised a second
2.4.21 release candidate shortly, but it had not been sent out as of this
writing.
The current 2.4 prepatch from Alan Cox is 2.4.20-rc1-ac3; it includes a merge of the XFS
filesystem, the current ACPI code, and the usual collection of fixes and
updates.
Comments (none posted)
Kernel development news
One of the important steps in getting a 2.6.0 release out the door is
creating an organized list of crucial outstanding issues. For this
development cycle, that job seems to have fallen to Andrew Morton, who has
posted
the first version of a "must-fix"
list for 2.6.0. It's a long list, even though it does not include routine
bugs kept in the
kernel bugzilla
system.
Many of the outstanding issues can be found in the block I/O subsystem -
not surprising, considering how much things have changed there. RAID
(especially RAID0) still has some problems with large requests. CD burning
can still hang. IDE tagged command queueing still does not work correctly;
the solution here may be to just take it out for 2.6. Work in I/O
schedulers is still ongoing; some of the schedulers could use some
improvement, and there needs to be a mechanism for choosing between them.
The floppy driver is still bug-ridden. And the IDE subsystem still has a
long list of things that need to be fixed.
In the filesystem arena, ext3 still lacks a working data=journal
mode. ext3 also still uses the big kernel lock, with significant work
required for its removal. There are race conditions with asynchronous I/O and
truncate() which can corrupt filesystems. NFS still has a number
of outstanding issues.
Networking has a potential deadlock for UDP applications. IPSec has a
number of outstanding problems including a substandard key management
implementation, "mysterious TCP hangs," the lack of an MPLS implementation, and incomplete IPv6
support.
In the kernel core, there are still complaints about poor interactive
response out of the new scheduler. The memory overcommit accounting is not
as accurate as it needs to be. There are still some issues with the
reverse-mapping VM (and the later object-based rmap patch) which can lead
to performance problems in some situations.
Then, there is still the 64-bit dev_t work; "...with the recent
rise of the neo-viro I'm not sure where things are at."
Power management still needs quite a bit of work. Much of the power
management core code remains to be merged, there needs to be a user-space
interface for power state transitions, and quite a bit of device support
work needs to be done. Restoration of video state appears to be
particularly tricky. There is also an effort afoot to rewrite the software
suspend code in a better way.
An issue which should not be overlooked is the large number of fixes from
the 2.4 series which have not yet made it into 2.5. Those all need to be
pulled together, ported forward, and merged.
The above is a summary; the full list is rather longer. But, then, these
lists are always long until the release gets close.
Comments (4 posted)
The software suspend patch was first merged in 2.5.18. It offers the
ability to suspend any Linux system to disk, whether that system has
hardware suspend support or not. It works by doing the following:
- Each process in the system is given (what looks like) a special
"freeze" signal. The process responds by going into the STOPPED
state.
- As much memory as possible is freed up within the system. Caches
are shrunk, user pages are forced out, etc.
- Pending disk writes are flushed out. Sort of.
- Each device on the system is put into the suspend state - at least,
those which support power management functions are.
- Control goes off into an uncommented assembly routine called
do_magic(). It arranges to find a swap partition to use,
creates a "page directory" containing a copy of each in-use page on
the system, writes the whole mess to the system swap partition (which
requires unsuspending the devices, then suspending them again), and
finally powers down.
When the system is next booted, it detects the saved image in the swap
partition and reverses the above process. If all goes well, the system
comes back to life looking mostly as it did before being suspended. It all
seems like a reasonable system if you don't mind that it does not work on
SMP boxes, it does not work with high memory, it only works on the x86
architecture, and it requires an adequately-sized swap partition (a regular
swap file can lead to corruption on some filesystems). It also fails badly
if it cannot find enough swap space to save the system image.
Work is in progress to address some of these issues. The swap space
problem, for example, could be easily solved by simply setting aside a
special partition for saving the system image. Many other systems work
that way now. Given the size of modern disks, setting aside a partition
with enough room to hold the system's RAM should not be that big of a
deal.
Saving to a swap file is a harder problem. Before the system can be
resumed, the host filesystem must be mounted so that the swap file can be
accessed. If a journaling filesystem is involved, remounting will clean
out the journal, making changes to the filesystem. Once the system image
is restored, however, the kernel will expect the filesystem to be in its
previous state -
before the journal was replayed. And that leads to filesystem corruption.
Possible solutions include remembering block numbers for the swap file (as
lilo does for kernel images) or setting up a way to mount the filesystem
without replaying the journal.
In the end, however, what may really happen is that most of the current
suspend code will be replaced. Patrick Mochel is working on a general power
management framework for Linux (that was, after all, the original purpose
of all that driver model work he has been doing). Included therein is a
flexible suspend implementation that can be tuned to the needs of the user
and the abilities of the hardware; if the hardware can save and restore
memory itself, there's little point in having the kernel duplicate that
ability.
So, in the new scheme, suspending (and resuming) the system becomes another
set of operations that can be hidden behind a structure full of function
pointers. Systems which can handle power management entirely through ACPI
calls run with one set of operations, while those requiring the software
suspend capability can have it. As part of this work, the software suspend
code has been substantially reworked and cleaned up. At this point,
though, the basic technique used by the code is the same, and it will
suffer from many of the same problems.
This work is not yet complete, however; expect it to be improved further
before heading toward the mainline 2.5 kernel. Those wanting to look at
Patrick's work can get it with BitKeeper at
ldm.bkbits.net/linux-2.5-power; your editor is not aware of a
non-BK copy available at this time.
Comments (1 posted)
Driver porting
Much of the core network driver API has not been changed between the 2.4
and 2.6 kernels. With only a relatively small amount of work, most drivers
should function just fine under 2.6. If, however, you want to get the very
best performance out of high-bandwidth network cards, you may have to make
more extensive changes to your driver to work with the new APIs which have
been made available.
Network device allocation
In 2.6, network devices are part of the wider kernel device model. There
are advantages to this change, including the fact that network device
information is available under
/sys/class/net/. But hooking into
the driver model poses a new set of potential race conditions which were
not there before. What happens if your driver module is removed while a
process has an associated sysfs file open? Network drivers are more
susceptible than most to this problem because the networking subsystem does
not restrict the unloading of drivers via the module use count.
The only way to properly deal with this problem is to allocate network
devices in a dynamic manner, and to let the device model code figure out
when to free them. To that end, all net_device structures must be
allocated with the new alloc_netdev() function:
struct net_device *alloc_netdev(int sizeof_priv, const char *name,
void (*setup)(struct net_device *));
Here, sizeof_priv is the size of the structure that you would
otherwise allocate and assign to the net_device priv
field; alloc_netdev() will allocate that memory for you as well.
name is the name of the device (a format string is acceptible, so
something like "eth%d" works), and setup is a function to
be called to complete the initialization of the net_device
structure. The setup function can be the same function that, in
older drivers, you may have assigned to the init field in the
net_device structure.
For Ethernet devices, there is a simpler form:
struct net_device *alloc_etherdev(int sizeof_priv);
Calling this function is equivalent to:
my_dev = alloc_netdev(sizeof(my_priv), "eth%d", setup_ether);
Either way, when you are done with the device (i.e. after you have called
unregister_netdev()), you must free it with:
void free_netdev(struct net_device *dev);
Note that it would be an error to free the priv field separately -
let free_netdev() take care of it.
NAPI
The most significant change, perhaps, is the addition of NAPI ("New API"),
which is designed to improve the performance of high-speed networking.
NAPI works through:
- Interrupt mitigation. High-speed networking can create thousands of
interrupts per second, all of which tell the system something it
already knew: it has lots of packets to process. NAPI allows drivers
to run with (some) interrupts disabled during times of high traffic,
with a corresponding decrease in system load.
- Packet throttling. When the system is overwhelmed and must drop
packets, it's better if those packets are disposed of before much
effort goes into processing them. NAPI-compliant drivers can often
cause packets to be dropped in the network adapter itself, before the
kernel sees them at all.
- More careful packet treatment, with special care taken to avoid
reordering packets. Out-of-order packets can be a significant
performance bottleneck.
NAPI was also backported to the 2.4.20 kernel.
The following is a whirlwind tour of what must be done to create a
NAPI-compliant network driver. More details can be found in
networking/NAPI_HOWTO.txt in the kernel documentation directory,
and, of course, in the source of drivers which have been converted. Note
that use of NAPI is entirely optional, drivers will work just fine (though
perhaps a little more slowly) without it.
The first step is to make some changes to your driver's interrupt handler.
