LWN.net Weekly Edition for October 23, 2008

OpenStreetMap contemplates licensing

Maps are cool; there's no end of applications which can make good use of mapping data. There is plenty of map data around, but it's almost exclusively proprietary in nature. That makes this data hard to use with free applications; it's also inherently annoying. We, as taxpayers, own those streets; why should we have to pay somebody else to know where the streets are?

Your editor likes to grumble about such things; meanwhile, the OpenStreetMap project (OSM) is busily doing something about it. OSM has put together a database and a set of tools making it easy for anybody to enter location data with the intent of producing a free mapping database with global coverage. It is an ambitious project, to say the least, but it's working:

OSM data is not limited to roads; just about any point or track of interest can be added to the database. If current trends continue, OSM could well grow into the most extensive geolocation database anywhere - free or proprietary. And those trends could well continue; one of the nice aspects of this kind of project is that no particular expertise is needed to contribute. All you need is a GPS receiver and some time; some OSM local groups have even acquired a set of receivers to lend out to interested volunteers. This is our planet, and we can all help to map it.

All this work raises an interesting question, though: under what license should this accumulated data be distributed? Currently, the OSM database is covered by the Creative Commons Attribution-ShareAlike 2.0 license. It is a copyleft-style license, requiring that derived products be made available under the same license. So, for example, if a GPS navigator manufacturer were to include an enhanced version of the OSM database in its products, it would have to release the enhanced version under the CC by-SA license.

The OSM project is not happy with this license, though, and is looking to make a change. The attribution requirement is ambiguous in this context; do users need to credit every OSM contributor? Does making a plot of OSM data with added data layered on top create a derived product? But the scariest question is a different one: can the CC by-SA license cover the OSM database at all?

Copyright law covers creative expression, not facts. The information in the OSM database is almost entirely factual in nature; one cannot copyright the location of a street corner. So what OSM is trying to protect is not the individual locations, but the database as a whole. Copyright law does allow for the protection of databases, but that law is far more complex than the law for pure creative works, and it varies far more between jurisdictions. Europe has a specific (though much-derided) database right, the US has far weaker database protections, and other parts of the planet lack this protection altogether. So it may well be that, if some evil corporation decides to appropriate the OSM database for its own nefarious, proprietary purposes, there will be nothing that the OSM project can do about it.

So the project is thinking of making a switch to the Open Database License (ODbL), which is still being developed. It, too, is a copyleft-style license, but it is crafted to make use of whatever database protection is available in a given jurisdiction. To that end, the ODbL is explicitly structured as a contract between the database owner and the user. In any jurisdiction where database rights are not recognized under copyright law, the contractual nature of the ODbL should provide a legal basis to go after license violators.

But the use of contract law muddies the water considerably; there are good reasons why free software licenses are carefully written to avoid that path. Contracts are only valid if they are explicitly and voluntarily entered into by all parties. If the OSM cannot show that a license violator agreed to abide by the license, it has no case under contract law. The project has a plan to address this problem:

Registration and clickthrough licensing are obnoxious, to say the least. But, in any case, the only people who will go through that process are those who obtain the database directly from OpenStreetMap. The ODbL allows redistribution, naturally, and it does not require that explicit agreement be obtained from recipients of the database. So it is hard to see an outcome where copies of the database lacking a "signed" contract do not proliferate. Additionally, reliance on contract law makes it very hard to get injunctive relief, weakening any enforcement efforts considerably.

The ODbL includes an anti-DRM measure; if a vendor locks down a copy of the database with some sort of DRM scheme, that vendor must also make an unrestricted copy available. This license tries to distinguish between "collective databases" (which are not derived works) and "derivative databases" (which are). Drawing layers on top of an OSM-based map is a collective work; tracing lines from such a map is a derivative work. It is, in general, a complex bit of work.

It is complex enough that a number of OSM contributors are wondering if it's all worth it. Jordan Hatcher is one of the authors of the ODbL, and he supports its use with OSM, but even he understands the concerns that some people have:

There is an active group with OSM which is opposed to this kind of licensing and would, in fact, rather just get down to the task of collecting and distributing the data. They express themselves in terms like this:

These contributors would rather that OSM release its data into the public domain - or something very close to that. Rather than put together a complicated license, they prefer to just publish their data for anybody to use as they see fit. There have been all of the usual discussions which resemble any "GPL vs. BSD" licensing flame war one has ever seen - except that the OSM folks appear to be a very polite crowd. It comes down to the usual question: will the OSM database become more complete and useful if those who extend it are forced to contribute back their changes?

The public domain contingent clearly does not believe that any improvements to the database obtained via licensing constraints will be worth the trouble. So it seems likely that there will be some sort of fork involving the creation of a smaller, purely public-domain OSM database. It may well be an in-house fork, with the public domain data being merged into the larger, more restrictively licensed database for distribution. Regardless of how that goes, this split raises issues of its own: how are the two databases to be kept distinct in the face of cooperative additions and edits?

Any relicensing of the database also brings up another interesting question: what to do about all of the existing data, which may or may not be copyrighted by those who contributed or edited it? The license change may well require a process of getting assent from all contributors and purging data obtained from those who do not agree. This proposed timeline shows how the project is thinking about working through this task. It is hard to imagine this process going entirely smoothly.

The OSM community clearly has a set of thorny issues to work out. Given that, it's not surprising that this process has already been dragged out over the better part of a year. How this issue is eventually resolved will certainly serve as an example - not necessarily a good example - for other projects working on free compilations of factual data. Let us hope that OSM can come to a solution which lets this project continue to grow and generate a valuable database that we all will benefit from.

Comments (46 posted)

Fedora and long term support

The news that Wikipedia was in the process of switching away from Red Hat and Fedora—and to Ubuntu—has stirred up some Fedora folks. The relatively short, 13 month support cycle for Fedora releases was fingered as a major part of the problem in a gigantic thread on the fedora-devel mailing list. Some would like to see Fedora be supported for longer, so that it could be used in production environments, but that is a fundamental misunderstanding of what Fedora has set out to do.

The idea of supporting Fedora beyond the standard "two releases plus one month", which should generally yield 13 months, is not new. It was, after all, the idea behind the Fedora Legacy project. Unfortunately, Fedora Legacy ceased operations at the end of 2006, largely due to a lack of interested package maintainers. So, calls for a "long term support" (LTS) version of Fedora are met with a fair amount of skepticism.

Just such a call went up in response to the Wikipedia news. Patrice Dumas outlined the need:

Fedora is not meant for production use, nor for those who cannot upgrade at least yearly. It has an entirely different mission, which Jon Stanley sums up:

Many believe that folks who want "Fedora LTS" would be better served by Red Hat Enterprise Linux (RHEL) or, for those that do not want to pay for a distribution with support, an RHEL derivative such as CentOS or Scientific Linux. But those don't have the package diversity available with Fedora. A stable release would also want to freeze major packages at a particular version—only backporting security fixes into that version—which is definitely not what is done with Fedora while it is being supported. Dumas wants to see something that finds a middle ground:

The Extra Packages for Enterprise Linux (EPEL) project is meant to help fill that gap, by maintaining additional packages—beyond what Red Hat maintains—for RHEL and compatible distributions. Typically, though, those packages will also be held at a version level that will, with time, grow rather obsolete, at least to those who want to more closely follow the upstream project. And, of course, there aren't as many packages available for the enterprise distributions, even with EPEL, as there are for Fedora.

It would seem the classic tension between "bleeding edge" and stable as described by Stanley. Though it isn't clear how it would solve that problem, there are calls for reviving Fedora Legacy. There are few opposed to the idea of continuing Fedora support—if enough people can be found to do it—but the implementation details seem to bog things down. There is a bit of a "chicken and egg" problem in that attracting package maintainers is hard to do without a project to point to, but convincing the Fedora Engineering Steering Committee (FESCo) that it is worthwhile without having those maintainers will be difficult.

One of the sticking points is the availability of infrastructure—servers and bandwidth primarily—for any nascent legacy project to use. The Fedora board is seen as being resistant to allowing the use of the Fedora infrastructure for such a project. In response to someone who pointed out that the board's approval is not required, Dumas disagrees:

There is also the question of what kind of guarantees a legacy project would make about how long it would support older releases. Dumas and others seem to be in favor of essentially no commitment, maintainers would continue supporting their packages for as long as they wished. While there is some attraction to that idea—it certainly reduces the number of maintainers required—it is unclear that it actually provides a useful service. The idea that some security fixes are better than none is attractive, but David Woodhouse cautions against that view:

As the original Fedora Legacy project wound down, it left just this kind of impression by promising support, but often not delivering it. For several years, updates for serious security problems were delivered late, if at all. Any new effort in that direction would have to be very clear about what it was delivering and how it planned to get the job done. A project that offered few, if any, guarantees would not be seen as something very useful, but making guarantees that don't get met is far worse.

While there are clearly Fedora users that would be interested in hanging on to their operating system for longer than one year, it isn't clear that there are enough of them—and, more importantly, enough maintainers—to make a legacy project successful. Agreement on the goal of the project, along with the promises it would make to adopters is important. It is difficult to see how the Fedora powers-that-be could allocate resources to such a project without those things. As Shmuel Siegel points out:

At least at this point, it doesn't seem like a revival of Fedora Legacy is in the cards, which leaves the problem unaddressed. Perhaps adding enough additional packages to EPEL will allow CentOS to truly become "Fedora LTS". It should be noted that while the original concern that LTS users might be switching to Ubuntu could well be true, Ubuntu LTS doesn't have a solution to the problem of package versions slowly getting obsolete either. Newer packages and stability are fundamentally at odds—trying to solve that problem is probably far too large of a job for any community distribution.

Comments (114 posted)

A tale of two conferences

Like many communities, the Linux community depends heavily on conferences as a way to help our developers and users know each other and work well together. We make highly effective use of electronic communications, but there is truly no substitute for occasionally getting together, sharing a beer or three, and engaging in some high-bandwidth discussion. So it stands to reason we want our events to be as productive and useful as possible, especially given the expense of participating in them.

Your editor recently had the fortune of attending, over the course of one week, two conferences which are arguably the oldest and the newest in our community. They were both interesting events, but they were very different in their organization and attendance. Both show both strengths and weaknesses in our organization of face-to-face events.

Arguably, the first Linux-related event ever was Linux-Kongress 1994. That gathering brought together developers working on the Linux kernel for the first time; it played host to a large portion of the (quite small) development community. For a period of time thereafter, Linux-Kongress was the development event for people working at or near the kernel level. It didn't take too long for other conferences (notably Linux Expo in the US) to grab some of the spotlight, but, unlike Linux Expo, Linux-Kongress is still an active conference.

The 2008 event, in Hamburg, Germany, was well organized and a lot of fun; it was a pleasant gathering of a part of the community which your editor visits far too rarely. It was a technical conference for technical people, with a number of well-known developers present. But it must be said: Linux-Kongress is a small and relatively obscure event in 2008. There were maybe 200 attendees; much of the northern European development community was absent. Even some developers based in Hamburg declined to attend. The quality of the talks was not uniformly good, though some were excellent. And, in stark contrast to the recent Linux Plumbers Conference, it's hard to point at much work that got done. For something that was once the Linux development gathering, Linux-Kongress has clearly come down in the world.

