By Jake Edge
October 15, 2008
A new version of the popular free software office application suite,
OpenOffice.org (OOo) 3.0, was released this week to lots of
press and enough download traffic to bring down its webserver. While the
release isn't a huge leap
forward in terms of features, it does provide some compelling
enhancements. Perhaps the most interesting is the increased focus on
extensions, a la Firefox, that don't require modifying the core OOo
code. This may help combat the problem—or perceived
problem—that Sun is stifling OOo development through its bureaucratic
procedures for adding new functionality.
The first thing one notices when starting up OOo 3.0 is the new splash screen,
but it appears for only a short time. One of the major complaints about
the suite has been how long it takes to start up—something that has
been addressed in 3.0. The application opens to a new welcome screen (seen
at left) that presents a more friendly appearance, rather than an empty
window, for new users. Once
past that point, the various tools look much as they did in OOo 2.4 and
earlier versions.
The other changes are mostly under the covers; they will be noticed by
power users, but are not immediately obvious to basic users. These
include:
- Writer (word processor) has a new slider for zooming
- Writer allows multi-page display and editing
- Calc (spreadsheet) allows up to 1024 columns per sheet
- Draw (drawing) can handle poster-size files
- Impress (presentation) supports multiple monitors for
presentations
- Writer has additional editing modes for multi-lingual support as well
as wiki document editing
- Calc has a new equation solver
- Chart (graphing) has improved graphical output
The OOo extensions
repository has many different kinds of add-ons for OOo, that provide
new or enhanced functionality for users. The most popular is the PDF
import extension which allows loading PDF files into the application
for editing. Given that OOo has long had the ability to natively export
PDFs, importing them is an excellent addition.
Clearly Sun and the OOo project see extensions as a fertile ground for
innovation by folks who are not necessarily OOo "contributors"—as
they have
not signed the Sun
Contributor Agreement (SCA) [ PDF, currently unavailable due to the download
traffic problems ]. Sun's community manager for OOo, Louis Suarez-Potts,
puts
it this way:
OOo 3.0 adds to that freedom by using extensions much the same way that
Firefox does: it gives all users the freedom to add new features,
functionality. At present, we have a couple of hundred, and they have
proved popular. We've also done minimal advertising. I anticipate that in
the coming months, as 3.0 gains yet more popularity (all servers are down
at the moment), there will be more and more interesting extensions out
there.
I can see extensions that radically depart from what we consider "office"
tools---and why not? OOo is an integrated set of tools based on fairly
conservative conceptions of office software. But there is no compelling
reason to stick with the conservative past, and every reason to be
creative.
One of the new features that OOo developers are most excited about won't
affect Linux users at all. OOo 3.0 has a native Mac OS X look and feel, rather
than the earlier X11-based interface. A native Windows version has always
been a part of OpenOffice (and its precursor, StarOffice), but the new
default theme is said to be particularly attractive on that platform.
There are various new features aimed at those currently using—or
needing to interoperate with—Microsoft Office. There is support for
Access database files as well as improved Visual Basic for Applications
(VBA) macro support. Somewhat controversially, OOo 3.0 has added the
ability to read (but not write) Office Open XML (OOXML) files. OOXML is
the newly minted standard for office documents that Microsoft and Ecma pushed through the ISO
standardization process earlier this year.
Support for OOXML is one of the contentious areas surrounding OOo. There
are two (vocal) developer camps, one Sun-centric, the other Novell-centric;
unsurprisingly they tend to clash over OOXML as well as development pace
and direction issues. It has gotten to the point where a fork, called Go-OO, has come about, led by Novell's Michael
Meeks. Go-OO's version of OOo has been adopted by several distributions
leading some to see it as a "hostile" fork.
Sun's chief open source officer, Simon Phipps, clearly sees
Go-OO (and the
related OO-Build) as an attempt by Novell to control OOo:
The result of this is that go-oo.org is definitely a hostile and
competitive fork of OpenOffice.org, and OO-Build is no longer a helpful
downstream since it no longer upstreams much of anything (especially for
Mac), small changes excepted. Unlike Groklaw I'd still hesitate to call
OO-Build a fork, but Go-OO is unmistakably one, just look at the web site,
the Windows build and the rhetoric.
The motivation for Go-OO being hosted and promoted by Novell and its staff
seems unmistakable to me, as does the fact it is a Novell-sponsored
fork. They are promoting Microsoft's flakey XSLT-based OOXML support, they
are isolating Linux from OpenOffice.org (so that no-one in the main
OpenOffice.org community is able to get support contracts from Linux
users). And it is all cleverly wrapped in a community-friendly story about
hackers and their freedom and evil, controlling Sun, delivered without
interference from Novell corporate.
Meeks most recent look
at OOo development is the proximate cause of much of the current
sniping in various blogs.
Meeks analyzes commits to the OOo codebase to try to extract trends in the
development of the tool. His conclusion is stark—undoubtedly
inflammatory to those in the Sun camp—"Crude as they
are - the statistics show a picture of slow disengagement by Sun, combined
with a spectacular lack of growth in the developer community."
While there have been various responses to the analysis—including
this LWN comment
thread—there has, as yet, been no real counter-analysis that
comes to a different conclusion. Perhaps there are other ways to slice and
dice the data that look more favorable to growth in the OOo community, but
if not, the conclusion is worrisome. OOo is a very useful tool, that is
used by many, which offers a way out of Microsoft lock-in. Because of
Novell's close association with Microsoft, people worry that Go-oo is an
underhanded means for another kind of lock-in—this time to Novell.
In what seems almost a taunt—as well as a validation of the
accusation of a hostile fork—Meeks adds a postscript to his analysis:
Why is my bug not fixed ? why is the UI still so unpleasant ? why is
performance still poor ? why does it consume more memory than necessary ?
why is it getting slower to start ? why ? why ? - the answer lies with
developers: Will you help us make OpenOffice.org better ? if so, probably
the best place to get started is by playing with go-oo.org and getting in
touch [...]
There have long been complaints about the pace of OOo development, along
with calls
for creating a foundation to oversee it. It would seem that OOo is at
a bit of a crossroads. If Sun's commitment is reduced, without a
corresponding increase in contributions from others, OOo could
stagnate—or Go-oo could take over.
Ostensibly, the SCA is one of the sticking points for some contributors.
They do not trust Sun not to take their contributions in a proprietary
direction. But the conflict is really rooted in issues of control and
development
direction—two things likely to lead to forking. While two forks is
suboptimal, perhaps, it may lead to improvements in both the code
and the development process for OOo.
There are legitimate concerns on both sides of the issue—undoubtedly
the mostly silent user community has yet another perspective—but
there is enough bad blood between them that it is hard to see it resolving
in some relatively amicable way. The office application suite is an
extremely lucrative product, at least in the proprietary world. One gets
the sense that both Sun and Novell are seeing dollar signs which are clouding
their vision. A neutral foundation of some kind might be a good first step
towards reconciliation.
Comments (33 posted)
By Jonathan Corbet
October 15, 2008
Linux-Kongress 2008 attendees had the opportunity to hear two different
sessions dedicated to organizations trying to improve the state of Linux
support for embedded and mobile systems. They have similar goals, but are
taking different approaches and have different levels of resources
available to them.
The first of these is OpenSourceEmbedded, presented by uClinux developer
Jeff Dionne. He opened with a statement that, ten years ago, Linux-based
embedded systems were nearly unknown. Now those systems are everywhere,
with hundreds of millions of deployments. Embedded systems, he says, make
up the largest installed base of Linux systems.
All is not perfect, though, in the embedded sphere. Linux still has an
uncomfortably
large footprint for embedded use. There is also no unified distribution
for embedded use; instead, the industry is full of homemade solutions made
by vendors. He would like to address this situation through the creation
of a next-generation platform. It would take the form of a kit that
developers could start with which comes equipped with design examples for a
number of applications: telephones, digital video recorders, etc.
There are two hardware platforms being targeted initially by this effort.
One is a Plasma MIPS processor - a very simple device which can be
implemented with an FPGA. A simulator for this processor runs about 600
lines of code. The other, more advanced platform is a LEON 2/3 SPARC
processor, a full system with a memory management unit and which supports
multiprocessor configurations. Examples of the first processor include a RealTek
MIPS system, while the LEON SPARC CPU is similar to current SuperH 3
processors. The Plasma and LEON SPARC processors are being designed now,
with the intent of producing them as open hardware designs.
On top of these processors will be a base operating system layer with a
"mini-POSIX" environment. There will be an interesting packaging system
which stores components as separate "blocks" in flash, outside of any
filesystem. The running system will be assembled from the blocks by the
boot loader. This organization is designed to avoid bricking; any bad or
corrupted components can simply be bypassed without affecting the
functioning of the rest of the system. This, evidently, is how PalmOS did
things.
The next challenge is creating a community around this whole effort. To
that end, resources are to be put up at opensourceembedded.org - though
nothing is available as of this writing. The site will include project
hosting, along with the ability to download the development kits. Jeff
says that the uClinux experience has shown that the kit approach works;
with a ready-to-use code base like that, a community can come together.
There are also plans to create an organization behind this effort which,
among other things, can enter into non-disclosure agreements with hardware
manufacturers. This organization will also work to help vendors ship
GPL-compliant products.
OpenSourceEmbedded appears to be in an early state, so it's hard to make
any guesses about how successful it will be. For more information, see Jeff's slides
[PDF].
Mobile Linux
The closing session at the 2008 Linux-Kongress was a talk by Dirk Hohndel,
who began by noting that Linux-Kongress is, in fact, the oldest Linux
event. It was first held in 1994, and hosted many of the kernel developers
who were active at that time; Dirk estimates that about half of the
development community was to be found in a single room. It would take a
rather larger room to accomplish that now. Dirk complimented the event on
its avoidance of commercialism and its sustained focus on the technology.
The technology that Dirk came to talk about was mobile Linux. He started
by expressing his disappointment with desktop Linux. It has become a
collection
of poorly-integrated applications which are somehow trying to replicate
Windows 95. The result does not work well on the desktop, and it
most certainly is not optimized for the mobile environment.
But, says Dirk, mobile Linux is not really embedded Linux either. Embedded
Linux evokes images of access points and other single-application boxes
which are not meant to be extended past a single function. They are not
concerned with the user's experience, and they are not concerned with
mobility. The subject here is devices with a screen, and which can have
new applications installed onto them. So some sort of desktop-like
interface is needed, but current desktop Linux does not fill the bill.
According to Dirk, the problem with desktop Linux is the fundamental
approach: developers are not the target audience for this software, but
they are making all the interface decisions. What's needed is input from
people who are specialized in interface design and human-computer
interaction. That leads to a "scary thought": interface specialists are
generally not coders, but they will be making decisions that coders are
expected to implement. That is not a normal mode of operation in the free
software community, but it is needed here.
Other problems include the proliferation of "80% done" projects. Much of
the work has been done, but nobody wants to do the work to finish the job.
There's also far too many choices; in general, says Dirk, people do not
like it if they have to choose between more than two alternatives. When
dealing with the Linux desktop, it's hard to find situations where there
are fewer than six choices. And, overall, the Linux desktop lacks
consistency. That, says Dirk, is why he uses an Apple laptop. Apple
enforces a consistent design across the application space and, he says, the
result is very nice.
Devices should be simple and natural to use; such devices are increasingly
hard to find anywhere. As an example, he held up a paper notebook. The
device boots very quickly, has a nice "touch-based" pencil-oriented
interface. No manuals or explanations are needed. Linux-based devices
should be just as easy to use. But, at the same time, they need to offer
an experience which is close to what people expect from an ordinary,
desktop computer. It should have access to the Internet, and users should
be able to install software.