If your driver has been interrupted because a new packet is available, that
packet should not be processed at the time. Instead, your driver should
disable any further "packet available" interrupts and tell the networking
subsystem to poll your driver shortly to pick up all available packets.
Disabling interrupts, of course, is a hardware-specific matter between the
driver and the adaptor. Arranging for polling is done with a call to:
void netif_rx_schedule(struct net_device *dev);
An alternative form you'll see in some drivers is:
if (netif_rx_schedule_prep(dev))
__netif_rx_schedule(dev);
The end result is the same either way. (If
netif_rx_schedule_prep() returns zero, it means that there was
already a poll scheduled, and you should not have received another
interrupt).
The next step is to create a poll() method for your driver; it's
job is to obtain packets from the network interface and feed them into the
kernel. The poll() prototype is:
int (*poll)(struct net_device *dev, int *budget);
The poll() function should process all available incoming packets,
much as your interrupt handler might have done in the pre-NAPI days. There
are some exceptions, however:
- Packets should not be passed to netif_rx(); instead, use:
int netif_receive_skb(struct sk_buff *skb);
The return value will be NET_RX_DROP if the networking
subsystem had to drop the packet. Network drivers could use that
information to stop feeding packets for the moment, but no driver in
the kernel tree does so currently.
- A new struct net_device field called quota contains
the maximum number of packets that the networking subsystem is
prepared to receive from your driver at this time. Once you have
exhausted that quota, no further packets should be fed to the kernel
in this poll() call.
- The budget parameter also places a limit on the number of
packets which your driver may process. Whichever of budget
and quota is lower is the real limit.
- Your driver should decrement dev->quota by the number of
packets it processed. The value pointed to by the budget
parameter should also be decremented by the same amount.
- If packets remain to be processed (i.e. the driver used its entire
quota), poll() should return a value of one.
- If, instead, all packets have been processed, your driver should
reenable interrupts, turn off polling, and return zero. Polling is
stopped with:
void netif_rx_complete(struct net_device *dev);
The networking subsystem promises that poll() will not be invoked
simultaneously (for the same device) on multiple processors.
The final step is to tell the networking subsystem about your
poll() method. This, of course, is done in your initialization
code when all the other struct net_device fields are set:
dev->poll = my_poll;
dev->weight = 16;
The weight field is a measure of the importance of this interface;
the number stored here will turn out to be the same number your driver
finds in the quota field when poll() is called. If you
forget to initialize weight and leave it at zero, poll()
will never be called (voice of experience here). Gigabit adaptor drivers
tend to set weight to 64; smaller values can be used for slower
media.
Receiving packets in non-interrupt mode
Network drivers tend to send packets into the kernel while running in
interrupt mode. There are occasions where, instead, packets will be
received by a driver running in process context. There is no problem with
this mode of operation, but it is possible that the networking software
interrupt which performs packet processing may be delayed, reducing
performance. To avoid this problems, drivers handing packets to the kernel
outside of interrupt context should use:
int netif_rx_ni(struct sk_buff *skb);
instead of netif_rx().
Other 2.5 features
A number of other networking features were added in 2.5. Here is a quick
summary of developments that driver developers may want to be aware of.
- Ethtool support. Ethtool is a utility which can perform
detailed configuration of network interfaces; it can be found on the gkernel SourceForge
page. This tool can be used to query network information, tweak
detailed operating parameters, control message logging, and more.
Supporting ethtool requires implementing the SIOCETHTOOL
ioctl() command, along with (parts of, at least) the lengthy
set of ethtool commands. See <linux/ethtool.h> for a
list of things that can be done. Implementing the message logging
control features requires checking the logging settings before each
printk() call; there is a set of convenience macros in
<linux/netdevice.h> which make that checking a little
easier.
- VLAN support. The 2.5 kernel has support for 802.1q VLAN
interfaces; this support has also been working its way into 2.4, with
the core being merged in 2.4.14. See this page for
information on the Linux 802.1q implementation.
- TCP segmentation offloading. The TSO feature can improve
performance by offloading some TCP segmentation work to the adaptor
and cutting back slightly on bus bandwidth. TSO is an advanced
feature that can be tricky to implement with good performance; see the
tg3 or e1000 drivers for examples of how it's done.
Comments (1 posted)
Patches and updates
Kernel trees
Core kernel code
Device drivers
Documentation
Filesystems and block I/O
Memory management
Architecture-specific
Security-related
Benchmarks and bugs
Miscellaneous
Page editor: Jonathan Corbet
Distributions
News and Editorials
[This article was contributed by Ladislav Bodnar]
With the release last week of Conectiva Linux 9, it might be a good time
to take a look at the project and its future prospects.
Conectiva, S.A., (conectiva.com.br), a private
company located in Curitiba, Brazil, was founded in 1995 by Arnaldo
Carvalho de Melo. As was often the case in those days, Red Hat Linux
was taken as the base for the new distribution, whose main objective
was to bring Linux to the vast numbers of Portuguese and
Spanish-speakers in Latin America. Following rapid internationalization
of many applications and documentation was the first stable release
announced in October 1997 - Conectiva Linux 1.0.
Now if you happen to conclude that Conectiva is just another Red Hat
clone with nothing much to offer to the Linux community, then stop
right there. Because Conectiva is, in fact, one of the most avid
contributors to the world of Free Software and one of the leading
innovators in the industry. Examples abound:
- Marcelo Tosatti, the 19-year old maintainer of the current stable
Linux Kernel is in Conectiva's employ. These links provide some
interesting information about Marcelo: Marcelo the Wonder
Penguin, Interview:
Linus's Latest Lieutenant by IBM developerWorks and 2.4
Maintainer Marcelo Tosatti Answers Your Questions by Slashdot.
- Also on Conectiva's payroll is Alfredo Kojima, the creator of the
popular Window Maker window
manager. More in this Interview with Alfredo
Kojima by Linux in Brazil.
- While mentioning names, here is another Conectiva employee -
Esveraldo Coelho. His original Crystal Icon Theme was
released under GPL and later incorporated into KDE. It became so popular
that many distributions now choose it as their default KDE theme.
- Conectiva's best known software utilities are apt-rpm and
its graphical front-end called Synaptic,
Debian-like utilities for managing software installations with automatic
resolution of dependencies. See An RPM port of APT and
Is it time to
change RPM? Both utilities are released under GPL and incorporated
into an increasing number of RPM-based distributions.
Now for some bad news.
Conectiva doesn't appear to be in a good financial shape. While this is
hardly unusual as Linux distributions go -- even better-known Linux
companies are struggling -- it does cast a shadow of doubt on
Conectiva's future. Back in the days of versions 6.0, 7.0 and 8,
Conectiva used to push its distribution internationally with some
vigor. Besides its native Portuguese, the distribution has always fully
supported Spanish and English. But a large portion of the Spanish and
English language content on Conectiva's web site is no longer
maintained. Even more surprising is the absence of any Spanish or
English press releases about last week's release of Conectiva Linux 9.
As such, the event was largely unnoticed by most international Linux
news sites, and even many Brazilian Linux web sites have barely
mentioned the release.
With version 9, Conectiva seems to have placed quantity above quality.
The distribution now comes on 4 binary CDs, all of which are required
for installation (surely, a strange decision from the inventors of
apt-rpm!). While the installation is very straightforward and the
desktop as pretty as ever, it seems that some obvious bugs have made it
into the stable release (e.g. my tried and tested XF86Config file fails
to bring up X Window and OpenOffice crashes every time I attempt to
select a font from the drop-down box). The default menus are a
hard-to-navigate mess and there is no relation between installed
applications and their presence in the menus.
But perhaps the worst of all is the absence of a user community, a forum
to ask questions and offer help, a place to share one's joys and
frustrations. And no, Conectiva's own mailing lists will not come to
the rescue -- the truth is that even there, Conectiva related traffic
is far outnumbered by posts dealing with other distributions.
What can Conectiva do? Creating a user community should be the company's
first priority. The web site needs plenty of work - documentation,
FAQs, user-contributed areas... Forums and properly categorized mailing
lists dealing with different issues are a must, tri-lingual ones would
be awesome. Then some PR. These measures don't take much time and
effort to implement and once they are done, users are likely to return
-- to what is probably the world's most underrated Linux distribution.
Comments (4 posted)
The previous article calls
APT-RPM one of Conectiva's
best known software utilities, and references some articles about it which
are good, but dated. As it happens, this LWN editor has been looking at
APT-RPM recently, so this seemed like a good time for APT-RPM update.