It is interesting to observe that Europe, while being the home to large numbers of free software developers, lacks a definitive development conference. That is not to say that no interesting events happen there; GUADEC and Akademy are probably the biggest desktop conferences, and the upcoming combined event is something to look forward to. But developers looking for a pan-European, Linux-oriented conference will not find one. LinuxConf.eu, a combination of the UKUUG and Linux-Kongress events held in Cambridge last year, offered the potential to become such an event, but the LinuxConf.eu idea appears to have stalled for now.

From Hamburg, your editor flew straight to New York City, where the Linux Foundation's End-User Summit was held. This event, happening for the first time, differs greatly from Linux-Kongress in many ways. To begin with, it was an invitation-only event, and one which explicitly excluded the press (which is why there have been no LWN articles from there). It was also intended to host a mixture of developers and users, and to allow them to talk to each other. These characteristics led to a different sort of conference experience.

[PULL QUOTE: We do not run an invitation-only community; excluding people from our conferences seems to run counter to the inclusive atmosphere we normally try to encourage. END QUOTE] The invitation-only nature of some Linux Foundation events naturally leads to complaints. We do not run an invitation-only community; excluding people from our conferences seems to run counter to the inclusive atmosphere we normally try to encourage. The Linux Foundation's reasoning here is easy to understand, though: many of the targeted end users (who represent mainly the financial industry in New York) have a hard time talking about what they are doing in any setting. In an open conference with press in attendance, those people will simply keep their mouths closed - if they show up at all.

The user community represented by the financial industry is important; they are a significant part of the business which keeps the enterprise distributions going. Even now, they are highly sought after as customers. It is important to know what they are thinking and what their biggest difficulties with Linux are. In the absence of an event like the End User Summit, this information will only be communicated directly to the enterprise distributors under a non-disclosure agreement. An invitation-only summit is fundamentally exclusive at one level, but it does help the development community (as opposed to one or two companies) get a sense for what this user community is thinking.

So what are they thinking? They feel some stress between the stability of enterprise distributions and the desire to have the features developed by the community in recent years. They want good tracing mechanisms, but do not necessarily need the dynamic tracing provided by tools like DTrace or SystemTap. They like Linux because its broad hardware support frees them from reliance on any specific hardware vendor. They are very interested in work on next-generation filesystems. Some of them, at least, very much want to better understand how our development process works and, possibly, participate in it. See the Linux Foundation's press release for a summary of what was discussed there.

It was a productive gathering, especially once the CEOs got off the stage and the attendees were able to talk to each other. But it points out another thing that we, as a community, lack: there are few forums where developers and users can get together and learn from each other. Developers tend to prefer the company of other developers; convincing them to go to more user-oriented events can be a challenge. So the closest thing we have to a combined user/developer event is the single-vendor conferences held by companies like Red Hat and Novell. Those, needless to say, are not the most community-oriented gatherings. They are not the best way to learn what our users are thinking.

The proposed LinuxCon event, to be co-located with the 2009 Linux Plumbers Conference, may help to fill in this gap somewhat.

Our community is blessed with a wealth of interesting gatherings worldwide. But that doesn't mean that we can't do better. Whether the subject is a true pan-European Linux gathering, user-oriented conferences, or something else altogether, there are always opportunities to find ways to help our community be more cohesive and productive. The trick is to expand communications to a broader community - as seen in our newest conference - while growing the open collaborative spirit exemplified by our oldest one.

Comments (14 posted)

Page editor: Jonathan Corbet

Security

HTTP response splitting

HTTP response splitting (HRS) is a technique that attackers can use to inject their own content into a web page. It exploits the way that HTTP delimits the boundary between its headers and the page content. It also is an example of that classic web application security bugaboo: improper filtering of user input.

The basic idea is that by injecting one or more carriage-return line-feed (CRLF) sequences into the output that a vulnerable web application returns, an attacker can control what goes to the victim's web browser. The HTTP response from a web server contains two parts: the headers that describe the content and the body which contains the HTML for the page. Each header is delimited by one CRLF and the header section is set off from the body by two CRLFs. It looks something like:

    Date: Fri, 17 Oct 2008 14:31:58 GMT
    Server: Apache                     
    Expires: -1                        
    Content-Length: 13355              
    Connection: close                  
    Content-Type: text/html; charset=iso-8859-1

    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
    ...

Where the first section is the headers, followed by the start of the HTML content.

The headers above are generated by the LWN web server directly, but sometimes headers can contain information that comes from a user's request, often in the form of cookies or redirections. If an attacker can sneak an extra CRLF or two into a header he controls, he can effectively create new header lines, or inject his own body content.

Typically this is done by using the URL-encoding values for CR and LF: %0d and %0a. If the web application is not careful to check for and filter those characters, the HTTP response can be split. If, for example, the value of the name variable is set into a cookie using code like:

    Response.Cookies["userName"].Value = request["name"];

then a name like "jake%0d%0a%0d%0a<html>surprise!</html>" could lead to some rather unexpected results. Obviously this is relatively benign, and only impacts someone who sets their name that way, but it does start to give an idea of the power of HRS. Incidentally, the code above is not random, it is adapted from that used to demonstrate a recent Mono HRS vulnerability.

If one can only inject headers into one's own session, it hardly merits mention, but there are ways for an attacker to inject into a victim's browser stream. Perhaps the simplest is just by passing a parameter in the URL in time-honored fashion: http://some.vulnerable.site/app?name="...". If the attacker can get the victim to follow that link, they can control headers and body of what gets returned by the server. Depending on the application, persistent versions, where a redirection URL, for example, was stored in a database, might be another way for an attacker to exploit HRS.

HRS is not new, Amit Klein first described it [PDF] in 2004, but it does keep cropping up. As described in Klein's paper, it can be used for cross-site scripting (XSS), web cache poisoning, web site hijacking, and other nefarious activities. More recently, Jeremiah Grossman found HRS vulnerabilities to be surprisingly widespread. He was also surprised at the variety and nastiness of the effects of HRS vulnerabilities.

HRS is not as well known as some of the other web application flaws, but it is a serious problem that needs to be considered when building or auditing such applications. Hopefully, we are starting to see some decline in the number of SQL injection, XSS, and other higher profile vulnerabilities, which may mean that attackers start looking towards the more obscure for exploitation. In what is likely to be a never-ending battle for control of our web applications, getting out ahead of the attacker community can only be a good thing.

Comments (1 posted)

New vulnerabilities

cups: denial of service

Package(s):	cups	CVE #(s):	CVE-2007-4045
Created:	October 16, 2008	Updated:	October 22, 2008
Description:	CUPS has a denial of service vulnerability. The vulnerability database entry states: The CUPS service, as used in SUSE Linux before 20070720 and other Linux distributions, allows remote attackers to cause a denial of service via unspecified vectors related to an incomplete fix for CVE-2007-0720 that introduced a different denial of service problem in SSL negotiation.
Alerts:	Fedora FEDORA-2008-8801 2008-10-16

Comments (none posted)

drupal: session hijacking vulnerability

Package(s):	drupal	CVE #(s):	CVE-2008-3661
Created:	October 16, 2008	Updated:	May 4, 2009
Description:	Drupal has a session hijacking vulnerability. From the Red Hat bug report: Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Alerts:	Fedora FEDORA-2008-9213 2008-10-30 Fedora FEDORA-2008-9170 2008-10-24 Fedora FEDORA-2008-8852 2008-10-16 Fedora FEDORA-2008-8905 2008-10-16

Comments (none posted)

jhead: buffer overflow

Package(s):	jhead	CVE #(s):	CVE-2008-4575
Created:	October 21, 2008	Updated:	March 5, 2009
Description:	From the CVE entry: Buffer overflow in the DoCommand function in jhead before 2.84 might allow context-dependent attackers to cause a denial of service (crash) via (1) a long -cmd argument and (2) possibly other unspecified vectors.
Alerts:	Fedora FEDORA-2009-1776 2009-02-17 Mandriva MDVSA-2009:041 2009-02-17 Gentoo 200901-02 2009-01-11 SuSE SUSE-SR:2009:001 2009-01-12 Fedora FEDORA-2008-8941 2008-10-20 Fedora FEDORA-2008-8928 2008-10-20

Comments (none posted)

kernel: memory corruption

Package(s):	linux-2.6.24	CVE #(s):	CVE-2008-3831
Created:	October 17, 2008	Updated:	June 25, 2009
Description:	Olaf Kirch discovered an issue with the i915 driver that may allow local users to cause memory corruption by use of an ioctl with insufficient privilege restrictions.
Alerts:	Fedora FEDORA-2009-6846 2009-06-23 Fedora FEDORA-2009-5383 2009-05-25 SuSE SUSE-SA:2009:003 2009-01-20 CentOS CESA-2008:1017 2008-12-17 Red Hat RHSA-2008:1017-01 2008-12-16 Ubuntu USN-679-1 2008-11-27 rPath rPSA-2008-0316-1 2008-11-12 Mandriva MDVSA-2008:224-1 2008-11-07 Mandriva MDVSA-2008:224 2008-11-04 Fedora FEDORA-2008-8929 2008-10-23 Fedora FEDORA-2008-8980 2008-10-23 Debian DSA-1655-1 2008-10-16 Red Hat RHSA-2009:0009-02 2009-01-22

Comments (none posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2008-3528
Created:	October 21, 2008	Updated:	June 25, 2009
Description:	From the CVE entry: The error-reporting functionality in (1) fs/ext2/dir.c, (2) fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux kernel 2.6.26.5 does not limit the number of printk console messages that report directory corruption, which allows physically proximate attackers to cause a denial of service (temporary system hang) by mounting a filesystem that has corrupted dir->i_size and dir->i_blocks values and performing (a) read or (b) write operations. NOTE: there are limited scenarios in which this crosses privilege boundaries.
Alerts:	Fedora FEDORA-2009-6846 2009-06-23 Fedora FEDORA-2009-5383 2009-05-25 CentOS CESA-2009:0326 2009-04-01 Red Hat RHSA-2009:0326-01 2009-04-01 Debian DSA-1687-1 2008-12-15 Debian DSA-1681-1 2008-12-04 SuSE SUSE-SA:2008:057 2008-12-04 SuSE SUSE-SA:2008:056 2008-12-03 CentOS CESA-2008:0972 2008-11-20 Red Hat RHSA-2008:0972-01 2008-11-19 SuSE SUSE-SR:2008:025 2008-11-14 rPath rPSA-2008-0316-1 2008-11-12 Mandriva MDVSA-2008:224-1 2008-11-07 Ubuntu USN-662-1 2008-11-05 Mandriva MDVSA-2008:224 2008-11-04 SuSE SUSE-SA:2008:053 2008-10-27 SuSE SUSE-SA:2008:052 2008-10-21 SuSE SUSE-SA:2008:051 2008-10-21 Red Hat RHSA-2009:0009-02 2009-01-22