Dirk then pulled out an Eee PC system and gave the five-second boot demonstration.
This work, he says, is an example of what is being done by Intel in support
of the Moblin project. Intel is
trying to solve some of the hardest problems in the mobile space,
contributing the results for everybody to use.
To that end, Moblin is working toward the creation of a base distribution
for mobile systems. The user interface will be based on the GNOME mobile
work, but with a lot of enhancements. The end goal is the creation of a
Linux distribution for mobile devices which is far better
than the
state of the art today. It is not, he says, an attempt to compete with
distributors; instead, Moblin is providing a base which the distributors
can build on. Intel's effort will naturally focus on Intel processors, but
contributions for any architecture are welcome at Moblin.
In conclusion, Dirk noted that Linux's success on the server side was
relatively easy. The mobile problem is much harder. Intel is hoping that
others will join in to help Moblin reach its rather ambitious goals.
Comments (6 posted)
By Jake Edge
October 15, 2008
Measuring the health of communities is an interesting, difficult task. The
Fedora project has recently started using a new tool, called EKG, to try to get an overview of
the demographics of the free software projects that are sponsored by
the distribution. EKG is still young, but already provides some
interesting information. Because it is GPL-licensed, as is the Fedora
norm, it can be picked up by other distributions or interested parties to
target their own projects.
At its core, EKG is a few Ruby scripts that process mailing list data so
that graphs can be produced. Currently, it produces both pie charts and
line graphs that indicate the number of Red Hat posters versus those from
elsewhere. A portion of the most
recent set of graphs can be seen at right.
Red Hat's Michael DeHaan has taken on development of EKG to use as a tool
to measure how
well various projects are building a community separate from Red
Hat. There are lots of free software projects that have been released by
Red Hat—or Fedora, which often amounts to the same thing—but
may or may not be seen as useful tools outside of Fedora. By looking at
the mailing list traffic, particularly over time, some idea of which
projects are building a community, and which aren't, can be derived. As
the project page puts it:
The premise is simple... what are the demographics behind open source
projects that we run in Fedora?
- Who posts
- Who contributes
- What projects are most active?
- What projects need a little help?
Mailing lists are just one measure of the health of a project, of course,
so DeHaan is looking at other metrics. Commits to the project
repository—along with the identities of the commiter—would seem
an obvious choice. Better graphs with more useful information on each axis
as well as time series of the pie charts are also on the "to do" list.
He is also looking at derived statistics that will allow direct comparison
of different projects by using equations that in some way model success.
It is difficult to draw any conclusions from the limited graphs that are
currently available. One thing that does stand out, though, is the
popularity of gmail.com email addresses, which seem to account
for around one-quarter of posts. One can also certainly see projects that
are completely dominated by "inside" (i.e. Red Hat) folks. The JBoss lists
are a good example.
Projects are trying various ways to measure how well they are doing their
job; EKG is another way to do that. For the kernel, the statistics on each
release are gathered by LWN, as well as over longer
periods by the Linux Foundation. Ubuntu has its Upstream Report which looks at
how well bugs are getting to upstream bug trackers. Undoubtedly other
projects have their own ways of trying to measure their impact.
As yet, there is no mailing list for EKG development. We look forward to
the day when EKG is applied to its own development list. It would seem
that some kind of "metahealth" measurement of the community
might be able to be derived from that data.
Comments (none posted)
By Jonathan Corbet
October 10, 2008
The opening keynote speaker for the 2008 Linux-Kongress was James
Bottomley, who presented his views on the Linux community's values. What these
values are, says James, is not entirely obvious. Related groups - the free
software community, for example - have well-articulated value systems which
define them. The Linux community's values are not so clearly expressed,
but, he says, they are central to what we do.
James started with a bit of history, noting the the initial value placed on
software was entirely commercial. Once the industry realized that software
could be worth far more to its users than it costs to create, the
proprietary mode became dominant - and that has affected the evolution of
programming in general. The value placed on the code by its developers
became irrelevant, leading to "paycheck coding." There is no value placed
on creativity, and such a model leads to bad code.
Eventually Richard Stallman came along and challenged the commercial view
of software. But, during this time, about the only alternative to
commercial software was the BSD Unix distribution, and that got caught up
in the lawsuit by ATT. So closed software took over; Windows won on
commodity platforms, but proprietary software also became dominant in the
Unix arena.
In 1991, Linux hit the scene; since then, it has become the most popular
and vibrant free software operating system available. In a sense, this is
interesting, in that Linux is licensed under the GPL, a license that many
companies hate. Apple explicitly chose BSD as the base for MAC OS to
avoid GPL-licensed code. But, despite this antipathy, lots of companies
use Linux, and even contribute to its development. It is interesting,
James says, to look at why that is.
The reason is the Linux community's values. In particular, the community
prizes technical merit above all other considerations - including small
things like what any company or user would like to have. Also prized is
passion; code supported by a developer who clearly cares about it will
generally fare better in the review process. If the code quality and the
passion are there, the community does not care about much of anything
else. Factors like the source of the code or who might benefit from its
incorporation don't really matter.
In particular, contributors to the kernel are not required to sign on to
any particular belief system or any specific view of freedom. A
contributor may have an FSF-like belief in free software, or, instead, be a
corporate developer who does not care about software freedom at all. Even
the BSD community requires acquiescence with a specific view of freedom. A
Linux contributor, instead, need only be willing to contribute the code
under the share-alike rules of the GPL.
As a result, anybody can play with Linux, regardless of philosophy or
corporate status. We have a community which is defined by contributions,
not by a specific set of values regarding software freedom. That has
allowed the formation of a very diverse community with a specific shared
interest: creating the best kernel we can.
There are some significant benefits from this approach. It forces
companies to recognize their engineers' values; that, in turn, makes for
more motivated developers. Developers who are interested in improving
Linux can get resources and support from corporations. Users get
high-quality code from developers who care about what they are doing.
Companies get the ability to focus on their little piece of the problem
while taking advantage of the community-maintained kernel for the rest;
they can also offload their older code to the community for long-term
maintenance.
James compared the Linux way of doing things with the US constitution.
That document only mentions freedom three times, yet it has become a
blueprint which has supported freedom for over 200 years. It is a
relatively short document. The proposed EU constitution, instead, is about
20 times the length, before taking into account other documents which are
referenced. That document would appear to be somewhat bloated; the goals
would be better served by a more concise formulation.
Similarly, the Linux community spends little time talking about freedom.
Instead, the focus is on a set of brief principles involving code quality
and passion. Freedom is not legislated; it arises as an emergent
value inherent in the Linux way of doing things. Linux has managed to
bring about software freedom without talking about it, and without imposing
a view of software freedom on its contributors. In the process,
Linux has succeeded in creating something which is as free - or more free -
than the GNU system envisioned by the Free Software Foundation.
During the question period, James wished for a free software advocate who
would argue the point with him, but no such person emerged. He will, it
seems, have to repeat the talk in a different venue before he can have that
debate.
Comments (49 posted)
Page editor: Jake Edge
Security
By Jake Edge
October 15, 2008
Readers of this page—along with the kernel page—will not find
it surprising that SELinux is a complex beast. It is, however, the
dominant security framework for Linux, pushed hard by Red Hat, but also
being adopted, slowly, by SUSE, Ubuntu, and others. Over the years,
through lots of
hard work, it has become somewhat less complex, at least for
administrators; a new feature, called permissive domains will help
further ease the administration of SELinux-enabled systems.
These days, SELinux has two modes, the aptly named enforcing and
permissive modes. When in enforcing mode, SELinux will not allow
operations that are not permitted by the policy, whereas in permissive
mode, a violation is just logged and the operation is allowed to continue.
Administrators trying to track down an SELinux problem with an
application—whether a real security issue or just a problem with the
policy—can put the system into permissive mode, then study the logs
to determine what policies are being violated. Or they can use audit2allow
to make those policy changes for them.
Until permissive domains, though, the choice between permissive and
enforcing was binary for the entire system. By putting a system into
permissive mode, various attacks that SELinux might normally stop on other
applications would instead just be logged. With permissive domains, a
single process, or group of related processes, can be marked as permissive,
while the rest of the system stays in enforcing mode.
Red Hat SELinux hacker Dan Walsh, describes permissive
domains on his blog. One of the motivations is to help third-party
software developers feel more comfortable about shipping SELinux policy
with their application:
Another problem SELinux has is that third party software companies want to
ship with SELinux policy for their software but do not trust that they have
tested it well enough to run their confined applications in enforcing mode.
I have talked to developers of stock market software that wanted to write
policy for an application, distribute it to a live environment of several
hundred machines, and then gather the AVCs as they happen, using this
information to fine-tune their policy. After a long period of time, where
they saw no AVCs, they might be willing to put their policy in enforcing
mode. In RHEL5 they need to put the entire machine in permissive mode, but
permissive domains solve this problem.
Permissive domains are available in recently updated Fedora 9 systems and
will come standard with Fedora 10. As Walsh shows, enabling permissive
mode for a domain is trivial:
# semanage permissive -a httpd_sys_script_t
which would put all CGI scripts into permissive mode. And:
# semanage permissive -d httpd_sys_script_t
to remove permissive mode for the CGI script domain
(
httpd_sys_script_t).
This is definitely a nice step forward for assisting with policy
development, but there is still a lingering problem with the recommended
way to generate SELinux policies. Walsh describes how that is done:
Finally, when someone wants to write policy for a new confined domain, we
tell the policy writer to build a minimal policy using tools like
system-config-selinux. Then we advise them to put the machine in
permissive mode, run the confined application, collect the AVC messages,
use audit2allow to generate new policy, and try again. Lather, rinse,
repeat. This puts the entire machine at risk, since it is no longer
protected by SELinux. With permissive domains, you can mark the new domain
as permissive and avoid putting the machine at risk.
The problem, of course, is that blindly using audit2allow is
extremely dangerous. It assumes that the application has no security
problems, that all of its accesses should be permitted—if that can be
assumed, what is SELinux for? By taking all
of the violations and turning them into policy changes, the application,
rather than the policy developer, decides on the access it requires. Using
audit2allow correctly is much more complex, requiring a good
understanding of SELinux and the existing policies and domains.
To be fair to Walsh, in a related post, he does warn:
Whenever you generate policy in this way you should really examine the te
file for what rules audit2allow has generated and try [to] make sure they make
sense, and don't open a security [hole]. It is always good to ask if the
policy is good on a list like fedora-selinux. If you believe this is a bug
in policy, please open a bugzilla. Then we can fix the policy for others.
The audit2allow manpage is even more explicit:
Care must be exercised while acting on the output of this utility to
ensure that the operations being permitted do not pose a security
threat. Often it is better to define new domains and/or types, or make
other structural changes to narrowly allow an optimal set of operations
to succeed, as opposed to blindly implementing the sometimes broad
changes recommended by this utility. Certain permission denials are
not fatal to the application, in which case it may be preferable to
simply suppress logging of the denial via a dontaudit rule rather
than an allow rule.
Using audit2allow is, unfortunately, the way that most SELinux
policy is developed. There aren't enough SELinux experts—there may
never be enough—to actually look at the code for applications and
determine a priori what the policy should look like. So, testing
applications by running them to determine what permissions they require is
the only sane way to do it, error-prone though it may be.
