LWN.net Logo

LWN.net Weekly Edition for October 16, 2008

OpenOffice.org releases 3.0, faces new challenges

By Jake Edge
October 15, 2008

A new version of the popular free software office application suite, OpenOffice.org (OOo) 3.0, was released this week to lots of press and enough download traffic to bring down its webserver. While the release isn't a huge leap forward in terms of features, it does provide some compelling enhancements. Perhaps the most interesting is the increased focus on extensions, a la Firefox, that don't require modifying the core OOo code. This may help combat the problem—or perceived problem—that Sun is stifling OOo development through its bureaucratic procedures for adding new functionality.

[OOo welcome screen]

The first thing one notices when starting up OOo 3.0 is the new splash screen, but it appears for only a short time. One of the major complaints about the suite has been how long it takes to start up—something that has been addressed in 3.0. The application opens to a new welcome screen (seen at left) that presents a more friendly appearance, rather than an empty window, for new users. Once past that point, the various tools look much as they did in OOo 2.4 and earlier versions.

The other changes are mostly under the covers; they will be noticed by power users, but are not immediately obvious to basic users. These include:

  • Writer (word processor) has a new slider for zooming
  • Writer allows multi-page display and editing
  • Calc (spreadsheet) allows up to 1024 columns per sheet
  • Draw (drawing) can handle poster-size files
  • Impress (presentation) supports multiple monitors for presentations
  • Writer has additional editing modes for multi-lingual support as well as wiki document editing
  • Calc has a new equation solver
  • Chart (graphing) has improved graphical output

The OOo extensions repository has many different kinds of add-ons for OOo, that provide new or enhanced functionality for users. The most popular is the PDF import extension which allows loading PDF files into the application for editing. Given that OOo has long had the ability to natively export PDFs, importing them is an excellent addition.

Clearly Sun and the OOo project see extensions as a fertile ground for innovation by folks who are not necessarily OOo "contributors"—as they have not signed the Sun Contributor Agreement (SCA) [ PDF, currently unavailable due to the download traffic problems ]. Sun's community manager for OOo, Louis Suarez-Potts, puts it this way:

OOo 3.0 adds to that freedom by using extensions much the same way that Firefox does: it gives all users the freedom to add new features, functionality. At present, we have a couple of hundred, and they have proved popular. We've also done minimal advertising. I anticipate that in the coming months, as 3.0 gains yet more popularity (all servers are down at the moment), there will be more and more interesting extensions out there.

I can see extensions that radically depart from what we consider "office" tools---and why not? OOo is an integrated set of tools based on fairly conservative conceptions of office software. But there is no compelling reason to stick with the conservative past, and every reason to be creative.

One of the new features that OOo developers are most excited about won't affect Linux users at all. OOo 3.0 has a native Mac OS X look and feel, rather than the earlier X11-based interface. A native Windows version has always been a part of OpenOffice (and its precursor, StarOffice), but the new default theme is said to be particularly attractive on that platform.

There are various new features aimed at those currently using—or needing to interoperate with—Microsoft Office. There is support for Access database files as well as improved Visual Basic for Applications (VBA) macro support. Somewhat controversially, OOo 3.0 has added the ability to read (but not write) Office Open XML (OOXML) files. OOXML is the newly minted standard for office documents that Microsoft and Ecma pushed through the ISO standardization process earlier this year.

Support for OOXML is one of the contentious areas surrounding OOo. There are two (vocal) developer camps, one Sun-centric, the other Novell-centric; unsurprisingly they tend to clash over OOXML as well as development pace and direction issues. It has gotten to the point where a fork, called Go-OO, has come about, led by Novell's Michael Meeks. Go-OO's version of OOo has been adopted by several distributions leading some to see it as a "hostile" fork.

Sun's chief open source officer, Simon Phipps, clearly sees Go-OO (and the related OO-Build) as an attempt by Novell to control OOo:

The result of this is that go-oo.org is definitely a hostile and competitive fork of OpenOffice.org, and OO-Build is no longer a helpful downstream since it no longer upstreams much of anything (especially for Mac), small changes excepted. Unlike Groklaw I'd still hesitate to call OO-Build a fork, but Go-OO is unmistakably one, just look at the web site, the Windows build and the rhetoric.

The motivation for Go-OO being hosted and promoted by Novell and its staff seems unmistakable to me, as does the fact it is a Novell-sponsored fork. They are promoting Microsoft's flakey XSLT-based OOXML support, they are isolating Linux from OpenOffice.org (so that no-one in the main OpenOffice.org community is able to get support contracts from Linux users). And it is all cleverly wrapped in a community-friendly story about hackers and their freedom and evil, controlling Sun, delivered without interference from Novell corporate.

Meeks most recent look at OOo development is the proximate cause of much of the current sniping in various blogs. Meeks analyzes commits to the OOo codebase to try to extract trends in the development of the tool. His conclusion is stark—undoubtedly inflammatory to those in the Sun camp—"Crude as they are - the statistics show a picture of slow disengagement by Sun, combined with a spectacular lack of growth in the developer community."

While there have been various responses to the analysis—including this LWN comment thread—there has, as yet, been no real counter-analysis that comes to a different conclusion. Perhaps there are other ways to slice and dice the data that look more favorable to growth in the OOo community, but if not, the conclusion is worrisome. OOo is a very useful tool, that is used by many, which offers a way out of Microsoft lock-in. Because of Novell's close association with Microsoft, people worry that Go-oo is an underhanded means for another kind of lock-in—this time to Novell.

In what seems almost a taunt—as well as a validation of the accusation of a hostile fork—Meeks adds a postscript to his analysis:

Why is my bug not fixed ? why is the UI still so unpleasant ? why is performance still poor ? why does it consume more memory than necessary ? why is it getting slower to start ? why ? why ? - the answer lies with developers: Will you help us make OpenOffice.org better ? if so, probably the best place to get started is by playing with go-oo.org and getting in touch [...]

There have long been complaints about the pace of OOo development, along with calls for creating a foundation to oversee it. It would seem that OOo is at a bit of a crossroads. If Sun's commitment is reduced, without a corresponding increase in contributions from others, OOo could stagnate—or Go-oo could take over.

Ostensibly, the SCA is one of the sticking points for some contributors. They do not trust Sun not to take their contributions in a proprietary direction. But the conflict is really rooted in issues of control and development direction—two things likely to lead to forking. While two forks is suboptimal, perhaps, it may lead to improvements in both the code and the development process for OOo.

There are legitimate concerns on both sides of the issue—undoubtedly the mostly silent user community has yet another perspective—but there is enough bad blood between them that it is hard to see it resolving in some relatively amicable way. The office application suite is an extremely lucrative product, at least in the proprietary world. One gets the sense that both Sun and Novell are seeing dollar signs which are clouding their vision. A neutral foundation of some kind might be a good first step towards reconciliation.

Comments (33 posted)

LK2008: Embedded and Mobile Linux

By Jonathan Corbet
October 15, 2008
Linux-Kongress 2008 attendees had the opportunity to hear two different sessions dedicated to organizations trying to improve the state of Linux support for embedded and mobile systems. They have similar goals, but are taking different approaches and have different levels of resources available to them.

The first of these is OpenSourceEmbedded, presented by uClinux developer Jeff Dionne. He opened with a statement that, ten years ago, Linux-based embedded systems were nearly unknown. Now those systems are everywhere, with hundreds of millions of deployments. Embedded systems, he says, make up the largest installed base of Linux systems.

All is not perfect, though, in the embedded sphere. Linux still has an uncomfortably large footprint for embedded use. There is also no unified distribution for embedded use; instead, the industry is full of homemade solutions made by vendors. He would like to address this situation through the creation of a next-generation platform. It would take the form of a kit that developers could start with which comes equipped with design examples for a number of applications: telephones, digital video recorders, etc.

There are two hardware platforms being targeted initially by this effort. One is a Plasma MIPS processor - a very simple device which can be implemented with an FPGA. A simulator for this processor runs about 600 lines of code. The other, more advanced platform is a LEON 2/3 SPARC processor, a full system with a memory management unit and which supports multiprocessor configurations. Examples of the first processor include a RealTek MIPS system, while the LEON SPARC CPU is similar to current SuperH 3 processors. The Plasma and LEON SPARC processors are being designed now, with the intent of producing them as open hardware designs.

On top of these processors will be a base operating system layer with a "mini-POSIX" environment. There will be an interesting packaging system which stores components as separate "blocks" in flash, outside of any filesystem. The running system will be assembled from the blocks by the boot loader. This organization is designed to avoid bricking; any bad or corrupted components can simply be bypassed without affecting the functioning of the rest of the system. This, evidently, is how PalmOS did things.

The next challenge is creating a community around this whole effort. To that end, resources are to be put up at opensourceembedded.org - though nothing is available as of this writing. The site will include project hosting, along with the ability to download the development kits. Jeff says that the uClinux experience has shown that the kit approach works; with a ready-to-use code base like that, a community can come together.

There are also plans to create an organization behind this effort which, among other things, can enter into non-disclosure agreements with hardware manufacturers. This organization will also work to help vendors ship GPL-compliant products.

OpenSourceEmbedded appears to be in an early state, so it's hard to make any guesses about how successful it will be. For more information, see Jeff's slides [PDF].

Mobile Linux

The closing session at the 2008 Linux-Kongress was a talk by Dirk Hohndel, who began by noting that Linux-Kongress is, in fact, the oldest Linux event. It was first held in 1994, and hosted many of the kernel developers who were active at that time; Dirk estimates that about half of the development community was to be found in a single room. It would take a rather larger room to accomplish that now. Dirk complimented the event on its avoidance of commercialism and its sustained focus on the technology.

The technology that Dirk came to talk about was mobile Linux. He started by expressing his disappointment with desktop Linux. It has become a collection of poorly-integrated applications which are somehow trying to replicate Windows 95. The result does not work well on the desktop, and it most certainly is not optimized for the mobile environment.

But, says Dirk, mobile Linux is not really embedded Linux either. Embedded Linux evokes images of access points and other single-application boxes which are not meant to be extended past a single function. They are not concerned with the user's experience, and they are not concerned with mobility. The subject here is devices with a screen, and which can have new applications installed onto them. So some sort of desktop-like interface is needed, but current desktop Linux does not fill the bill.

According to Dirk, the problem with desktop Linux is the fundamental approach: developers are not the target audience for this software, but they are making all the interface decisions. What's needed is input from people who are specialized in interface design and human-computer interaction. That leads to a "scary thought": interface specialists are generally not coders, but they will be making decisions that coders are expected to implement. That is not a normal mode of operation in the free software community, but it is needed here.

Other problems include the proliferation of "80% done" projects. Much of the work has been done, but nobody wants to do the work to finish the job. There's also far too many choices; in general, says Dirk, people do not like it if they have to choose between more than two alternatives. When dealing with the Linux desktop, it's hard to find situations where there are fewer than six choices. And, overall, the Linux desktop lacks consistency. That, says Dirk, is why he uses an Apple laptop. Apple enforces a consistent design across the application space and, he says, the result is very nice.

Devices should be simple and natural to use; such devices are increasingly hard to find anywhere. As an example, he held up a paper notebook. The device boots very quickly, has a nice "touch-based" pencil-oriented interface. No manuals or explanations are needed. Linux-based devices should be just as easy to use. But, at the same time, they need to offer an experience which is close to what people expect from an ordinary, desktop computer. It should have access to the Internet, and users should be able to install software.

[Dirk Hohndel] Dirk then pulled out an Eee PC system and gave the five-second boot demonstration. This work, he says, is an example of what is being done by Intel in support of the Moblin project. Intel is trying to solve some of the hardest problems in the mobile space, contributing the results for everybody to use.

To that end, Moblin is working toward the creation of a base distribution for mobile systems. The user interface will be based on the GNOME mobile work, but with a lot of enhancements. The end goal is the creation of a Linux distribution for mobile devices which is far better than the state of the art today. It is not, he says, an attempt to compete with distributors; instead, Moblin is providing a base which the distributors can build on. Intel's effort will naturally focus on Intel processors, but contributions for any architecture are welcome at Moblin.