Comments (none posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2008-4576
Created:	October 21, 2008	Updated:	January 22, 2009
Description:	From the CVE entry: sctp in Linux kernel before 2.6.25.18 allows remote attackers to cause a denial of service (OOPS) via an INIT-ACK that states the peer does not support AUTH, which causes the sctp_process_init function to clean up active transports and triggers the OOPS when the T1-Init timer expires.
Alerts:	CentOS CESA-2008:1017 2008-12-17 Red Hat RHSA-2008:1017-01 2008-12-16 Debian DSA-1687-1 2008-12-15 Debian DSA-1681-1 2008-12-04 Ubuntu USN-679-1 2008-11-27 SuSE SUSE-SR:2008:025 2008-11-14 SuSE SUSE-SA:2008:053 2008-10-27 Fedora FEDORA-2008-8929 2008-10-23 Fedora FEDORA-2008-8980 2008-10-23 SuSE SUSE-SA:2008:052 2008-10-21 Red Hat RHSA-2009:0009-02 2009-01-22

Comments (none posted)

libxml2: denial of service

Package(s):	libxml2	CVE #(s):	CVE-2008-4409
Created:	October 16, 2008	Updated:	December 2, 2008
Description:	libxml2 has a denial of service vulnerability. From the Mandriva alert: libxml2 version 2.7.0 and 2.7.1 did not properly handle predefined entities definitions in entities, which allowed context-dependent attackers to cause a denial of service (memory consumption and application crash) via certain XML documents (CVE-2008-4409).
Alerts:	Gentoo 200812-06 2008-12-02 Mandriva MDVSA-2008:212 2008-10-15

Comments (none posted)

mantis: insecure cookies

Package(s):	mantis	CVE #(s):	CVE-2008-3102
Created:	October 21, 2008	Updated:	December 2, 2008
Description:	From the CVE entry: Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Alerts:	Gentoo 200812-07 2008-12-02 Fedora FEDORA-2008-9015 2008-10-20 Fedora FEDORA-2008-8925 2008-10-20

Comments (none posted)

neon: denial of service

Package(s):	neon	CVE #(s):	CVE-2008-3746
Created:	October 16, 2008	Updated:	September 22, 2009
Description:	Neon has a denial of service vulnerability. From the Red Hat bug report: A NULL pointer deference in the Digest authentication support in neon versions 0.28.0 through 0.28.2 inclusive allows a malicious server to crash a client application, resulting in possible denial of service.
Alerts:	Ubuntu USN-835-1 2009-09-21 Mandriva MDVSA-2009:074 2009-03-10 Fedora FEDORA-2008-7661 2008-10-16

Comments (none posted)

php-smarty: regex handling

Package(s):	php-Smarty	CVE #(s):
Created:	October 22, 2008	Updated:	October 22, 2008
Description:	php-smarty 2.6.20 fixes checking of /e tags on regular expressions, closing an a potential code execution vulnerability.
Alerts:	Fedora FEDORA-2008-8956 2008-10-20 Fedora FEDORA-2008-8945 2008-10-20

Comments (none posted)

qemu: insecure temporary files

Package(s):	qemu	CVE #(s):	CVE-2008-4553
Created:	October 21, 2008	Updated:	October 22, 2008
Description:	From the Debian advisory: Dmitry E. Oboukhov discovered that the qemu-make-debian-root script in qemu, fast processor emulator, creates temporary files insecurely, which may lead to a local denial of service through symlink attacks.
Alerts:	Debian DSA-1657-1 2008-10-20

Comments (none posted)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The 2.6.28 merge window is still open, so there is no 2.6 development kernel at the moment. See the article below for an update on what has been merged for the 2.6.28 development cycle.

The current stable 2.6 kernel is 2.6.27.2, released on October 18. It contains about a dozen important fixes. Previously, 2.6.27.1 was released with a single fix disabling the dynamic function tracing feature.

There are stable updates for the 2.6.25, 2.6.26, and 2.6.27 kernels in the review process as of this writing; chances are they will have been released by the time you read this.

Comments (none posted)

Kernel development news

Quotes of the week

-- Andres Salomon should be a hardware salesman

-- Linus Torvalds

-- Hugh Dickins

Comments (3 posted)

2.6.28 merge window, part 2

As of this writing, just under 6200 non-merge changesets have been merged into the mainline kernel since the 2.6.27 release. This merge window should be drawing to a close around October 24, so we are getting closer to seeing what 2.6.28 will look like. User-visible changes merged since last week's update include:

• New drivers have been merged for Maxim/Dallas DS3234 SPI realtime clock chips, VIA UniChrome Family graphics chipsets, Toshiba Mobile IO framebuffers, C-Media CM109 USB phones, the touchpad shipped on OLPC XO systems, Automata Sercos III PCI cards (via UIO), Delcom USB 7-segment LED displays, generic USB test-and-measurement devices, Freescale QE/CPM USB device controllers, Vernier Software Technologies USB spectrometers, GPIO-connected NAND flash devices, Freescale i.MX2 and i.MX3 flash controllers, OMAP2/OMAP3-connected OneNAND flash devices, Dialog DA9030/DA9034 multifunction controllers, and Texas Instruments TWL4030/TPS659x0 multifunction controllers.

• The driver staging tree has been moved into the mainline. It brings with it a new TAINT_CRAP flag and suitably tainted drivers for Meilhaus ME-4000 data collection boards, Go 7007 ("some weird device") video controllers, Agere ET-1310 Gigabit Ethernet controllers, Atmel at76c503/at76c505/at76c505a wireless USB cards, Alacritech SLIC Technology non-accelerated 10Gb Ethernet cards, Alacritech IS-NIC gigabit Ethernet cards, Winbond w35und wireless network adapters, and Prism 2.5 USB wireless network adapters (a driver which includes its own 802.11 stack). Also added are an echo cancellation module and a driver which enables the passing of network packets over a USB link.

• A lot of work on the Intel i915 graphics driver has been merged; this work includes the Graphics Execution Manager (GEM) GPU memory management subsystem and "IGD OpRegion" support which enables ACPI backlight control. It looks like kernel-based mode setting might not make it for 2.6.28, but much of the rest of the big graphics rework is now merged.

• The way video drivers handle waiting for vertical blank cycles has been changed to reduce interrupts - and, thus, power consumption.

• Rik van Riel's memory management scalability patches have, at long last, been merged. These patches separate the management of anonymous, file-backed, and completely unevictable pages, eliminating a lot of useless page scanning.

• Another VM improvement causes the system to free a page's swap space after that page is brought back into RAM; this effectively increases the amount of swap available on the system.

• Nick Piggin's rewritten vmap layer should give significant performance improvements, especially as the number of CPUs on a system grows.

• Huge pages will now be included in core dumps, making the debugging of applications using those pages easier.

• The container freezer has been merged. It is now possible for the system to freeze all processes within a container (control group) as a unit.

• The KVM virtualization code has seen a number of improvements, including the ability to assign PCI devices to guests and support for Intel "Tukwila" processors.

• Kprobes are now supported by the SuperH architecture.

• There is a new ext3 mount option (data_err=abort) which causes filesystem operations to abort when I/O errors are encountered. In the absence of this option, the old behavior (continue but complain in the system log) remains.

• In-kernel interrupt balancing for 32-bit x86 systems has been removed. This feature has been deprecated (in favor of user-space balancing) for some time.

Changes visible to kernel developers include:

• A number of tracing-related patches have been merged. These include the tracepoints mechanism, some instrumentation in the core scheduler code, improvements to the ftrace function tracing feature, a new ftrace-based stack tracer, a new ftrace-based boot (initcall) tracer, and the low-level trace buffer code.

• The sysctl strategy() function prototype has changed: the unused name and nlen parameters have been removed.

• Asynchronous I/O support can now be configured out of the kernel, saving about 7KB of space on systems where AIO is not needed.

• As planned, device_create_drvdata() has been renamed to device_create(), with the same parameters.

• There is now a mechanism to enable and disable output from pr_debug() and dev_dbg() calls on a per-module basis. Control is through a virtual file in debugfs. There is no documentation file associated with this change; instructions on how to use this feature can be found in the patch changelog.

• The new dev_WARN() function:

      dev_WARN(struct device *dev, char *format, ...);
  

  will output the formatted warning, along with a full stack trace. This will allow the warnings to be collected at kerneloops.org and incorporated into the reports there.

• The new %pR formatting directive allows printk() and friends to output the contents of resource structures.

• There is a new function intended to make life easier for PCI driver writers:

      static inline void *pci_ioremap_bar(struct pci_dev *pdev, int bar);
  

  This function will remap the entire PCI I/O memory region, as selected by the bar argument.

See next week's Kernel Page for a summary of the final days of the 2.6.28 merge window.

Comments (7 posted)

The source of the e1000e corruption bug

When LWN last looked at the e1000e hardware corruption bug, the source of the problem was, at best, unclear. Problems within the driver itself seemed like a likely culprit, but it did not take long for those chasing this problem to realize that they needed to look further afield. For a while, the X server came under scrutiny, as did a number of other system components. When the real problem was found, though, it turned out to be a surprise for everybody involved.

Tracking down intermittent problems is hard. When those problems result in the destruction of hardware, finding them is even harder. Even the most dedicated testers tend to balk when faced with the prospect of shipping their systems back to the manufacturer for repairs. So the task of finding this issue fell to Intel; engineers there locked themselves into a lab with a box full of e1000e adapters and set about bisecting the kernel history to identify the patch which caused the problem. Some time (and numerous fried adapters) later, the bisection process turned up an unlikely suspect: the ftrace tracing framework.

Developers working on tracing generally put a lot of effort into minimizing the impact of their code on system performance. Every last bit of runtime overhead is scrutinized and eliminated if at all possible. As a general rule, bricking the hardware is a level of overhead which goes well beyond the acceptable parameters. So the ftrace developers, once informed of the bisection result, put in some significant work of their own to figure out what was going on.

One of the features offered by ftrace is a simple function call tracing operation; ftrace will output a line with the called function (and its caller) every time a function call is made. This tracing is accomplished by using the venerable profiling mechanism built into gcc (and most other Unix-based compilers). When code is compiled with the -pg option, the compiler will place a call to mcount() at the beginning of every function. The version of mcount() provided by ftrace then logs the relevant information on every call.

As noted above, though, tracing developers are concerned about overhead. On most systems, it is almost certain that, at any given time, nobody will be doing function call tracing. Having all those mcount() calls happening anyway would be a measurable drag on the system. So the ftrace hackers looked for a way to eliminate that overhead when it is not needed. A naive solution to this problem might look something like the following. Rather than put in an unconditional call to mcount(), get gcc to add code like this:

    if (function_tracing_active)
        mcount();

But the kernel makes a lot of function calls, so even this version will have a noticeable overhead; it will also bloat the size of the kernel with all those tests. So the favored approach tends to be different: run-time patching. When function tracing is not being used, the kernel overwrites all of the mcount() calls with no-op instructions. As it happens, doing nothing is a highly optimized operation in contemporary processors, so the overhead of a few no-ops is nearly zero. Should somebody decide to turn function tracing on, the kernel can go through and patch all of those mcount() calls back in.