Comments (4 posted)
New vulnerabilities
cups: several vulnerabilities
| Package(s): | cups |
CVE #(s): | CVE-2008-3639
CVE-2008-3640
CVE-2008-3641
|
| Created: | October 10, 2008 |
Updated: | February 20, 2009 |
| Description: |
From the Red Hat advisory:
A buffer overflow flaw was discovered in the SGI image format decoding
routines used by the CUPS image converting filter "imagetops". An attacker
could create a malicious SGI image file that could, possibly, execute
arbitrary code as the "lp" user if the file was printed. (CVE-2008-3639)
An integer overflow flaw leading to a heap buffer overflow was discovered
in the Text-to-PostScript "texttops" filter. An attacker could create a
malicious text file that could, possibly, execute arbitrary code as the
"lp" user if the file was printed. (CVE-2008-3640)
An insufficient buffer bounds checking flaw was discovered in the
HP-GL/2-to-PostScript "hpgltops" filter. An attacker could create a
malicious HP-GL/2 file that could, possibly, execute arbitrary code as the
"lp" user if the file was printed. (CVE-2008-3641)
|
| Alerts: |
|
Comments (none posted)
dbus: denial of service
| Package(s): | dbus |
CVE #(s): | CVE-2008-3834
|
| Created: | October 10, 2008 |
Updated: | May 3, 2011 |
| Description: |
From the CVE entry: The dbus_signature_validate function in the D-bus library (libdbus) before 1.2.4 allows remote attackers to cause a denial of service (application abort) via a message containing a malformed signature, which triggers a failed assertion error. |
| Alerts: |
|
Comments (none posted)
exiv2: denial of service
| Package(s): | exiv2 |
CVE #(s): | CVE-2008-2696
|
| Created: | October 15, 2008 |
Updated: | October 31, 2008 |
| Description: |
From the Ubuntu advisory:
Joakim Bildrulle discovered that exiv2 did not correctly handle Nikon
lens EXIF information. If a user or automated system were tricked into
processing a specially crafted image, a remote attacker could cause the
application linked against libexiv2 to crash, leading to a denial of
service. (CVE-2008-2696)
|
| Alerts: |
|
Comments (none posted)
kernel: several vulnerabilities
| Package(s): | linux-2.6 |
CVE #(s): | CVE-2008-1514
CVE-2008-3833
CVE-2008-4210
CVE-2008-4302
|
| Created: | October 14, 2008 |
Updated: | January 8, 2009 |
| Description: |
From the Debian advisory:
Jan Kratochvil reported a local denial of service vulnerability in the ptrace interface for the s390 architecture. Local users can trigger an invalid pointer dereference, leading to a system panic. (CVE-2008-1514)
The S_ISUID/S_ISGID bits were not being cleared during an inode splice, which, under certain conditions, can be exploited by local users to obtain the privileges of a group for which they are not a member. Mark Fasheh reported this issue. (CVE-2008-3833)
David Watson reported an issue in the open()/creat() system calls which, under certain conditions, can be exploited by local users to obtain the privileges of a group for which they are not a member. (CVE-2008-4210)
A coding error in the splice subsystem allows local users to attempt to unlock a page structure that has not been locked, resulting in a system crash. (CVE-2008-4302) |
| Alerts: |
|
Comments (none posted)
mon: insecure temp files
| Package(s): | mon |
CVE #(s): | CVE-2008-4477
|
| Created: | October 9, 2008 |
Updated: | October 17, 2008 |
| Description: |
mon has an insecure temporary file creation vulnerability.
From the Debian alert:
Dmitry E. Oboukhov discovered that the test.alert script used in one of the
alert functions in mon, a system to monitor hosts or services and alert
about problems, creates temporary files insecurely, which may lead to a local
denial of service through symlink attacks. |
| Alerts: |
|
Comments (none posted)
portage: privilege escalation
| Package(s): | portage |
CVE #(s): | CVE-2008-4394
|
| Created: | October 10, 2008 |
Updated: | October 15, 2008 |
| Description: |
From the Gentoo advisory: A search path vulnerability in Portage allows local attackers to execute commands with root privileges if emerge is called from untrusted directories.
|
| Alerts: |
|
Comments (none posted)
ruby: multiple vulnerabilities
| Package(s): | ruby |
CVE #(s): | CVE-2008-3905
CVE-2008-3790
CVE-2008-3443
|
| Created: | October 10, 2008 |
Updated: | January 5, 2009 |
| Description: |
From the CVE entries:
CVE-2008-3905 - resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before
1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses
sequential transaction IDs and constant source ports for DNS requests,
which makes it easier for remote attackers to spoof DNS responses, a
different vulnerability than CVE-2008-1447.
CVE-2008-3790 - The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7
through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a
denial of service (CPU consumption) via an XML document with recursively
nested entities, aka an "XML entity explosion."
CVE-2008-3443 - The regular expression engine (regex.c) in Ruby 1.8.5 and
earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through
r18423 allows remote attackers to cause a denial of service (infinite loop
and crash) via multiple long requests to a Ruby socket, related to memory
allocation failure, and as demonstrated against Webrick. |
| Alerts: |
|
Comments (none posted)
Events
The
Open Web Application Security Project is announcing its European summit to be held November 4-7 in Algarve, Portugal. The theme of the conference is "Setting the AppSec [Application Security] agenda for 2009". "
This venue hosts a diverse selection of training courses along with
technical and business tracks, making it THE place to learn about web
application security and the resources OWASP has available for use today." Click below for the full announcement.
Full Story (comments: none)
Page editor: Jake Edge
Kernel development
Brief items
The 2.6.27 kernel is out, released by Linus on October 9.
For those just tuning in, 2.6.27 includes (among many other
things) UBIFS, support for integrity checking in the block
layer, multiqueue networking,
the ftrace tracing framework,
the lockless page cache, the
relocation of a lot of
firmware, the GSPCA webcam driver set, and a number of extended system calls.
See the always-excellent
KernelNewbies summary for lots more information about this release.
The 2.6.28 merge window is currently open with around 4100 changesets
merged at the time of this writing. See the article below for a summary of
what has been added to the kernel so far in this development cycle.
The current stable kernels are 2.6.25.18 and
2.6.26.6 which were
released on
October 8. Both contain a long list of important fixes throughout the
kernel tree.
Comments (4 posted)
Kernel development news
ooh, I like err_ick and err_fck a lot. They sound like akpm review
comments at the end of a long day.
--
Andrew Morton
You should just get a real name, not that "John Smith"
crud. Something _manly_. Something unique. Something
strong. Something that tells you that you're not just another
clone.
Something like "Linus Torvalds". Except not exactly.
--
Linus Torvalds (Thanks to Matthew Burgess)
On Tue, 14 Oct 2008, Jean Delvare wrote:
>
> Marek Vasut (1):
> i2c/tps65010: Vibrator hookup to gpiolib
Guys, I know we geeks aren't known for our sex-life, but do we have to
make it so obvious?
--
Linus Torvalds (thanks to David Lang and
Walter Franzini)
Comments (none posted)
2.6.16 has become a bit dated, and I'll maintain 2.6.27 for a few years
as a replacement.
As with 2.6.16, I'll pickup maintenance when the normal -stable
maintenance ends (at some point after 2.6.28 gets released in January).
It is intended to fill the niche for users who are not using
distribution kernels but want to use a regression-free kernel for a
longer time. It might be a small part of the userbase, but after the
experiences with 2.6.16 I can say that there are quite a few users
who appreciate such an offering.
--
Adrian Bunk
Comments (1 posted)
By Jonathan Corbet
October 15, 2008
As of this writing, 4193 non-merge changesets have been incorporated for
the 2.6.28 kernel. In other words, this merge window is just beginning,
having merged probably less than half of the patches which will eventually
find their way into the mainline. What we see so far are a lot of drivers
and incremental improvements, but not many major changes.
User-visible changes for 2.6.28 include:
- There are new drivers for Analog Devices SSM2602, AD1882A and AD1980 codecs,
Freescale MPC5200 I2S audio devices,
Texas Instruments TLV320AIC26 codecs,
Tascam US-122L USB Audio/MIDI interfaces,
Wolfson Micro WM8580, WM8900, WM8903, and WM8971 audio devices,
Blackfin SPORT peripheral interface controllers,
NVIDIA HDMI HD-audio codecs,
Toshiba RBTX4939 MIPS boards,
Atheros L2 10/100 network adapters,
Cisco 10G Ethernet adapters,
JMicron JMC250 chipset-based network adapters,
QLogic QLGE 10Gb Ethernet adapters,
SMSC LAN95XX based USB 2.0 10/100 ethernet devices,
AFEB9260 ARM-based boards (an open source board design),
Arcom/Eurotech VIPER boards,
AT91SAM9X watchdog devices,
ITE IT8716, IT8718, IT8726, and IT8712 Super I/O watchdogs,
W83697UG/W83697UF watchdog devices,
TLV320AIC23 codecs,
Micron MT9M111 camera chips,
Magic-Pro DMB-TH tuners,
Afatech AF9015 and AF9013 DVB-T USB2.0 receivers,
Conexant cx24116/cx24118 tuners,
DVB cards based on SDMC DM1105 PCI chip,
Silicon Laboratories SI2109/2110 demodulators,
ST STB6000 DVBS Silicon tuners,
numerous Fujifilm FinePix cameras,
ALi video camera controllers,
WM8400 AudioPlus HiFi codecs, and
SGS-Thomson M48T35 Timekeeper RAM chips.
- Support for the old Sun 4 architecture and ColdFire serial ports has
been removed.
- There is a new sysfs file (unload_heads) which can be
used by a user-space process to tell an ATA disk to retract its heads
and prepare for an impact. When used in conjunction with an
accelerometer, this feature could be used to attempt to preserve a
disk in a falling laptop.
- Improved support for ptrace() - and support for precise event-based
sampling in particular - has been added for the x86 architecture.
- The crypto subsystem has gained support for deterministic ANSI X9.31
A.2.4 pseudo-random number generation.
- The SMACK security module can now be configured to enforce mandatory
access control rules on privileged processes.
- There is a script which can be used to generate a minimal "dummy"
policy for SELinux. The smallest workable policy, it seems, is 587
lines long.
- Some sound devices can detect the presence of audio devices on input
and output jacks. The ALSA layer now allows drivers for those devices
to register those jacks and report the presence of devices attached to
sound cards through the input layer.
- Work with multiqueue networking continues; 2.6.28 will include the
ability to associate a separate queueing discipline with each internal
packet queue.
- The wireless regulatory
compliance subsystem has been merged.
- The kernel now supports the Phonet packet protocol used by
Nokia cellular modems. See networking/phonet.txt in the kernel
documentation directory for more information.
- Also added to core networking is support for the Distributed Switch
Architecture protocol, with initial support for a number of Marvell
switch chips.
- The netfilter layer has been augmented to support network namespaces.
- The ext4 system has lost the "ext4dev" name; this is a signal that the
developers are getting ready to declare it ready for production use.
Ext4 has also gained a set of static tracepoints for use with
SystemTap or other tracing tools.
- The FIEMAP
ioctl() for extent mapping has been added.
- Xen has added CPU hotplugging support.
- Version 4 of the rpcbind protocol is now supported; this enables the
kernel to offer RPC services via IPv6.
- The OCFS2 filesystem has gained a number of features, including POSIX
locks, extended attributes, and use of the JBD2 journaling layer.
Changes visible to kernel developers include:
- Discard request
and request timeout handling have been added to the block layer; a
number of other internal API changes have been made as well. See this article for details.