APT-RPM is an active development project headed by Gustavo Niemeyer, who
started working on the project at the beginning of the 0.5.4 series. The
Freshmeat project page
shows the release of version 0.5.5cnc5 on April 14,
2003.
The APT-RPM mailing
list is a good place to watch if you want to stay current. Gustavo has
been busy adding
many interesting features like the new apt-shell tool, or the recently
added scripting
capabilities, which will allow users to customize advanced setups.
Comments (4 posted)
Distribution News
The
Debian Weekly News for April 29, 2003 is
out. This week's edition begins with a look at an article by Robin Miller on
why programmers write Free Software (LWN daily readers it will find
familiar); and a similar article on Cybernaut which comes to different
conclusions; with a pointer to the Slashdot discussion of both articles.
Also this week: Removal of Pike 0.6 and Roxen 1.3; Debian Free Software
License?; Proposed Statement about the GNU FDL; Python Volunteers for
AGNULA wanted; and much more.
Otavio Salvador reports that the DDTP team
and the Debian-BR project have released an experimental version of APT
featuring support for translated package descriptions.
Somehow we missed last week's DWN which
looks at software patents and Free software, and other topics.
Comments (none posted)
Guardian Digital launched the next generation of the Community edition of
EnGarde Secure Linux. The Community Edition of EnGarde is suitable for
individuals, students, security enthusiasts, and those wishing to evaluate
the level of security and ease of management available in Guardian Digital
enterprise products.
Full Story (comments: none)
The Gentoo Weekly Newsletter for the week of April 28, 2003 is out. This
week's topics include some proposed changes to how ebuilds are managed;
mailing list changes and the early addition of tcl/tk.
Full Story (comments: none)
The
Mandrake Linux Community Newsletter for
April 28, 2003 is out. This week's top story is the released of Mandrake
Linux 9.1 PPC.
There are a number of updated packages
available, fixing various bugs in Mandrake Linux 9.1.
New ldetect packages are available for
Mandrake Linux 9.0, 9.1, Corporate Server 2.1 which fix a bug that could
freeze systems when harddrake probed for PCI information on the computer.
Comments (none posted)
SuSE Linux announced market availability for its Carrier-Grade Linux (CGL)
edition of SuSE Linux Enterprise Server, Powered by UnitedLinux. Scalable
for all requirements and infrastructures, CGL will enable businesses to
develop and deploy advanced voice, data and wireless applications on a
standards-based, modular communications platforms.
Full Story (comments: none)
New Distributions
SnapGear has gotten into the embedded distribution business with the
announcement (click below) of
SnapGear
Embedded Linux. It appears to be a 100% free distribution supporting
several processors (with an emphasis, perhaps, on MMU-less processors - the
principal developers of uClinux are at SnapGear).
Full Story (comments: none)
Beyond Linux From Scratch
(BLFS) is a project with the aim of assisting LFS users to go beyond
the base system. It contains a broad range of instrutions for installing
and configuring various packages on top of a base LFS system. BLFS
1.0 was released April 28,
2003 under the original BSD License.
Comments (none posted)
Minor distribution updates
Astaro Security Linux
has released
v4.003
with major security fixes. "
Changes: This Up2Date fixed several
vulnerabilites in OpenSSL and PPTP and some bugs in the SMTP virus scan,
increased performance of antispam, and updated PGP keys for the Up2Date
packages."
Comments (none posted)
Damn Small Linux has released
v0.3.7 with minor
feature enhancements. "
Changes: This release has a small but
significant addition: a hard drive install script."
Comments (none posted)
Debian-Ham has released
v0.5. "
Changes: All
of the binaries and libraries on the root floppy have been updated. Tlf is
now statically linked against ncurses, so there is almost 400k free to run
a contest. Cwdaemon is now the default keyer."
Comments (none posted)
Fli4l (Floppy ISDN/DSL) has released
v2.0.8 with minor
bugfixes. "
Changes: This release has some bugfixes for the
bootscript, in the fli4lctrl script, and in the Windows-IMONC. There is a
new version of flicp (0.2). imond & ens are now logging to Syslog
correctly. The hd package has a change for syslinux to not use the msdos.o
kernel module, and now performs more error checking."
Comments (none posted)
freevix has released
v0.6 with major feature
enhancements. "
Changes: Operation from cramfs/tmpfs, booting on 64MB
RAM systems, Samba client binaries, an easier install system, the latest X
version and VIA drivers, the latest Freevo version, and bugfixes."
Comments (none posted)
KNOPPIX has
released
v3.2-2003-04-28 with
software updates.
Comments (none posted)
Linux From Scratch has
released
v4.1 with
minor bugfixes.
Comments (none posted)
Mindi Linux has released
v0.84 with minor bugfixes.
"
Changes: This release supports Debian and other non-standard Linux
distributions more effectively."
Comments (1 posted)
Morphix has released
v0.3-5 with major
bugfixes. "
Changes: A number of annoying bugs were fixed and
preliminary ALSA support was activated. dillo was added to Light, K3B was
added to Heavy, and Pingus 0.6 is included in Game."
Comments (none posted)
MoviX has released
v0.8.0pre4 with major
bugfixes. "
Changes: MPlayer was upgraded to 0.90. faad/Real support
was added. DeCSS support was removed. Modules for i815 and Epia/Trident
video cards were added. Automatic DMA activation was removed. The TV boot
label was fixed. Support for DVD playback was improved. Support for SCSI
CD-ROMs was improved. Many minor & major bugs were fixed, including video
card detection and software video rescaling."
Comments (none posted)
Slackware Live CD has released
v2.9.0.13 with minor
feature enhancements. "
Changes: This release has minor bugfixes with
USB mouse detection. It adds KDE 3.1.1, k3b (a CD burning GUI for KDE), and
Netscape 7.02. All development packages (the /d directory and
xfree86-devel) have been removed."
Comments (none posted)
TopologiLinux has
released
v3.1.0 with
minor feature enhancements. "
Changes: This release adds some extra
precompiled kernels, KDE 3.1.1a, and some other updates. It is released as
2 CDs (one install CD and one extra CD). The LITE version has been
released."
Comments (none posted)
uClinux has released
v2.5.68-uc0 with major
feature enhancements. "
Changes: This version was updated to the
latest development kernel."
Comments (none posted)
Distribution reviews
The UK technology seller and magazine, MicroMart,
reviewed
Red Hat Linux 9 Personal, SuSE Linux 8.2 Personal, Mandrake Linux 9.1
Standard, Lycoris Desktop/LX and LindowsOS 3.0, and awarded the Editor's
Choice award to Lycoris Desktop/LX. "
All of these distributions
have their own positives and negatives, but for anyone looking for an
simple, easy to use system Lycoris Desktop/LX is the clear winner. It is
clearly developed from the ground-up to be easy to use for anyone aged 9 to
90."
Comments (none posted)
NewsForge
takes a look at
Morphix. A bug fix release of Morphix (0.3.5) is now available, and
many of the bugs mentioned in this article have already been fixed. (See
Morphix entry under Minor Distribution Updates) "
I was impressed
with what I saw in Morphix -- a LiveCD distribution that could be used not
only by curious home users and Linux evangelists, but by businesses wishing
to set up ultra-cheap workstations. Imagine having the workstations at your
office loaded up with RAM, not needing a hard drive, and having everyone
able to carry their systems around on a CD-ROM."
Comments (none posted)
Page editor: Rebecca Sobol
Development
Last week, the
Open Source Applications Foundation (OSAF)
released
version 0.1 of Chandler, an open-source Personal Information
Management (PIM) system.
The
Product Roadmap shows the long-term release plan.
As Chandler matures, it will be aimed at increasingly larger audiences.
The release levels are aimed at five classes of users:
developers, early adopters, higher ed users,
mainstream users, and conservatives.
The first release opens the project up for general consumption by
developers:
While we are still very early in the design and
implementation process, we intend for this 0.1 release to make us a more
fully open project. We have made the release available for download,
opened up our bug tracking database, and opened our source code
repository.
Chandler is written in the Python language and uses the
wxPython GUI toolkit.
The Chandler
Application Architecture Overview gives a pictorial view of the
various components that make up of the application.
The Chandler
Current Vision document describes the aim of the project.
Chandler is intended to be an open source personal information manager for
email, calendars, contacts, tasks, and general information management, as
well as a platform for developing information management applications. It
is currently under development and will run on Windows, Mac, and
Linux-based PC's.