Run-time patching can solve the performance problem, but it introduces a new problem of its own. Changing the code underneath a running kernel is a dangerous thing to do; extreme caution is required. Care must be taken to ensure that the kernel is not running in the affected code at the time, processor caches must be invalidated, and so on. To be safe, it is necessary to get all other processors on the system to stop and wait while the patching is taking place. The end result is that patching the code is an expensive thing to do.

The way ftrace was coded was to patch out every mcount() call point as it was discovered through an actual call to mcount(). But, as noted above, run-time patching is very expensive, especially if it is done a single function at a time. So ftrace would make a list of mcount() call sites, then fix up a bunch of them later on. In that way, the cost of patching out the calls was significantly reduced.

The problem now is that things might have changed between the time when an mcount() call is noticed and when the kernel gets around to patching out the call. It would be very unfortunate if the kernel were to patch out an mcount() call which no longer existed in the expected place. To be absolutely sure that unrelated data was not being corrupted, the ftrace code used the cmpxchg operation to patch in the no-ops. cmpxchg atomically tests the contents of the target memory against the caller's idea of what is supposed to be there; if the two do not match, the target location will be left with its old value at the end of the operation. So the no-ops will only be written to memory if the current contents of that memory are a call to mcount().

This all seems pretty safe, except that it fell down in one obscure, but important case. One obvious place where an mcount() call could go away is in loadable modules. This can happen if the module is unloaded, of course, but there is another important case too: any code marked as initialization code will be removed once initialization is complete. So a module's initialization function (and any other code marked __init) could leave a dangling reference in the "mcount() calls to be patched out" list maintained by ftrace.

The final piece of this puzzle comes from this little fact: on 32-bit architectures, memory returned from vmalloc() and ioremap() share the same address space. Both functions create mappings to memory from the same range of addresses. Space for loadable modules is allocated with vmalloc(), so all module code is found within this shared address space. Meanwhile, the e1000e driver uses ioremap() to map the adapter's I/O memory and NVRAM into the kernel's address space. The end result is this fatal sequence of events:

1. A module is loaded into the system. As part of the module's initialization, a number of mcount() calls are made; these call sites are noted for later patching.

2. Module initialization completes, and the module's __init functions are removed from memory. The address space they occupied is freed up for future use.

3. The e1000e driver maps its I/O memory and NVRAM into the address range recently occupied by the above-mentioned initialization code.

4. Ftrace gets around to patching out the accumulated list of mcount() calls. But some of those "calls" are now, actually, I/O memory belonging to the e1000e device.

Remember that the ftrace code was very careful in its patching, using cmpxchg to avoid overwriting anything which is not an mcount() call. But, as Steven Rostedt noted in his summary of the problem:

The end result is a write to the wrong bit of I/O memory - and a destroyed device.

In hindsight, this bug is reasonably clear and understandable, but it's not at all surprising that it took a long time to find. One should note that there were, in fact, two different bugs here. One of them is ftrace's attempt to write to a stale pointer. But the other one was just as important: the e1000e driver should never have left its hardware configured in a mode where a single stray write could turn it into a brick. One never knows where things might go wrong; hardware should never be left in such a vulnerable state if it can be helped.

The good news is that both bugs have been fixed. The e1000e hardware was locked down before 2.6.27 was released, and the 2.6.27.1 update disables the dynamic ftrace feature. The ftrace code has been significantly rewritten for 2.6.28; it no longer records mcount() call sites on the fly, no longer uses cmpxchg, and, one hopes, is generally incapable of creating such mayhem again.

Comments (19 posted)

Reworking vmap()

Kernel memory is normally allocated in relatively small chunks - usually just a single page at a time. As the size of an allocation grows, satisfying that allocation with physically-contiguous pages gets progressively harder. So most of the kernel has been written with an eye toward avoiding the use of large, contiguous allocations. There are times, though, when a large memory array needs to be virtually contiguous, but not necessarily physically contiguous. One example is the allocation of space for loadable modules; any given module should live in a single, contiguous address range, but nobody cares how it's laid out in physical RAM. For cases like this, the kernel provides a set of functions like vmalloc() and vmap().

Functions like vmalloc() have long been known to be somewhat expensive to use. They have to work with a single shared (and limited) address range, and they require making changes to the kernel's page tables. Page table changes, in turn, require translation lookaside buffer (TLB) flushes, which are a costly, all-CPUs operation. So kernel developers have generally tried to avoid using these functions in performance-critical parts of the kernel.

Nick Piggin has noticed, though, that the performance characteristics of vmalloc() and friends are catching up with us. The vmalloc() address space is kept on a linked list and protected by a global lock, which does not scale very well. But the real cost is in freeing memory regions in this space; the ensuing TLB flush must be done using an inter-processor interrupt to every CPU, each of which must then flush its own TLB. People normally do not buy more CPUs unless they have more work to run on them, so systems with more processors will, as a general rule, be performing more mapping and freeing in the vmalloc() range. As systems grow, there will be more global TLB flushes, each of which disrupts more processors. In other words, the amount of work grows proportional to the square of the number of processors - meaning that everything falls down, eventually.

To make things worse, Nick has a longstanding series of patches which, among other things, do a lot of vmap() calls to support larger block sizes in the filesystem layer and page cache. Merging those patches would add significantly to the amount of time the system spends managing the vmalloc() space, which would not be a good thing. So fixing vmalloc() seems like a good thing to do first. As of 2.6.28, Nick has, in fact, fixed the management of kernel virtual allocations.

The first step is to get rid of the linked list and its corresponding global lock. Instead, a red-black tree is used to track ranges of available address space; finding a suitable region can now be done without having to traverse a long list. The tree is still protected by a global lock, which poses potential scalability problems. To avoid this issue, Nick's patch creates a separate, per-CPU list of small address ranges which can be allocated and freed in a lockless manner. New functions must be called to make use of this facility:

    void *vm_map_ram(struct page **pages, unsigned int count, 
                     int node, pgprot_t prot);
    void vm_unmap_ram(const void *mem, unsigned int count);

A call to vm_map_ram() will create a virtually-contiguous mapping for the given pages. The associated data structures will be allocated on the given NUMA node; the memory will have the protection specified in prot. With the version of the patch merged for 2.6.28, mappings of up to 64 pages can be made from the per-cpu lists.

Note that these functions do not allocate memory, they just create a virtual mapping for a given set of pages. They are a replacement for vmap() and vunmap(), not vmalloc() and vfree(). It is probably possible to rewrite vmalloc() to use this mechanism, but that has not happened. So vmalloc() calls still require the acquisition of a global lock.

There's another trick in this patch set which is used by all of the kernel virtual address management functions. Nick realized that it is not actually necessary to flush TLBs across the system immediately after an address range is freed. Since those addresses are being given back to the system, no code will be making use of them afterward, so it does not matter if a processor's TLB contains a stale mapping for them. All that really matters is that the TLB gets cleaned out before those addresses are used again elsewhere. So unmapped regions can be allowed to accumulate, then all flushed with a single operation. That cuts the number of TLB flushes significantly.

How much faster do things run? Nicks patch (the merged version can be found here) contains some benchmark results. With an artificial test aimed at demonstrating the difference, the new code runs 25 times faster. By changing the vmap() code in the XFS filesystem to use vm_map_ram() instead, some workloads were sped up by a factor of twenty. So it seems to work.

Comments (3 posted)

Patches and updates

Kernel trees

• Greg KH: Linux 2.6.27.1. (October 16, 2008)

• Greg KH: Linux 2.6.27.2. (October 18, 2008)

• Willy Tarreau: Linux 2.4.36.8. (October 20, 2008)

Core kernel code

• Martin Schwidefsky: kernel message catalog patches. (October 16, 2008)

• Dave Hansen: Kernel-based checkpoint/restart. (October 20, 2008)

• Andrey Mirkin: OpenVZ kernel based checkpointing/restart (v2). (October 20, 2008)

• Thomas Gleixner: range hrtimers for .28. (October 21, 2008)

• Mike Travis: cpumask: Replace cpumask_t with struct cpumask. (October 21, 2008)

• Rusty Russell: module, param and stop_machine patches. (October 22, 2008)

• Petr Tesarik: enable irqs when waiting for rwlocks. (October 22, 2008)

Development tools

• Tom Zanussi: relay revamp v6. (October 20, 2008)

• Jason Baron: tracepoints for kernel/mutex.c. (October 20, 2008)

• Mathieu Desnoyers: Tracer Timestamping. (October 20, 2008)

• eranian@googlemail.com: perfmon3: introduction. (October 20, 2008)

• Vegard Nossum: What's in kmemcheck.git (for v2.6.28?). (October 20, 2008)

• Frederic Weisbecker: tracing/ftrace: Introduce the big kernel lock tracer. (October 22, 2008)

Device drivers

• Eric Piel: LIS3LV02Dx Accelerometer driver (take 4). (October 20, 2008)

• Mark Jackson: Add Dallas DS1390 RTC chip. (October 20, 2008)

• Greg KH: driver core patches for your 2.6-git tree. (October 20, 2008)

• Greg KH: USB patches for 2.6-git. (October 20, 2008)

• Greg KH: more STAGING patches for 2.6.28. (October 22, 2008)

• James Bottomley: intermediate SCSI updates (v2). (October 20, 2008)

• Dave Airlie: drm patches for 2.6.27-rc1. (October 20, 2008)

• Ira Snyder: net: add PCINet driver. (October 20, 2008)

• Kuninori Morimoto: Add ov772x driver. (October 20, 2008)

• Bill Gatliff: Generic PWM API implementation. (October 20, 2008)

• Jesse Barnes: PCI pull request for 2.6.28. (October 21, 2008)

• Yu Zhao: PCI: Linux kernel SR-IOV support. (October 21, 2008)

• Alan Cox: 8250: Oxford Semiconductor Devices. (October 21, 2008)

• Steve Glendinning: SMSC LAN911x and LAN921x vendor driver. (October 21, 2008)

• Tejun Heo: libata: separate out SFF and BMDMA. (October 21, 2008)

• Luis R. Rodriguez: Release of Atheros 802.11n USB Linux driver. (October 22, 2008)

• Pavel Machek: LIS3LV02Dx Accelerometer driver. (October 22, 2008)

• Jean Delvare: i2c updates for 2.6.28, round 2. (October 22, 2008)

• Rodolfo Giometti: c2port (Version 2): support for Silicon C2 Interface.. (October 22, 2008)

Documentation

• Jonathan Corbet: Documentation tree. (October 17, 2008)

Filesystems and block I/O

• Phillip Lougher: Subject: [PATCH 00/16] Squashfs: compressed read-only filesystem. (October 17, 2008)

• Nicholas A. Bellinger: : LIO-Target/ConfigFS for v2.6.27. (October 20, 2008)

• Nick Piggin: fs: improved handling of page and buffer IO errors. (October 21, 2008)

Janitorial

• Ingo Molnar: new tree: "fix all build warnings, on all configs". (October 17, 2008)

Memory management

• Mel Gorman: Report the size of pages backing VMAs in /proc V3. (October 20, 2008)

Architecture-specific

• Nick Piggin: mutex: optimise generic mutex implementations. (October 20, 2008)

Security-related

• David Howells: Copy on write credentials for Linux [ver #2]. (October 20, 2008)

• Kentaro Takeda: TOMOYO Linux. (October 20, 2008)

• James Morris: SELinux and security patches for 2.6.28. (October 20, 2008)

• Eric Paris: Audit support for file capabilities. (October 21, 2008)

Virtualization and containers

• Ryo Tsuruta: [PATCH 0/2] dm-ioband: I/O bandwidth controller v1.8.0: Introduction. (October 20, 2008)

Benchmarks and bugs

• Arjan van de Ven: Oops/Warning report for the week October 17th, 2008. (October 17, 2008)

Page editor: Jonathan Corbet

Distributions

News and Editorials

K12Linux - Fedora 9 with LTSP

The K12Linux project builds on the efforts of K12LTSP, which started working with the Linux Terminal Server Project (LTSP) on Red Hat Linux before switching to Fedora and CentOS. The newly named K12Linux project recently announced the release of K12Linux Release Candidate 1.