In conclusion, Dirk noted that Linux's success on the server side was relatively easy. The mobile problem is much harder. Intel is hoping that others will join in to help Moblin reach its rather ambitious goals.

Comments (6 posted)

Fedora checking community health with EKG

By Jake Edge
October 15, 2008

Measuring the health of communities is an interesting, difficult task. The Fedora project has recently started using a new tool, called EKG, to try to get an overview of the demographics of the free software projects that are sponsored by the distribution. EKG is still young, but already provides some interesting information. Because it is GPL-licensed, as is the Fedora norm, it can be picked up by other distributions or interested parties to target their own projects.

At its core, EKG is a few Ruby scripts that process mailing list data so that graphs can be produced. Currently, it produces both pie charts and line graphs that indicate the number of Red Hat posters versus those from elsewhere. A portion of the most recent set of graphs can be seen at right.

[EKG output]

Red Hat's Michael DeHaan has taken on development of EKG to use as a tool to measure how well various projects are building a community separate from Red Hat. There are lots of free software projects that have been released by Red Hat—or Fedora, which often amounts to the same thing—but may or may not be seen as useful tools outside of Fedora. By looking at the mailing list traffic, particularly over time, some idea of which projects are building a community, and which aren't, can be derived. As the project page puts it:

The premise is simple... what are the demographics behind open source projects that we run in Fedora?
  • Who posts
  • Who contributes
  • What projects are most active?
  • What projects need a little help?

Mailing lists are just one measure of the health of a project, of course, so DeHaan is looking at other metrics. Commits to the project repository—along with the identities of the commiter—would seem an obvious choice. Better graphs with more useful information on each axis as well as time series of the pie charts are also on the "to do" list. He is also looking at derived statistics that will allow direct comparison of different projects by using equations that in some way model success.

It is difficult to draw any conclusions from the limited graphs that are currently available. One thing that does stand out, though, is the popularity of gmail.com email addresses, which seem to account for around one-quarter of posts. One can also certainly see projects that are completely dominated by "inside" (i.e. Red Hat) folks. The JBoss lists are a good example.

Projects are trying various ways to measure how well they are doing their job; EKG is another way to do that. For the kernel, the statistics on each release are gathered by LWN, as well as over longer periods by the Linux Foundation. Ubuntu has its Upstream Report which looks at how well bugs are getting to upstream bug trackers. Undoubtedly other projects have their own ways of trying to measure their impact.

As yet, there is no mailing list for EKG development. We look forward to the day when EKG is applied to its own development list. It would seem that some kind of "metahealth" measurement of the community might be able to be derived from that data.

Comments (none posted)

LK2008: The values of the Linux community

By Jonathan Corbet
October 10, 2008
The opening keynote speaker for the 2008 Linux-Kongress was James Bottomley, who presented his views on the Linux community's values. What these values are, says James, is not entirely obvious. Related groups - the free software community, for example - have well-articulated value systems which define them. The Linux community's values are not so clearly expressed, but, he says, they are central to what we do.

James started with a bit of history, noting the the initial value placed on software was entirely commercial. Once the industry realized that software could be worth far more to its users than it costs to create, the proprietary mode became dominant - and that has affected the evolution of programming in general. The value placed on the code by its developers became irrelevant, leading to "paycheck coding." There is no value placed on creativity, and such a model leads to bad code.

[James Bottomley] Eventually Richard Stallman came along and challenged the commercial view of software. But, during this time, about the only alternative to commercial software was the BSD Unix distribution, and that got caught up in the lawsuit by ATT. So closed software took over; Windows won on commodity platforms, but proprietary software also became dominant in the Unix arena.

In 1991, Linux hit the scene; since then, it has become the most popular and vibrant free software operating system available. In a sense, this is interesting, in that Linux is licensed under the GPL, a license that many companies hate. Apple explicitly chose BSD as the base for MAC OS to avoid GPL-licensed code. But, despite this antipathy, lots of companies use Linux, and even contribute to its development. It is interesting, James says, to look at why that is.

The reason is the Linux community's values. In particular, the community prizes technical merit above all other considerations - including small things like what any company or user would like to have. Also prized is passion; code supported by a developer who clearly cares about it will generally fare better in the review process. If the code quality and the passion are there, the community does not care about much of anything else. Factors like the source of the code or who might benefit from its incorporation don't really matter.

In particular, contributors to the kernel are not required to sign on to any particular belief system or any specific view of freedom. A contributor may have an FSF-like belief in free software, or, instead, be a corporate developer who does not care about software freedom at all. Even the BSD community requires acquiescence with a specific view of freedom. A Linux contributor, instead, need only be willing to contribute the code under the share-alike rules of the GPL.

As a result, anybody can play with Linux, regardless of philosophy or corporate status. We have a community which is defined by contributions, not by a specific set of values regarding software freedom. That has allowed the formation of a very diverse community with a specific shared interest: creating the best kernel we can.

There are some significant benefits from this approach. It forces companies to recognize their engineers' values; that, in turn, makes for more motivated developers. Developers who are interested in improving Linux can get resources and support from corporations. Users get high-quality code from developers who care about what they are doing. Companies get the ability to focus on their little piece of the problem while taking advantage of the community-maintained kernel for the rest; they can also offload their older code to the community for long-term maintenance.

James compared the Linux way of doing things with the US constitution. That document only mentions freedom three times, yet it has become a blueprint which has supported freedom for over 200 years. It is a relatively short document. The proposed EU constitution, instead, is about 20 times the length, before taking into account other documents which are referenced. That document would appear to be somewhat bloated; the goals would be better served by a more concise formulation.

Similarly, the Linux community spends little time talking about freedom. Instead, the focus is on a set of brief principles involving code quality and passion. Freedom is not legislated; it arises as an emergent value inherent in the Linux way of doing things. Linux has managed to bring about software freedom without talking about it, and without imposing a view of software freedom on its contributors. In the process, Linux has succeeded in creating something which is as free - or more free - than the GNU system envisioned by the Free Software Foundation.

During the question period, James wished for a free software advocate who would argue the point with him, but no such person emerged. He will, it seems, have to repeat the talk in a different venue before he can have that debate.

Comments (49 posted)

Page editor: Jake Edge

Security

SELinux permissive domains

By Jake Edge
October 15, 2008

Readers of this page—along with the kernel page—will not find it surprising that SELinux is a complex beast. It is, however, the dominant security framework for Linux, pushed hard by Red Hat, but also being adopted, slowly, by SUSE, Ubuntu, and others. Over the years, through lots of hard work, it has become somewhat less complex, at least for administrators; a new feature, called permissive domains will help further ease the administration of SELinux-enabled systems.

These days, SELinux has two modes, the aptly named enforcing and permissive modes. When in enforcing mode, SELinux will not allow operations that are not permitted by the policy, whereas in permissive mode, a violation is just logged and the operation is allowed to continue. Administrators trying to track down an SELinux problem with an application—whether a real security issue or just a problem with the policy—can put the system into permissive mode, then study the logs to determine what policies are being violated. Or they can use audit2allow to make those policy changes for them.

Until permissive domains, though, the choice between permissive and enforcing was binary for the entire system. By putting a system into permissive mode, various attacks that SELinux might normally stop on other applications would instead just be logged. With permissive domains, a single process, or group of related processes, can be marked as permissive, while the rest of the system stays in enforcing mode.

Red Hat SELinux hacker Dan Walsh, describes permissive domains on his blog. One of the motivations is to help third-party software developers feel more comfortable about shipping SELinux policy with their application:

Another problem SELinux has is that third party software companies want to ship with SELinux policy for their software but do not trust that they have tested it well enough to run their confined applications in enforcing mode. I have talked to developers of stock market software that wanted to write policy for an application, distribute it to a live environment of several hundred machines, and then gather the AVCs as they happen, using this information to fine-tune their policy. After a long period of time, where they saw no AVCs, they might be willing to put their policy in enforcing mode. In RHEL5 they need to put the entire machine in permissive mode, but permissive domains solve this problem.

Permissive domains are available in recently updated Fedora 9 systems and will come standard with Fedora 10. As Walsh shows, enabling permissive mode for a domain is trivial:

    # semanage permissive -a httpd_sys_script_t
which would put all CGI scripts into permissive mode. And:
    # semanage permissive -d httpd_sys_script_t
to remove permissive mode for the CGI script domain (httpd_sys_script_t).

This is definitely a nice step forward for assisting with policy development, but there is still a lingering problem with the recommended way to generate SELinux policies. Walsh describes how that is done:

Finally, when someone wants to write policy for a new confined domain, we tell the policy writer to build a minimal policy using tools like system-config-selinux. Then we advise them to put the machine in permissive mode, run the confined application, collect the AVC messages, use audit2allow to generate new policy, and try again. Lather, rinse, repeat. This puts the entire machine at risk, since it is no longer protected by SELinux. With permissive domains, you can mark the new domain as permissive and avoid putting the machine at risk.

The problem, of course, is that blindly using audit2allow is extremely dangerous. It assumes that the application has no security problems, that all of its accesses should be permitted—if that can be assumed, what is SELinux for? By taking all of the violations and turning them into policy changes, the application, rather than the policy developer, decides on the access it requires. Using audit2allow correctly is much more complex, requiring a good understanding of SELinux and the existing policies and domains.

To be fair to Walsh, in a related post, he does warn:

Whenever you generate policy in this way you should really examine the te file for what rules audit2allow has generated and try [to] make sure they make sense, and don't open a security [hole]. It is always good to ask if the policy is good on a list like fedora-selinux. If you believe this is a bug in policy, please open a bugzilla. Then we can fix the policy for others.

The audit2allow manpage is even more explicit:

Care must be exercised while acting on the output of this utility to ensure that the operations being permitted do not pose a security threat. Often it is better to define new domains and/or types, or make other structural changes to narrowly allow an optimal set of operations to succeed, as opposed to blindly implementing the sometimes broad changes recommended by this utility. Certain permission denials are not fatal to the application, in which case it may be preferable to simply suppress logging of the denial via a dontaudit rule rather than an allow rule.

Using audit2allow is, unfortunately, the way that most SELinux policy is developed. There aren't enough SELinux experts—there may never be enough—to actually look at the code for applications and determine a priori what the policy should look like. So, testing applications by running them to determine what permissions they require is the only sane way to do it, error-prone though it may be.

Comments (4 posted)

New vulnerabilities

cups: several vulnerabilities

Package(s):cups CVE #(s):CVE-2008-3639 CVE-2008-3640 CVE-2008-3641
Created:October 10, 2008 Updated:February 20, 2009
Description: From the Red Hat advisory:

A buffer overflow flaw was discovered in the SGI image format decoding routines used by the CUPS image converting filter "imagetops". An attacker could create a malicious SGI image file that could, possibly, execute arbitrary code as the "lp" user if the file was printed. (CVE-2008-3639)

An integer overflow flaw leading to a heap buffer overflow was discovered in the Text-to-PostScript "texttops" filter. An attacker could create a malicious text file that could, possibly, execute arbitrary code as the "lp" user if the file was printed. (CVE-2008-3640)

An insufficient buffer bounds checking flaw was discovered in the HP-GL/2-to-PostScript "hpgltops" filter. An attacker could create a malicious HP-GL/2 file that could, possibly, execute arbitrary code as the "lp" user if the file was printed. (CVE-2008-3641)

Alerts:
CentOS CESA-2009:0308 2009-02-19
Red Hat RHSA-2009:0308-01 2009-02-19
rPath rPSA-2008-0338-1 2008-12-19
Gentoo 200812-11 2008-12-10
Slackware SSA:2008-312-01 2008-11-07
Debian DSA-1656-1 2008-10-20
SuSE SUSE-SR:2008:021 2008-10-17
Ubuntu USN-656-1 2008-10-15
Fedora FEDORA-2008-8844 2008-10-16
Fedora FEDORA-2008-8801 2008-10-16
Mandriva MDVSA-2008:211 2007-10-10
CentOS CESA-2008:0937 2008-10-10
Red Hat RHSA-2008:0937-01 2008-10-10
SuSE SUSE-SR:2009:002 2009-01-19