Chandler differs from conventional PIM solutions in the following way:
With Chandler, users will be able to organize diverse
kinds of information for their own convenience -- not the computer's
convenience. Chandler will have a rich ability not only to associate and
interconnect items, but also to gather and collect related items in a
single place creating a context sensitive "view" of many types of data,
mixing-and-matching email, mailing lists, instant messages, appointments,
contacts, tasks, free-form notes, blogs, web pages, documents,
spreadsheets, slide shows, bookmarks, photos, MP3's, and so on (and
on). Data in Chandler is stored on repositories on the user's local
machine, on others' machines, and on shared resources such as servers.
This is a very different approach from that of today's common PIMs. For
example, users can usually only view a given email message in one specific
folder, grouped only with other email messages. In the user-centric world
of Chandler, the basis of the relatedness of items is completely at
the users discretion and is merely facilitated, rather than imposed by the
software.
For more information, see the Chandler
README document.
Chandler has been licensed under
Version 2 of the GPL.
Comments (none posted)
System Applications
Clusters and Grids
The (US) National Science Foundation has
announced the third
release of its Middleware Initiative software tool collection. These tools
are aimed at the creation of national research grids, and thus address a
number of access and "single signon" tasks that are also of interest
elsewhere. There are also improved versions of tools like MPI. More
information can be found on
the
NSF Middleware Initative site.
Comments (none posted)
Database Software
The PostgreSQL Weekly News for April 23, 2003 looks at the possiblility of
a version 7.3.3 release in the next few weeks; a revised Front-End/Back-End
protocol is in the works; plus miscellaneous fixes, new documentation, and
much more.
Full Story (comments: 8)
Version 0.6 of Knoda, a KDE database frontend for various databases,
has been released. Numerous bugs have been fixed.
Full Story (comments: none)
Electronics
Release 20030427 of the
Icarus Verilog electronic simulation language compiler has
been released. The changes are documented in the
release notes.
Comments (none posted)
Version 1.1.4 of Hamlib
has been announced.
"
Hamlib provides a unified environment for the development of radio and
rotator control applications. Release 1.1.4 includes improved rotator
support, important build fixes for gcc-3.x, *BSD, Mac OS X and Cygwin(win32)
platforms. Besides improvements and bug fixes, some experimental work has
been started on SDR, stay tuned."
Comments (none posted)
Mail Software
A new release of bogofilter, an email spam filter,
is available.
"
The bogofilter package implements a
fast Bayesian spam filter along the lines suggested by Paul Graham in his
article 'A Plan For Spam' . It is written in C."
Comments (none posted)
Version 2.1.2 of Mailman, the GNU Mailing List Manager, has been released.
Version 2.1.2 is a bug fix release, including language updates and two new
languages, Portuguese/Portugal and Polish. It is recommend that all
Mailman 2.1.x sites upgrade to version 2.1.2.
Full Story (comments: 1)
Peer to Peer
Version 1.7.2 of Furthur
has been released.
"
Furthur is a peer-to-peer music sharing tool that allows fully enforcable
legal sharing, instant downloads with no waiting lists, in-depth cataloging
functionality, and detailed attribute searches. Upgrading to this version is
recommended for all existing users."
Comments (none posted)
Printing
Version 1.1.19rc3 of the
Cups print system
has been released. A number of bug fixes and enhancements are included.
See the
release notes
for the full description of the changes.
Comments (none posted)
The latest news from
LinuxPrinting.org
includes the release of the Foomatic 3.0.0rc2 printer database,
and improved Adobe complance for the Foomatic PPD files.
Comments (none posted)
Version 3.8.21 of the
LPRng print system
has been released. Change information is in the source code.
Comments (none posted)
Science
Chris Cochella and Tyler Cruickshank
piece together Perl, MySQL, and SVG to keep track of high country
snow conditions.
"
A wise backcountry skier is always aware of the specific local and regional weather conditions in the mountains that contribute to avalanche danger. For winter backcountry enthusiasts like us, the problem is that all of the weather data available (i.e., National Oceanic and Atmospheric Association's National Weather Service) from remote mountain stations and ski areas is scattered throughout the Web -- in various formats, of varying frequency, contained in difficult to read text files, and differing in measured parameters. Cobbling this information together at 6AM prior to skiing is not our idea of fun. Thus, our goal is to collect all of this data in one place and then graphically display related parameters in a Web information appliance. We call this appliance the Avalanche Meteorology Toolkit (AMT)."
Comments (3 posted)
Web Site Development
Version 0.6 of the Quixote web development framework has been released.
This release includes a new template syntax, automatic HTML escaping, a new
lazy module importing mechanism, better support for multi-threaded
applications, support for running under Twisted, and several other
improvements.
Full Story (comments: none)
A Japanese language translation is now available for the Aeger Content
Management System.
Full Story (comments: none)
Use Perl has
an announcement for a new version of the Perl-based content
management system, Bricolage.
"
The Bricolage team is pleased to announce the release of Bricolage 1.6.0. This is the first new stable release of Bricolage since the release of version 1.4.6 in January, and the first major release since 1.4.0 in September, 2002. The result of contributions from Bricolage community members from around the world, version 1.6.0 is the most full-featured, best performing, most stable version of Bricolage yet."
Comments (none posted)
Version 1.2.1 of ht://Check is out.
"
ht://Check is more than a link checker. It's a console application written
for GNU/Linux systems in C++ and derived from the best search engine
available on the Internet for free: ht://Dig. It is very useful for
Webmasters who want to control and monitor their Websites, in order to
discover unexpected broken links, but also interesting information from the
data they have in the form of HyperText documents."
Full Story (comments: none)
Version 0.6.7 of moregroupware
has been announced.
"
moregroupware is a
web-based groupware package, written in PHP4. moregroupware includes modules
like webmail, notes, todo, contacts, project management, calendar and others.
The most important improvements to the 0.6.7 release are those made to the
files module and the new setup, logging and messaging code."
Comments (none posted)
Version 1.4 beta 1 of the Zope Content Management Framework (CMF)
has been announced. See the
CHANGES file for details.
Comments (none posted)
Version 0.3 of TownPortal is available.
"
The TownPortal developer team has released the
first beta release of TownPortal, a free portal system for villages
and local communities.
The beta release is mostly feature-complete, but lots of tuning will
still be needed for installation and user interfaces. Midgard
experience is recommended for installing and using the package."
Full Story (comments: none)
Desktop Applications
Audio Applications
A new version of ecasound, a multi-track audio processing utility,
has been released. Here is the change summary:
"
User-friendliness of 'jack_auto' and 'resample' audio
objects has been improved. Compile-time support added for
both JACK -0.50 and 0.60-. Python-only implementation of ECI
is now selected by default. Work-around included for a bug in
ALSA -0.9.1 that broke xrun handling for record and playback.
Lots of small bugs have been fixed in the build process.
The SIGFPE bug that occured on FreeBSD systems is now
fixed, as is the non-aligned access problem on Alphas."
Full Story (comments: none)
Version 0.3.0-test3 of
gAlan has been released.
"
gAlan is an audio-processing tool (both on-line and off-line) for X windows and Win32. It allows you to build synthesisers, effects chains, mixers, sequencers, drum-machines etc. etc. in a modular fashion by linking together icons representing primitive audio-processing components."
Full Story (comments: none)
Version 4-0.9 of Rosegarden, a MIDI and audio sequencer and notation editor,
has been released.
"
This release shows a signifi[c]ant step towards our final 1.0 release
goals and includes much improved performance notation support, improved
device/instrument management, improved audio capabilities (including
fully working LADSPA plugins, stereo audio recording and mixing), more
studio features (improved bank editing and device information import
and sharing), much improved lilypond export, a variety of translations
(Russian, Spanish, and German), MIDI synchronisation infrastructure and
much more."
Full Story (comments: none)
Version 0.012 of
SoundFontCombi is available.
SoundFontCombi is a router of ALSA based sequencer clients that has
a graphical user interface.
Comments (none posted)
Version 0.8.2 of Sweep, an audio file editor, is available.
Changes include support for the ALSA 0.9 sound drivers,
Internationalization (i18n) improvements, and more.
Full Story (comments: none)
A new version of Tekno Composer
has been announced.
"
Tekno Composer takes the ideas of real-time music composition for drum and bass. It features a synthesizer, a drum machine, and a sample player. It allows you to play and record loops in real-time using pattern based sequencing. It is an ALSA midi sequencer app, and will use ALSA and has support for Jack Audio."
Comments (none posted)
Desktop Environments
GNOME Desktop
has published
a long list of proposed modules that are to be included in the next major
GNOME release.
Included are several web browsers, a calculator, a video conferencing
utility, system tools, a PDF viewer, a CD burner, and more.