The Linux Terminal Server Project provides software that adds thin-client support to Linux distributions. The project's documentation page has pointers to using LTSP with Ubuntu, openSUSE, Fedora and Debian, along with instructions for Integrating LTSP-5 into your favorite Linux distribution. LTSP provides server and client software for a single server and many thin clients or diskless terminals. This can be an inexpensive way to provide files and applications for many users. While often used in schools, LTSP has many other applications as well.

K12 refers to the USA primary school system, where children start their education in Kindergarten (from the German) and go through grade 12 before going on to a university. This brings us back to K12Linux, the new name for continuing efforts to integrate LTSP with Fedora. Currently these efforts are focused on LTSP 5 and Fedora 9.

This RC release contains Fedora 9 and all updates as of October 12, 2008, with LTSP-5.1.26, ldm-2.0.13, ltspfs-0.5.5, many bug fixes and new K12Linux-themed artwork for the login screen. This release comes as a live image suitable for a USB key or a DVD; both with the client chroot already installed and configured. If you are already running Fedora 9 and would like to try this release you can use the instructions in the install guide instead of the live media. Either way, if you are looking for an easy way to get LTSP running, give K12Linux a try.

Comments (none posted)

New Releases

CentOS 4.7 Server CD released

The single CD server install for CentOS 4.7 has been released and is available from all active mirrors. It is available for i386 and x86_64. Click on the desired architecture for notes, sha1sum and other information.

Comments (1 posted)

Fedora 10 Snapshot 2

Fedora 10 Snapshot 2 is available for testing. "This time not only will we have Live images, we'll also have DVD and split CD install images. Due to the amount of data to sync around, we're going to stagger the torrent releases, making them available as they finish syncing to the torrent server."

Full Story (comments: none)

Foresight 2.0.5 Released

Foresight 2.0.5 featuring GNOME 2.24 has been released. "Foresight 2.0.5 features the latest GNOME desktop environment, 2.24; OpenOffice.org 3.0, and the latest Xorg release, 1.5.1." Click below for links to the release notes and download page.

Full Story (comments: none)

OpenSUSE 11.1 beta 3 available

The third OpenSUSE 11.1 beta is now available. "We all want openSUSE 11.1 to be the best release yet, and we need your help to get there. This release is ready for widespread testing, and we're encouraging everyone to download and test the beta release." For the curious, the project has also put up a set of excuses for why this release was late; it comes down to an extended power outage in Nuremberg on top of the usual problems.

Comments (6 posted)

RPM 4.6.0 release candidate 1

RPM 4.6.0 release candidate 1 is available. "As you may or may not know, we've been test-driving snapshots of rpm.org HEAD in Fedora development repository, including F10 alpha and beta releases, since early July in order to shake out any regressions from all the rather heavy refactoring and cleanup work that has been done over the last year and half. And sure, there were some regressions, that was to be expected. Those have been sorted out as they've come up and no new regressions have been reported for a while (plenty of ancient bugs have been discovered and fixed in the meantime though)."

Full Story (comments: 2)

Distribution News

SUSE Linux and openSUSE

openSUSE Hack Week III winners

The openSUSE project has announced the winners of Hack Week III. The winners are Best Cross-Pollination Team: Andrew Wafaa, for his videos of openSUSE Staff and Members, First Penguin Award: Lynn Bendixsen and Jason Douglas, for their work enabling driver upgrades for installing Windows para-virtualized drivers, plus winners for best overall projects. Click below for details.

Full Story (comments: none)

Distribution Newsletters

DistroWatch Weekly, Issue 275

The DistroWatch Weekly for October 20, 2008 is out. "Mandriva Linux 2009 took the centre stage during last week as many Linux users had a chance to install and check out the latest and greatest from the company that recently celebrated 10 years of existence. The reports varied widely, ranging from praise for the excellent way KDE 4 was integrated into the distribution to outright recommendations to skip this release due to a surprisingly high number of bugs. In other words, it's the story of Linux distributions - they will work great on one combination of hardware, but will fail miserably on another. In the news section, Debian presents updated artwork for "Lenny", Linux Mint releases its first stable 64-bit edition, the developers of KPackageKit introduce a new universal way of managing software, and K12LSTP Linux, a Fedora-based distribution for thin servers and clients, becomes K12Linux. Finally, don't miss the latest entrant into the world of BSD-based live CDs - BSDanywhere, or OpenBSD with Enlightenment."

Comments (none posted)

Fedora Weekly News #148

This week the Fedora Weekly News looks at Announcements for The Big ACL Opening, Fedora Test Day and K12Linux Release Candidate 1 Now Available; Developments in OpenOffice and go-oo, PackageGurus, SpecMentats or UeberPackagers?, A Single Torrent?, The Old Sendmail Argument and Review-o-matic; and much more.

Full Story (comments: none)

openSUSE Weekly News, Issue 42

This edition of the openSUSE Weekly News covers Power Outage of most openSUSE servers, Retiring from the openSUSE Board, Status openSUSE distribution, Pascal Bleser: Packman: removing openSUSE 10.0 and 10.1 packages, Bernhard Walle: Automatic reboot with kexec and more. Click below for links to the German, Russian and Japanese translations.

Full Story (comments: none)

PCLinuxOS Magazine October 2008 Released

PCLinuxOS Magazine Issue 26 is available. Some highlights include: Gnome Users' Guide, The Poets are Back, VirtualBox: Easier Than You Think!, An Alphabet of Computer Languages: BASIC, KDE Desktop on PCLinuxOS, Linux Media Players, and more. There is an HTML version and a PDF version.

Comments (none posted)

Ubuntu Weekly Newsletter #113

The Ubuntu Weekly Newsletter for October 18, 2008 covers: Ubuntu 7.04 "End of Life", Intrepid Release Parties, Archive frozen for Intrepid 8.10, Preparing for Ubuntu Open Week, New Ubuntu Members, New MOTU video, New US Ubuntu store, Launchpad 2.1.10 released, Launchpod episode #11, Ubuntu-UK podcast #16, Inspiron Mini 12 on Dell's website, and much more.

Full Story (comments: none)

Newsletters and articles of interest

The Perfect Server - Mandriva 2009.0 Free (i386) (HowtoForge)

HowtoForge covers one way of setting up Mandriva 2009.0 as "the perfect server". "This is a detailed description about how to set up a Mandriva 2009.0 Free server that offers all services needed by ISPs and hosters: Apache web server (SSL-capable), Postfix mail server with SMTP-AUTH and TLS, BIND DNS server, Proftpd FTP server, MySQL server, Dovecot POP3/IMAP, Quota, Firewall, etc. This tutorial is written for the 32-bit version of Mandriva 2009.0."

Comments (none posted)

Distribution reviews

Mandriva Linux 2009.0 : upgrade successful (Greetings from the free side)

A blog site called Greetings from the free side has a review of Mandriva 2009.0, as an upgrade from 2008.1. "Here's how it went. I tried to remain in the position of a newcomer that has no clue about what a command line interface is, so even if I used a terminal a couple of times, it was just to check some stuff, not to fix it. I launched the mdkonline applet for the purpose of the upgrade (I always disable it because of it wastes too much memory to my taste)."

Comments (none posted)

Meet PCLinuxOS 2009 (Beta 1) (TuxMachines)

TuxMachines.org has a review of the first beta of PCLinuxOS 2009. "To the excitement of its many loyal users, the PCLinuxOS development team released the first beta of the highly anticipated 2009 release. It's been a long time coming but it seems it's finally on its way. There were no big surprizes found in this release, but lots of updates."

Comments (none posted)

Page editor: Rebecca Sobol

Development

Mozilla releases Firefox 3.1 Beta 1

Version 3.1 Beta 1 of the popular Mozilla Firefox web browser was announced on October 14, 2008. This is a testing release:

The release announcement and the Web Developer Feature Overview page discuss the new capabilities in more detail. The major new additions include:

• Support has been added for the html <video> and <audio> elements using the OGG Theora and OGG Vorbis formats.
• Geolocation features have been added, but not in the Linux version (discussed here).
• The Gecko layout engine has some improved web standards implementations.
• More CSS 2.1 and CSS 3 properties have been implemented.
• Support for the CSS @font-face property has been added (Mac OS-X and Windows only), allowing support for downloadable user-specified true type fonts.
• Support for Access Control for Cross-Site Requests has been added.
• Beta support for Mozilla's TraceMonkey JavaScript engine has been added.
• Some new customizations are available for controlling the Smart Location Bar.
• JavaScript web worker threads are being worked on.
• New graphics, SVG and CSS capabilities are being added.
• Improvements have been made to the browser tabs including:
  • A new "Open a new tab" button has been added to the tab bar.
  • Support for switching between tabs with Ctrl-Tab has been added.
  • Tabs can now be dragged and dropped between Firefox windows.
• More features are planned for the official Mozilla 3.1 release.

Your author spent an entire day doing his normal LWN work using Firefox 3.1 Beta 1 on an Ubuntu 8.04 system. The only problem that showed up was choppy and aliased audio playback when viewing some of the recommended test videos. Otherwise, the browser worked well.

Firefox 3.1 Beta 1 is available for download here, it is a good idea to read the release notes first.

Comments (8 posted)

System Applications

Database Software

PostgreSQL Weekly News

The October 19, 2008 edition of the PostgreSQL Weekly News is online with the latest PostgreSQL DBMS articles and resources.

Full Story (comments: none)

SQLite release 3.6.4 announced

Version 3.6.4 of SQLite, a light weight DBMS, has been announced. A number of new capabilities and some bug fixes have been added.

Comments (none posted)

Package Management

RPM 5.1.6 released

Version 5.1.6 of the RPM package manager has been announced. "We've today released RPM 5.1.6, another maintenance release from the stable RPM 5.1 branch."

Full Story (comments: none)

Printing

Gutenprint: 5.2.1 Release (SourceForge)

Version 5.2.1of Gutenprint has been announced, it includes support for many new printers and other improvements. Gutenprint is: "A very high quality package of printer drivers for Ghostscript and CUPS on Linux, Macintosh OS X, and other POSIX-compliant operating systems. This project also maintains an enhanced Print plug-in for GIMP 2.x from the same code base."