Comments (none posted)

dbus: denial of service

Package(s):dbus CVE #(s):CVE-2008-3834
Created:October 10, 2008 Updated:May 3, 2011
Description: From the CVE entry: The dbus_signature_validate function in the D-bus library (libdbus) before 1.2.4 allows remote attackers to cause a denial of service (application abort) via a message containing a malformed signature, which triggers a failed assertion error.
Alerts:
SUSE SUSE-SR:2011:008 2011-05-03
Red Hat RHSA-2010:0018-01 2010-01-07
CentOS CESA-2010:0018 2010-01-08
Mandriva MDVSA-2009:256 2009-10-06
CentOS CESA-2009:0008 2009-01-08
SuSE SUSE-SR:2008:027 2008-12-09
Gentoo 200901-04 2009-01-11
Red Hat RHSA-2009:0008-01 2009-01-07
Debian DSA-1658-1 2008-10-22
Mandriva MDVSA-2008:213 2008-10-15
Ubuntu USN-653-1 2008-10-14
Fedora FEDORA-2008-8764 2008-10-09
openSUSE openSUSE-SU-2012:1418-1 2012-10-31

Comments (none posted)

exiv2: denial of service

Package(s):exiv2 CVE #(s):CVE-2008-2696
Created:October 15, 2008 Updated:October 31, 2008
Description:

From the Ubuntu advisory:

Joakim Bildrulle discovered that exiv2 did not correctly handle Nikon lens EXIF information. If a user or automated system were tricked into processing a specially crafted image, a remote attacker could cause the application linked against libexiv2 to crash, leading to a denial of service. (CVE-2008-2696)

Alerts:
SuSE SUSE-SR:2008:023 2008-10-31
Ubuntu USN-655-1 2008-10-15

Comments (none posted)

kernel: several vulnerabilities

Package(s):linux-2.6 CVE #(s):CVE-2008-1514 CVE-2008-3833 CVE-2008-4210 CVE-2008-4302
Created:October 14, 2008 Updated:January 8, 2009
Description: From the Debian advisory:

Jan Kratochvil reported a local denial of service vulnerability in the ptrace interface for the s390 architecture. Local users can trigger an invalid pointer dereference, leading to a system panic. (CVE-2008-1514)

The S_ISUID/S_ISGID bits were not being cleared during an inode splice, which, under certain conditions, can be exploited by local users to obtain the privileges of a group for which they are not a member. Mark Fasheh reported this issue. (CVE-2008-3833)

David Watson reported an issue in the open()/creat() system calls which, under certain conditions, can be exploited by local users to obtain the privileges of a group for which they are not a member. (CVE-2008-4210)

A coding error in the splice subsystem allows local users to attempt to unlock a page structure that has not been locked, resulting in a system crash. (CVE-2008-4302)

Alerts:
Red Hat RHSA-2008:0787-01 2009-01-05
CentOS CESA-2008:0973 2008-12-17
Red Hat RHSA-2008:0973-03 2008-12-16
SuSE SUSE-SA:2008:057 2008-12-04
SuSE SUSE-SA:2008:056 2008-12-03
Ubuntu USN-679-1 2008-11-27
Mandriva MDVSA-2008:220-1 2008-11-19
CentOS CESA-2008:0972 2008-11-20
Red Hat RHSA-2008:0972-01 2008-11-19
SuSE SUSE-SR:2008:025 2008-11-14
Red Hat RHSA-2009:0001-01 2009-01-08
CentOS CESA-2008:0957 2008-11-05
Red Hat RHSA-2008:0957-02 2008-11-04
Mandriva MDVSA-2008:220 2008-10-29
SuSE SUSE-SA:2008:051 2008-10-21
Debian DSA-1655-1 2008-10-16
Debian DSA-1653-1 2008-10-13

Comments (none posted)

mon: insecure temp files

Package(s):mon CVE #(s):CVE-2008-4477
Created:October 9, 2008 Updated:October 17, 2008
Description: mon has an insecure temporary file creation vulnerability. From the Debian alert:

Dmitry E. Oboukhov discovered that the test.alert script used in one of the alert functions in mon, a system to monitor hosts or services and alert about problems, creates temporary files insecurely, which may lead to a local denial of service through symlink attacks.

Alerts:
Mandriva MDVSA-2008:214 2008-10-16
Debian DSA-1648-1 2008-10-08

Comments (none posted)

portage: privilege escalation

Package(s):portage CVE #(s):CVE-2008-4394
Created:October 10, 2008 Updated:October 15, 2008
Description: From the Gentoo advisory: A search path vulnerability in Portage allows local attackers to execute commands with root privileges if emerge is called from untrusted directories.
Alerts:
Gentoo 200810-02 2008-10-09

Comments (none posted)

ruby: multiple vulnerabilities

Package(s):ruby CVE #(s):CVE-2008-3905 CVE-2008-3790 CVE-2008-3443
Created:October 10, 2008 Updated:January 5, 2009
Description: From the CVE entries:

CVE-2008-3905 - resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.

CVE-2008-3790 - The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."

CVE-2008-3443 - The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick.

Alerts:
Debian DSA-1695-1 2009-01-02
Gentoo 200812-17 2008-12-16
Ubuntu USN-691-1 2008-12-16
Mandriva MDVSA-2008:226 2008-11-06
CentOS CESA-2008:0897 2008-10-24
CentOS CESA-2008:0896 2008-10-21
Red Hat RHSA-2008:0897-01 2008-10-21
Red Hat RHSA-2008:0896-01 2008-10-21
Red Hat RHSA-2008:0895-02 2008-10-21
Debian DSA-1652-1 2008-10-12
Debian DSA-1651-1 2008-10-12
Ubuntu USN-651-1 2008-10-10
Fedora FEDORA-2008-8736 2008-10-09
Fedora FEDORA-2008-8738 2008-10-09

Comments (none posted)

Events

OWASP Summit set for November in Portugal

The Open Web Application Security Project is announcing its European summit to be held November 4-7 in Algarve, Portugal. The theme of the conference is "Setting the AppSec [Application Security] agenda for 2009". "This venue hosts a diverse selection of training courses along with technical and business tracks, making it THE place to learn about web application security and the resources OWASP has available for use today." Click below for the full announcement.

Full Story (comments: none)

Page editor: Jake Edge

Kernel development

Brief items

Kernel release status

The 2.6.27 kernel is out, released by Linus on October 9. For those just tuning in, 2.6.27 includes (among many other things) UBIFS, support for integrity checking in the block layer, multiqueue networking, the ftrace tracing framework, the lockless page cache, the relocation of a lot of firmware, the GSPCA webcam driver set, and a number of extended system calls. See the always-excellent KernelNewbies summary for lots more information about this release.

The 2.6.28 merge window is currently open with around 4100 changesets merged at the time of this writing. See the article below for a summary of what has been added to the kernel so far in this development cycle.

The current stable kernels are 2.6.25.18 and 2.6.26.6 which were released on October 8. Both contain a long list of important fixes throughout the kernel tree.

Comments (4 posted)

Kernel development news

Quotes of the week

ooh, I like err_ick and err_fck a lot. They sound like akpm review comments at the end of a long day.
-- Andrew Morton

You should just get a real name, not that "John Smith" crud. Something _manly_. Something unique. Something strong. Something that tells you that you're not just another clone.

Something like "Linus Torvalds". Except not exactly.

-- Linus Torvalds (Thanks to Matthew Burgess)

On Tue, 14 Oct 2008, Jean Delvare wrote:
> 
> Marek Vasut (1):
>       i2c/tps65010: Vibrator hookup to gpiolib

Guys, I know we geeks aren't known for our sex-life, but do we have to make it so obvious?

-- Linus Torvalds (thanks to David Lang and Walter Franzini)

Comments (none posted)

Quotes of the week (part 2)

2.6.16 has become a bit dated, and I'll maintain 2.6.27 for a few years as a replacement.

As with 2.6.16, I'll pickup maintenance when the normal -stable maintenance ends (at some point after 2.6.28 gets released in January).

It is intended to fill the niche for users who are not using distribution kernels but want to use a regression-free kernel for a longer time. It might be a small part of the userbase, but after the experiences with 2.6.16 I can say that there are quite a few users who appreciate such an offering.

-- Adrian Bunk

Comments (1 posted)

Merged for 2.6.28

By Jonathan Corbet
October 15, 2008
As of this writing, 4193 non-merge changesets have been incorporated for the 2.6.28 kernel. In other words, this merge window is just beginning, having merged probably less than half of the patches which will eventually find their way into the mainline. What we see so far are a lot of drivers and incremental improvements, but not many major changes.

User-visible changes for 2.6.28 include:

  • There are new drivers for Analog Devices SSM2602, AD1882A and AD1980 codecs, Freescale MPC5200 I2S audio devices, Texas Instruments TLV320AIC26 codecs, Tascam US-122L USB Audio/MIDI interfaces, Wolfson Micro WM8580, WM8900, WM8903, and WM8971 audio devices, Blackfin SPORT peripheral interface controllers, NVIDIA HDMI HD-audio codecs, Toshiba RBTX4939 MIPS boards, Atheros L2 10/100 network adapters, Cisco 10G Ethernet adapters, JMicron JMC250 chipset-based network adapters, QLogic QLGE 10Gb Ethernet adapters, SMSC LAN95XX based USB 2.0 10/100 ethernet devices, AFEB9260 ARM-based boards (an open source board design), Arcom/Eurotech VIPER boards, AT91SAM9X watchdog devices, ITE IT8716, IT8718, IT8726, and IT8712 Super I/O watchdogs, W83697UG/W83697UF watchdog devices, TLV320AIC23 codecs, Micron MT9M111 camera chips, Magic-Pro DMB-TH tuners, Afatech AF9015 and AF9013 DVB-T USB2.0 receivers, Conexant cx24116/cx24118 tuners, DVB cards based on SDMC DM1105 PCI chip, Silicon Laboratories SI2109/2110 demodulators, ST STB6000 DVBS Silicon tuners, numerous Fujifilm FinePix cameras, ALi video camera controllers, WM8400 AudioPlus HiFi codecs, and SGS-Thomson M48T35 Timekeeper RAM chips.

  • Support for the old Sun 4 architecture and ColdFire serial ports has been removed.

  • There is a new sysfs file (unload_heads) which can be used by a user-space process to tell an ATA disk to retract its heads and prepare for an impact. When used in conjunction with an accelerometer, this feature could be used to attempt to preserve a disk in a falling laptop.

  • Improved support for ptrace() - and support for precise event-based sampling in particular - has been added for the x86 architecture.

  • The crypto subsystem has gained support for deterministic ANSI X9.31 A.2.4 pseudo-random number generation.

  • The SMACK security module can now be configured to enforce mandatory access control rules on privileged processes.

  • There is a script which can be used to generate a minimal "dummy" policy for SELinux. The smallest workable policy, it seems, is 587 lines long.

  • Some sound devices can detect the presence of audio devices on input and output jacks. The ALSA layer now allows drivers for those devices to register those jacks and report the presence of devices attached to sound cards through the input layer.

  • Work with multiqueue networking continues; 2.6.28 will include the ability to associate a separate queueing discipline with each internal packet queue.

  • The wireless regulatory compliance subsystem has been merged.

  • The kernel now supports the Phonet packet protocol used by Nokia cellular modems. See networking/phonet.txt in the kernel documentation directory for more information.

  • Also added to core networking is support for the Distributed Switch Architecture protocol, with initial support for a number of Marvell switch chips.

  • The netfilter layer has been augmented to support network namespaces.

  • The ext4 system has lost the "ext4dev" name; this is a signal that the developers are getting ready to declare it ready for production use. Ext4 has also gained a set of static tracepoints for use with SystemTap or other tracing tools.

  • The FIEMAP ioctl() for extent mapping has been added.

  • Xen has added CPU hotplugging support.

  • Version 4 of the rpcbind protocol is now supported; this enables the kernel to offer RPC services via IPv6.

  • The OCFS2 filesystem has gained a number of features, including POSIX locks, extended attributes, and use of the JBD2 journaling layer.