Comments (none posted)
Issue #47
of Kernel Cousin KDE
has been announced.
"
Russell Miller recently took over as maintainer and editor for
KC KDE (from a
long line of predecessors) and has lost no time in releasing issue #47! This
week he covers everything from KImageEdit MMX optimizations to KDE hacker
Ellis Whitehead's joyful step up in life."
Comments (none posted)
The April 26, 2003 edition of
KDE Traffic is out. Topics include:
Moving aKtion to kdeblackhole, KMail SSH Tunneling HOWTO, and
KAutoConfigDialog Howto.
Comments (none posted)
The April 25, 2003 edition of the
KDE-CVS-Digest is available.
"
KHTML gets table layout fixes. Many KScreensavers bugs have been fixed. KDevelop adds database programming support. Dia, UML and engineering stencils have been added to Kivio. And more..."
Comments (none posted)
GnomeDesktop
points to
a new release of cilc.
"
cilc is a CIL-to-C binding generator. It can be used to expose any CIL library to the C (and C++) world using the GObject object model and coding style. This should be of particular interest to GNOME developers who wish to make use of libraries developed in C#, perhaps Gtk# widgets, within their own C applications."
Comments (none posted)
GnomeDesktop
looks at a new patch for supporting XRandR, the
X Resize and Rotate Extension, on GNOME.
"
XRandR is an extension to XFree86 which allows resizing, rotating,
reflecting, and changing the refresh rate of each screen of a X-window
display on the fly. The extension is part of XFree86 4.3."
Comments (1 posted)
Games
Several new packages are available from the
WorldForge Gaming System.
Version 0.6.0 of varconf, the WorldForge config library,
skstream 0.2.5, a socket library, and wfmath 0.2.11,
the WorldForge maths library have been released.
Comments (none posted)
This week's new software on the
PyGame site
includes Pyddr version 0.6.2 and Jestur version 0.1.
Comments (none posted)
Interoperability
Issue #167 of the
Wine Weekly Newsletter is out. Topics include:
CrossOver Office 2.0, MS Threatens Developer, Winelib CoolPlayer Port,
Wintab Status and Development, Another List of Working Apps,
Improving Wine's Debugger, Accessing ODBC Databases, and
WineHQ Outage.
Comments (none posted)
Multimedia
Version 1.3.2-pre4 of Freevo, an application for running a TV capture
card,
has been announced.
"
This development release includes GUI improvements, the ability to play music
in the background, CD playing (with CDDB support), a new plugin interface, a
Web recording interface, and many bugfixes. The binary runtime was updated,
and MPlayer 0.90 is now used."
Comments (none posted)
Office Applications
Issue #141 of the
AbiWord Weekly News is out, with the latest AbiWord word processor
development news.
"
I hope you like staring at pictures this week because there's a good and plenty lot of them. Not only has the Support AbiWord button changed, but some mighty fun niftiness has also kicked up. We've got a visual lock on the first reported appearance of Abiword on AIX."
Comments (none posted)
Version 1.3 Beta 1 of KOffice
has been announced.
"
It comes with many new features and improvements, new filters,
hyphenation and the new database client Kexi."
Comments (none posted)
Web Browsers
Jonathan Walther has posted
an
interview with an unnamed Mozilla developer which discusses browser
naming. "
Think of our current project. How many people call it
'Seamonkey'? How many? That's its name. The real name is Seamonkey. But
how many people call it that? Everyone calls it 'Mozilla'. When it goes
away and is replaced by the new standalone browser, people will call
*that* Mozilla."
Comments (10 posted)
The most recent Mozilla Independent Status Reports
have been posted.
"
The latest set of status reports includes updates from the Tinderstatus,
SmoothWheel, Mozile, Electrix, Demiurge, JSLib, DownloadStatusbar, SecClab,
Gnusto, Diggler, NeedleSearch and Checky."
Comments (none posted)
Miscellaneous
A preview release of Red Carpet 2.0,
a graphical software management tool for RPM and dpkg systems,
has been announced.
"
Since the first preview release we've fixed several bugs that have been
found and based on your feedback have addressed a number of user
interface issues, including a tabbed UI and reworked strings."
Comments (none posted)
Version 0.3 of gmodconfig
has been announced on the GnomeDesktop site.
"
gmodconfig aims to provide a
simple way for end-users to download, install, configure and update Linux
kernel modules, in the language of their choosing, through an easy-to-use
graphic interface. The backend consists of XML files that contain the modules
informations and translations.
Release 0.3 features an assistant druid to help module authors generate those
XML files."
Comments (none posted)
Languages and Tools
C
Version 3.2.3 of
GCC, the
GNU Compiler Collection, is available. The
changes
are mostly bug fixes.
Thanks to Dan Kegel.
Comments (none posted)
Objective C
Andrew M. Duncan
writes about Objective-C on O'Reilly.
"
Objective-C is also (like Smalltalk) a dynamic language. Briefly, this means that Objective-C defers, until runtime, decisions more static languages (such as C++) would perform at compile time. This lets you do a number of interesting things that would be awkward or simply impossible in a less dynamic language."
Comments (none posted)
Caml
The April 15-22, 2003 edition of the Caml Weekly News is available
with lots of Caml language news and discussion.
Full Story (comments: none)
FORTRAN
Development work
continues on the
g95 FORTRAN compiler project.
"
Work on the front end has slowed down considerably lately although efforts continue to get that last 0.001% of the test suite to be correctly accepted. The back end and libraries are now up for general testing, at least on x86 linux boxes. The tarball is updated as the web page is, give it a try!"
Comments (none posted)
Java
Dennis M. Sosnoski
discusses the Java binary class on IBM's developerWorks.
"
Take a look at what goes on behind the scenes of executing your Java application in this new series on the dynamic aspects of Java programming. Enterprise Java expert Dennis Sosnoski gives the scoop on the Java binary class format and what happens to classes inside the JVM. Along the way, he covers class loading issues ranging from the number of classes required for running a simple Java application to the class loader conflicts that can cause problems in J2EE and similar complex architectures. "
Comments (none posted)
John I. Moore, Jr.
writes about enumerated types in Java.
"
Unlike most modern languages, Java does not support the concept of user-defined enumerated types--enums. This article revisits the topic one more time, briefly defining what it means for a programming language to support enums and reviewing the strengths and weaknesses of two alternative approaches for Java. It then presents a mini-language for defining enums compactly. A small "compiler" that translates this mini-language into Java source code is provided as a resource accompanying this article."
Comments (none posted)
Perl
The April 21-27, 2003 edition of
This Week on perl5-porters is out.
"
This week's summary presents a nice variety of language issues. Read about some new errors, documentation patches, bug closing and configuration."
Comments (none posted)
The April 20, 2003 edition of
This week on Perl 6 is out. Topics include:
Building Parrot on Win32, PMC documentation, Is PMC size fixed?,
Dan Does Design Decisions, Short-lived memory allocation,
How deep is clone?, Shared memory, A New GC approach?,
IMC and variable number of arguments, Currying questions,
Are all list constructors iterators?, and more.
Comments (none posted)
Simon Cozens
discusses POOL on O'Reilly.
"
In this article, we're going to look at POOL, a handy "little language" I recently created for templating object-oriented modules. Now you may not write many object-oriented modules, so this may not sound too interesting to you. Don't worry; I also plan to discuss, among other things, Ruby, how to use the Template Toolkit, profiling, computational linguistic trie structures, Ruby again, and the oil paintings of the Great Masters. Hopefully, something in here will be enough to keep your interest."
Comments (none posted)
PHP
PHP version 4.3.2RC2
has been released.
"
This is the second release candidate and should have no critical problems/bugs. Nevertheless, please download and test it as much as possible on real-life applications to uncover any remaining issues."
Comments (none posted)
Paul Meagher
plots statistical graphics using PHP on IBM's developerWorks.
"
In this article, the author, Paul Meagher, addresses these shortcomings with PHP-based probability functions; demonstrates how to integrate output methods into the SimpleLinearRegression class; and creates graphical output. He then tackles these issues by building a data-exploration tool, designed to plumb the depths of information contained in small- to medium-sized datasets."
You may want to start off with
part one.
Comments (none posted)
Python
Guido van Rossum has announced version 2.3b1 of Python, which includes
lots of changes.
Full Story (comments: none)
Here is this week's Python URL, with pointers to techniques for making
*small* stand-alone versions of Python programs; two real-life uses for
metaclasses; common uses of C++ references; and much more.