Comments (none posted)

Security

conntrack-tools 0.9.8 released

Version 0.9.8 of conntrack-tools has been announced. "The netfilter project proudly presents another development release of the conntrack-tools. This release includes important updates, fixes and improvements. Moreover, a new user manual has been released, contributions to improve are welcome! Detailed changelog is attached. What are the conntrack-tools? - The userspace daemon so-called conntrackd that covers the specific aspects of stateful Linux firewalls to enable high availability solutions."

Full Story (comments: none)

sqlmap 0.6.1 released

Version 0.6.1 of sqlmap has been announced, it includes some new features. "sqlmap is an automatic SQL injection tool developed in Python. Its goal is to detect and take advantage of SQL injection vulnerabilities on web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specific DBMS tables/columns, run his own SQL SELECT statement, read specific files on the file system and much more."

Full Story (comments: none)

Telecom

Android source available

Google has finally released the source to its "Android" mobile phone platform; it can be obtained from source.android.com. It's not for the faint of heart: "The source is approximentely [sic] 2.1GB in size. You will need 6GB free to complete the build."

Comments (49 posted)

queXS: 0.9.0 (Beta) First public release (SourceForge)

Beta Version 0.9.0 of queXS, a Computer Assisted Telephone Interviewing package, has been announced. "queXS handles questionnaire design (via LimeSurvey and queXML), integration with VoIP (Asterisk), operator management and performance, data output in standard formats (DDI), client progress reporting, easy sample file import, simple appointment system, fast and effective case queuing, and more."

Comments (none posted)

Web Site Development

amplee 0.6.1 - AtomPub Python implementation

Version 0.6.1 of amplee, a Python implementation of the Atom Publishing Protocol, is out. "This release is a minor release that fixes a few annoying defects and improves overall performances of the internal of amplee".

Full Story (comments: none)

Gallery: 2.3 (Skidoo) Released (SourceForge)

Version 2.3 of Gallery has been announced. "Gallery is an online photo album organizer. Whether for small personal sites or large community sites, Gallery provides an intuitive way to blend photo management seamlessly into any website. Serving millions worldwide, Gallery is the most widely used system of its kind. Gallery is free to download and use. Gallery 2.3 (Skidoo) is now available for download! It's been almost 20 months since the last major release and Gallery 2.3 is packed with new features and enhancements. Major new features include: A much improved slideshow using PicLens to provide a rich, full screen experience; Comment spam filtering with Akismet; and configurable e-mail notifications."

Comments (none posted)

Miscellaneous

Solitox Community Framework: libmsocket-0.4 release (SourceForge)

Version 0.4 of Solitox has been announced. "The Solitox Community system provides an integrated real-time chat service, web interface, and a scalable infrastructure for adding more services with common credentials. These interfaces allow a greater level of communication for your users. The 0.4 release of libmsocket is somewhat preliminary - the basic functionality for TCP sockets is there, and it works, which should allow folks to start developing with it. In addition to this first stable release, a FreeBSD port has been submitted and committed to the FreeBSD ports tree. I am also currently seeking folks to release packages for other operating systems and distributions, especially pkgsrc and several Linux distributions."

Comments (none posted)

Desktop Applications

Audio Applications

Xtreme Media Player 0.6.0 released

Version 0.6.0 of Xtreme Media Player has been announced. "Finally the version 0.6.0 is out. In this release mostly of the source files were rewritten in order to fix bugs and support the new upcoming features."

Comments (none posted)

Plugins For Ardour

The Ardour multi-track audio editor project has announced a new plugins page. "Ardour does not come with any built-in signal processors of its own (other than volume faders) and it also generally doesn't ship with any plugins. This page provides informations on plugins that you can use with Ardour, many of which are available at no charge."

Comments (none posted)

Business Applications

OrangeHRM Releases Version 2.4 (SourceForge)

Version 2.4 of OrangeHRM has been announced. "OrangeHRM developed by OrangeHRM Inc is an Open Source HR Information Systems (HRIS) that covers Personnel Information Management, Employee Self Service, Leave, Time & Attendance, Benefits and Recruitment. New Recruitment Module - a result of OrangeHRM and its user community collaboration has brought out a powerful, comprehensive and user friendly recruitment engine that can be easily plugged into your company’s website."

Comments (none posted)

CAD

Asymptote: 1.46 released (SourceForge)

Version 1.46 of Asymptote, a vector graphics language for technical drawing, has been announced. "Release Notes for Version 1.46 Support was added for embedding 3D PRC files within LaTeX even when settings.render=0. An error is now signalled if the user tries to render an image without freeglut library support. The Klein bottle example was updated to use lightgray instead of the new default surface color (black). The sphere animation example was updated to work with the new skeleton structure in the solids module."

Comments (none posted)

Desktop Environments

GNOME 2.24.1 released

Version 2.24.1 of the GNOME desktop environment has been announced. "This is the first update to GNOME 2.24. Come and see all the bug fixing, all the new translations and all the updated documentation brought to you by the wonderful team of GNOME contributors! A lot of work has been done in the stable branch to make it even more solid than it was."

Full Story (comments: none)

GNOME Software Announcements

The following new GNOME software has been announced this week:

• anjuta and gnome-build 2.24.1 (bug fixes and translation work)
• Cheese 2.24.1 (bug fix and translation work)
• Clutter-GTK 0.8.2 (new features and bug fixes)
• Conduit 0.3.15 (bug fixes and translation work)
• Deskbar-Applet 2.24.1 (translation work)
• Ekiga 3.0.1 (bug fixes)
• Empathy 2.24.1 (bug fixes and translation work)
• Eye of GNOME 2.24.1 (new features, bug fixes and translation work)
• F-Spot 0.5.0.3 (bug fixes)
• Gcalctool 5.24.1 (bug fixes and translation work)
• GLib 2.18.2 (bug fixes and translation work)
• GLib 2.19.0 (new features, bug fixes and translation work)
• glibmm 2.18.1 (bug fixes)
• gnome-applets 2.24.1 (new features, bug fixes and translation work)
• Gnome Games 2.24.1 (bug fixes and translation work)
• gnome-keyring 2.24.1 (bug fixes and translation work)
• GNOME Power Manager 2.24.1 (bug fixes and translation work)
• GNOME Utilities 2.24.1 (bug fixes and translation work)
• GTK+ 2.14.4 (bug fixes and translation work)
• Gtk2-Perl 2.24.0 (bug fixes and documentation work)
• gtk-engines 2.16.1 (translation work)
• gtk-null-engine 0.2 (new features)
• metacity 2.25.2 (new features, bug fixes and translation work)
• metacity 2.25.3 (bug fixes and translation work)
• mousetweaks 2.24.1 (translation work)
• PyClutter 0.8.0 (support for Clutter 0.8.2)
• seahorse 2.24.1 (bug fixes and translation work)
• seahorse-plugins 2.24.1 (bug fixes and translation work)
• Vala 0.4.0 (new features and bug fixes)

You can find more new GNOME software releases at gnomefiles.org.

Comments (none posted)

KDE Software Announcements

The following new KDE software has been announced this week:

• cb2Bib 1.0.4 (new features and bug fixes)
• CrossVC XXL 2.1.1 (bug fixes and translation work)
• kalender 0.1.0 (initial release)
• KNetMon 0.9.9 (unspecified)
• netgo_ng 0.1.8 (new features and bug fixes)
• netgo_ng 0.1.9 (bug fix)
• NoteFinder 0.2 (code cleanup)
• SMILE 0.8.5 (bug fixes)
• Snake 0.5 (initial release)
• TeXamator 1.0 (initial release)
• twofish 0.6 (unspecified)
• XPasta 0.7 (new feature)

You can find more new KDE software releases at kde-apps.org.

Comments (none posted)

KDE Commit-Digest (KDE.News)

The September 28, 2008 edition of the KDE Commit-Digest has been announced. The content summary says: "Continued work on PowerDevil, and the "NetworkManager" and "Weather" Plasmoids. Monochrome action icons in Plasma expand to cover KRunner. A first working version of QEdje script engine, and the import of a "Window Manager" runner. Work on new containments and a mobile internet devices (MID) panel in Plasma. Various improvements in Konsole and the Kvkbd keyboard utility. Support for adding actions implemented by Kross scripts in Lokalize..."

Comments (none posted)

Xfce 4.6 BETA-1 released

Version 4.6 BETA-1 of Xfce, a light weight desktop environment, has been announced. "A lot of bugs have been fixed in this release; a few highlights: - Xfwm4 can now detect if a program is unresponsive. It will show a dialog to let the user kill it. - Xfce4-session will start up significantly faster by starting apps in parallel where possible. - It is possible to configure the keyboard layout. - Toggling event-sounds with libcanberra + gtk 2.14 is now possible (meaning: you can turn them off). And lets not forget the translations, thanks to them Xfce 4.6.0 will be available to a lot of people in their native language."

Comments (none posted)

Xorg Software Announcements

The following new Xorg software has been announced this week:

• applewmproto 1.1.1 (bug fixes)
• libpciaccess 0.10.4 (new features and bug fixes)
• xf86-input-elographics 1.2.3 (new features and bug fixes)
• xf86-input-evdev 2.0.7 (bug fixes)
• xf86-input-evdev 2.0.99.1 (new features and bug fixes)
• xf86-video-radeonhd 1.2.3 (new feature)
• xf86-input-vmmouse 12.5.2 (bug fixes)
• xpyb 1.0 (bug fixes)

More information can be found on the X.Org Foundation wiki.

Comments (none posted)

Desktop Publishing

DiffPDF 0.3.4 released

Version 0.3.4 of DiffPDF has been announced. "DiffPDF is a program for comparing two PDF files. By default the comparison is of the text on each pair of pages, but comparing the appearance of pages is also supported (for example, if a diagram is changed or a paragraph reformatted). It is also possible to compare particular pages or page ranges (for example, to account for pages added to one PDF but not the other)."

Full Story (comments: none)

Encryption Software

GPGME 1.1.7 released

Version 1.1.7 of GPGME has been announced. "We are pleased to announce version 1.1.7 of GnuPG Made Easy, a library designed to make access to GnuPG easier for applications."

Full Story (comments: none)

Interoperability

Wine 1.0.1 announced

Version 1.0.1 of Wine has been announced. "This is a maintenance release from the 1.0 stable branch. It contains only translation updates and small bug fixes."

Comments (none posted)

Multimedia

Elisa Media Center 0.5.15 released

Version 0.5.15 of Elisa Media Center has been announced. "The focus during this release cycle has been put on fixing bugs (16 closed, with an emphasis on reducing memory leaks and usability improvements), while a good part of the team was working on implementing new features with a mid-term target. These features will show up within the next releases of Elisa, stay tuned!"

Full Story (comments: none)

Music Applications

Virtual MIDI Piano Keyboard 0.2.2

Version 0.2.2 of Virtual MIDI Piano Keyboard has been announced. "This is a maintenance release, fixing a crash at startup when no MIDI input devices were found. The load/save options now display a warning message if the file operation fails. Spanish translation has been updated."