Changes visible to kernel developers include:

  • Discard request and request timeout handling have been added to the block layer; a number of other internal API changes have been made as well. See this article for details.

  • Video4Linux2 drivers no longer have their open() function called with the big kernel lock held. The lock_kernel() calls have been pushed down into individual drivers within the mainline tree; external drivers will need to be fixed.

The merge window is likely to remain open until approximately October 24.

Comments (none posted)

Block layer: solid-state storage, timeouts, affinity, and more

By Jonathan Corbet
October 15, 2008
The 2.6.28 merge window has seen the addition of a number of changes to the block layer. Here's a summary of the new features and APIs which have gone in.

Solid-state storage devices

There are some enhancements aimed at improving the kernel's support of solid state storage devices. One of those, the discard API, has been covered here before. This API allows high-level block subsystem users (filesystems) to indicate that a particular range of blocks no longer contains useful data. That allows the low-level device to incorporate those blocks into its garbage collection scheme and to stop worrying about their contents when performing wear leveling.

Since the initial LWN article, though, the API has changed a little. The way to issue a discard request is now:

    int blkdev_issue_discard(struct block_device *bdev, sector_t sector,
			     unsigned nr_sects);

The end_io() parameter seen in previous versions of the API is no longer present. There is no way for callers to know when the request completes, or, indeed, if the request completes at all. Since the caller is indicating a lack of interest in the given sectors, it really should not matter what the device does thereafter.

There is a filesystem-level function for creating discard requests:

    static inline int sb_issue_discard(struct super_block *sb,
				       sector_t block, 
				       unsigned nr_blocks);

Here, the interface is expecting block numbers using the filesystem block size, rather than 512-byte sectors.

User-space programs can issue discard requests with the new BLKDISCARD ioctl() call. Needless to say, such operations should be done with care; about the only logical user of this ioctl() would be mkfs programs.

Block drivers which support discard requests will provide a suitable function to the block layer:

    typedef int (prepare_discard_fn) (struct request_queue *queue, 
    	    			      struct request *rq);

    void blk_queue_set_discard(struct request_queue *q, 
    	                       prepare_discard_fn *dfn);

In the absence of a "prepare discard" function, discard requests for the device will fail.

The block layer has also added a flag by which drivers can indicate that a device is not rotating storage, and, thus, does not suffer from seek delays. By setting QUEUE_FLAG_NONROT (with queue_flag_set() or queue_flag_set_unlocked()), a driver tells the block layer that it is working with a solid state device. I/O schedulers can use that information to avoid plugging the queue - a useful technique for combining requests to rotating storage devices, but a useless operation when there is no seek penalty to avoid.

Request affinity

On large, multiprocessor systems, there can be a performance benefit to ensuring that all processing of a block I/O request happens on the same CPU. In particular, data associated with a given request is most likely to be found in the cache of the CPU which originated that request, so it makes sense to perform the request postprocessing on that same CPU. With 2.6.28, sysfs entries for block devices will include an rq_affinity variable. If it is set to a non-zero value, CPU affinity will be turned on for that device. According to the patch changelog, turning this feature on can reduce system time by 20-40% on some benchmarks.

Timeout handling

Robust device drivers typically have to be written to handle cases where devices fail to complete operations they have been instructed to do. In a few cases, higher-level code helps with this task; the networking layer, for example, can track outgoing packets and let a driver know when a transmit operation has taken too long. In most other drivers, though, it's up to the driver itself to notice when an operation seems to be taking too long.

Like the network subsystem, the block layer manages queues of requested operations. As of 2.6.28 the block layer will, again like networking, have a mechanism for notifying drivers about request timeouts; that, in turn, will allow a bunch of timeout-related code to be removed from the lower layers. Timeout handling in the block layer can be more complex, though, and the associated API reflects that complexity.

A block driver must register a function to handle timed-out requests:

    typedef enum blk_eh_timer_return (rq_timed_out_fn)(struct request *);

    void blk_queue_rq_timed_out(struct request_queue *q, 
				rq_timed_out_fn *fn);

The amount of time a request should be outstanding before timing out is set up with:

    void blk_queue_rq_timeout(struct request_queue *q, 
    	 		      unsigned int timeout);

The tracking of per-request timeouts is done within the block layer; the timer for any individual request is started when that request is dispatched to the driver by the I/O scheduler. Should a request fail to complete before the timeout period passes, the driver's timeout function will be called with a pointer to the languishing request. The driver then can do one of three things:

  • Figure out that, in fact, the request was completed as expected, but that completion had not been noticed by the driver. A dropped interrupt could bring out such a situation, for example. In this case, the driver returns BLK_EH_HANDLED, and the request will be marked as completed.

  • Decide that the request needs more time, perhaps because it has been re-issued by the driver. A BLK_EH_RESET_TIMER will start the timer again for this request.

  • Punt and return BLK_EH_NOT_HANDLED. The block layer currently does nothing at all when it gets this return code; future plans appear to include aborting the request within the block layer when this return value is encountered.

If things look bad, the driver may decide to abort any outstanding requests, reset the device, and start over. There are a couple of new functions which can help with this task:

    void blk_abort_request(struct request *req);
    void blk_abort_queue(struct request_queue *q);

These functions will abort the given request, or all requests on the queue, as appropriate. Part of that process involves calling the driver's timeout handler for each aborted request.

Other changes in brief

Some other block-layer changes include:

  • The handling of minor numbers has been changed, allowing disks to have an essentially unbounded number of partitions. The cost of this change is that minor numbers may be attached to a different major number, and they might not all be contiguous; for this reason, drivers must set the GENHD_FL_EXT_DEVT flag before the extended numbers will be used. See this article for more information on this change.

  • The prototypes of blk_rq_map_user() and blk_rq_map_user_iov() have changed; there is now a gfp_mask parameter. This allows these functions to be used in atomic context.

  • kblockd_schedule_work() has an additional parameter specifying the relevant request queue.

  • The new function bio_kmalloc() behaves much like bio_alloc(), but it does not use a mempool to guarantee allocations and can thus fail.

It is, all told, one of the busier development cycles for the block layer in recent times.

Comments (1 posted)

Patches and updates

Kernel trees

Core kernel code

Development tools

Device drivers

Filesystems and block I/O

Networking

Architecture-specific

Security-related

Page editor: Jake Edge

Distributions

News and Editorials

What is Ulteo?

By Rebecca Sobol
October 15, 2008
Gaël Duval, founder of Mandrake-Linux, started Ulteo after he was laid off by Mandriva in 2006. The first alpha release was announced several months later.

In the past two years the project has had some time to mature and with the announcement that OpenOffice.org 3.0 is available through Ulteo.com it seemed like a good time to revisit the project.

Ulteo is aimed at Windows users, and gives them a slow and easy to way to convert to Linux using the first of several several sub-projects; the Ulteo Online Desktop. Many Linux applications are available through a Java enabled web browser such as Firefox or Internet Explorer. OpenOffice.org, KPdf, Kopete, Skype, Thunderbird + Enigmail, Gimp and Digikam, Inkscape and Scribus and many other applications are available in the Online Desktop without installing any new software on the PC. A subscription to Ulteo Premium provides extra storage for documents and other benefits.

Once the user becomes comfortable with Linux applications they could be ready for the Ulteo Application System which is an installable system for the PC. The Application System features automatic document synchronization/backup, automatic updates and upgrades, and all the applications included in the online desktop.

The Ulteo Virtual Desktop seems to be much the same as the Online Desktop. It is designed to run under Windows and allows the use of both Linux and Windows applications. The Virtual Desktop uses coLinux to provide the Linux desktop on Windows.

The final Ulteo product, for now at least, is the Documents Synchronizer. This, like the Virtual Desktop, is Windows software but it can be used with the Online Desktop to backup and retrieve documents, whether these are produced locally with Windows applications or with Linux applications using Online Desktop.

Ulteo is not something that will be of immediate interest to the average LWN reader. Presumably most readers are already knowledgeable about running Linux and its applications. However most of us probably do know someone who is not ready to run Linux natively. At least some of those people could start using the Online Desktop and become more familiar with various Linux applications without having to download and install those applications. Who knows where they might go after that.

Comments (2 posted)

New Releases

Mandriva Linux 2009 has been released

Mandriva has announced the release of Mandriva Linux 2009. "Mandriva Linux 2009 goes further in its innovations and offers a thoroughly modern and cutting-edge graphical environment: KDE 4.1. Personalizable, modular, scalable, and full of visual effects that enhance the environment, KDE's new version is usable everywhere, from the oldest hardware to the newest. Mandriva’s team has gone to great lengths to integrate this new environment in a way that ensures everyone can jump right in to using it, with a customized graphical theme, careful choice of the most powerful applications, and a default configuration tuned to your system's particular hardware."

Comments (none posted)

Fedora 10 Snapshot 1 Released

A snapshot of Fedora 10 (beta) is available for testing. "As part of our development schedule, we are releasing a snapshot of Rawhide in Live form. We are releasing these via bittorrent only as it is a much lighter weight method to get bits out the door than to go through our mirroring system. If you cannot use bittorrent we apologize for the inconvenience."

Full Story (comments: none)

Announcing the General Availability of XO Software Release 8.2.0

The XO Software Release 8.2.0 was developed by OLPC engineers and the OLPC open source community. "Release 8.2 is based on a child focused graphical interface called Sugar, a Red Hat Fedora 9 Linux operating system and OLPC customized implementations of core software including power management, wireless drivers, NAND flash file system, Open Firmware, and other components."

Full Story (comments: 2)

Distribution News

Debian GNU/Linux

Bits from the Debian Eee PC team

The Debian Eee PC team reports numerous successes in getting the various Eee PC models to run Debian. Most of the work has been on getting wireless networking working with in-tree (i.e. not binary) drivers, but there has also been work done on ACPI support. They are also keeping an eye on the 5-second-boot work that Arjan van de Ven and Auke Kok are doing. Click below for the full report.

Full Story (comments: 9)

Bits from the Debian CD team

The Debian CD team has been building CD and DVD images of each weekly Lenny build. Lenny is the codename for the upcoming Debian 5.0 release. Some Blu-ray images are also available for i386, amd64 and source, *jigdo only*. Grab an image and start testing.

Full Story (comments: none)

Debian bugs #600000 and #1000000 contest

The Debian project has set up a small contest, a bet on the day that bug numbers 600000 and 1000000 will be reported. "The winner(s) will be the person(s) placing her|his|their bet as close as possible to the real moment bug #600000 and #1000000 are reported."

Full Story (comments: 2)

Fedora

Fedora Board Meeting Recap 2008-10-07

Some note from the Fedora Board Meeting of October 7, 2008 are available. Topics include codecs, a trademark update, and more.

Full Story (comments: none)

First steps of the transition from Livna to RPM Fusion begins now for livna-devel users!

RPM Fusion is the merger of Dribble, Freshrpms and Livna, still in progress. "Most of the packages from Livna have been imported and build for RPM Fusion already, hence we now begin to slowly move users from Livna over to RPM Fusion by activating the RPM Fusion free and nonfree rawhide repos for users of livna's devel branch *now*." Click below for more on the status of this new "extras" repository for Fedora users.

Full Story (comments: none)

Distribution Newsletters

Arch Linux Newsletter

The October 2008 issue of the Arch Linux Newsletter is out, with news about TeXLive in extras, netcfg in core, Arch Linux in the media, and several other topics.

Comments (none posted)

DistroWatch Weekly, Issue 274

The DistroWatch Weekly for October 13, 2008 is out. "Mandriva Linux, traditionally the first among the major distribution releases, boldly unveiled its latest product late last week. Shipping with KDE 4.1.2, an updated system installer, and a variety of usability enhancements, version 2009 should have been the company's best release ever. It was somewhat spoilt by a long list of known bugs that weren't fixed in time for the release - hopefully these will be corrected through post-install package updates soon, but there are those who'd argue for a postponement of a release in such situations. No similar dilemma is ever likely to face the Debian development team. If it isn't ready, it won't be released - that's the message given to the user community which has been hoping for a timely arrival of "Lenny". And while most other distributions have been quietly fixing the bugs in their own development trees, DistroWatch has compiled another package management cheatsheet - now incorporating two distro-agnostic tools, as well as source-based distributions."