Full Story (comments: none)
Ruby
The April 28, 2003 edition of the
Ruby Weekly News is out with the latest Ruby language news
and software releases.
Comments (none posted)
Scheme
The April 29, 2003 edition of the Scheme Weekly News has
been published, take a look for the latest Scheme language news.
Full Story (comments: none)
Tcl/Tk
Dr. Dobb's Tcl-URL for April 30 is out with the usual collection of
News from the Tcl/Tk development community.
Full Story (comments: none)
Miscellaneous
The Bugzilla Team has
released
Bugzilla 2.16.3, the latest stable release, and Bugzilla 2.17.4, the latest
development snapshot (not recommended for use in production
environments). Both updates fix several security bugs so all users are
advised to upgrade.
Comments (none posted)
Garrett Rooney
writes about subversion, a next-generation reversion control system.
"
Subversion, as you probably already know, is a version control system written from scratch to replace CVS, the most popular open source version control system. While there are many reasons to choose Subversion, one of the most interesting is that Subversion has been designed and implemented as a collection of reusable libraries, written in C. This allows your programs to use the same functionality found in the command line Subversion client without having to call out to the command line client, to execute commands, or parsing output. This article briefly reviews the Subversion libraries, explains some of their data structures, and demonstrates the use of the Subversion client APIs in other programs."
Comments (none posted)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
MozillaZine
reports on
the results of its 'Firebird' poll. "
The question posed by our last
poll was intended to get feedback on 'Firebird', the new name for
Phoenix. We got it in buckets. A massive 20,576 people voted — that's
over ten times as many as for the new Roadmap poll."
Comments (2 posted)
NewsForge
looks at
some of the motivations for developers to participate in open source
projects. "
A majority of people who write open source code do it as
part of their jobs. Apache was originally written and is still maintained
primarily by network admins and programmers who need reliable, low-cost Web
server software and believe it's better to pool their efforts than go it
alone. Many Linux kernel improvements come from programmers who work for
companies that depend on Linux in one way or another, ranging from small
consulting firms up to multinationals like IBM, HP, and Computer
Associates. Intel and AMD have helped the Linux kernel scale to multiple
processors and support 64-bit CPUs."
Comments (none posted)
Robert X. Cringely
writes
about Sudden Infant Death Syndrome and open source software.
"
...here is where we'll find Open Source's vulnerability. There is
this idea (I've written it myself) that Microsoft, for example, can't
compete with Open Source because you can't compete with a product that has
no profit Motive, and can't out-market a product that has no marketing
budget or plan. But Microsoft could still beat Open Source simply by
subverting it." (Thanks to Timothy Hunt)
Comments (12 posted)
Here's a NewsForge article by Lee Schlesinger, in which he
dissects Neal
Stephenson's 1999 essay "In the Beginning was the Command Line".
"
This is a key lesson for Linux proponents to learn. Linux is a
powerful operating system -- no one argues that. But Linux started out as a
difficult operating system for the average person to learn. There are far
more average users than expert users out there. To grow the community,
Linux must be as simple as possible to work with. A larger group of users
benefits both average and expert users, so even experts should support
"frills" like GUI utilities and package installation tools."
Comments (21 posted)
Trade Shows and Conferences
TechWeb
covers this
year's Embedded Systems Conference in San Francisco. "
MontaVista, a
key player in the embedded Linux market, announced that its embedded
version of the open-source OS had been tweaked to work with Tensilica's
Xtensa processors. The pairing of MontaVista Linux Professional Edition 3.0
and Xtensa's OSKit automatically generates updates to the embedded Linux as
designers modify the base Xtensa architecture to create their own custom
SoC (systems on a chip). The result, according to MontaVista, is faster
design and development of Linux-running SoCs."
Comments (none posted)
Stephen Figgins
covers the development of the Twisted application framwork.
"
At last month's PyCon in Washington D.C. several developers of the Twisted network application framework gave presentations. (Papers are available on the Python wiki.) In some ways, it was Twisted's big debut. Many attendees have made positive remarked the presentations. Once obscured, Twisted is stepping into the light."
Comments (none posted)
Linux Journal
covers
LinuxFest NorthWest 2003. "
LinuxFest had a great atmosphere: it was
pro-Linux and fun, with very little bashing of Microsoft or anyone else. It
was geared towards Linux enthusiasts who already know something about
Linux, but some of the presentations could be enjoyed by anyone."
Comments (1 posted)
Daniel H. Steinberg
writes about several presentations at this year's
O'Reilly Emerging Technology Conference.
"
Individually, Eric Bonabeau's keynote on Biological Computing and Howard Rheingold's address on Smart Mobs would have been interesting. Taken together you can see the application of emergent behavior described by Bonabeau to the technological challenges issued by Rheingold."
Comments (none posted)
Linux Adoption
Toronto's Globe and Mail
looks
at Linux adoption in Canada. "
The potential impact on corporate
computing and the technology marketplace is profound because this vast
worldwide talent pool can create innovations, plug holes and fix flaws more
quickly and more surely than any single company acting alone with limited
resources, according to Chris Pratt, Linux manager for Markham, Ont.-based
IBM Canada Ltd., who describes the open-source concept as "a Darwinian
approach in which the strongest code survives."" (Thanks to Jim
Gallacher)
Comments (none posted)
New Zealand's Stuff
reports
that State Services Commissioner Michael Wintringham has written to the
heads of all government agencies, encouraging them to assess open source
options when buying software. "
The initiative, approved by State
Services Minister Trevor Mallard, was the key recommendation of a briefing
paper on open source software written by the SSC's E-Government Unit head,
Brendan Boyle. However, the SSC has stopped well short of following
countries such as India, Italy and South Africa and calling for open source
products to be preferred over commercial software as a matter of
course." (Thanks to Kanchana Wickremasinghe)
Comments (none posted)
Here's
an article in the Bangkok Post regarding a plan by the Thai Information and Communications Technology Ministry to sell low-cost, Linux-based computers. "
The ministry expects that the second phase of the Computer ICT project will be able to distribute 300,000 units a month or 10 times more than in the first phase. It aims to place one million PC within 12 months." The systems will cost 10,000 Baht, or just over US$250.
Comments (none posted)
In this O'ReillyNet article David HM Spector
explores the history and current state of directory services, and
explains why it's important to interoperate with Active Directory.
"
Linux has really reinvigorated the UNIX family of operating systems,
as well as competition in the server market place. The hard work and
talents of thousands of developers have made Linux an unstoppable force in
the data center. They have also set the foundation for Linux (and other
UNIXes) to provide credible and well-implemented alternatives to Microsoft
Office on the desktop, but Microsoft still has absolutely no competition in
the directory space. The directory space is the key to the desktop
marketplace and the possibility of Linux's total integration in mainstream
environments, because that's where all the really important metadata--the
stuff that businesses run on--lives."
Comments (5 posted)
Legal
News.com
reports on
the outcome of the suit against Streamcast and Grokster: not guilty.
"
'Defendants distribute and support software, the users of which can
and do choose to employ it for both lawful and unlawful ends,' [Judge Stephen] Wilson wrote
in his opinion, released Friday. 'Grokster and StreamCast are not
significantly different from companies that sell home video recorders or
copy machines, both of which can be and are used to infringe copyrights.'"
Comments (none posted)
ZDNet
reports that
a group of high-ranking scientists are petitioning the European Parliament
to prevent the patenting of algorithms and software ideas. "
The fate
of the proposed patent plan could have a dramatic effect on the way
software is developed in the EU, with many developers and small businesses
fearing a U.S.-style system in which large companies with thousands of
software-related patents are able to force smaller competitors to pay for
intellectual property licenses."
Comments (none posted)
Interviews
Here's a Linux Journal
interview with
Miguel De Icaza. "
MdI: I work at Ximian, but my focus has
changed from doing GNOME development to working on a project called
Mono. Mono is an open-source implementation of the .NET Framework, a
development platform that I really like. A lot of the effort that has gone
into Mono has been put there mainly to help GNOME become a better
platform--my merging these two worlds. And, those of us working on the
project would love to see more Mono-based desktop applications out
there."
Comments (none posted)
News.com
talks with Steve Ballmer about why Microsoft is not afraid of Linux.
"
Innovation is not something that is easy to do in the kind of distributed environment that the open-source/Linux world works in. I would argue that our customers have seen a lot more innovation from us than they have seen from that community.
Linux itself is a clone of an operating system that is 20-plus years old. That's what it is. That is what you can get today, a clone of a 20-year-old system. I'm not saying that it doesn't have some place for some customers, but that is not an innovative proposition."