Full Story (comments: none)

Digital Photography

UFRaw 0.14 released

Version 0.14 of UFRaw, a utility to read and manipulate raw images from digital cameras, has been announced. "UFRaw-0.14 was just released. 33 new cameras got supported thanks to dcraw and we have 7 new translations. Some of the controls in the user interface were shuffled, getting rid of the "Save As" pop-up dialog. Hopefully the new interface will streamline your workflow."

Full Story (comments: none)

UFRaw 0.14.1 released

Version 0.14.1 of UFRaw, a utility to read and manipulate raw images from digital cameras, has been announced. "I just made a new release to fix 2 small, but annoying, bugs".

Full Story (comments: none)

Science

Modular toolkit for Data Processing 2.4 released

Version 2.4 of Modular toolkit for Data Processing has been announced, it includes some new features, bug fixes and Python 3.0 migration work. "MDP is a Python library of widely used data processing algorithms that can be combined according to a pipeline analogy to build more complex data processing software. The base of available algorithms includes, to name but the most common, Principal Component Analysis (PCA and NIPALS), several Independent Component Analysis algorithms (CuBICA, FastICA, TDSEP, and JADE), Slow Feature Analysis, Restricted Boltzmann Machine, and Locally Linear Embedding."

Full Story (comments: none)

Video Applications

PiTiVi 0.11.2 released

Version 0.11.2 of PiTiVi, an open source video editor, has been announced. "The PiTiVi team is proud to announce the third release in the unstable 0.11 PiTiVi series. This release series is not intended to be production-ready, but instead to allow users to try more often new features that will be available in the next stable series."

Full Story (comments: none)

Miscellaneous

Kamaelia 0.6.0 and Axon 1.6.0 released

Version 0.6.0 of Kamaelia and version 1.6.0 of Axon have been announced. "In Kamaelia you build systems from simple components that talk to each other. This speeds development, massively aids maintenance and also means you build naturally concurrent software. It's intended to be accessible by any developer, including novices. It also makes it fun :) What sort of systems? Network servers, clients, desktop applications, pygame based games, transcode systems and pipelines, digital TV systems, spam eradicators, teaching tools, and a fair amount more :)"

Full Story (comments: none)

Languages and Tools

C

GCC 4.4.0 Status Report

The October 21, 2008 edition of the GCC 4.4.0 Status Report has been published. "The trunk remains Stage 3, so only bug fixes and documentation changes are allowed. While the various maintainers have discretion in allowing additional changes, they should, at this point, being using that discretion sparingly. We should now be focusing clearly on getting 4.4 out the door, not on adding more things to it. As expected, there are a number of performance and a few correctness issues stemming from IRA. These include bootstrap problems on popular platforms. There are also several issues that seem to be related to the use of assembler CFI directives."

Full Story (comments: none)

Caml

Caml Weekly News

The October 21, 2008 edition of the Caml Weekly News is out with new articles about the Caml language.

Full Story (comments: none)

Java

Jikes RVM 3.0.1 released

Version 3.0.1 of Jikes RVM has been announced, it includes new capabilities and bug fixes. "The Jikes Research Virtual Machine (RVM) is designed to execute Java(TM) programs that are typically used in research on fundamental virtual machine design issues."

Full Story (comments: none)

Lilith: 0.9.32 has been released (SourceForge)

Version 0.9.32 of Lilith has been announced, it includes a number of new features and some bug fixes. "Lilith is a Logging- and AccessEvent viewer for SLF4j/LOGBack."

Comments (none posted)

Python

Python-URL! - weekly Python news and links

The October 21, 2008 edition of the Python-URL! is online with a new collection of Python article links.

Full Story (comments: none)

Tcl/Tk

Tcl-URL! - weekly Tcl news and links

The October 22, 2008 edition of the Tcl-URL! is online with new Tcl/Tk articles and resources.

Full Story (comments: 1)

Version Control

bzr 1.8 released

Version 1.8 of bzr, a distributed version control system, has been announced. "Bazaar 1.8 includes several fixes that improve working tree performance, display of revision logs, and merges. The bzr testsuite now passes on OS X and Python 2.6, and almost completely passes on Windows. The smartserver code has gained several bug fixes and performance improvements, and can now run server-side hooks within an http server."

Full Story (comments: none)

GIT 1.6.0.3 released

Version 1.6.0.3 of GIT, a distributed version control system, has been announced, it includes numerous bug fixes and documentation improvements. "This one is larger than usual, as I took two weeks off since 1.6.0.2."

Full Story (comments: none)

Miscellaneous

OpenGrok 0.7 has been released

Version 0.7 of OpenGrok has been announced. "OpenGrok is a fast and usable source code search and cross reference engine. It helps you search, cross-reference and navigate your source tree. It can understand various program file formats and version control histories like Mercurial, Git, SCCS, RCS, CVS, Subversion, Teamware, ClearCase, Perforce and Bazaar. In other words it lets you grok (profoundly understand) the open source, hence the name OpenGrok. It is written in Java, and is OSS under the CDDL license."

Full Story (comments: none)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Build It. Share It. Profit. Can Open Source Hardware Work? (Wired)

Wired has a lengthy look at open-source hardware, and Arduino in particular. "Right now, open design pioneers tend to follow one of two economic models. The first is not to worry about selling much hardware but instead to sell your expertise as the inventor. If anyone can manufacture a device, then the most efficient manufacturer will do so at the best price. Fine, let them. It'll ensure your contraption is widely distributed. Because you're the inventor, though, the community of users will inevitably congregate around you, much as Torvalds was the hub for Linux. You will always be the first to hear about cool improvements or innovative uses for your device. That knowledge becomes your most valuable asset, which you can sell to anyone."

Comments (none posted)

Bruce Perens: A Vertical Market Seeks Open Standards (Datamation)

Bruce Perens discusses open standards in vertical markets in a Datamation article. "History repeats itself in interesting ways. Vertical markets are today grappling with their own need for truly Open Standards, going through all of the pain that the broader IT industry suffered two decades ago. Fortunately, the verticals can learn from the experience of the broader IT industry that has already fought these battles. So, of all the critical industries crying out for Open Standards, who is campaigning for them in their own industry today? Is it the manufacturers of voting machines, who must establish high standards to safeguard democracy? Or the medical records system vendors? Nope, it's the makers of casino slot machines."

Comments (15 posted)

Companies

Linux now an equal Flash player (Linux-Watch)

Linux-Watch reports on Adobe's release of the proprietary Flash Player 10 for Linux. "Welcome to the future. Linux is now a first-class desktop operating system citizen. Adobe today released version 10 of its Adobe Flash Player, available now in a variety of convenient packaging formats for Linux, as well as other popular desktop operating systems. Once upon a time, desktop Linux was a second-class citizen, where Flash was concerned. As recently as 2007, Linux users waited six months for Flash 9 to arrive. Now, while Microsoft appears bent on leaving Linux users behind on Silverlight technology, its Flash alternative, Adobe has made Linux an equal player."

Comments (72 posted)

Linux phone pioneer acquired (LinuxDevices)

LinuxDevices takes a look at Wind River's acquisition of Korean firm Mizi Research. "Founded in 1999, Mizi was among the first wave of companies attempting to commercialize embedded Linux. From the beginning, the company took an interest in Linux on handsets, as well as PDAs. It began offering GPL-licensed Linux BSPs (board support packages) for Samsung system-on-chip processors targeting smartphones in 2003, and later that year released Mizi Linux 2.0, a full software stack targeting phones and other mobile devices. Samsung first experimented with the stack in 2003, and Mizi collaborated with an unspecified partner in 2004 on a low-cost handset hardware/software reference design."

Comments (none posted)

Linux Adoption

Why OpenOffice.org Failed - and What to Do About It (ComputerWorld UK)

Glyn Moody has an article in ComputerWorld UK which is, in essence, a summary of a lengthy study in First Monday on why a Belgian agency chose not to switch to OpenOffice.org. "In other words, the principal reason OpenOffice.org was not adopted was Microsoft lock-in. The difficulty of converting macros, and the use of customised apps in Microsoft Access, were the two biggest obstacles... Open source effectively has one hand tied behind its back by the legacy code that its tightly wedded to Microsoft's products. The only way to create a level playing field is to insist on completely open standards, where Microsoft cannot simply fall back on the need for backward compatibility with its proprietary formats." On the other hand, forcing people to change might not be the best way to build good will.

Comments (24 posted)

Resources

Animating slide shows in OpenOffice.org Impress (Linux Journal)

Bruce Byfield discusses animation in OpenOffice.org Impress in a Linux Journal article. "Animation is one of the less-known features in OpenOffice.org Impress. Its most obvious uses are for transitions for individual objects on a slide (rather than for the entire slide), or for dramatic emphasis and calling attention to objects. But it can also be used for more serious purposes, such as illustrating a procedure that is clearer if you can see it in motion -- for instance, one of the most effective animations I saw showed was on a Society for Creative Anachronism site that explained how the links in chain mail fitted together."

Comments (none posted)

Reviews

Lightweight, Linux-compatible browser evolves (DesktopLinux.com)

DesktopLinux.com takes a look at Dillo 2.0. "The eight-year-old Dillo project has released version 2.0 of its Linux-compatible, ultra-lightweight HTML browser for embedded systems, antiquated PCs, and other low-powered devices. Dillo 2 adds support for anti-aliased text, multiple languages, and tabbed browsing, while improving table rendering and lowering memory usage, says the project."

Comments (13 posted)

Hands on: Fennec alpha 1 puts Firefox on your handheld (ars technica)

Ars technica has posted a detailed review of the Mozilla Fennec alpha release. "The project, which is codenamed Fennec, aims to bring the desktop Firefox browsing experience to mobile devices like MIDs and phone handsets. This early alpha release delivers a compelling user interface and demonstrates the impressive scope of the browser's potential on diminutive devices, but suffers from performance limitations and instability that reflect the need for significant refinement before it's mature enough for mainstream adoption."

Comments (none posted)

Linux Standard Base boosts developer features (IT World)

IT World takes a look at the LSB 4.0 beta release. "A beta version of Linux Standard Base (LSB) 4.0 released this week adds developer features to technology intended to reconcile differences between Linux distributions, the Linux Foundation said. Version 4.0 offers application and shell script-checkers and a multiversion software development kit, the foundation said. The full release of LSB 4.0 is set for this fall."

Comments (none posted)

Miscellaneous

Nine Attitude Problems in Free and Open Source Software (Datamation)

Here's your sermon for the day: Datamation lists a set of perceived "attitude problems" found in the free software community. "Especially in large projects, documenters, testers, artists, marketers and managers -- to say nothing of general end users -- have all become essential contributors. Increasingly, a FOSS software release is becoming a collaboration among people of different skill sets. Yet, despite this change, in many projects, non-developers are given second class treatment. In a large number of cases, they cannot become full members of the project, and are not allowed to vote."

Comments (28 posted)

UK gains LPI affiliate (Linux-Watch)

Linux-Watch reports that Bristol, UK based LinuxIT has joined the Global Affiliate Network of the Linux Professional Institute (LPI). "In its capacity as an official LPI affiliate, LinuxIT has established an independent "LPI-UK" organization aimed at ensuring that "all UK Linux training is accredited under the LPI framework," LinuxIT CEO Peter Dawes-Huish said."