Comments (none posted)

Fedora Weekly News #147

This week the Fedora Weekly News looks at New Fedora 9 Re-spins, Fedora Test Day, Uberpackager Replaces Packager. The marketing beat has Fedora's Community Attracts Experienced Users and Five Second Boot of a Modified Version of Fedora. In Developments there are Unsigned Rawhide Packages an Attack Vector ?, Procedure for Re-naming a Package, Review of trash-cli Raises Generic Naming Issues, PackageKit-gstreamer-plugins Obsoletes Codeina, LXDE Feature Removal Disappointment - How to Avoid; and much more.

Full Story (comments: none)

Ubuntu Weekly Newsletter #112

The Ubuntu Weekly Newsletter for October 11, 2008 covers: Ubuntu Countdown banner for WordPress, Follow up: Xubuntu Hug Day, Ubuntu Free Culture Showcase Winners, New Ubuntu Members, Getting help from the Launchpad Team, Launchpad to be off-line, Server Team meeting summary, and much more.

Full Story (comments: none)

Newsletters and articles of interest

Mandriva Linux 2009 'optimised' for mini laptops (vnunet)

vnunet covers the release of Mandriva Linux 2009. "Linux publisher Mandriva has released its latest distribution, Mandriva Linux 2009, offering a faster boot time and up-to-date versions of tools such as KDE, Gnome, OpenOffice and Firefox, plus an installer that optimises the platform for mini-laptops. Available immediately for download, Mandriva Linux 2009 integrates the latest innovations, from office applications to the newest virtualisation technology, according to the firm."

Comments (none posted)

Distribution reviews

Foresight Kid's can inspire young minds (Linux.com)

Susan Linton looks at the Foresight Kid's Edition. "Foresight Kid's Edition captures children's attention immediately with its happy bumblebee character, smiling and waving from the lower corner of the brightly colored desktop. Distractions are kept to a minimum on the panel and desktop, with only a few icons such as Trash and Home showing. The customized Slab menu is also constructed for children, having entries for the applications of interest to youngsters in the Favorite Applications screen (main panel)."

Comments (3 posted)

Sidux grows on you (Linux.com)

Susan Linton reviews Sidux. "Sidux, a relatively new desktop Linux distribution, is based on Sid, the unstable developmental branch of Debian. The developers strive for an easy-to-install and easy-to-use modern Debian derivative, and pride themselves on remaining true to the principles and values of the Debian project. Despite a few inconveniences, I like Sidux a bit more each time I use it."

Comments (none posted)

Page editor: Rebecca Sobol

Development

Connecting to Microsoft Exchange with OpenChange

October 13, 2008

This article was contributed by Tom Chance.

Working with a Windows network from Linux has never been a smooth ride. While Samba, Wine and OpenOffice.org have made many components workable, connecting to the Microsoft Exchange email server has remained unreliable. Now the OpenChange developers hope to change that, providing the same capabilities as Microsoft Outlook in a range of Linux-native clients like Kontact and Evolution. OpenChange is not yet workable, but partial operation can demonstrate its potential.

If you want to connect to Exchange at the moment, you have a few options. Evolution can connect using a hack with Outlook Web Access, providing email, shared folders, calendars and contacts. But it's far from reliable; I tried to get by with it at the office, warts and all, and managed it for a couple of weeks before resigning myself to Windows. The other options are even worse -- just use the webmail client, or use the IMAP server for email and hacks such as this one to get at other data in a manner similar to Evolution. Working from home on Kubuntu, I find it easier to just use the webmail client.

OpenChange is taking a much more sensible approach. At the heart of the project is a MAPI-compatible API, which allows clients to talk directly to Exchange and access all of its functionality. The code is still being actively developed, but some application developers have started playing around with it; the first code for Evolution came out in January 2008. According to Brad Hards, an OpenChange and Kontact developer, "OpenChange can do most of the Exchange tasks now, though it can't currently do free/busy."

For the curious, OpenChange developer Julien Kerihuel has written a simple command-line client. It's currently available in Ubuntu Intrepid and Debian Experimental, though you're better off compiling it yourself as it is changing quite rapidly. It isn't especially well documented, and the manpage implies some functionality that Kerihuel is still working on, but I did have some success.

First, you need to set-up a new profile:

tom@dell-desktop:~$ mapiprofile --profile=tom.chance -w=dell-desktop \
  -I=192.168.0.11 -D=BIOREG -u=tom.chance -p=mypassword --create

You can check if it has worked by listing your mailboxes:

tom@dell-desktop:~$ openchangeclient --mailbox --profile=tom.chance \
  + Mailbox - Tom Chance
|---+ Calendar :      (Total: 774 / Unread: 0 - Container class: IPF.Appointment) [FID: 0xdadb000000000001]  
|---+ Contacts :      (Total: 59 / Unread: 0 -  Container class: IPF.Contact) [FID: 0xdbdb000000000001]
|---+ Deleted Items : (Total: 0 / Unread: 0 -   Container class: IPF.Note) [FID: 0x3efc000000000001] 
|---+ Drafts :        (Total: 0 / Unread: 0 -   Container class: IPF.Note) [FID: 0xdcdb000000000001]   
|---+ Inbox :         (Total: 474 / Unread: 0 - Container class: IPF.Note) [FID: 0x3bfc000000000001]
|---+ General :       (Total: 10 / Unread: 1 -  Container class: IPF.Note) [FID: 0xe00240000000003]

I managed to send a test email, which I picked up in Outlook without problems. When I opened the same email in KMail, however, it has a "winmail.dat" binary file attached, which you wouldn't normally get in emails from Outlook.

tom@dell-desktop:~$ openchangeclient -p=tom.chance --to="tom.chance@bioregional.com" \
  --subject="OpenChange test" --body="Hmm, did this work?" --sendmail

sendmail MAPI_E_SUCCESS (0x0)

You can also interrogate folders, send emails, create and delete contacts, calendar appointments and access most of the other Exchange functionality. Kerihuel: "Openchangeclient is a test case for libmapi, it's a useful way to test if a problem is in the client application or in libmapi, and there is a plugin for sugarcrm, so it may remain in future." There's a proxy server using Samba too, for those who want yet another way of connecting.

For Kontact users, usable integration is probably a good 6 months away. The akonadi resource can deal with most of OpenChange's functionality, "at least a bit", accord to Hards, though "Kontact can't currently make use of it because it isn't converted to akonadi yet." KDE 4.2 should come out with akonadi integration, but the OpenChange functionality might not yet be stable enough for large quantities of important data. Hards thinks KDE 4.3 is probably "the sweet spot."

Until then, Ballmer's mantra remains relevant; OpenChange and its client implementations could do with developers, developers, developers. Cracking this nut could throw open Exchange to a new range of clients, and as Kontact and its peers become stable on Windows and MacOSX, an entrenched Windows server will pose less of a threat to free software migrations on desktops.

Comments (3 posted)

System Applications

Clusters and Grids

VIFF 0.7.1 released

Version 0.7.1 of VIFF has been announced, it is a bug fix release. "Virtual Ideal Functionality Framework is a framework for creating efficient and secure multiparty computations (SMPC). Players, who do not trust each other, participate in a joint computation based on their private inputs. The computation is done using cryptographic protocols which allows them to obtain a correct answer without revealing their private inputs. Operations supported include addition, multiplication, and comparison, all with Shamir secret shared outputs."

Full Story (comments: none)

Database Software

PostgreSQL Weekly News

The October 12, 2008 edition of the PostgreSQL Weekly News is online with the latest PostgreSQL DBMS articles and resources.

Full Story (comments: none)

Device Drivers

LIRC 0.8.4 released

Version 0.8.4 of LIRC, the Linux Infrared Remote Controller, has been announced. "Irman support is broken in 0.8.2. Please use 0.8.4 if you have this receiver. "

Comments (none posted)

Filesystem Utilities

Stable NTFS-3G 1.5012 released

Stable version 1.5012 of NTFS-3G has been announced. "The NTFS-3G driver is able now for unlimited file and directory creation and removal as the result of 13 years continuous clean-room reverse engineering, documenting the different versions of NTFS on-disk formats and implementing a safely interoperable file system driver with the over 500,000 source lines Microsoft NTFS driver by the help of hundreds of contributors over these years."

Full Story (comments: none)

Mail Software

managesieve 0.4 released

Version 0.4 of managesieve has been announced, it includes new capabilities and bug fixes. "A ManageSieve client library for remotely managing Sieve scripts, including an user application (the interactive 'sieveshell'). Sieve scripts allow users to filter incoming email on the mail server. The ManageSieve protocol allows managing Sieve scripts on a remote mail server. These servers are commonly sealed so users cannot log into them, yet users must be able to update their scripts on them."

Full Story (comments: none)

Networking Tools

libnetfilter_conntrack 0.0.97 released

Version 0.0.97 of libnetfilter_conntrack has been announced. "libnetfilter_conntrack is a userspace library providing a programming interface (API) to the in-kernel connection tracking state table. This library requires a linux kernel >= 2.6.18. This release includes minor fixes, some enhancements and cleanups."

Full Story (comments: none)

Printing

CUPS 1.3.9 released

Version of CUPS, the Common UNIX Printing System, has been announced. "CUPS 1.3.9 fixes three integer overflow bugs, an incompatibility with Firefox 3, several printing bugs, and several scheduler bugs."

Comments (none posted)

Web Site Development

Plone 3.1.6 released

Version 3.1.6 of the Plone web development platform has been announced. "The 6th maintenance release of Plone 3.1 is now available."

Full Story (comments: none)

Plone 3.2a1 released

Version 3.2a1 of the Plone web development platform has been announced. "I'm proud to announce Plone 3.2a1, the first step towards an all egg-based Plone release."

Full Story (comments: none)

Desktop Applications

Audio Applications

Ardour: Finally, "move Tracks Up/down" (and Other News)

The latest news from the Ardour multi-track audio editor project includes a new move tracks up/down capability. "Ardour has had only one way to change the order of tracks in the editor window since it began - dragging the track names around in the list of tracks attached to one side of the window. In SVN for 2.X, I've just added the new move-selected-tracks-up and move-selected-tracks-down commands, which are bound to Shift-Up and Shift-Down by default. So now you can just select one or more tracks and press a key (or two) to move them up and down."

Comments (none posted)

mp3splt 0.5.2 released (SourceForge)

Version 0.5.2 of mp3splt, an mp3/ogg file splitter and its associated libraries, have been announced: "fixed bug crashing the applications on the silence split when no 'get_silence_level' function defined".

Comments (none posted)

Business Applications

Chandler Desktop 1.0.2 released

Version 1.0.2 of Chandler Desktop has been announced. "The Chandler Project is an open source, standards-based information manager designed for personal use and small group collaboration. Chandler Desktop 1.0.2 is a bug fix update to the previous release, 1.0.1."

Full Story (comments: none)

Openbravo ERP: R2.40 version is available (SourceForge)

Version 2.40 of Openbravo ERP has been announced. The description states: "Web based ERP for SMEs, built on proven MVC & MDD framework that facilitate customization & maintenance of code. Already in production, it encompasses a broad range of functionalities such as finance, supply chain, project mgmt, manufacturing & much more Openbravo ERP 2.40 is ready for general usage, including evaluation and production. We recommend existing production deployments to upgrade to this release."

Comments (none posted)

CAD

Sweet Home 3D: version 1.4 released (SourceForge)

Version 1.4 of Sweet Home 3D, an interior design CAD application, has been announced. "The new features of version 1.4 include bug corrections, texture images import, export to OBJ format, Swedish localization and other enhancements".

Comments (none posted)

Data Visualization

DISLIN 9.4 released

Version 9.4 of the DISLIN Data Plotting Library has been announced. "DISLIN is a high-level and easy to use plotting library for displaying data as curves, bar graphs, pie charts, 3D-colour plots, surfaces, contours and maps. Several output formats are supported such as X11, VGA, PostScript, PDF, CGM, WMF, HPGL, TIFF, GIF, PNG, BMP and SVG. The software is available for the most C, Fortran 77 and Fortran 90/95 compilers. Plotting extensions for the interpreting languages Perl, Python and Java are also supported."