- Video4Linux2 drivers no longer have their open() function
called with the big kernel lock held. The lock_kernel()
calls have been pushed down into individual drivers within the
mainline tree; external drivers will need to be fixed.
The merge window is likely to remain open until approximately
October 24.
Comments (none posted)
By Jonathan Corbet
October 15, 2008
The 2.6.28 merge window has seen the addition of a number of changes to the
block layer. Here's a summary of the new features and APIs which have gone
in.
Solid-state storage devices
There are some enhancements aimed at improving the kernel's support
of solid state storage devices. One of those, the discard API, has been
covered here before. This API allows
high-level block subsystem
users (filesystems) to indicate that a particular range of blocks no longer
contains useful data. That allows the low-level device to incorporate
those blocks into its garbage collection scheme and to stop worrying about
their contents when performing wear leveling.
Since the initial LWN article, though, the API has changed a little. The
way to issue a discard request is now:
int blkdev_issue_discard(struct block_device *bdev, sector_t sector,
unsigned nr_sects);
The end_io() parameter seen in previous versions of the API is no
longer present. There is no way for callers to know when the request
completes, or, indeed, if the request completes at all. Since the caller
is indicating a lack of interest in the given sectors, it really should not
matter what the device does thereafter.
There is a filesystem-level function for creating discard requests:
static inline int sb_issue_discard(struct super_block *sb,
sector_t block,
unsigned nr_blocks);
Here, the interface is expecting block numbers using the filesystem block
size, rather than 512-byte sectors.
User-space programs can issue discard requests with the new
BLKDISCARD ioctl() call. Needless to say, such
operations should be done with care; about the only logical user of this
ioctl() would be mkfs programs.
Block drivers which support discard requests will provide a suitable
function to the block layer:
typedef int (prepare_discard_fn) (struct request_queue *queue,
struct request *rq);
void blk_queue_set_discard(struct request_queue *q,
prepare_discard_fn *dfn);
In the absence of a "prepare discard" function, discard requests for the
device will fail.
The block layer has also added a flag by which drivers can indicate that a
device is not rotating storage, and, thus, does not suffer from seek
delays. By setting QUEUE_FLAG_NONROT (with
queue_flag_set() or queue_flag_set_unlocked()), a driver
tells the block layer that it is working with a solid state device. I/O
schedulers can use that information to avoid plugging the queue - a useful
technique for combining requests to rotating storage devices, but a useless
operation when there is no seek penalty to avoid.
Request affinity
On large, multiprocessor systems, there can be a performance benefit to
ensuring that all processing of a block I/O request happens on the same
CPU. In particular, data associated with a given request is most likely to
be found in the cache of the CPU which originated that request, so it makes
sense to perform the request postprocessing on that same CPU. With 2.6.28,
sysfs entries for block devices will include an rq_affinity variable.
If it is set to a non-zero value, CPU affinity will be turned on for that
device. According to the patch changelog, turning this feature on can
reduce system time by 20-40% on some benchmarks.
Timeout handling
Robust device drivers typically have to be written to handle cases where
devices fail to complete operations they have been instructed to do. In a
few cases, higher-level code helps with this task; the networking layer,
for example, can track outgoing packets and let a driver know when a
transmit operation has taken too long. In most other drivers, though, it's
up to the driver itself to notice when an operation seems to be taking too
long.
Like the network subsystem, the block layer manages queues of requested
operations. As of 2.6.28 the block layer will, again like networking, have
a mechanism for notifying drivers about request timeouts; that, in turn,
will allow a bunch of timeout-related code to be removed from the lower
layers. Timeout handling in the block layer can be more complex, though,
and the associated API reflects that complexity.
A block driver must register a function to handle timed-out requests:
typedef enum blk_eh_timer_return (rq_timed_out_fn)(struct request *);
void blk_queue_rq_timed_out(struct request_queue *q,
rq_timed_out_fn *fn);
The amount of time a request should be outstanding before timing out is set
up with:
void blk_queue_rq_timeout(struct request_queue *q,
unsigned int timeout);
The tracking of per-request timeouts is done within the block layer; the
timer for any individual request is started when that request is dispatched
to the driver by the I/O scheduler. Should a request fail to complete
before the timeout period passes, the driver's timeout function will be
called with a pointer to the languishing request. The driver then can do
one of three things:
- Figure out that, in fact, the request was completed as expected, but
that completion had not been noticed by the driver. A dropped
interrupt could bring out such a situation, for example. In this
case, the driver returns BLK_EH_HANDLED, and the request will
be marked as completed.
- Decide that the request needs more time, perhaps because it has been
re-issued by the driver. A BLK_EH_RESET_TIMER will start the
timer again for this request.
- Punt and return BLK_EH_NOT_HANDLED. The block layer
currently does nothing at all when it gets this return code; future plans
appear to include aborting the request within the block layer when
this return value is encountered.
If things look bad, the driver may decide to abort any outstanding
requests, reset the device, and start over. There are a couple of new
functions which can help with this task:
void blk_abort_request(struct request *req);
void blk_abort_queue(struct request_queue *q);
These functions will abort the given request, or all requests on the queue,
as appropriate. Part of that process involves calling the driver's timeout
handler for each aborted request.
Other changes in brief
Some other block-layer changes include:
- The handling of minor numbers has been changed, allowing disks
to have an essentially unbounded number of partitions. The cost of
this change is that minor numbers may be attached to a different major
number, and they might not all be contiguous; for this reason, drivers
must set the GENHD_FL_EXT_DEVT flag before the extended
numbers will be used. See this
article for more information on this change.
- The prototypes of blk_rq_map_user() and
blk_rq_map_user_iov() have changed; there is now a
gfp_mask parameter. This allows these functions to be used
in atomic context.
- kblockd_schedule_work() has an additional parameter
specifying the relevant request queue.
- The new function bio_kmalloc() behaves much like
bio_alloc(), but it does not use a mempool to guarantee
allocations and can thus fail.
It is, all told, one of the busier development cycles for the block layer
in recent times.
Comments (1 posted)
Patches and updates
Kernel trees
Core kernel code
Development tools
Device drivers
Filesystems and block I/O
Networking
Architecture-specific
Security-related
Page editor: Jake Edge
Distributions
News and Editorials
By Rebecca Sobol
October 15, 2008
Gaël Duval, founder of Mandrake-Linux, started
Ulteo after he was
laid off by Mandriva in 2006. The first alpha
release was
announced several months later.
In the past two years the project has had some time to mature and with the
announcement that OpenOffice.org 3.0 is
available through Ulteo.com it seemed like a good time to revisit the
project.
Ulteo is aimed at Windows users, and gives them a slow and easy to way to
convert to Linux using the first of several several sub-projects; the Ulteo Online
Desktop. Many Linux applications are available through a Java enabled
web browser such as Firefox or Internet Explorer. OpenOffice.org, KPdf,
Kopete, Skype, Thunderbird + Enigmail, Gimp and Digikam, Inkscape and
Scribus and many other applications are available in the Online Desktop
without installing any new software on the PC. A subscription to Ulteo
Premium provides extra storage for documents and other benefits.
Once the user becomes comfortable with Linux applications they could be
ready for the Ulteo
Application System which is an installable system for the PC. The
Application System features automatic document synchronization/backup,
automatic updates and upgrades, and all the applications included in the
online desktop.
The Ulteo
Virtual Desktop seems to be much the same as the Online Desktop. It is
designed to run under Windows and allows the use of both Linux and Windows
applications. The Virtual Desktop uses coLinux to provide the Linux
desktop on Windows.
The final Ulteo product, for now at least, is the Documents
Synchronizer. This, like the Virtual Desktop, is Windows software but
it can be used with the Online Desktop to backup and retrieve documents,
whether these are produced locally with Windows applications or with Linux
applications using Online Desktop.
Ulteo is not something that will be of immediate interest to the average
LWN reader. Presumably most readers are already knowledgeable about
running Linux and its applications. However most of us probably do know
someone who is not ready to run Linux natively. At least some of those
people could start using the Online Desktop and become more familiar with
various Linux applications without having to download and install those
applications. Who knows where they might go after that.
Comments (2 posted)
New Releases
Mandriva has
announced the release of Mandriva Linux 2009.
"
Mandriva Linux 2009 goes further in its innovations and offers a thoroughly modern and cutting-edge graphical environment: KDE 4.1. Personalizable, modular, scalable, and full of visual effects that enhance the environment, KDE's new version is usable everywhere, from the oldest hardware to the newest.
Mandrivas team has gone to great lengths to integrate this new environment in a way that ensures everyone can jump right in to using it, with a customized graphical theme, careful choice of the most powerful applications, and a default configuration tuned to your system's particular hardware."
Comments (none posted)
A snapshot of Fedora 10 (beta) is available for testing. "
As part of
our development schedule, we are releasing a snapshot of Rawhide in Live
form. We are releasing these via bittorrent only as it is a much lighter
weight method to get bits out the door than to go through our mirroring
system. If you cannot use bittorrent we apologize for the
inconvenience."
Full Story (comments: none)
The XO Software Release 8.2.0 was developed by OLPC engineers and the OLPC
open source community. "
Release 8.2 is based on a child focused
graphical interface called Sugar, a Red Hat Fedora 9 Linux operating system
and OLPC customized implementations of core software including power
management, wireless drivers, NAND flash file system, Open Firmware, and
other components."
Full Story (comments: 2)
Distribution News
Debian GNU/Linux
The Debian Eee PC team reports numerous successes in getting the various Eee PC models to run Debian. Most of the work has been on getting wireless networking working with in-tree (i.e. not binary) drivers, but there has also been work done on ACPI support. They are also keeping an eye on the 5-second-boot work that Arjan van de Ven and Auke Kok are doing. Click below for the full report.
Full Story (comments: 9)
The Debian CD team has been building CD and DVD images of each weekly Lenny
build. Lenny is the codename for the upcoming Debian 5.0 release. Some
Blu-ray images are also available for i386, amd64 and source, *jigdo
only*. Grab an image and start testing.
Full Story (comments: none)
The Debian project has set up a small contest, a bet on the day that bug
numbers 600000 and 1000000 will be reported. "
The winner(s) will be
the person(s) placing her|his|their bet as close as possible to the real
moment bug #600000 and #1000000 are reported."
Full Story (comments: 2)
Fedora
Some note from the Fedora Board Meeting of October 7, 2008 are available.
Topics include codecs, a trademark update, and more.
Full Story (comments: none)
RPM Fusion is the merger of Dribble,
Freshrpms and Livna, still in progress. "
Most of the packages from
Livna have been imported and build for RPM Fusion already, hence we now
begin to slowly move users from Livna over to RPM Fusion by activating
the RPM Fusion free and nonfree rawhide repos for users of livna's devel
branch *now*." Click below for more on the status of this new
"extras" repository for Fedora users.
Full Story (comments: none)
Distribution Newsletters
The
October
2008 issue of the Arch Linux Newsletter is out, with news about
TeXLive in extras, netcfg in core, Arch Linux in the media, and several
other topics.
Comments (none posted)
The
DistroWatch
Weekly for October 13, 2008 is out. "
Mandriva Linux,
traditionally the first among the major distribution releases, boldly
unveiled its latest product late last week. Shipping with KDE 4.1.2, an
updated system installer, and a variety of usability enhancements, version
2009 should have been the company's best release ever. It was somewhat
spoilt by a long list of known bugs that weren't fixed in time for the
release - hopefully these will be corrected through post-install package
updates soon, but there are those who'd argue for a postponement of a
release in such situations. No similar dilemma is ever likely to face the
Debian development team. If it isn't ready, it won't be released - that's
the message given to the user community which has been hoping for a timely
arrival of "Lenny". And while most other distributions have been quietly
fixing the bugs in their own development trees, DistroWatch has compiled
another package management cheatsheet - now incorporating two
distro-agnostic tools, as well as source-based distributions."
Comments (none posted)
This week the Fedora Weekly News looks at New Fedora 9 Re-spins, Fedora
Test Day, Uberpackager Replaces Packager. The marketing beat has Fedora's
Community Attracts Experienced Users and Five Second Boot of a Modified
Version of Fedora. In Developments there are Unsigned Rawhide Packages an
Attack Vector ?, Procedure for Re-naming a Package, Review of trash-cli
Raises Generic Naming Issues, PackageKit-gstreamer-plugins Obsoletes
Codeina, LXDE Feature Removal Disappointment - How to Avoid; and much
more.
Full Story (comments: none)
The Ubuntu Weekly Newsletter for October 11, 2008 covers: Ubuntu Countdown
banner for WordPress, Follow up: Xubuntu Hug Day, Ubuntu Free Culture
Showcase Winners, New Ubuntu Members, Getting help from the Launchpad Team,
Launchpad to be off-line, Server Team meeting summary, and much more.
Full Story (comments: none)
Newsletters and articles of interest
vnunet
covers the release of Mandriva Linux 2009.
"
Linux publisher Mandriva has released its latest distribution, Mandriva Linux 2009, offering a faster boot time and up-to-date versions of tools such as KDE, Gnome, OpenOffice and Firefox, plus an installer that optimises the platform for mini-laptops.
Available immediately for download, Mandriva Linux 2009 integrates the latest innovations, from office applications to the newest virtualisation technology, according to the firm."
Comments (none posted)
Distribution reviews
Susan Linton
looks at the
Foresight Kid's Edition. "
Foresight Kid's Edition captures
children's attention immediately with its happy bumblebee character,
smiling and waving from the lower corner of the brightly colored
desktop. Distractions are kept to a minimum on the panel and desktop, with
only a few icons such as Trash and Home showing. The customized Slab menu
is also constructed for children, having entries for the applications of
interest to youngsters in the Favorite Applications screen (main
panel)."
Comments (3 posted)
Susan Linton
reviews
Sidux. "
Sidux, a relatively new desktop Linux distribution, is based
on Sid, the unstable developmental branch of Debian. The developers strive
for an easy-to-install and easy-to-use modern Debian derivative, and pride
themselves on remaining true to the principles and values of the Debian
project. Despite a few inconveniences, I like Sidux a bit more each time I
use it."
Comments (none posted)
Page editor: Rebecca Sobol
Development
October 13, 2008
This article was contributed by Tom Chance.
Working with a Windows network from Linux has never been a smooth ride.
While Samba, Wine and OpenOffice.org have made many components workable, connecting to the Microsoft Exchange email server has remained unreliable. Now the OpenChange developers hope to change that, providing the same capabilities as Microsoft Outlook in a range of Linux-native clients like Kontact and Evolution.
OpenChange is not yet workable, but partial operation can demonstrate
its potential.
If you want to connect to Exchange at the moment, you have a few options. Evolution can connect using a hack with Outlook Web Access, providing email, shared folders, calendars and contacts. But it's far from reliable; I tried to get by with it at the office, warts and all, and managed it for a couple of weeks before resigning myself to Windows. The other options are even worse -- just use the webmail client, or use the IMAP server for email and hacks such as
this one to get at other data in a manner similar to Evolution. Working from home on Kubuntu, I find it easier to just use the webmail client.
OpenChange is taking a much more sensible approach. At the heart of the project is a
MAPI-compatible API, which allows clients to talk directly to Exchange and access all of its functionality. The code is still being actively developed, but some application developers have started playing around with it; the first code for Evolution came out in
January 2008. According to Brad Hards, an OpenChange and Kontact developer, "OpenChange can do most of the Exchange tasks now, though it can't currently do free/busy."
For the curious, OpenChange developer Julien Kerihuel has written a simple command-line client. It's currently available in Ubuntu Intrepid and Debian Experimental, though you're better off compiling it yourself as it is changing quite rapidly. It isn't especially well documented, and the manpage implies some functionality that Kerihuel is still working on, but I did have some success.
First, you need to set-up a new profile:
tom@dell-desktop:~$ mapiprofile --profile=tom.chance -w=dell-desktop \
-I=192.168.0.11 -D=BIOREG -u=tom.chance -p=mypassword --create
You can check if it has worked by listing your mailboxes:
tom@dell-desktop:~$ openchangeclient --mailbox --profile=tom.chance \
+ Mailbox - Tom Chance
|---+ Calendar : (Total: 774 / Unread: 0 - Container class: IPF.Appointment) [FID: 0xdadb000000000001]
|---+ Contacts : (Total: 59 / Unread: 0 - Container class: IPF.Contact) [FID: 0xdbdb000000000001]
|---+ Deleted Items : (Total: 0 / Unread: 0 - Container class: IPF.Note) [FID: 0x3efc000000000001]
|---+ Drafts : (Total: 0 / Unread: 0 - Container class: IPF.Note) [FID: 0xdcdb000000000001]
|---+ Inbox : (Total: 474 / Unread: 0 - Container class: IPF.Note) [FID: 0x3bfc000000000001]
|---+ General : (Total: 10 / Unread: 1 - Container class: IPF.Note) [FID: 0xe00240000000003]
I managed to send a test email, which I picked up in Outlook without problems. When I opened the same email in KMail, however, it has a "winmail.dat" binary file attached, which you wouldn't normally get in emails from Outlook.
tom@dell-desktop:~$ openchangeclient -p=tom.chance --to="tom.chance@bioregional.com" \
--subject="OpenChange test" --body="Hmm, did this work?" --sendmail
sendmail MAPI_E_SUCCESS (0x0)
You can also interrogate folders, send emails, create and delete contacts, calendar appointments and access most of the other Exchange functionality. Kerihuel: "Openchangeclient is a test case for libmapi, it's a useful way to test if a problem is in the client application or in libmapi, and there is a plugin for sugarcrm, so it may remain in future." There's a proxy server using Samba too, for those who want yet another way of connecting.
For Kontact users, usable integration is probably a good 6 months away. The akonadi resource can deal with most of OpenChange's functionality, "at least a bit", accord to Hards, though "Kontact can't currently make use of it because it isn't converted to akonadi yet." KDE 4.2 should come out with akonadi integration, but the OpenChange functionality might not yet be stable enough for large quantities of important data. Hards thinks KDE 4.3 is probably
"the sweet spot."
Until then, Ballmer's mantra remains relevant; OpenChange and its client implementations could do with developers, developers, developers. Cracking this nut could throw open Exchange to a new range of clients, and as Kontact and its peers become stable on Windows and MacOSX, an entrenched Windows server will pose less of a threat to free software migrations on desktops.
Comments (3 posted)
System Applications
Clusters and Grids
Version 0.7.1 of VIFF has been announced, it is a bug fix release.
"
Virtual Ideal Functionality Framework is a framework for creating
efficient and secure multiparty computations (SMPC). Players, who do
not trust each other, participate in a joint computation based on
their private inputs. The computation is done using cryptographic
protocols which allows them to obtain a correct answer without
revealing their private inputs. Operations supported include
addition, multiplication, and comparison, all with Shamir secret
shared outputs."
Full Story (comments: none)
Database Software
The October 12, 2008 edition of the PostgreSQL Weekly News
is online with the latest PostgreSQL DBMS articles and resources.
Full Story (comments: none)
Device Drivers
Version 0.8.4 of
LIRC, the Linux
Infrared Remote Controller, has been announced.
"
Irman support is broken in 0.8.2. Please use 0.8.4 if you have this receiver. "
Comments (none posted)
Filesystem Utilities
Stable version 1.5012 of NTFS-3G has been announced.
"
The NTFS-3G driver is able now for unlimited file and directory creation
and removal as the result of 13 years continuous clean-room reverse
engineering, documenting the different versions of NTFS on-disk formats
and implementing a safely interoperable file system driver with the over
500,000 source lines Microsoft NTFS driver by the help of hundreds of
contributors over these years."
Full Story (comments: none)
Mail Software
Version 0.4 of managesieve has been announced, it includes new capabilities
and bug fixes.
"
A ManageSieve client library for remotely managing Sieve scripts,
including an user application (the interactive 'sieveshell').
Sieve scripts allow users to filter incoming email on the mail server.
The ManageSieve protocol allows managing Sieve scripts on a remote
mail server. These servers are commonly sealed so users cannot log
into them, yet users must be able to update their scripts on them."
Full Story (comments: none)
Networking Tools
Version 0.0.97 of libnetfilter_conntrack has been announced.
"
libnetfilter_conntrack is a userspace library providing a programming
interface (API) to the in-kernel connection tracking state table. This
library requires a linux kernel >= 2.6.18.
This release includes minor fixes, some enhancements and cleanups."
Full Story (comments: none)
Printing
Version of CUPS, the Common UNIX Printing System, has been
announced.
"
CUPS 1.3.9 fixes three integer overflow bugs, an incompatibility with Firefox 3, several printing bugs, and several scheduler bugs."
Comments (none posted)
Web Site Development
Version 3.1.6 of the Plone web development platform has been announced.
"
The 6th maintenance release of Plone 3.1 is now available."
Full Story (comments: none)
Version 3.2a1 of the Plone web development platform has been announced.
"
I'm proud to announce Plone 3.2a1, the first step towards an
all egg-based Plone release."
Full Story (comments: none)
Desktop Applications
Audio Applications
The latest
news from the
Ardour multi-track audio editor project includes a new move
tracks up/down capability.
"
Ardour has had only one way to change the order of tracks in the editor window since it began - dragging the track names around in the list of tracks attached to one side of the window. In SVN for 2.X, I've just added the new move-selected-tracks-up and move-selected-tracks-down commands, which are bound to Shift-Up and Shift-Down by default. So now you can just select one or more tracks and press a key (or two) to move them up and down."
Comments (none posted)
Version 0.5.2 of mp3splt, an mp3/ogg file splitter and its associated
libraries, have been
announced:
"
fixed bug crashing the applications on the silence split when no 'get_silence_level' function defined".
Comments (none posted)
Business Applications
Version 1.0.2 of Chandler Desktop has been announced.
"
The Chandler Project is an open source, standards-based information
manager designed for personal use and small group collaboration.
Chandler Desktop 1.0.2 is a bug fix update to the previous release,
1.0.1."
Full Story (comments: none)
Version 2.40 of Openbravo ERP has been
announced. The description states:
"
Web based ERP for SMEs, built on proven MVC & MDD framework that facilitate customization & maintenance of code. Already in production, it encompasses a broad range of functionalities such as finance, supply chain, project mgmt, manufacturing & much more
Openbravo ERP 2.40 is ready for general usage, including evaluation and production. We recommend existing production deployments to upgrade to this release."
Comments (none posted)
CAD
Version 1.4 of Sweet Home 3D, an interior design CAD application, has been
announced.
"
The new features of version 1.4 include bug corrections, texture images import, export to OBJ format, Swedish localization and other enhancements".
Comments (none posted)
Data Visualization
Version 9.4 of the DISLIN Data Plotting Library has been announced.
"
DISLIN is a high-level and easy to use plotting library for
displaying data as curves, bar graphs, pie charts, 3D-colour plots,
surfaces, contours and maps. Several output formats are supported
such as X11, VGA, PostScript, PDF, CGM, WMF, HPGL, TIFF, GIF, PNG,
BMP and SVG.
The software is available for the most C, Fortran 77 and Fortran 90/95
compilers. Plotting extensions for the interpreting languages Perl,
Python and Java are also supported."
Full Story (comments: none)
Desktop Environments
The following new GNOME software has been announced this week:
You can find more new GNOME software releases at
gnomefiles.org.
Comments (none posted)
The following new KDE software has been announced this week:
You can find more new KDE software releases at
kde-apps.org.
Comments (none posted)
The following new Xorg software has been announced this week:
More information can be found on the
X.Org Foundation wiki.
Comments (none posted)
Desktop Publishing
The
GNU PDF Blog
for October 6, 2008 has been published.
Topics include:
Fixes in the Stream Module, Super Powered pdf-filter, Crypt Unit Tests Passing(now), nocheck and fork-mode and more.
Comments (none posted)
Electronics
The Comprehensive
GNU Radio Archive Network site (CGRAN) has been launched.
"
The Comprehensive GNU Radio Archive Network (CGRAN) is a free open
source repository for 3rd party GNU Radio applications that are not
officially supported by the GNU Radio project. CGRAN provides a
subversion repository for users to develop or submit new applications,
and wiki access for full project documentation. Trac (our web interface)
provides unique features such as a browser for the subversion repository
and a ticket system for users to file issues with projects in CGRAN."
GNU Radio is a software controlled multi-purpose radio platform.
Full Story (comments: none)
Encryption Software
Version 0.19.1 of M2Crypto has been announced.
"
The 0.19.1 release fixes the build when OpenSSL has been configured
without EC support, thanks to Miloslav Trmac.
M2Crypto is the most complete Python wrapper for OpenSSL.."
Full Story (comments: none)
Games
Version 2.0 of Humerus has been announced.
"
This version of Humerus has been extensively revised from the previous one.
Instead of a pile of code to be cut and pasted, it is now a proper library
made up of reusable classes, with detailed documentation and some example code included.
What is Humerus?
Humerus is a companion to the Albow widget library for PyGame. It provides a
framework for games made up of a sequence of levels, including user interface
and back-end logic for loading levels, saving and restoring game state and
sundry other details."
Full Story (comments: none)
Geographical Software
Linux Journal
takes a look at the uDig GIS application as part of its series on geographic information systems (GIS). The article shows how to find and load GIS data, then display it in various ways in this free software application.
"
To those who are new to GIS I generally tell them it involves "mapping with a computer". While this description is a bit oversimplistic, it captures the broad purpose of GIS. A more accurate description is, as the folks at Quantum GIS say, that a GIS is a collection of software that allows you to create, query and analyze geospatial data. I would further add that one can integrate any kind of geographic information and then find relationships among that information, and display it how you wish."
Comments (8 posted)
Interoperability
Version 1.1.6 of Wine has been
announced. Changes include:
"
Beginnings of schannel implementation using GnuTLS.
Many fixes from various code analysis tools.
Support for X11 desktop work area.
Fixes for Richedit tables.
More complete JavaScript support.
Various bug fixes."
Comments (none posted)
Mail Clients
Version 3.6.1 of
Claws Mail
has been announced.
"
New in this release: Added /View/Fullscreen option.
Re-ordering of the filtering/processing condition and actions lists
is now possible using drag'n'drop.
Updated Brazilian Portuguese and French translations."
Full Story (comments: none)
Medical Applications
LinuxMedNews
introduces the
medical application,
MedinTux. The MedinTux
interface is written in French and the project is looking for translators.
"
MedinTux is a powerful medical software, multiuser (using MySQL for
data storage), easy-to-use (thanks to Qt development toolkit), complete,
working from the GP to the hospital. Its unique design makes it the most
customisable software you can dream of."
Comments (1 posted)
Multimedia
Version 0.5.14 of Elisa Media Center has been announced.
"
The Elisa team is happy to announce the release of Elisa Media Center
0.5.14, code-named "El Bosc Vertical".
The focus during this release cycle has been put on Windows
functionalities and bug fixing (a good dozen closed)."
Full Story (comments: none)
Music Applications
Version 0.2.1 of Virtual MIDI Piano Keyboard has been announced.
"
This is a maintenance release, fixing a crash in Windows when playing certain
MIDI files and connecting a player output to VMPK input. The reset all button
now also resets the internal controllers states. The number of keys is now
constrained to reasonable limits within the MIDI notes range. The "grab
keyboard" feature is now an optional runtime setting, as a workaround for
some broken X11 window managers and desktops."
Full Story (comments: none)
Office Applications
Version 0.71.1 of Task Coach has been
announced.
"
Task Coach - Your friendly task manager. Task Coach is a simple open source todo manager to manage personal tasks and todo lists. Often, tasks and other things todo consist of several activities. Task Coach is designed to deal with composite tasks.
This release fixes a major bug in 0.71.0 (could not open older task files with e-mail attachments)."
Full Story (comments: none)
Office Suites
OpenOffice.org 3.0 has been released. "
Right from the opening screen,
OpenOffice.org 3 has a fresh new look, with a new start screen, new
splash screen, new icons, and a host of usability improvements."
Click below for the announcement which contains an overview of the new
features in this release.
Full Story (comments: 26)
Michael Meeks has taken
a
detailed look at contributions to OpenOffice.org and come away
worried. "
Crude as they are - the statistics show a picture of slow
disengagement by Sun, combined with a spectacular lack of growth in the
developer community. In a healthy project we would expect to see a large
number of volunteer developers involved, in addition - we would expect to
see a large number of peer companies contributing to the common code pool;
we do not see this in OpenOffice.org. Indeed, quite the opposite we appear
to have the lowest number of active developers on OO.o since records began:
24, this contrasts negatively with Linux's recent low of 160+. Even spun in
the most positive way, OO.o is at best stagnating from a development
perspective."
Comments (36 posted)
Science
Version 0.1.0 of mpmath, a pure-Python library for arbitrary-precision
floating-point arithmetic, has been announced.
"
Additions in 0.10 include plotting support, matrices and linear
algebra functions, new root-finding and quadrature algorithms,
enhanced interval arithmetic, and some new special functions. Many
speed improvements have been committed (a few functions are an order
of magnitude faster than in 0.9), and as usual various bugs have been
fixed. Importantly, this release fixes mpmath to work with Python 2.6."
Full Story (comments: none)
Video Applications
Version 0.8.4 beta 3 of
Gnash,
a free Flash player, has been announced.
From the
release notes:
"
Keep Adobe happy with our users and our users happy with us by
changing "Flash player" into "SWF player" everywhere. Adobe
claims "Flash" as a trademark and had asked a Linux distributor
to fix it.
The popular SWF Twitter badge now renders correctly.
Fix parsing of urls containing multiple question marks
Fix support for movies embedding multiple sound streams
Support for loading PNG and GIF images added.
Improved rendering of SWF movies because of the less visible
changes listed below.
Support for writing RGB/RGBA PNG images and JPEG images.
Works with Potlatch OpenStreetMap editor
New 'flvdumper' utility for analyzing FLV video files.
XPI packaging support for Mozilla & Firefox."
Full Story (comments: 1)
Web Browsers
The first beta of Firefox 3.1 is available for testing. "
This
milestone is focused on testing the core functionality provided by many new
features and changes to the platform scheduled for Firefox 3.1."
Full Story (comments: none)
Linux Magazine
reports that the Geode geolocation feature of Firefox 3.1 will not be available to Linux users. While privacy advocates may be perfectly happy with that outcome, there may be others who would find the feature useful. It certainly seems to run counter to the whole idea of a free and open browser. "
Mozilla Labs presents the following scenario: When you open the Firefox browser, it knows where you are and immediately opens websites for nearby restaurants, stores and other attractions. Mozilla developers have already integrated this feature, as the Geode plug-in, in the current beta version of Firefox 3.1. It is based on proprietary software from a company called Skyhook."
Comments (11 posted)
Languages and Tools
C++
Version 17.10 of dlib has been
announced.
"
The dlib C++ library is a modern general purpose C++ toolkit with a focus on portability and program correctness. It comes with extensive documentation and thorough debugging modes. The library provides a platform abstraction layer for common tasks such as interfacing with network services, handling threads, and creating graphical user interfaces. Additionally, the library implements many useful algorithms such as data compression routines, linked lists, binary search trees, linear algebra and matrix utilities, machine learning algorithms, XML and general text parsing, and many other general utilities.
This release was focused on fixing bugs and improving usability."
Comments (none posted)
Caml
The October 7-14, 2008 edition of the Caml Weekly News
is out with new articles about the Caml language.
Full Story (comments: none)
Java
Version 1.3 of IcedTea6 has been announced, it includes new features,
bug fixes and security fixes.
"
The IcedTea6 project provides a harness to build the source code from
OpenJDK6 using Free Software build tools and
provides replacements libraries for the binary plugs with code from the
GNU Classpath project."
Full Story (comments: none)
Version 2.1 of Whiteoak has been
announced.
"
The Whiteoak programming language is a backward compatible extension of Java 6, that supports: structural subtyping (AKA: structural conformance), virtual fields and constructors, mixin-like/trait-like composition of objects and more.
Whiteoak 2.1 has been officially released. This release includes both a command-line compiler as well as an Eclipse plugin."
Comments (none posted)
Python
Version 0.4.0 of
Mock
has been announced.
"
Mock 0.4.0 has just been released, the first release in about ten
months (but worth the wait).
Mock is a simple library for testing: specifically for mocking,
stubbing and patching."
Full Story (comments: none)
The initial release of the Python posix_ipc package has been announced.
"
The package posix_ipc provides a Python interface to POSIX shared
memory and named semaphores on platforms that support them (i.e. most
Unices)."
Full Story (comments: none)
Version 1.2 of python-aspects has been announced, one new function has
been added.
"
aspects.py is a lightweight and low-level library for intercepting
function calls. Functions and methods (also in Python standard library
and third party code) can be wrapped so that when they are called, the
wrap is invoked first. Depending on the wrap, the execution of the
original function can be omitted, or the function can be called
arbitrarily many times. Wraps are able to modify the call arguments
and the return values of wrapped functions and handle
exceptions. There can be many wraps on the same function. The wraps
can be enabled, disabled and removed in any order."
Full Story (comments: none)
The October 14, 2008 edition of the Python-URL! is online with
a new collection of Python article links.
Full Story (comments: none)
Tcl/Tk
The October 15, 2008 edition of the Tcl-URL! is online with new
Tcl/Tk articles and resources.
Full Story (comments: none)
IDEs
Version 3.5.1 of ZK has been
announced.
"
ZK is Ajax framework. 100% Java, no JavaScript. With event-driven, 170+ components, and markup languages, development as simple as programming desktops and authoring HTML/XUL pages. ZK supports JSF, JSP, J2EE, and scripting in Java, Ruby, Groovy...
Over 6 new features and 28 bugs fixed. New Tree style, Session fixation protection suppor[]ted."
Comments (none posted)
Libraries
Version 1.0.1 beta 165 of Pantheios, an Open Source C/C++ Logging API library, has been
announced.
"
Release 1.0.1 beta 165 incorporates:
Substantial reworking of contract API, reflected throughout the headers, implementation, example and test files".
Comments (none posted)
Miscellaneous
Version 4.7 of BOUML has been
announced, it includes various improvements.
"
BOUML is a free UML 2 tool box allowing you to specify and generate code in C++, Java, Idl, Php and Python. BOUML runs under Unix/Linux/Solaris, MacOS X and Windows. It is very fast and doesn't require much memory to manage several thousands of classes."