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

AEGIS invests in Accessibility

The AEGIS project has announced a 12.6 million Euro investment in accessibility technology. "With AEGIS, over the next 3.5 years we will attempt to bring programmatic accessibility more fully to the web, and to the mobile world. With AEGIS we will also address a number of issues that still remain in accessibility on the open desktop. And while we're at it, we will bring a bunch of new and talented people into the open source accessibility community (you should start seeing them showing up on our mailing lists and wikis in the coming months). We will also fund a number of the experts who have already made tremendous open source accessibility contributions - to enable to them to continue and to do even more."

Full Story (comments: none)

New members for Moblin

Moblin, the Intel-backed effort to improve Linux support for mobile devices, has picked up a few new members, including gOS, Mandriva, Turbolinux, and Novell. (This report from Linux-Kongress looked at what the Moblin project is trying to do.)

Comments (none posted)

Commercial announcements

Data Robotics Aligns With Developers to Deliver 20 New Applications for Drobo and DroboShare

Data Robotics has announced that since opening up its storage platform to third-party developers in July 2008, 20 DroboApps have been developed or ported for use with Drobo and DroboShare. "The Drobo Developer Community (DDC) and DroboApps initiatives underscore Data Robotics' commitment to working closely with the developer community to provide a completely customized experience to every Drobo customer. Anyone interested in developing or porting applications to Drobo and DroboShare can sign up for the DDC at www.drobospace.com/developers"

Comments (1 posted)

Infobright Releases Open Source Data Warehouse Software for 32-Bit Linux

Infobright has announced the availability of its new 32-bit Linux version of Infobright Community Edition (ICE), its open source data warehouse software. The 64-bit version was announced previously. ""The Infobright team is committed to being very responsive to the needs of our community," said Mark Windrim, vice president of community relations for Infobright. "Our goal is to build a strong and vibrant community that makes it easy for anyone who needs a scalable data warehouse to easily download, install and manage it. Providing a 32-bit version was key to that, as it enables users to download the software and try it out immediately."" Both versions are available for download on Infobright.org

Comments (none posted)

New Books

Nagios: System and Network Monitoring, 2nd Edition--New from No Starch Press

No Starch Press has published the book Nagios: System and Network Monitoring, 2nd Edition by Wolfgang Barth.

Full Story (comments: none)

Ubuntu Kung Fu--New from O'Reilly

O'Reilly has published the book Ubuntu Kung Fu by Keir Thomas.

Full Story (comments: none)

Resources

The GPL Compliance Engineering Guide

Armijn Hemel has posted the GPL Compliance Engineering Guide [PDF], a manual describing how the gpl-violations.org project finds GPL-licensed software on embedded systems. "Often there is device, firmware, source tarball (or any combination thereof) that you are asked to check for compliance. Depending on the situation, a lot of work could be required to discover whether GPL violations exist, or to make sure there are none. This can range from dissecting a firmware and go as far as physical modification of a device to log in via a serial port onto the device, or beyond. This section summarizes my tools of choice to do this."

Comments (none posted)

The Linux Foundation puts a value on Linux

The Linux Foundation has announced the availability of a study attempting to estimate the value of a Linux distribution. "Using 2008 salary figures, the tests published in the paper revealed that if developed today, the full set of Fedora 9 distribution packages would cost $10.8 billion. The Fedora 9 distribution contains 204.5 million lines of code in 5547 application packages. The development effort estimate comes close to 60,000 Person-Years."

Comments (4 posted)

Openmoko Community newsletter

The Openmoko Community newsletter for October 4-19, 2008 has been published. "The two big news are the launch of opkg.org, an application directory, and Openmoko engineering team focusing back to the basics on Improving user experience."

Full Story (comments: none)

Contests and Awards

Plat'Home unveils final results of "Will Linux Work?" contest

Plat'Home has announced the results of its "Will Linux Work?" contest. "Last month, Plat'Home announced the OMS would be awarded to Steve Castellotti to test the server as a GPS and monitoring device aboard his trimaran, Martin Ewing to test the server as a home utility automation system, Colin Duplantis to test the server as an irrigation control system and Gordon Smith to test the server as monitoring door controller for his chicken coop."

Full Story (comments: none)

Education and Certification

Free Linux Training Notes

Stephen Mulcahy has announced some free Linux training notes that are available here. "When we started our IT consulting company, Applepie Solutions back in 2004 we looked at working in a number of different areas including Java development, C# development, software engineering consulting and Linux support. At the time, we thought there might be an opening for Linux training also, and we figured it was one way of marketing our services to prospective Linux customers. So we added Linux training to our reportoire of services and I set out to put together some training material."

Comments (none posted)

Event Reports

Linux Foundation End User Summit wrap-up

The Linux Foundation has sent out a summary of the first Linux Foundation End User Summit. "On Monday and Tuesday this week the Linux Foundation held the first Linux Foundation End User Summit in New York. Companies who attended included Credit Suisse, CME, AIG, Merrill Lynch, Dreamworks, NYSE, Fidelity, UBS, NYPD, US NAVY, Metlife, Morgon Stanley, JPMorgan Chase, Aetna, NAVTEQ, Goldman Sachs, Citigroup, Mitsubishi UFJ Financial Group (MUFJ) and many more. There was concern ahead of time that financial services companies may not attend due to the recent financial crisis on Wall Street. We were pleasantly surpirsed, however, to have a packed house. Perhaps in these times companies are committed to making the most of their investments, especially open and lower cost investments."

Full Story (comments: 6)

Symbian lays foundations for open source (451 CAOS)

451 CAOS reports from the Symbian Smartphone Show with an eye toward the upcoming open-source release of the Symbian code. "As David Rivas noted, the biggest risk was in setting up the organisation to manage the project itself. He noted that the employees of foundation members will be responsible for development and engineering but that employees of the foundation itself will not get involved in development. Foundation employees (who will number 100-150) will be responsible for admin, foundation management, support, marketing and software management and will corral the development teams to create the roadmap without getting involved in directing development projects themselves." It's a rare free software project which requires over 100 non-developers to support it.

Comments (1 posted)

Meeting Minutes

Perl 6 Design Minutes (use Perl)

The minutes from the October 8, 2008 and the October 15, 2008 Perl 6 Design Meetings have been published.

Comments (none posted)

Calls for Presentations

Nordic Perl Workshop 2009 Call for Papers (use Perl)

A call for papers for the Nordic Perl Workshop 2009 has been announced. "The workshop's topic is "Your future with Perl" and we're interested in hearing about your talks on these topics: * Perl 6, Rakudo, Parrot * Modern use of Perl * Good testing practices using Perl * Perl used in new and novel ways * Your Favourite Topic? (systems administration / life sciences / web development)" The event takes place in Oslo, Norway on April 16-17, 2009, submissions are due by January 11, 2009.

Comments (none posted)

Upcoming Events

ApacheCon US comes to New Orleans

ApacheCon US has been announced. "The Apache Software Foundation invites you to its 2008 conference being held in New Orleans this year from November 3-7, 2008. Meet open source experts for three days of networking opportunities and information sessions. This year represents a first for ApacheCon, as for the first time, OFBiz Symposium is co-locating with ApacheCon. The two conferences will allow attendees to attend the tracks from both conferences."

Full Story (comments: none)

Join us in Jamaica next January for Camp KDE (KDE.News)

KDE.News has announced the next Camp KDE, it will take place on January 19-23, 2009. "In January 2008, the KDE community celebrated the release of the much anticipated KDE 4.0 in Mountain View, CA. When the event was celebrated by a packed house, we realised that there was a strong demand for KDE events in the Americas. One year later, the community will celebrate this new conference series at Camp KDE 2009, to be held in Negril, Jamaica."

Comments (none posted)

Events: October 30, 2008 to December 29, 2008

The following event listing is taken from the LWN.net Calendar.

Date(s)	Event	Location
October 26 October 31	IBM Information On Demand 2008	Mandalay Bay - Las Vegas, Nevada, USA
October 27 October 30	Embedded Systems Conference - Boston	Boston, USA
October 29 November 1	10th Real-Time Linux Workshop	Colotlán, Jalisco, Mexico
November 3 November 7	ApacheCon US 2008	New Orleans, LA, USA
November 5 November 7	OpenOffice.org Conference 2008	Beijing, China
November 6	NLUUG autumn conference: Mobile Applications	Ede, Netherlands
November 6 November 7	Embedded Linux Conference Europe 2008	Ede, Netherlands
November 7 November 8	TwinCity Perl Workshop 2008	Vienna, Austria
November 7 November 9	UKUUG linux conference	Manchester, UK
November 8 November 9	Hackers to Hackers Conference 05'	Sao Paulo, Brazil
November 8 November 9	FOSS.my	Kuala Lumpur, Malaysia
November 10 November 14	Python Bootcamp with Dave Beazley	Atlanta, GA, USA
November 11 November 14	DeepSec IDSC 2008	Vienna, Austria
November 12 November 14	php|works 2008	Atlanta, GA, USA
November 12 November 13	PacSec Applied Security Conference	Tokyo, Japan
November 13 November 14	International Hacking and Security Conference	Seoul, Korea
November 14 November 16	OpenSQL Camp 2008	Charlottesville, VA, USA
November 16 November 20	Middle East IT Security Conference	Dubai, UAE
November 19 November 20	Linux Foundation Japan Symposium	Tokyo, Japan
November 20 November 21	FreedomHEC Taipei 2008	Taipei, Taiwan
November 22	The phpnw08 conference	Manchester, UK
November 22	PGDay Rio de la Plata	Buenos Aires, Argentina
November 22	Mandriva 2009 Installfest	Everywhere, World
November 25 November 29	FOSS.IN 2008	Bangalore, India
November 25 November 30	make art 2008	Poitiers, France
November 28	Informazione geografica aperta e libera	Pontedera (PI), Italy
November 28 November 29	WhyFLOSS La Plata - Argentina	La Plata, Argentina
November 29	LinuxDay in Vorarlberg (Deutschland, Schweiz, Liechtenstein und Österreich)	Dornbirn, Austria
December 1	First Nuxeo Developer Day	Paris, France
December 1 December 2	Open World Forum	Paris, France
December 2 December 5	Open Source Developers' Conference 2008	Sydney, NSW, Australia
December 4 December 7	PIKSEL08 - code dreams	Bergen, Norway
December 5 December 6	FOSSCamp	Mountain View, CA, USA
December 5 December 13	International Joint Conferences on Computer, Information, and Systems Sciences, and Engineering	Online,
December 7 December 12	Computer Measurement Group Conference 2008	Las Vegas, NV, USA
December 8 December 12	Ubuntu Developer Summit	Mountain View, CA, USA
December 8	Forum PHP Paris 2008	Paris, France
December 10 December 11	First Workshop on I/O Virtualization	San Diego, CA, USA
December 13	NLLGG meeting/BSD Community Day	Utrecht, The Netherlands
December 27 December 30	Chaos Communication Congress	Berlin, Germany

If your event does not appear here, please tell us about it.

Page editor: Forrest Cook