Full Story (comments: none)

Desktop Environments

GNOME Software Announcements

The following new GNOME software has been announced this week: You can find more new GNOME software releases at gnomefiles.org.

Comments (none posted)

KDE Software Announcements

The following new KDE software has been announced this week: You can find more new KDE software releases at kde-apps.org.

Comments (none posted)

Xorg Software Announcements

The following new Xorg software has been announced this week: More information can be found on the X.Org Foundation wiki.

Comments (none posted)

Desktop Publishing

GNU PDF Blog

The GNU PDF Blog for October 6, 2008 has been published. Topics include: Fixes in the Stream Module, Super Powered pdf-filter, Crypt Unit Tests Passing(now), nocheck and fork-mode and more.

Comments (none posted)

Electronics

introducing CGRAN: 3rd party GNU Radio application support

The Comprehensive GNU Radio Archive Network site (CGRAN) has been launched. "The Comprehensive GNU Radio Archive Network (CGRAN) is a free open source repository for 3rd party GNU Radio applications that are not officially supported by the GNU Radio project. CGRAN provides a subversion repository for users to develop or submit new applications, and wiki access for full project documentation. Trac (our web interface) provides unique features such as a browser for the subversion repository and a ticket system for users to file issues with projects in CGRAN." GNU Radio is a software controlled multi-purpose radio platform.

Full Story (comments: none)

Encryption Software

M2Crypto 0.19.1 released

Version 0.19.1 of M2Crypto has been announced. "The 0.19.1 release fixes the build when OpenSSL has been configured without EC support, thanks to Miloslav Trmac. M2Crypto is the most complete Python wrapper for OpenSSL.."

Full Story (comments: none)

Games

Humerus 2.0 released

Version 2.0 of Humerus has been announced. "This version of Humerus has been extensively revised from the previous one. Instead of a pile of code to be cut and pasted, it is now a proper library made up of reusable classes, with detailed documentation and some example code included. What is Humerus? Humerus is a companion to the Albow widget library for PyGame. It provides a framework for games made up of a sequence of levels, including user interface and back-end logic for loading levels, saving and restoring game state and sundry other details."

Full Story (comments: none)

Geographical Software

uDig GIS: A First Look (Linux Journal)

Linux Journal takes a look at the uDig GIS application as part of its series on geographic information systems (GIS). The article shows how to find and load GIS data, then display it in various ways in this free software application. "To those who are new to GIS I generally tell them it involves "mapping with a computer". While this description is a bit oversimplistic, it captures the broad purpose of GIS. A more accurate description is, as the folks at Quantum GIS say, that a GIS is a collection of software that allows you to create, query and analyze geospatial data. I would further add that one can integrate any kind of geographic information and then find relationships among that information, and display it how you wish."

Comments (8 posted)

Interoperability

Wine 1.1.6 announced

Version 1.1.6 of Wine has been announced. Changes include: "Beginnings of schannel implementation using GnuTLS. Many fixes from various code analysis tools. Support for X11 desktop work area. Fixes for Richedit tables. More complete JavaScript support. Various bug fixes."

Comments (none posted)

Mail Clients

Claws Mail 3.6.1 is out

Version 3.6.1 of Claws Mail has been announced. "New in this release: Added /View/Fullscreen option. Re-ordering of the filtering/processing condition and actions lists is now possible using drag'n'drop. Updated Brazilian Portuguese and French translations."

Full Story (comments: none)

Medical Applications

MedinTux needs French to English translators to spread worldwide (LinuxMedNews)

LinuxMedNews introduces the medical application, MedinTux. The MedinTux interface is written in French and the project is looking for translators. "MedinTux is a powerful medical software, multiuser (using MySQL for data storage), easy-to-use (thanks to Qt development toolkit), complete, working from the GP to the hospital. Its unique design makes it the most customisable software you can dream of."

Comments (1 posted)

Multimedia

Elisa Media Center 0.5.14 released

Version 0.5.14 of Elisa Media Center has been announced. "The Elisa team is happy to announce the release of Elisa Media Center 0.5.14, code-named "El Bosc Vertical". The focus during this release cycle has been put on Windows functionalities and bug fixing (a good dozen closed)."

Full Story (comments: none)

Music Applications

Virtual MIDI Piano Keyboard 0.2.1

Version 0.2.1 of Virtual MIDI Piano Keyboard has been announced. "This is a maintenance release, fixing a crash in Windows when playing certain MIDI files and connecting a player output to VMPK input. The reset all button now also resets the internal controllers states. The number of keys is now constrained to reasonable limits within the MIDI notes range. The "grab keyboard" feature is now an optional runtime setting, as a workaround for some broken X11 window managers and desktops."

Full Story (comments: none)

Office Applications

Task Coach: Release 0.71.1 available (SourceForge)

Version 0.71.1 of Task Coach has been announced. "Task Coach - Your friendly task manager. Task Coach is a simple open source todo manager to manage personal tasks and todo lists. Often, tasks and other things todo consist of several activities. Task Coach is designed to deal with composite tasks. This release fixes a major bug in 0.71.0 (could not open older task files with e-mail attachments)."

Full Story (comments: none)

Office Suites

OpenOffice.org 3.0 released

OpenOffice.org 3.0 has been released. "Right from the opening screen, OpenOffice.org 3 has a fresh new look, with a new start screen, new splash screen, new icons, and a host of usability improvements." Click below for the announcement which contains an overview of the new features in this release.

Full Story (comments: 26)

Meeks: Measuring the true success of OpenOffice.org

Michael Meeks has taken a detailed look at contributions to OpenOffice.org and come away worried. "Crude as they are - the statistics show a picture of slow disengagement by Sun, combined with a spectacular lack of growth in the developer community. In a healthy project we would expect to see a large number of volunteer developers involved, in addition - we would expect to see a large number of peer companies contributing to the common code pool; we do not see this in OpenOffice.org. Indeed, quite the opposite we appear to have the lowest number of active developers on OO.o since records began: 24, this contrasts negatively with Linux's recent low of 160+. Even spun in the most positive way, OO.o is at best stagnating from a development perspective."

Comments (36 posted)

Science

mpmath 0.10 released

Version 0.1.0 of mpmath, a pure-Python library for arbitrary-precision floating-point arithmetic, has been announced. "Additions in 0.10 include plotting support, matrices and linear algebra functions, new root-finding and quadrature algorithms, enhanced interval arithmetic, and some new special functions. Many speed improvements have been committed (a few functions are an order of magnitude faster than in 0.9), and as usual various bugs have been fixed. Importantly, this release fixes mpmath to work with Python 2.6."

Full Story (comments: none)

Video Applications

Gnash 0.8.4 released

Version 0.8.4 beta 3 of Gnash, a free Flash player, has been announced. From the release notes: "Keep Adobe happy with our users and our users happy with us by changing "Flash player" into "SWF player" everywhere. Adobe claims "Flash" as a trademark and had asked a Linux distributor to fix it. The popular SWF Twitter badge now renders correctly. Fix parsing of urls containing multiple question marks Fix support for movies embedding multiple sound streams Support for loading PNG and GIF images added. Improved rendering of SWF movies because of the less visible changes listed below. Support for writing RGB/RGBA PNG images and JPEG images. Works with Potlatch OpenStreetMap editor New 'flvdumper' utility for analyzing FLV video files. XPI packaging support for Mozilla & Firefox."

Full Story (comments: 1)

Web Browsers

Firefox 3.1 beta 1 is now available for download

The first beta of Firefox 3.1 is available for testing. "This milestone is focused on testing the core functionality provided by many new features and changes to the platform scheduled for Firefox 3.1."

Full Story (comments: none)

Geode in Firefox 3.1: Lost in Linux (Linux Magazine)

Linux Magazine reports that the Geode geolocation feature of Firefox 3.1 will not be available to Linux users. While privacy advocates may be perfectly happy with that outcome, there may be others who would find the feature useful. It certainly seems to run counter to the whole idea of a free and open browser. "Mozilla Labs presents the following scenario: When you open the Firefox browser, it knows where you are and immediately opens websites for nearby restaurants, stores and other attractions. Mozilla developers have already integrated this feature, as the Geode plug-in, in the current beta version of Firefox 3.1. It is based on proprietary software from a company called Skyhook."

Comments (11 posted)

Languages and Tools

C++

dlib C++ Library: 17.10 Released (SourceForge)

Version 17.10 of dlib has been announced. "The dlib C++ library is a modern general purpose C++ toolkit with a focus on portability and program correctness. It comes with extensive documentation and thorough debugging modes. The library provides a platform abstraction layer for common tasks such as interfacing with network services, handling threads, and creating graphical user interfaces. Additionally, the library implements many useful algorithms such as data compression routines, linked lists, binary search trees, linear algebra and matrix utilities, machine learning algorithms, XML and general text parsing, and many other general utilities. This release was focused on fixing bugs and improving usability."

Comments (none posted)

Caml

Caml Weekly News

The October 7-14, 2008 edition of the Caml Weekly News is out with new articles about the Caml language.

Full Story (comments: none)

Java

IcedTea6 1.3 released

Version 1.3 of IcedTea6 has been announced, it includes new features, bug fixes and security fixes. "The IcedTea6 project provides a harness to build the source code from OpenJDK6 using Free Software build tools and provides replacements libraries for the binary plugs with code from the GNU Classpath project."

Full Story (comments: none)

Whiteoak 2.1 released (SourceForge)

Version 2.1 of Whiteoak has been announced. "The Whiteoak programming language is a backward compatible extension of Java 6, that supports: structural subtyping (AKA: structural conformance), virtual fields and constructors, mixin-like/trait-like composition of objects and more. Whiteoak 2.1 has been officially released. This release includes both a command-line compiler as well as an Eclipse plugin."

Comments (none posted)

Python

Mock 0.4.0 released

Version 0.4.0 of Mock has been announced. "Mock 0.4.0 has just been released, the first release in about ten months (but worth the wait). Mock is a simple library for testing: specifically for mocking, stubbing and patching."

Full Story (comments: none)

posix_ipc 0.1 is available

The initial release of the Python posix_ipc package has been announced. "The package posix_ipc provides a Python interface to POSIX shared memory and named semaphores on platforms that support them (i.e. most Unices)."

Full Story (comments: none)

python-aspects 1.2 released

Version 1.2 of python-aspects has been announced, one new function has been added. "aspects.py is a lightweight and low-level library for intercepting function calls. Functions and methods (also in Python standard library and third party code) can be wrapped so that when they are called, the wrap is invoked first. Depending on the wrap, the execution of the original function can be omitted, or the function can be called arbitrarily many times. Wraps are able to modify the call arguments and the return values of wrapped functions and handle exceptions. There can be many wraps on the same function. The wraps can be enabled, disabled and removed in any order."

Full Story (comments: none)

Python-URL! - weekly Python news and links

The October 14, 2008 edition of the Python-URL! is online with a new collection of Python article links.

Full Story (comments: none)

Tcl/Tk

Tcl-URL! - weekly Tcl news and links

The October 15, 2008 edition of the Tcl-URL! is online with new Tcl/Tk articles and resources.

Full Story (comments: none)

IDEs

ZK: 3.5.1 released (SourceForge)

Version 3.5.1 of ZK has been announced. "ZK is Ajax framework. 100% Java, no JavaScript. With event-driven, 170+ components, and markup languages, development as simple as programming desktops and authoring HTML/XUL pages. ZK supports JSF, JSP, J2EE, and scripting in Java, Ruby, Groovy... Over 6 new features and 28 bugs fixed. New Tree style, Session fixation protection suppor[]ted."

Comments (none posted)

Libraries

Pantheios: 1.0.1 (beta 165) released (SourceForge)

Version 1.0.1 beta 165 of Pantheios, an Open Source C/C++ Logging API library, has been announced. "Release 1.0.1 beta 165 incorporates: Substantial reworking of contract API, reflected throughout the headers, implementation, example and test files".