Comments (none posted)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
The Register
reflects on the history of Linux.
"
Linux is what Windows had once promised to be - at least in terms of cross-platform support. In the wake of the PowerPC alliance from IBM, Apple, and Motorola in 1991, Microsoft made a commitment to support Windows NT 3.51 on PowerPC chips. Windows eventually added support for Digital's Alpha NEC's and SGI's MIPS chips. Workstation maker Intergraph ported Windows NT 3.51 to its Clipper chips and said it was creating a port to Sparc chips from Sun. Neither ports saw the light of day."
Comments (7 posted)
Samba hacker Jeremy Allison
reflects on free formats and free software over at ZDNet. He looks at the evolution of storage during his life and looks down the road to see freedom playing a large role. "
In short, encoding my CD's in a free format gave me the freedom to do what I wanted with the music I had already bought. In the same way, using Free Software gives device manufacturers the freedom to create the devices they think will be the most popular, without any restrictions on what those devices should do or how they should look. There's no proprietary operating system owner who insists on their consumer 'experience' being done a certain way. No commandments insisting that certain software components must be included in the device, which is to propagate control of proprietary media formats and web browsers, not to give device designers the flexibility they need."
Comments (1 posted)
Trade Shows and Conferences
SearchEnterpriseLinux.com
previews presentations by Ted Ts'o and Chris Mason at the Linux Foundation End User Collaboration Summit that starts on October 13. "
But changing the file system to fix the scalability and functional limitations of ext3, the default file system in many popular Linux distributions, requires a significant education outreach. Because the consequences of data loss are so severe, data center managers are reluctant to trust their data to new file systems, Ts'o said. New-system information needs to be shared well ahead of time, including a roadmap of coming features so IT professionals know what to expect, he said. That's where the Linux Foundation's event hopes to make inroads."
Comments (57 posted)
Companies
Over at CNET, Matt Asay
sees opportunities for Linux in the recent news that IBM claimed 35% of the Unix server market for second quarter of 2008. "
For those wondering how big Red Hat and Novell can become on operating-system revenue alone, keep that $61 billion number in mind. Most of that $61 billion is hardware-related, but it meant approximately $650 million in Linux server sales for Red Hat and Novell over the past year. As Linux eats into Unix, Red Hat and Novell can expect to grow linearly with it."
Comments (none posted)
Linux Adoption
There appear to be some opposing trends involving Linux on Netbooks.
PC World's article
Netbooks Will Boost Adoption of Linux, Says Novell CTO notes:
"
A surge in demand for netbooks is helping drive business for Linux, as the devices are designed to be low-cost with smaller storage, according to Novell's chief technology and strategy officer for Linux.
" People typically don't care what operating system is on the netbooks, because they don't buy them to run a suite of applications like Microsoft Office, but to be on the Web using a Web browser," Nat Friedman said in an interview with IDG News Service."
Laptop Mag's article
Ubuntu Confirms Linux Netbook Returns Higher than Anticipated quotes Canonical's marketing manager
Gerry Carr:
"We dont know what the XP return rates are. But I will say that the return rate is above normal for netbooks that offer open-source operating systems, Carr echoed. Carr highlighted a few reasons why Ubuntu-running netbooks are returned more often. Unclear selling is happening, typically online. The customer will get their netbook sent to their home and they imagine to find something like a Microsoft desktop, but they see a brown Ubuntu version. They are unwilling to learn it and they were expecting to have Windows."
Comments (6 posted)
IT Management's Matt Hartley
considers the effects of the recent economic woes on Linux adoption.
"
Considering the state of the US finances, I would point out that spending money on a computer pre-loaded with an OS that can be, even to this date with Vista, hit with malware with little to stop it seems rather foolish to me.
Now consider industries where the bulk needs of a workstation can adequately be upheld with most common Linux distributions. Unfortunately the joy might stop there if that company is already using an in-house IT staff.
Why? Because so many of them here in the States are Windows only, thus making a switch to a new platform a move to fire and rehire your IT staff."
Comments (none posted)
Linux at Work
BR-Linux.org has
pictures and
video of Brazilian Linux-powered voting machines. "
Just 10 days
ago, 130 million brazilian voters were turned into users of one of the
largest Linux deployment worldwide: the 400,000 electoral sections in all
of the 5,563 brazilian municipalities were running electronic voting
machines, and the Linux kernel was running in all of them." (Thanks
to Augusto Campos)
Comments (66 posted)
Legal
The sub-title for
this
article is
Proprietary data formats may be legally defensible but
open standards can be a better spur for innovation. "
Dan
Cohen, director of GMU's Center for History and New Media, and Sean Takats,
a GMU history professor, are also directors of Zotero: open-source software
developed by the history centre that lets researchers organize and share
their digital information iTunes style, whether it is in the form of
citations, documents or web pages. Zotero is free and popular, and has
attracted some 1 million downloads since its launch in October 2006.
Thomson makes the proprietary bibliography software EndNote, and claims
that Zotero is causing its commercial business "irreparable harm" and is
wilfully and intentionally destroying Thomson's customer base. "
(Thanks to jerbol)
Comments (8 posted)
Interviews
DesktopLinux.com features an
interview with Miguel de Icaza.
"
GNOME project co-founder Miguel de Icaza discusses the release of Mono 2.0, in this detailed interview with Henry Kingman, executive editor of DesktopLinux. The conversation spans Mono's history, current state, and future, with stops along the way for updates on Moonlight and Mono Develop."
Comments (34 posted)
Resources
HowtoForge presents
a tutorial on running the Chromium browser
under Ubuntu 8.04.
"
Chromium is an open-source browser project that is the basis for Google's Chrome browser. Right now, Chromium doesn't support Linux natively, but Codeweavers has created a Linux port called CrossOver Chromium that can be installed free of charge. This guide shows how to install CrossOver Chromium on Ubuntu 8.04."
Comments (2 posted)
Reviews
LinuxMedNews
looks
at multi-head, the killer application in health care.
"
Multi-head, multi-user systems running off a single PC. This is
where multiple displays, keyboards and mice can be attached to a single PC
with multiple users all working simultaneously from one system unit. This
can dramatically lower the cost of an individual workstations as well as
the cost to support individual workstations. This setup is becoming more
and more viable as hardware power increases."
Comments (7 posted)
Miscellaneous
James Gray
is
looking for creative ways to recycle waste server heat. "
The
botanical garden that is heated by Notre Dame's servers specializes in
desert plants and is located in Indiana, well know for its brutal
winters. The concept is simple. The waste server heat is pumped into the
interior space of the garden to keep the desert-loving plants toasty warm
all year long. This simple, creative step is saving the university $100,000
on cooling costs and the owner of the botanical garden, the City of South
Bend, Indiana, another $70,000 on heating costs. Not only that, but the
atmosphere is spared many thousands of tons of pollution from carbon
emissions. That is quite a triple win-win-win arrangement."
Comments (21 posted)
Silicon.com presents a collection of
Top Agenda Setters for 2008.
"
Silicon.com chooses the top 50 most influential individuals in the worldwide technology and IT industries business leaders, CEOs, CIOs, techies, open source gurus, security experts, visionaries, entrepreneurs and politicos".
Comments (none posted)
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
Electronic Frontier Foundation has announced a new bogus patent
challenge.
"
The Electronic Frontier Foundation (EFF) is
challenging a bogus patent on Internet music files that
could stifle new innovations in online music distribution.
Seer Systems was awarded this illegitimate patent for a
system and method for joining different musical data types
together in a file, distributing them over the Internet,
and then playing that file. But in a reexamination request
filed with the United States Patent and Trademark Office
(USPTO) today, EFF and the law firm Day Casebeer Madrid &
Batchelder show that descriptions of this technology were
published a number of times before Seer Systems made its
claim--including one in a book written by Seer's own
founder and the named inventor of the patent, Stanley
Jungleib."
Full Story (comments: none)
The Linux Foundation has
announced
that its Free and Open Source Software (FOSS) governance workgroup, called
FOSSBazaar, has nearly doubled its membership since launching in January.
"
During its inaugural year, FOSSBazaar has both established an online
destination where collaboration on these topics takes place
(https://fossbazaar.org)
and appointed full-time workgroup community leader
Martin Michlmayr. Michlmayr is a well-known figure that currently serves on
the Board of Directors for the Open Source Initiative (OSI). He has been
involved in FOSS projects for more than 10 years, including having led the
Debian project for two years. FOSSBazaar has also participated in
collaborative forums this year such as the Annual Linux Foundation
Collaboration Summit and OSCON."
Comments (none posted)
Commercial announcements
Apache Software Foundation has
announced
the release of Apache Tuscany 1.3.2.
"
Apache Tuscany, a
new Top-Level Project of the Apache Software Foundation (ASF), today
announced the release of version 1.3.2 of its Service Component
Architecture (SCA) for Java -- the Project's latest release since its
graduation from the ASF Incubator four months ago.
Apache Tuscany provides a robust, highly extensible infrastructure for
building, deploying, running and managing Service Oriented Architecture
(SOA) solutions, streamlining the development process of service-based
application networks and addressing real business problems posed in SOA."
Comments (none posted)
AtMail has
announced
the release of AtMail 5.5.
"
AtMail, a leading provider of easy-to-use, Linux-based email management
appliances and software, today announced the latest release to its
commercial Webmail platform, AtMail 5.5. The new AtMail 5.5 version
includes support for Canonical's Ubuntu Server Edition Linux-based
operating system."
Comments (none posted)
Atmel Corporation has
announced the release of the
uIPv6 protocol stack.
"
Atmel(R) Corporation, Cisco and the Swedish Institute of Computer
Science (SICS) today announced the availability of uIPv6, one of the
world's smallest open-source, IPv6-ready protocol stack, which could enable
every device, no matter how limited by power or memory to have an Internet
Protocol address."
Comments (none posted)
GarageGames has
announced an expansion drive.
"
GarageGames, creators of InstantAction.com, the website for gamers that combines the intensity of videogames with the accessibility of the web, have announced that they are looking to fund new startup studios working on original IP for InstantAction and other platforms.
"We're seeing a lot of larger studios cutting back on costs and thus forced to let go of great talent," said Josh Williams, CEO of GarageGames. "There's always opportunity for good developers to start anew and we're looking to give these guys a shot to get back to their roots on a small team making games for a cutting edge platform.""
Comments (none posted)
ITTIA has
announced
the availability of ITTIA DB Compact edition.
"
ITTIA, a leading provider of embedded database software and services, today introduced Compact edition as a new member of its ITTIA DB product family. Compact is a rock-solid transactional database engine that allows embedded developers to select the exact database features to match the requirements of a particular device. Compact is an ideal database candidate for application development projects related to digital media such as portable multimedia players (PMP), digital audio players (DAP), and automotive computer systems."
Comments (none posted)
rPath has announced a new Cloud Computing Adoption Model.
"
rPath today announced its Cloud Computing Adoption Model, which
defines a pragmatic, five-step approach for the graduated adoption of cloud computing. The Cloud
Computing Adoption Model will be rolled out on October 23, as part of an rPath webinar featuring
guests Amazon Web Services, Forrester Research and MomentumSI."
Full Story (comments: none)
SSH Communications Security has announced SSH Tectia Server for Linux
on IBM System z.
"
This new
version of SSH Tectia provides a unified, end-to-end security model that
extends from distributed platforms, to mainframes running the Linux
operating system on the IBM System z platform, and also to virtualized
environments."
Full Story (comments: none)
OpenLogic has announced an expansion of its professional service
offerings.
"
OpenLogic, Inc., a provider of enterprise open source software
solutions encompassing hundreds of open source packages, today announced several new professional
services packages, ranging from one day to one week engagements, that help companies quickly and
cost-effectively identify, fine-tune and implement enterprise-ready open source products."
Full Story (comments: none)
SourceForge.net has announced the launch of
Hosted Apps.
"
SourceForge, Inc.,the leader in
community-driven content and media, has announced the launch of Hosted Apps, a new service for
developers that provides instant, virtualized access to popular open source applications.
SourceForge will centrally manage the infrastructure and security of Hosted Apps, allowing
developers to innovate freely without being distracted by the maintenance of their project's
infrastructure."
Full Story (comments: none)
Timesys has
announced new ARM processor ReadyKits.
"
Timesys Corporation®, a premier provider of embedded Linux software solutions, today announced general availability of embedded Linux ReadyKits for several popular ARM-based processors.
Assembled by Timesys award winning Online Linux Factory, ReadyKits enable embedded developers to have a robust Linux platform up and running on their select processor within a few hours ready to benchmark platform performance or prototype applications. Each ReadyKit comes complete with a pre-built, integrated and tested embedded Linux platform, including all sources."
Comments (none posted)
New Books
O'Reilly has published the book
Maven: The Definitive Guide
by Tim O'Brien.
Full Story (comments: none)
Packt Publishing has published the book
CUPS Administrative Guide
by Ankur Shah.
Full Story (comments: none)
Resources
The Linux Foundation has
announced
the release of version 4.0 beta of the Linux Standards Base (LSB).
"
This new version of LSB promises to accomplish these goals in a more
powerful way. "We have a new set of LSB tools to make it much easier for
ISVs to development applications that are LSB compliant, and to test to see
how portable their applications are via the Linux Application Checker," Ted
T'so, Chief Platform Strategist and Fellow with the Linux Foundation,
explained."
Comments (10 posted)
Contests and Awards
The U.S. Agency for International Development has
announced the 2008 USAID Development 2.0
Challenge.
"
The Development 2.0 Challenge signals that USAID is
responding to a shifting business and technology culture that goes by many
names, including Web 2.0, inventive economics, wikinomics, or
crowdsourcing. Just as online communities have changed the way business is
done, USAID's open call for technology solutions seeks to improve the way
international development is done."
Grants of up to $10K will be awarded and submissions will be accepted
from October 13 - December 5, 2008.
Comments (none posted)
Meeting Minutes
The
September 24, 2008,
September 17, 2008 and
September 10, 2008 Perl 6 Design Meeting Minutes have been posted.
Comments (none posted)
Calls for Presentations
The paper submission deadline for CISSE 2008, the Fourth International
Joint Conferences on Computer, Information, and Systems Sciences, and
Engineering, has been extended to October 28, 2008.
The conference will be held online on December 5-13, 2008.
"
Due to numerous deadline extension requests from potential CISSE 2008
authors, the CISSE organizing committee has decided to extend the paper
submission deadline to 10/28/2008.
Please note that this is a hard deadline, so that the technical committees
can perform their paper reviewing duties in a timely manner."
Full Story (comments: 3)
A call for papers has gone out for FOSS.IN/2008.
"
Time is short, so please read through carefully and get ready with your
proposals. The registration system will open from October 10, 2008.
FOSS.IN is a contributor event, focusing on development efforts in FOSS
from India." The event takes place on
November 25-29, 2008 in Bangalore, India,
abstracts are due by October 18.
Full Story (comments: none)
LinuxChix has announced that they'll be hosting the LinuxChix mini-conf at
Linux.conf.au in January, 2009 in Hobart, Tasmania. This mini-conf exists
to encourage women with an interest in free and open source technology to
share their ideas, network and improve their presentation skills.
Abstracts for talk proposals should be submitted by October 20, 2008 12:00
GMT.
Full Story (comments: none)
A call for participation has gone out for the O'Reilly RailsConf 2009.
The event takes place in Las Vegas, NV on May 4-7, 2009, submissions are
due by February 17.
Full Story (comments: none)
A call for participation has gone out for the O'Reilly Where 2.0 2009
Conference.
"
The earth isn't flat, and maps don't live
in the glove compartment anymore. The O'Reilly Where 2.0 Conference will
pinpoint how far location technology has reached, explore the boundaries
of geospace, and point the way into the location frontier at the Fairmont
Hotel in San Jose, CA, May 19-21, 2009. O'Reilly Media and program chair
Brady Forrest invite proposals for conference sessions, workshops, demos,
and panels for Where 2.0 2009." Submissions are due by December 2.
Full Story (comments: none)
Upcoming Events
The
MySQL European Customer Conferences 2008 will take place in
London on Thursday, October 23,
Munich on Tuesday, October 21 and
Paris on Wednesday, November 19.
Comments (none posted)
European PGDay 2008
will be held on October 17-18, 2008.
"
The conference will once again be held in the beautiful historic surroundings of the
Monash University Prato Centre in Prato, a small walled town near Florence, Tuscany."
Comments (none posted)
Web 2.0 Expo Europe has been announced.
"
The second annual Web 2.0 Expo Europe
will define the current state of Web 2.0 and, more importantly, outline
its future. The three-day conference, co-produced by O'Reilly Media, Inc.
and TechWeb, will attract the largest pan-European community of
international technical, design, marketing, and business professionals,
entrepreneurs, start-ups, and VCs building, leveraging, and driving the
European Web economy. Each will bring a unique and insightful perspective
to the dynamic state of innovation happening on the Web. Scheduled for
October 21-23, 2008, Web 2.0 Expo Europe will be held at a new venue, the
Berliner Congress Center in Berlin, Germany."
Full Story (comments: none)
Events: October 23, 2008 to December 22, 2008
The following event listing is taken from the
LWN.net Calendar.
| Date(s) | Event | Location |
October 19 October 24 |
Colorado Software Summit 2008 |
Keystone, CO, USA |
October 20 October 24 |
15th Annual Tcl/Tk Conference |
Manassas, VA, USA |
October 21 October 23 |
Web 2.0 Expo Europe |
Berlin, Germany |
October 21 October 24 |
Systems |
Munich, Germany |
October 22 October 24 |
Hack.lu 2008 |
Parc Hotel Alvisse, Luxembourg |
October 22 October 24 |
Encuentro Linux |
Concepción, Chile |
October 24 October 26 |
Free Society Conference and Nordic Summit |
Gothenburg, Sweden |
October 25 October 26 |
T-DOSE 2008 |
Eindhoven, the Netherlands |
| October 25 |
Ontario Linux Fest 2008 |
Toronto, Canada |
October 26 October 31 |
IBM Information On Demand 2008 |
Mandalay Bay - Las Vegas, Nevada, USA |
October 27 October 30 |
Embedded Systems Conference - Boston |
Boston, USA |
October 29 November 1 |
10th Real-Time Linux Workshop |
Colotlán, Jalisco, Mexico |
November 3 November 7 |
ApacheCon US 2008 |
New Orleans, LA, USA |
November 5 November 7 |
OpenOffice.org Conference 2008 |
Beijing, China |
| November 6 |
NLUUG autumn conference: Mobile Applications |
Ede, Netherlands |
November 6 November 7 |
Embedded Linux Conference Europe 2008 |
Ede, Netherlands |
November 7 November 8 |
TwinCity Perl Workshop 2008 |
Vienna, Austria |
November 7 November 9 |
UKUUG linux conference |
Manchester, UK |
November 8 November 9 |
Hackers to Hackers Conference 05' |
Sao Paulo, Brazil |
November 8 November 9 |
FOSS.my |
Kuala Lumpur, Malaysia |
November 10 November 14 |
Python Bootcamp with Dave Beazley |
Atlanta, GA, USA |
November 11 November 14 |
DeepSec IDSC 2008 |
Vienna, Austria |
November 12 November 14 |
php|works 2008 |
Atlanta, GA, USA |
November 12 November 13 |
PacSec Applied Security Conference |
Tokyo, Japan |
November 13 November 14 |
International Hacking and Security Conference |
Seoul, Korea |
November 14 November 16 |
OpenSQL Camp 2008 |
Charlottesville, VA, USA |
November 16 November 20 |
Middle East IT Security Conference |
Dubai, UAE |
November 19 November 20 |
Linux Foundation Japan Symposium |
Tokyo, Japan |
November 20 November 21 |
FreedomHEC Taipei 2008 |
Taipei, Taiwan |
| November 22 |
The phpnw08 conference |
Manchester, UK |
| November 22 |
PGDay Rio de la Plata |
Buenos Aires, Argentina |
| November 22 |
Mandriva 2009 Installfest |
Everywhere, World |
November 25 November 29 |
FOSS.IN 2008 |
Bangalore, India |
November 25 November 30 |
make art 2008 |
Poitiers, France |
| November 28 |
Informazione geografica aperta e libera |
Pontedera (PI), Italy |
November 28 November 29 |
WhyFLOSS La Plata - Argentina |
La Plata, Argentina |
| November 29 |
LinuxDay in Vorarlberg (Deutschland, Schweiz, Liechtenstein und Österreich) |
Dornbirn, Austria |
| December 1 |
First Nuxeo Developer Day |
Paris, France |
December 1 December 2 |
Open World Forum |
Paris, France |
December 2 December 5 |
Open Source Developers' Conference 2008 |
Sydney, NSW, Australia |
December 4 December 7 |
PIKSEL08 - code dreams |
Bergen, Norway |
December 5 December 6 |
FOSSCamp |
Mountain View, CA, USA |
December 5 December 13 |
International Joint Conferences on Computer, Information, and Systems Sciences, and Engineering |
Online, |
December 7 December 12 |
Computer Measurement Group Conference 2008 |
Las Vegas, NV, USA |
December 8 December 12 |
Ubuntu Developer Summit |
Mountain View, CA, USA |
| December 8 |
Forum PHP Paris 2008 |
Paris, France |
December 10 December 11 |
First Workshop on I/O Virtualization |
San Diego, CA, USA |
| December 13 |
NLLGG meeting/BSD Community Day |
Utrecht, The Netherlands |
If your event does not appear here, please
tell us about it.
Web sites
KDE has launched the
KDE Forum, which is a MyBB-based forum for users to discuss KDE-related topics. In conjunction with the adoption by KDE, MyBB has released their software under the GPLv3. "
Sebastian Kügler, member of the KDE e.V. Board of Directors explains where
the new KDE Forum fits into KDE communication infrastructure: 'We've come to
believe that mailinglist don't cut it for all users. KDE becoming increasingly
widely used should also offer those that aren't familiar with the use of email
for such discussions a place. The new KDE forum complements KDE's new end-user
knowledge base Userbase that has been launched last month. At the same time,
we're really happy to see that after our request the MyBB team has decided to
release their forum software under the terms of the GPL.'" Click below for the full announcement.
Full Story (comments: none)
Audio and Video programs
O'Reilly will hold a webcast entitled:
When Times Gets Tough, the Tough Get Tuning by Dee-Ann LeBlanc on
October 21 at 10am PDT.
"
When you experience reduced performance, your first inclination may be to
groan and open your wallet. While new hardware often can offer the best
bang for your buck, it's also possible that you don't need to invest that
money just yet--or at least that you can improve the performance while you
look for a good deal. In this seminar, you'll learn how to break down
performance into four major areas, how to determine which area(s) are
causing your problems, and some tips on how to improve in each."
Full Story (comments: none)
Page editor: Forrest Cook