Comments (25 posted)
In this Linux Journal article, Aleksey Dolya
interviews
Matthias Ettrich, creator of the KDE desktop environment. "
ME:
Professionally I'm focusing on the next generation of Qt. Qt today is
established technology that has been developed for more than ten years, so
we feel it's about time to revise some of its architecture. The wide range
of devices it is used on--[everything] from powerful desktop workstations
to small embedded devices--leads to new challenges. Interestingly enough,
both small embedded applications and the big desktop applications that
constantly become more and more complex have one thing in common: they
would benefit from a more flexible, smaller and at the same time even
faster toolkit. And we believe we can [deliver] exactly this."
Comments (none posted)
IBM News is carrying this
interview
with Nicholas Petreley as he analyzes the results of the latest Evans
Data Corp 2003 Linux Developer Survey. "
You spent a lot of time
investigating developers' perception of Linux security. Where did the
respondents come down on the Linux versus Windows security debate?
Nick: They came squarely down on the side of Linux being a far more secure
system. The comparison wasn't even close. What I found interesting though,
was that their confidence in open source as inherently more secure has been
dropping over the past 18 months or so, despite the fact that their actual
incidence of crack-ins, break-ins to their servers, and virus problems,
based on the survey was statistically insignificant."
Comments (1 posted)
Resources
IBM developerWorks
takes
a look at CD burning on Linux systems. "
CD-writing programs are
available for both Linux and Windows, but the Linux versions are more
powerful and versatile than their Windows cousins. In this article, we'll
look at mkisofs and cdrecord, the workhorses of Linux CD recording. mkisofs
creates a pre-mastered image, to generate an ISO9660/JOLIET/HFS hybrid
filesystem. It both creates and populates a filesystem. Unlike other data
storage media such as hard drives and floppy drives, a filesystem on CD is
not first created, then populated with data. There is only one chance with
a CD-R: formatting it first would create a disk with an empty
filesystem. cdrecord records data on Orange Book CD-R/RWs, which is pretty
much all of them."
Comments (19 posted)
This lengthy O'Reilly Network article looks at tools for digging through old code.
"
In the real world, most programmers spend most of their time going through code that's a hundred years old and extremely messy. If it ever was designed, the design document was lost long ago. It has evolved over the years. Hundreds of people have worked on it. And it appears most of them knew very little about programming. As a result, most professional programmers have to deal with badly designed, badly implemented, uncommented, incomprehensible blobs."
Comments (none posted)
Reviews
ZDNet
takes a look
at a tiny desktop computer featuring an embedded Linux operating system.
"
The Mini-Box M-100, a general-purpose computer built around Via's
EPIA Mini-ITX mainboard, is about the size of a dictionary and weighs about
two pounds. Besides being used as a desktop, it can also be used
"embedded"--housed within a larger machine to perform a specific computing
task."
Comments (2 posted)
Gartner
examines the myths surrounding Linux on the Desktop. "
Although
Linux has many attributes that make it a fine operating system (OS), and it
will be a viable option for certain types of users and enterprises, there
are several areas of Linux's reputation on the desktop that we feel will be
proved, over time, to be myths. Enterprises need to understand where
reality ends and myth begins so they can make informed, justifiable
decisions for its use on the desktop."
Comments (9 posted)
Miscellaneous
News.com is running
a column on the importance of commodity 64-bit systems. "
These two trends--commodity 64-bit architectures and Linux--are intersecting. Five years from today, nobody in IT will be buying 32-bit servers (and maybe not even 32-bit laptops). They will buy 64-bit servers and almost universally run them with Linux." Of course, the optimistic tone may have something to do with the fact that the author is SuSE CEO Richard Seibt.
Comments (3 posted)
MozillaZine
covers the continuing debate over the Firebird name.
"
Jonathan Walther of the Debian project has published a transcript of an
interview with an anonymous Mozilla developer about the Firebird naming
conflict. According to IBPhoenix, which is affiliated with the Firebird
database project, Walther has offered to mediate in the dispute."
Comments (none posted)
News.com
reports on
a proposal to end spam. "
A few months ago, Lessig made an unusual
wager: If Congress enacts an antispam law that offers bounties for the
reporting of spammers, and the law fails to "substantially reduce the level
of spam," he will resign from his dream job at a top law school."
Comments (2 posted)
Kendall Grant Clark
ponders
the current state of XML editors on O'Reilly.
"
In a recent XML-Deviant column, "The Pace of Innovation", I examined the still contentious, often puzzling issue of XML tools support, especially for end users. Even after five long years of XML development, the ideal and ubiquitous "XML editor for humans" seems more rumor than reality. Could it be that we have underestimated the difficulty of building a tool with which ordinary people can easily and simply create XML content?
What troubles me even more, however, was the conclusion I reached in that column, namely, that the XML creation facilities in the next major release of Microsoft Office are the best, realistic hope for the future of the documents side of XML, at least in terms of mass market success."
Comments (none posted)
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
NY Fair Use and NYLUG will be working together on DRM issues.
"
On May 2nd, NY Fair Use and NYLUG are working together to represent Free
Software at the Copyright Office Hearings for 1201 of the DMCA. Ruben
Safir, representing NY Fair Use, will be testifying about DRM on
Commercial DVD's and its negative impact on private ownership rights and
normative commercial dealing."
Full Story (comments: none)
Commercial announcements
Commerce One has
announced
an open source Web services and SOAP XML Development Kit as part of its
ongoing drive to foster the adoption of Web services technology for
business.
Comments (none posted)
CodeWeavers has
announced
the release of CrossOver Office 2.0. This version allows Linux systems to run applications like Office XP, Photoshop 7, Access, and others - without Windows. Language support has also been improved.
Comments (4 posted)
IBM announced the official opening of a new center in London for the
financial sector, the latest of nine new IBM Linux® competency centers IBM
has across four different continents. The centers are designed to help
customers of every size, and from a variety of industries, including
government, oil and gas and retail, take advantage of the reliability,
flexibility and cost-effectiveness of Linux.
Full Story (comments: none)
Intel Corporation has
announced
the release of open-source software that allows developers to build
computers that see and "read lips" the way humans do to better understand
spoken commands.
Comments (1 posted)
Intel Corporation and the Institute for Computing Technology, Chinese
Academy of Sciences (CAS) in Beijing have
released
version 2.0 of the Open Research Compiler (ORC) for the Intel(R) Itanium(R)
processor family. This set of open source compiler tools for Linux is aimed
at researchers doing advanced compiler and micro-architecture research and
adds several new features over the earlier release.
Comments (none posted)
The Dravis Group LLC has
announced
the existance of a report "Open Source Software: Case Studies Examining its
Use," which illustrates the diverse uses of open source software. The
actual report is available in PDF format at the
Dravis website.
Comments (none posted)
O'Reilly & Associates has announced its commitment to Founders'
Copyright; an initiative that will allow more O'Reilly titles to become
available online.
Full Story (comments: 6)
Red Hat, Inc. has
announced
the appointment of Alex Pinchev to their executive team as President,
International Operations. Pinchev will be responsible for the sales and
service delivery for all Red Hat offerings outside of North America.
Comments (none posted)
SuSE Linux named three key executives and announced the selection of new
public relations and marketing agencies. Effective immediately, Juergen
Geck, formerly vice president, Technology Partners, will be the company's
Chief Technology Officer. Uwe Heine -- based in Oakland, California --
joins SuSE as Chief Alliance Officer and Dr. Uwe Schmid joins SuSE as vice
president, Business Development and Marketing. The company also tapped
Burson-Marsteller and J. Walter Thompson to develop and implement an
international, integrated branding and communications program.
Full Story (comments: none)
Resources
Loads of Linux Links (LoLL) Version 1.1.0 has been released. There are many
changes and improvements, notably a new look to the website, W3C compliancy,
better search engine and improvement of the underlying data with 1400 links
added, 500 links deleted, bringing the total to 4000+ links.
Full Story (comments: 2)
The
Linux Documentation Project
weekly news has returned in time to celebrate the tenth anniversary of
the Linux Documentation Project.
Comments (none posted)
Upcoming Events
The GIMP Developers Conference 2003
has been announced. The event will take place as part of the
Chaos Communication Camp 2003 in Paulshof, Altlandsberg, Germany
on August 7-10, 2003.
Comments (none posted)
The pan-European Linux@work conference will be held in Dublin
coincident with the GNOME User and
Developer European Conference (GUADEC).
"
Linux@work will
be held on GUADEC's User Day, June 18, 2003 at Trinity College in Dublin.
GUADEC and Linux@work will bring developers, GNOME Foundation leaders
and individual, business and government GNOME users together to discuss
open source software advantages and issues."
Full Story (comments: none)
The Open Source CMS Conference III will be held in Cambridge, MA on
May 28-30, 2003.
"
OSCOM 3 promises to be the best OSCOM conference yet, with
a wide range of talks and tutorials covering 3 separate tracks.
OSCOM 3 will be a meeting of the minds with the best from
academia (MIT, University of St. Gallen, Harvard, University
College, Cornell, Rice and others), corporations (HP, RedHat,
Merant, Wolf, Greenfield & Sacks) and organizations
(Apache Foundation, mozilla.org). The keynote will be given
by Dave Winer (author and co-inventor of numerous important
Internet technologies). A second keynote will be delivered
by Jon Udell from Infoworld."
Full Story (comments: none)
Use Perl has
a preview of what's to come at the
third Open Source Content Management Conference, which will be held
at Harvard on May 28-30, 2003.
Comments (none posted)
The GCC Developers' Summit will be held in Ottawa, Canada in
one month.
"
We have space for up to 90 delegates to attend, and it would be great to
see more people there. We strongly recommend that if you're planning on
attending that you register ASAP. On May 1st the cost to attend will
double."
Full Story (comments: none)
The first call for participation has gone out for the
International Lisp Conference 2003, to be held in
New York, NY on October 12-15, 2003.
Full Story (comments: none)
The
Initial Announcement
has gone out for the KDE Developer's Conference 2003, to be held in
the south of the Czech Republic starting August 22, 2003.
"
Compared to previous KDE
conferences, this one will be bigger, in terms of number of
participants, scope and time. We will start with two days of
technical talks in at least two parallel tracks, and end with an
optional six-days project work and hacking session until the
31st of August. The event will be held in a castle
near a famous brewery.
Comments (none posted)
Registration is now open for the
Tcl 2003 Conference.
The event will be held in Ann Arbor Michigan from July 29
through August 2, 2003.
Comments (none posted)
A Zope traing session
will be held in Paris , France on May 19-23, 2003.
"
Topics convered are: Zope basics, Python, ZPT, CMF fundamentals and CPS usage and personnalisation (including skinning and workflows)."
The event will be presented in French.
Comments (none posted)
The first call for papers has gone out for the
Asian Enterprise Open Source Conference 2003.
The conference will be held in Singapore on October 29-31, 2003.
Full Story (comments: none)
Preregistration
is now open for the Ruby Conference 2003, to be held in
Austin, Texas from November 14 to 16, 2003.
Comments (none posted)
| Date | Event | Location |
| May 2 - 4, 2003 | Penguicon | Warren, Michigan |
| May 3, 2003 | International Conference on Software Engineering 2003 | Portland, Oregon |
| May 7, 2003 | The Open Group Conference/Open Source in the Enterprise | (Hilton London Paddington)London, England |
| May 8 - 9, 2003 | International PHP Conference, 2003 | Amsterdam, the Netherlands |
| May 11 - 14, 2003 | The International Symposium on
High Performance Computing Systems and Applications(HPCS 2003) | (Sherbrooke Delta Hotel)Quebec, Canada |
| May 11, 2003 | Yet Another Perl Conference, Israel(YAPC::Israel::2003) | (C.R.I.)Haifa, Israel |
| May 15 - 16, 2003 | YAPC::Canada | (Carleton University)Ottawa, Canada |
| May 25 - 27, 2003 | GCC Developer's Summit | Ottawa, Canada |
| May 28 - 30, 2003 | Open Source Content Management, 2003(OSCOM) | (Harvard Law School)Cambridge, Mass |
| May 30 - 31, 2003 | 4th European Tcl/Tk Users Meeting(Tcl'Europe 2003) | Nürnberg, Germany |
| June 4 - 6, 2003 | Enterprise Linux Forum Conference & Expo | (Santa Clara Convention Center)Santa Clara, California |
| June 9 - 14, 2003 | USENIX 2003 | (Marriott Hotel)San Antonio, TX |
| June 10, 2003 | Linux For Business | (The Commonwealth Institute)London, England |
| June 16 - 18, 2003 | Yet Another Perl Conference::North America(YAPC::2003) | (Florida Atlantic University)Boca Raton, FL |
| June 16 - 18, 2003 | GNOME User and Developer European Conference(GUADEC) | (Trinity College)Dublin, Ireland |
| June 18 - 23, 2003 | Open Source Clinical Application Resource Workshop(OSCAR) | (McMaster University)Ontario, Canada |
| June 21 - 22, 2003 | EuropeanRubyConference | (University of Karlsruhe)Karlsruhe, Germany |
| June 23 - 26, 2003 | ClusterWorld Conference & Expo | (San Jose Convention Center)San Jose, California |
| June 24 - 26, 2003 | LinuxUser & Developer Expo 2003 | Birmingham, UK |
| June 24 - 26, 2003 | LinuxUser & Developer Expo | (Birmingham National Exhibition Centre)Birmingham, UK |
| June 25 - 27, 2003 | European Python and Zope Conference 2003 | (CEME)Charleroi, Belgium |
Comments (none posted)
Software announcements
Here are the software announcements, courtesy of
Freshmeat.net. They are available in
two formats:
Comments (none posted)
Miscellaneous
According to MozillaZine, responses
are being requested from German open-source developers for the
FLOSS-US 2003 survey.
"
Claus Augusti, maintainer of the German MozillaZine, writes: "FLOSS-US
2003 is an international online survey aimed towards open source developers,
currently being conducted for the second time by researchers of Stanford
University's Institute for Economic Policy Research (SIEPR). I received a
request for assistance at MozillaZine.de, as there are only 30 (of 1000)
responses from Austrian/German/Swiss open source developers so far."
Comments (none posted)
Page editor: Forrest Cook
Letters to the editor
| From: |
| Bill Carlson <bill-carlson@uiowa.edu> |
| To: |
| psheer@icon.co.za |
| Subject: |
| Desktop Linux |
| Date: |
| Thu, 24 Apr 2003 11:20:39 -0500 (CDT) |
| Cc: |
| letters@lwn.net |
Paul,
Regarding your recent LWN letter about the problems associated with
deploying Linux as a desktop replacement for Windows:
First, thanks for supplying a comprehensive list of problems, that
certainly helps those that want to pursue smoothing the user experience.
I, however, have a problem with your argument that Linux is not ready for
the desktop and that lies in your unspoken assumption:
Users already use Windows effectively and efficiently.
Your statement "End users of Windows are FAR less intelligent than you
might expect" highlights the fallacy of this assumption. In my opinion,
someone who understands what they are doing under Windows will readily
make a transition to Linux; the problem comes with those who have only
"Push button one followed by button two" understandings of their daily
tasks. This type of user will resist and complain about ANY change, it
doesn't matter whether it is a move to Linux, the next version of Windows
or an upgrade to Office. There is certainly NOTHING wrong with this type
of user; they have a job to do, and that is not become a computer expert.
However, it's important to realize this type of user exists and why they
resist or become confused by Change; it is not because of the inherent
superiority of their current tools, but rather because they know how to
make them do the required tasks. Any change means relearning and
relearning requires admitting not knowing how to do something, which
bothers many people.
So, the end goal should not be "emulate Windows" or "be more efficient
than Windows", that will not really accomplish anything. Rather, the goal
should be to continue to create new designs, improve existing ones and
focus on excellence, not "the other guy".
Regards,
Bill Carlson
--
Systems Administrator bill-carlson@uiowa.edu | Anything is possible,
Virtual Hospital http://www.vh.org/ | given time and money.
University of Iowa Hospitals and Clinics |
Opinions are mine, not my employer's. |
Comments (none posted)
| From: |
| "David Hartley" <penguin@linuxweb.org> |
| To: |
| <letters@lwn.net> |
| Subject: |
| Whats going on over at InfoWorld? |
| Date: |
| Thu, 24 Apr 2003 12:58:24 -0400 (EDT) |
I am a subscriber to the print edition of InforWorld. In the current issue
it being divulged that most of the columnists who espouse free/open source
solutions are being dropped in favor of a new "format". Of course it wasnt
stated that way but anyone who follows the columns can see a pattern. I am
curious what the inside story is. I was an avid reader of the magazine
until now. I hope that other publications will take this opportunity to
pick up some talented writers.
--
David Hartley
penguin@linuxweb.org
Peace, Love, and Penguins
Comments (2 posted)
Page editor: Jonathan Corbet