Comments (none posted)

Miscellaneous

Bouml: 4.7 released (SourceForge)

Version 4.7 of BOUML has been announced, it includes various improvements. "BOUML is a free UML 2 tool box allowing you to specify and generate code in C++, Java, Idl, Php and Python. BOUML runs under Unix/Linux/Solaris, MacOS X and Windows. It is very fast and doesn't require much memory to manage several thousands of classes."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Linux at 17 - What Windows promised to be (the Register)

The Register reflects on the history of Linux. "Linux is what Windows had once promised to be - at least in terms of cross-platform support. In the wake of the PowerPC alliance from IBM, Apple, and Motorola in 1991, Microsoft made a commitment to support Windows NT 3.51 on PowerPC chips. Windows eventually added support for Digital's Alpha NEC's and SGI's MIPS chips. Workstation maker Intergraph ported Windows NT 3.51 to its Clipper chips and said it was creating a port to Sparc chips from Sun. Neither ports saw the light of day."

Comments (7 posted)

Livin' La Vida Linux (ZDNet)

Samba hacker Jeremy Allison reflects on free formats and free software over at ZDNet. He looks at the evolution of storage during his life and looks down the road to see freedom playing a large role. "In short, encoding my CD's in a free format gave me the freedom to do what I wanted with the music I had already bought. In the same way, using Free Software gives device manufacturers the freedom to create the devices they think will be the most popular, without any restrictions on what those devices should do or how they should look. There's no proprietary operating system owner who insists on their consumer 'experience' being done a certain way. No commandments insisting that certain software components must be included in the device, which is to propagate control of proprietary media formats and web browsers, not to give device designers the flexibility they need."

Comments (1 posted)

Trade Shows and Conferences

Linux Summit will preview new advanced file system (SearchEnterpriseLinux.com)

SearchEnterpriseLinux.com previews presentations by Ted Ts'o and Chris Mason at the Linux Foundation End User Collaboration Summit that starts on October 13. "But changing the file system to fix the scalability and functional limitations of ext3, the default file system in many popular Linux distributions, requires a significant education outreach. Because the consequences of data loss are so severe, data center managers are reluctant to trust their data to new file systems, Ts'o said. New-system information needs to be shared well ahead of time, including a roadmap of coming features so IT professionals know what to expect, he said. That's where the Linux Foundation's event hopes to make inroads."

Comments (57 posted)

Companies

Linux opportunity buried in Unix market share data (CNET)

Over at CNET, Matt Asay sees opportunities for Linux in the recent news that IBM claimed 35% of the Unix server market for second quarter of 2008. "For those wondering how big Red Hat and Novell can become on operating-system revenue alone, keep that $61 billion number in mind. Most of that $61 billion is hardware-related, but it meant approximately $650 million in Linux server sales for Red Hat and Novell over the past year. As Linux eats into Unix, Red Hat and Novell can expect to grow linearly with it."

Comments (none posted)

Linux Adoption

Differing trends for Linux on netbooks

There appear to be some opposing trends involving Linux on Netbooks. PC World's article Netbooks Will Boost Adoption of Linux, Says Novell CTO notes: "A surge in demand for netbooks is helping drive business for Linux, as the devices are designed to be low-cost with smaller storage, according to Novell's chief technology and strategy officer for Linux. " People typically don't care what operating system is on the netbooks, because they don't buy them to run a suite of applications like Microsoft Office, but to be on the Web using a Web browser," Nat Friedman said in an interview with IDG News Service."

Laptop Mag's article Ubuntu Confirms Linux Netbook Returns Higher than Anticipated quotes Canonical's marketing manager Gerry Carr: "“We don’t know what the XP return rates are. But I will say that the return rate is above normal for netbooks that offer open-source operating systems,” Carr echoed. Carr highlighted a few reasons why Ubuntu-running netbooks are returned more often. “Unclear selling is happening, typically online. The customer will get their netbook sent to their home and they imagine to find something like a Microsoft desktop, but they see a brown Ubuntu version. They are unwilling to learn it and they were expecting to have Windows.”"

Comments (6 posted)

Linux in The Economic Meltdown (IT Management)

IT Management's Matt Hartley considers the effects of the recent economic woes on Linux adoption. "Considering the state of the US finances, I would point out that spending money on a computer pre-loaded with an OS that can be, even to this date with Vista, hit with malware with little to stop it seems rather foolish to me. Now consider industries where the bulk needs of a workstation can adequately be upheld with most common Linux distributions. Unfortunately the joy might stop there if that company is already using an in-house IT staff. Why? Because so many of them here in the States are Windows only, thus making a switch to a new platform a move to fire and rehire your IT staff."

Comments (none posted)

Linux at Work

Video and photos show Linux booting on the Brazilian voting machines (BR-Linux.org)

BR-Linux.org has pictures and video of Brazilian Linux-powered voting machines. "Just 10 days ago, 130 million brazilian voters were turned into users of one of the largest Linux deployment worldwide: the 400,000 electoral sections in all of the 5,563 brazilian municipalities were running electronic voting machines, and the Linux kernel was running in all of them." (Thanks to Augusto Campos)

Comments (66 posted)

Legal

Beta blockers? (Nature)

The sub-title for this article is Proprietary data formats may be legally defensible but open standards can be a better spur for innovation. "Dan Cohen, director of GMU's Center for History and New Media, and Sean Takats, a GMU history professor, are also directors of Zotero: open-source software developed by the history centre that lets researchers organize and share their digital information iTunes style, whether it is in the form of citations, documents or web pages. Zotero is free and popular, and has attracted some 1 million downloads since its launch in October 2006. Thomson makes the proprietary bibliography software EndNote, and claims that Zotero is causing its commercial business "irreparable harm" and is wilfully and intentionally destroying Thomson's customer base. " (Thanks to jerbol)

Comments (8 posted)

Interviews

Interview: Miguel de Icaza (DesktopLinux.com)

DesktopLinux.com features an interview with Miguel de Icaza. "GNOME project co-founder Miguel de Icaza discusses the release of Mono 2.0, in this detailed interview with Henry Kingman, executive editor of DesktopLinux. The conversation spans Mono's history, current state, and future, with stops along the way for updates on Moonlight and Mono Develop."

Comments (34 posted)

Resources

Running the Chromium browser on Ubuntu 8.04 with CrossOver Chromium (HowtoForge)

HowtoForge presents a tutorial on running the Chromium browser under Ubuntu 8.04. "Chromium is an open-source browser project that is the basis for Google's Chrome browser. Right now, Chromium doesn't support Linux natively, but Codeweavers has created a Linux port called CrossOver Chromium that can be installed free of charge. This guide shows how to install CrossOver Chromium on Ubuntu 8.04."

Comments (2 posted)

Reviews

Multi-Head, Multi-User Killer GNU/Linux App Languishes (LinuxMedNews)

LinuxMedNews looks at multi-head, the killer application in health care. "Multi-head, multi-user systems running off a single PC. This is where multiple displays, keyboards and mice can be attached to a single PC with multiple users all working simultaneously from one system unit. This can dramatically lower the cost of an individual workstations as well as the cost to support individual workstations. This setup is becoming more and more viable as hardware power increases."

Comments (7 posted)

Miscellaneous

Ideas Wanted: Creative Heat Recycling from Servers (Linux Journal)

James Gray is looking for creative ways to recycle waste server heat. "The botanical garden that is heated by Notre Dame's servers specializes in desert plants and is located in Indiana, well know for its brutal winters. The concept is simple. The waste server heat is pumped into the interior space of the garden to keep the desert-loving plants toasty warm all year long. This simple, creative step is saving the university $100,000 on cooling costs and the owner of the botanical garden, the City of South Bend, Indiana, another $70,000 on heating costs. Not only that, but the atmosphere is spared many thousands of tons of pollution from carbon emissions. That is quite a triple win-win-win arrangement."

Comments (21 posted)

Top Agenda Setters for 2008 (Silicon.com)

Silicon.com presents a collection of Top Agenda Setters for 2008. "Silicon.com chooses the top 50 most influential individuals in the worldwide technology and IT industries – business leaders, CEOs, CIOs, techies, open source gurus, security experts, visionaries, entrepreneurs and politicos".

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

EFF challenges bogus patent on Internet music files

Electronic Frontier Foundation has announced a new bogus patent challenge. "The Electronic Frontier Foundation (EFF) is challenging a bogus patent on Internet music files that could stifle new innovations in online music distribution. Seer Systems was awarded this illegitimate patent for a system and method for joining different musical data types together in a file, distributing them over the Internet, and then playing that file. But in a reexamination request filed with the United States Patent and Trademark Office (USPTO) today, EFF and the law firm Day Casebeer Madrid & Batchelder show that descriptions of this technology were published a number of times before Seer Systems made its claim--including one in a book written by Seer's own founder and the named inventor of the patent, Stanley Jungleib."

Full Story (comments: none)

The Linux Foundation's FOSSBazaar Nearly Doubles its Membership

The Linux Foundation has announced that its Free and Open Source Software (FOSS) governance workgroup, called FOSSBazaar, has nearly doubled its membership since launching in January. "During its inaugural year, FOSSBazaar has both established an online destination where collaboration on these topics takes place (https://fossbazaar.org) and appointed full-time workgroup community leader Martin Michlmayr. Michlmayr is a well-known figure that currently serves on the Board of Directors for the Open Source Initiative (OSI). He has been involved in FOSS projects for more than 10 years, including having led the Debian project for two years. FOSSBazaar has also participated in collaborative forums this year such as the Annual Linux Foundation Collaboration Summit and OSCON."

Comments (none posted)

Commercial announcements

ASF announces Apache Tuscany 1.3.2

Apache Software Foundation has announced the release of Apache Tuscany 1.3.2. "Apache Tuscany, a new Top-Level Project of the Apache Software Foundation (ASF), today announced the release of version 1.3.2 of its Service Component Architecture (SCA) for Java -- the Project's latest release since its graduation from the ASF Incubator four months ago. Apache Tuscany provides a robust, highly extensible infrastructure for building, deploying, running and managing Service Oriented Architecture (SOA) solutions, streamlining the development process of service-based application networks and addressing real business problems posed in SOA."

Comments (none posted)

AtMail releases AtMail 5.5

AtMail has announced the release of AtMail 5.5. "AtMail, a leading provider of easy-to-use, Linux-based email management appliances and software, today announced the latest release to its commercial Webmail platform, AtMail 5.5. The new AtMail 5.5 version includes support for Canonical's Ubuntu Server Edition Linux-based operating system."

Comments (none posted)

Atmel, Cisco and SICS collaboratively release uIPv6

Atmel Corporation has announced the release of the uIPv6 protocol stack. "Atmel(R) Corporation, Cisco and the Swedish Institute of Computer Science (SICS) today announced the availability of uIPv6, one of the world's smallest open-source, IPv6-ready protocol stack, which could enable every device, no matter how limited by power or memory to have an Internet Protocol address."

Comments (none posted)

GarageGames Looking to Fund New Studios in Austin, Vancouver, and Seattle

GarageGames has announced an expansion drive. "GarageGames, creators of InstantAction.com, the website for gamers that combines the intensity of videogames with the accessibility of the web, have announced that they are looking to fund new startup studios working on original IP for InstantAction and other platforms. "We're seeing a lot of larger studios cutting back on costs and thus forced to let go of great talent," said Josh Williams, CEO of GarageGames. "There's always opportunity for good developers to start anew and we're looking to give these guys a shot to get back to their roots on a small team making games for a cutting edge platform.""

Comments (none posted)

ITTIA introduces compact DBMS for portable media applications

ITTIA has announced the availability of ITTIA DB Compact edition. "ITTIA, a leading provider of embedded database software and services, today introduced Compact edition as a new member of its ITTIA DB product family. Compact is a rock-solid transactional database engine that allows embedded developers to select the exact database features to match the requirements of a particular device. Compact is an ideal database candidate for application development projects related to digital media such as portable multimedia players (PMP), digital audio players (DAP), and automotive computer systems."

Comments (none posted)

Cloud Computing Adoption Model unveiled by rPath

rPath has announced a new Cloud Computing Adoption Model. "rPath today announced its Cloud Computing Adoption Model, which defines a pragmatic, five-step approach for the graduated adoption of cloud computing. The Cloud Computing Adoption Model will be rolled out on October 23, as part of an rPath webinar featuring guests Amazon Web Services, Forrester Research and MomentumSI."

Full Story (comments: none)

New SSH Tectia Solution for Linux on IBM System z

SSH Communications Security has announced SSH Tectia Server for Linux on IBM System z. "This new version of SSH Tectia provides a unified, end-to-end security model that extends from distributed platforms, to mainframes running the Linux operating system on the IBM System z platform, and also to virtualized environments."

Full Story (comments: none)

OpenLogic expands professional service offerings

OpenLogic has announced an expansion of its professional service offerings. "OpenLogic, Inc., a provider of enterprise open source software solutions encompassing hundreds of open source packages, today announced several new professional services packages, ranging from one day to one week engagements, that help companies quickly and cost-effectively identify, fine-tune and implement enterprise-ready open source products."

Full Story (comments: none)

SourceForge.net launches Hosted Apps

SourceForge.net has announced the launch of Hosted Apps. "SourceForge, Inc.,the leader in community-driven content and media, has announced the launch of Hosted Apps, a new service for developers that provides instant, virtualized access to popular open source applications. SourceForge will centrally manage the infrastructure and security of Hosted Apps, allowing developers to innovate freely without being distracted by the maintenance of their project's infrastructure."

Full Story (comments: none)

Timesys Announces Embedded Linux ReadyKits

Timesys has announced new ARM processor ReadyKits. "Timesys Corporation®, a premier provider of embedded Linux software solutions, today announced general availability of embedded Linux ReadyKits for several popular ARM-based processors. Assembled by Timesys’ award winning Online Linux Factory, ReadyKits enable embedded developers to have a robust Linux platform up and running on their select processor within a few hours — ready to benchmark platform performance or prototype applications. Each ReadyKit comes complete with a pre-built, integrated and tested embedded Linux platform, including all sources."

Comments (none posted)

New Books

Maven: The Definitive Guide - New from O'Reilly

O'Reilly has published the book Maven: The Definitive Guide by Tim O'Brien.

Full Story (comments: none)

Packt Publishing releases CUPS Administrative Guide

Packt Publishing has published the book CUPS Administrative Guide by Ankur Shah.

Full Story (comments: none)

Resources

Linux Foundation releases LSB 4.0 beta

The Linux Foundation has announced the release of version 4.0 beta of the Linux Standards Base (LSB). "This new version of LSB promises to accomplish these goals in a more powerful way. "We have a new set of LSB tools to make it much easier for ISVs to development applications that are LSB compliant, and to test to see how portable their applications are via the Linux Application Checker," Ted T'so, Chief Platform Strategist and Fellow with the Linux Foundation, explained."

Comments (10 posted)

Contests and Awards

USAID Launches Open Source Development 2.0 Challenge

The U.S. Agency for International Development has announced the 2008 USAID Development 2.0 Challenge. "The Development 2.0 Challenge signals that USAID is responding to a shifting business and technology culture that goes by many names, including Web 2.0, inventive economics, wikinomics, or crowdsourcing. Just as online communities have changed the way business is done, USAID's open call for technology solutions seeks to improve the way international development is done." Grants of up to $10K will be awarded and submissions will be accepted from October 13 - December 5, 2008.

Comments (none posted)

Meeting Minutes

Perl 6 Design Minutes (use Perl)

The September 24, 2008, September 17, 2008 and September 10, 2008 Perl 6 Design Meeting Minutes have been posted.

Comments (none posted)

Calls for Presentations

CISSE 2008 - paper submission deadline extended

The paper submission deadline for CISSE 2008, the Fourth International Joint Conferences on Computer, Information, and Systems Sciences, and Engineering, has been extended to October 28, 2008. The conference will be held online on December 5-13, 2008. "Due to numerous deadline extension requests from potential CISSE 2008 authors, the CISSE organizing committee has decided to extend the paper submission deadline to 10/28/2008. Please note that this is a hard deadline, so that the technical committees can perform their paper reviewing duties in a timely manner."

Full Story (comments: 3)

FOSS.IN/2008: CfP announced

A call for papers has gone out for FOSS.IN/2008. "Time is short, so please read through carefully and get ready with your proposals. The registration system will open from October 10, 2008. FOSS.IN is a contributor event, focusing on development efforts in FOSS from India." The event takes place on November 25-29, 2008 in Bangalore, India, abstracts are due by October 18.

Full Story (comments: none)

Linuxchix Miniconf @linux.conf.au 2009: Call for Presentations

LinuxChix has announced that they'll be hosting the LinuxChix mini-conf at Linux.conf.au in January, 2009 in Hobart, Tasmania. This mini-conf exists to encourage women with an interest in free and open source technology to share their ideas, network and improve their presentation skills. Abstracts for talk proposals should be submitted by October 20, 2008 12:00 GMT.

Full Story (comments: none)

O'Reilly RailsConf 2009 opens Call for Participation

A call for participation has gone out for the O'Reilly RailsConf 2009. The event takes place in Las Vegas, NV on May 4-7, 2009, submissions are due by February 17.

Full Story (comments: none)

O'Reilly Where 2.0 2009 Conference opens call for participation

A call for participation has gone out for the O'Reilly Where 2.0 2009 Conference. "The earth isn't flat, and maps don't live in the glove compartment anymore. The O'Reilly Where 2.0 Conference will pinpoint how far location technology has reached, explore the boundaries of geospace, and point the way into the location frontier at the Fairmont Hotel in San Jose, CA, May 19-21, 2009. O'Reilly Media and program chair Brady Forrest invite proposals for conference sessions, workshops, demos, and panels for Where 2.0 2009." Submissions are due by December 2.

Full Story (comments: none)

Upcoming Events

MySQL European Customer Conferences 2008

The MySQL European Customer Conferences 2008 will take place in London on Thursday, October 23, Munich on Tuesday, October 21 and Paris on Wednesday, November 19.

Comments (none posted)

European PGDay 2008

European PGDay 2008 will be held on October 17-18, 2008. "The conference will once again be held in the beautiful historic surroundings of the Monash University Prato Centre in Prato, a small walled town near Florence, Tuscany."

Comments (none posted)

Web 2.0 Expo Europe Examines Key Industry Themes

Web 2.0 Expo Europe has been announced. "The second annual Web 2.0 Expo Europe will define the current state of Web 2.0 and, more importantly, outline its future. The three-day conference, co-produced by O'Reilly Media, Inc. and TechWeb, will attract the largest pan-European community of international technical, design, marketing, and business professionals, entrepreneurs, start-ups, and VCs building, leveraging, and driving the European Web economy. Each will bring a unique and insightful perspective to the dynamic state of innovation happening on the Web. Scheduled for October 21-23, 2008, Web 2.0 Expo Europe will be held at a new venue, the Berliner Congress Center in Berlin, Germany."

Full Story (comments: none)

Events: October 23, 2008 to December 22, 2008

The following event listing is taken from the LWN.net Calendar.

Date(s)EventLocation
October 19
October 24
Colorado Software Summit 2008 Keystone, CO, USA
October 20
October 24
15th Annual Tcl/Tk Conference Manassas, VA, USA
October 21
October 23
Web 2.0 Expo Europe Berlin, Germany
October 21
October 24
Systems Munich, Germany
October 22
October 24
Hack.lu 2008 Parc Hotel Alvisse, Luxembourg
October 22
October 24
Encuentro Linux Concepción, Chile
October 24
October 26
Free Society Conference and Nordic Summit Gothenburg, Sweden
October 25
October 26
T-DOSE 2008 Eindhoven, the Netherlands
October 25 Ontario Linux Fest 2008 Toronto, Canada
October 26
October 31
IBM Information On Demand 2008 Mandalay Bay - Las Vegas, Nevada, USA
October 27
October 30
Embedded Systems Conference - Boston Boston, USA
October 29
November 1
10th Real-Time Linux Workshop Colotlán, Jalisco, Mexico
November 3
November 7
ApacheCon US 2008 New Orleans, LA, USA
November 5
November 7
OpenOffice.org Conference 2008 Beijing, China
November 6 NLUUG autumn conference: Mobile Applications Ede, Netherlands
November 6
November 7
Embedded Linux Conference Europe 2008 Ede, Netherlands
November 7
November 8
TwinCity Perl Workshop 2008 Vienna, Austria
November 7
November 9
UKUUG linux conference Manchester, UK
November 8
November 9
Hackers to Hackers Conference 05' Sao Paulo, Brazil
November 8
November 9
FOSS.my Kuala Lumpur, Malaysia
November 10
November 14
Python Bootcamp with Dave Beazley Atlanta, GA, USA
November 11
November 14
DeepSec IDSC 2008 Vienna, Austria
November 12
November 14
php|works 2008 Atlanta, GA, USA
November 12
November 13
PacSec Applied Security Conference Tokyo, Japan
November 13
November 14
International Hacking and Security Conference Seoul, Korea
November 14
November 16
OpenSQL Camp 2008 Charlottesville, VA, USA
November 16
November 20
Middle East IT Security Conference Dubai, UAE
November 19
November 20
Linux Foundation Japan Symposium Tokyo, Japan
November 20
November 21
FreedomHEC Taipei 2008 Taipei, Taiwan
November 22 The phpnw08 conference Manchester, UK
November 22 PGDay Rio de la Plata Buenos Aires, Argentina
November 22 Mandriva 2009 Installfest Everywhere, World
November 25
November 29
FOSS.IN 2008 Bangalore, India
November 25
November 30
make art 2008 Poitiers, France
November 28 Informazione geografica aperta e libera Pontedera (PI), Italy
November 28
November 29
WhyFLOSS La Plata - Argentina La Plata, Argentina
November 29 LinuxDay in Vorarlberg (Deutschland, Schweiz, Liechtenstein und Österreich) Dornbirn, Austria
December 1 First Nuxeo Developer Day Paris, France
December 1
December 2
Open World Forum Paris, France
December 2
December 5
Open Source Developers' Conference 2008 Sydney, NSW, Australia
December 4
December 7
PIKSEL08 - code dreams Bergen, Norway
December 5
December 6
FOSSCamp Mountain View, CA, USA
December 5
December 13
International Joint Conferences on Computer, Information, and Systems Sciences, and Engineering Online,
December 7
December 12
Computer Measurement Group Conference 2008 Las Vegas, NV, USA
December 8
December 12
Ubuntu Developer Summit Mountain View, CA, USA
December 8 Forum PHP Paris 2008 Paris, France
December 10
December 11
First Workshop on I/O Virtualization San Diego, CA, USA
December 13 NLLGG meeting/BSD Community Day Utrecht, The Netherlands

If your event does not appear here, please tell us about it.

Web sites

KDE Launches User Forum

KDE has launched the KDE Forum, which is a MyBB-based forum for users to discuss KDE-related topics. In conjunction with the adoption by KDE, MyBB has released their software under the GPLv3. "Sebastian Kügler, member of the KDE e.V. Board of Directors explains where the new KDE Forum fits into KDE communication infrastructure: 'We've come to believe that mailinglist don't cut it for all users. KDE becoming increasingly widely used should also offer those that aren't familiar with the use of email for such discussions a place. The new KDE forum complements KDE's new end-user knowledge base Userbase that has been launched last month. At the same time, we're really happy to see that after our request the MyBB team has decided to release their forum software under the terms of the GPL.'" Click below for the full announcement.

Full Story (comments: none)

Audio and Video programs

O'Reilly Webcast - When Times Gets Tough, the Tough Get Tuning

O'Reilly will hold a webcast entitled: When Times Gets Tough, the Tough Get Tuning by Dee-Ann LeBlanc on October 21 at 10am PDT. "When you experience reduced performance, your first inclination may be to groan and open your wallet. While new hardware often can offer the best bang for your buck, it's also possible that you don't need to invest that money just yet--or at least that you can improve the performance while you look for a good deal. In this seminar, you'll learn how to break down performance into four major areas, how to determine which area(s) are causing your problems, and some tips on how to improve in each."

Full Story (comments: none)

Page editor: Forrest Cook

Copyright © 2008, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds