The
DocBook format is often promoted
as the format of choice for free (and non-free) documentation. DocBook, as
an SGML and XML standard, is compliant with as many buzzwords as anybody
could wish for. The standard is well developed and highly expressive.
And DocBook, of course, is all about structure. More, perhaps, than any
other markup language, DocBook forces the author to concentrate on the
structure of the language without thinking about how a document will be
rendered in any particular medium.
Anybody who has had to create a serious work in full frontal DocBook knows
the rest of the story, however. DocBook is complex and verbose. Like
PostScript, DocBook requires that the author maintain a deep stack in mind
to track the current state of the document. And, like PostScript, DocBook
is best used as the output of a higher-level tool, rather than created
directly by the author.
Unfortunately, given the current state of the tools available, manipulating
DocBook directly with a text editor is often the only option available. So
your editor, who is currently in the process of updating a substantial book
which is, of course, in DocBook format, was more than usually interested in
the recent announcement
that Conglomerate 0.70 had been
released. As stated in the announcement:
Congomerate is a free, user-friendly XML editor. It is
particularly aimed at DocBook editing, but should be able to handle
arbitrary XML document types.
For authors working in DocBook, a nice editor would be worth a great deal.
So Conglomerate seemed worth checking out.
The first challenge with bleeding-edge software, of course, is getting it
installed and running. For Conglomerate, an attempted install on Debian
sid proved doomed to failure; the maze of dependencies proved too twisted,
and the packaged version in experimental had not been updated. On the
other hand, version 0.70 configured, built, and installed on a Red Hat
Linux 9 system without trouble. There are advantages to having a
variety of distributions sitting around.
What resulted was a tool that shows some serious promise, but which is not
yet ready for production use. The sample text used (Chapter Two of
Linux Device Drivers, Third Edition) required significant editing
(with a text editor) before Conglomerate would accept it. Conglomerate
does not recognize common entities (e.g. –), and there
are differences of opinion on how certain types of tag (such as
<indexterm>) should be terminated in some situations. The
tool spews out an unending series of Gtk warnings, crashes occasionally,
and is generally slow. It is missing fundamental features, such as an
"undo" operation. It does, however, work well enough to give a good
idea of where the developers are going.
True to the basic premise of DocBook, Conglomerate is all about structure.
Looking at a document in DocBook will not tell you much about how it will
appear in printed (or web) form, but it is full of information on how the
document goes together. To that end, the window (see the screen shot on
the right) is divided into two panes. The left side shows the overall
structure of the document, in the usual tree presentation. The main
window, on the right, shows the text. But this is no WYSIWYG presentation;
instead, the document is presented as a set of nested boxes showing, once
again, how things are structured. Subtrees of the document can be expanded
or hidden at will, providing a sort of zoom feature.
At the structural element level, the right mouse button yields an
impressive array of new elements (86 of them) which can be added as
subelement or sibling elements. Once you get below the paragraph level,
however, a whole new menu with various types of low-level markup
(e.g. <emphasis>) appears instead. Conglomerate does not, of
course, change the presentation of the text to reflect this sort of
markup. So, for example, rather than italicizing text marked
<literal>, it simply indicates that the tag is present.
The tool displays internal comments in a highlighted form, but does not
appear to provide a way to add or edit comments.
There is no shortage of features that this tool still needs: undo, an easy
way to join paragraphs, the ability to read and fix not-quite-perfect
files, entity definitions, and some sort of way to quickly see what
formatted output would look like. The performance and stability issues
need some work. But none of this should detract from the fact that the
Conglomerate developers have made substantial progress toward the creation
of a desperately needed tool. Conglomerate is headed in the right
direction; we're looking forward to the next release.
Comments (31 posted)
Last week we reported on the impending
software patent vote in the European Parliament. That vote, set for
September 1, did not happen as scheduled. Thanks, at least in part,
to protests in various forms, the vote has been pushed back to the
September 22 Strasbourg session.
What remains unclear is what will be voted on at that time. By some
reports, the entire software patent proposal has been pushed back for a
rewrite before the vote. By others, it is a simple delay, and the same
proposal will be voted upon in Strasbourg. Real information, however,
seems hard to come by.
Either way, now is not the time to let up the
pressure on software patents. The next few weeks should be used, by
Europeans, to make sure their MEPs understand how they feel about software
patents and the threats patents pose to European businesses. The "software patent factsheet" being distributed by
MEP Arlene McCarthy should be challenged.
It is also
necessary to provide a counter to the pro-patent forces, which are
evidently pressing for a removal of the interoperability exemption in the
proposed law.
This battle,
perhaps, can be won - but it is not over yet.
Comments (7 posted)
[This article was contributed by Joe 'Zonker' Brockmeier]
In the last week or so, Cem Kaner's Software
Customer Bill of Rights has been making the rounds of the "blogosphere"
and getting quite a bit of attention. Essentially, Kaner proposes ten basic
rights that should be enjoyed by any user of commericial software. As End
User License Agreements (EULAs) have become increasingly onerous over the
last few years, Kaner's bill of rights has struck a chord with users.
For the most part, the rights proposed by Kaner are already enjoyed by
users of open source software. They
already have the right to transfer free software to other users. They don't
need to reverse engineer the software to check for security holes or to
fix bugs and security glitches -- they already have the source code.
(Nothing in any open source license would prevent a user from choosing
to do it the hard way, however.) Kaner proposes that users should have
the "right to see and approve all transfers of information from her
computer." While "spyware" is a constant danger posed by proprietary
software, with access to source code, users can make sure that a program
isn't secretly sending data off of their computer to another machine.
However, there are a few rights that would benefit users of open source
software. Firstly, the unfettered right to reverse-engineer proprietary
software
would be a major boon to the open source software community. As Kaner
points out, courts
have been willing to enforce clauses against reverse-engineering in
software licenses. This poses a problem for open source developers looking
to achieve interoperability with commercial software, operate embedded
devices with open source software or simply a way to access data saved in a
proprietary format.
Another right that Kaner proposes is "mass-market software should be
transferrable." As mentioned previously, users already enjoy the right
to transfer software that is licensed under a FOSS license. However,
most users of open source software still end up dealing with proprietary
software. How many open source users have purchased a laptop or desktop
computer with software preinstalled that will never be use by the
purchaser? The cost of a Windows XP license is built into the price of a
brand-new machine. The user should have the right to transfer that
software to another user who will make use of the software, if we so
choose.
The first item on Kaner's list, however, is "let the customer see the
contract before the
sale." This is particularly timely in light of Dell's hidden license
policy. Even some of the Linux vendors have started using the
"clickthrough" mechanism, with some of the Linux installers requiring
the user to agree to the terms of the open source licenses, without
allowing the user to read them first. This is probably done because of
the number of licenses involved -- most distributions include software
under the GNU General Public License (GPL), Lesser GPL, Artistic
License, Apache License, Mozilla License, BSD License and so on.
One potentially dangerous clause in Kaner's bill of rights is number
ten, "When software is embedded in a product, the law governing the
product should govern the software." Generally, this would be a good
thing. A hardware manufacturer should not be able to use licensing terms
to forbid the transfer of a router or network appliance by forbidding
the transfer of embedded software. Car manufacturers shouldn't be able
to exclude embedded software from warranties.
However, one wonders if this might make open source developers liable in
some way if their software is "embedded" in a product. Most, if not all,
FOSS licenses disclaim any warranty because the software is being given
away. What happens, however, if a court decides that embedded software
qualifies as "goods" and that developers can be held liable for defects
-- even if they have not charged for the software in the first place?
This may seem like a stretch, but we do live in a very litigious
society.
Kaner's proposed rights would be a dramatic improvement for users of
proprietary software, but they leave out many rights that FOSS users
take for granted. For example, users of FOSS software expect to have
access to source code. They also expect to be able to modify the
software, to add or remove features that they deem necessary or
desirable, and to be able to distribute the changes.
Despite the fact that the Software Customer Bill of Rights doesn't quite
match the average FOSS license in terms of customer rights, it would be
good to see it become reality. It's time to start reversing the current
legislative trends that have given far too much power, and too little
accountability, to vendors of proprietary software.
Comments (5 posted)
Page editor: Jonathan Corbet
Security
Brief items
A
recent CNN article asks why the Linux community hasn't used the Blaster
and SoBig worms for marketing purposes. The author concludes:
Etiquette and naiveté aside, however, perhaps the
biggest reason Linux companies haven't touted their products'
security advantages is that it's unclear right now how much of an
advantage they really possess. Consider this: The Computer
Emergency Response Team (CERT) released data showing that 16 of the
29 security advisories it released last year involved Linux or
open-source products.
This seems like a good time to go and look at what these advisories really
covered. CERT's 2002 advisories were:
Interestingly, we count 37 advisories for last year, not 29.
There is no contesting the fact that the Linux-related column is
significantly longer than the others. One could quibble a bit: the mod_ssl
worm advisory covers the same vulnerability as the OpenSSL advisory, and
the three trojan advisories are individual site compromises rather than
widespread vulnerabilities. But that sort of quibbling wouldn't really
change the situation.
On the other hand, it is a legimate question to ask why the mod_ssl worm
(which affected very few systems) merits a CERT advisory, when worms like
Klez, Bugbear, Badtrans, Nimda, and Sircam do not. The costs imposed by
any one of those worms is likely to exceed that of all the Linux
vulnerabilities put together.
The real point is that anybody who tries to make a security point by
counting advisories is building a weak argument. A more honest look at the
situation would ask how many vulnerabilities have been actively exploited,
and how quickly they have been fixed.
That said, we couldn't resist putting together a 2003 table while we were
at it:
This table suggests that the record for Linux-related software is nothing
to be all that proud of, but certain other operating systems are currently
in the lead in the "advisory count" race. On the other hand, in the
fast-changing free software world, it is somehow comforting to see that
sendmail continues to give advisory writers something to do - as long as
you're running a different MTA...
Comments (15 posted)
New vulnerabilities
gkrellm: buffer overflow
| Package(s): | gkrellm |
CVE #(s): | |
| Created: | August 29, 2003 |
Updated: | September 3, 2003 |
| Description: |
A buffer overflow was discovered in gkrellmd, the server component of the
gkrellm monitor package, in versions of gkrellm 2.1.x prior to 2.1.14.
This buffer overflow occurs while reading data from connected gkrellm
clients and can lead to possible arbitrary code execution as the user
running the gkrellmd server. |
| Alerts: |
|
Comments (none posted)
horde: session hijacking
| Package(s): | horde |
CVE #(s): | |
| Created: | September 1, 2003 |
Updated: | September 3, 2003 |
| Description: |
According to this
advisory an attacker could send an email to a victim who used HORDE
MTA, to get the victim to visit a website, which then logs all available
information about the victim's system. |
| Alerts: |
|
Comments (none posted)
mindi: insecure file creations
| Package(s): | mindi |
CVE #(s): | CAN-2003-0617
|
| Created: | September 2, 2003 |
Updated: | October 1, 2003 |
| Description: |
Mindi versions prior to 0.86 creates files in /tmp which could allow local
user to overwrite arbitrary files.
CAN-2003-0617 |
| Alerts: |
|
Comments (none posted)
node: buffer overflow, format string
| Package(s): | node |
CVE #(s): | |
| Created: | September 1, 2003 |
Updated: | September 3, 2003 |
| Description: |
Morgan alias SM6TKY discovered and fixed several security related
problems in LinuxNode, an Amateur Packet Radio Node program. The
buffer overflow he discovered can be used to gain unauthorised root
access and can be remotely triggered. |
| Alerts: |
|
Comments (none posted)
pam_ldap: non-functioning host restrictions
| Package(s): | pam_ldap |
CVE #(s): | |
| Created: | September 3, 2003 |
Updated: | September 3, 2003 |
| Description: |
pam_ldap 161 contains a bug in the pam_filter module which prevents host-based restrictions from working as advertised; version 1.62 fixes the problem. |
| Alerts: |
|
Comments (none posted)
phpwebsite: SQL Injection, DoS and XSS Vulnerabilities
| Package(s): | phpwebsite |
CVE #(s): | |
| Created: | September 2, 2003 |
Updated: | September 3, 2003 |
| Description: |
phpwebsite contains an sql injection vulnerability in the calendar
module which allows the attacker to execute sql queries. In addition
phpwebsite is also vulnerable to XSS. More information can be found in the
full
advisory. |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
2.4 kernel - several vulnerabilities
| Package(s): | 2.4 kernel |
CVE #(s): | CAN-2003-0461
CAN-2003-0462
CAN-2003-0464
CAN-2003-0476
CAN-2003-0501
CAN-2003-0550
CAN-2003-0551
CAN-2003-0552
|
| Created: | July 21, 2003 |
Updated: | December 24, 2003 |
| Description: |
Several security issues have been discovered affecting the Linux kernel:
-
CAN-2003-0461: /proc/tty/driver/serial reveals the exact character
counts for serial links. This could be used by a local attacker to infer
password lengths and inter-keystroke timings during password entry.
-
CAN-2003-0462: Paul Starzetz discovered a file read race condition
existing in the execve() system call, which could cause a local crash.
-
CAN-2003-0464: A recent change in the RPC code set the reuse flag on
newly-created sockets. Olaf Kirch noticed that his could allow normal
users to bind to UDP ports used for services such as nfsd.
-
CAN-2003-0476: The execve system call in Linux 2.4.x records the file
descriptor of the executable process in the file table of the calling
process, allowing local users to gain read access to restricted file
descriptors.
-
CAN-2003-0501: The /proc filesystem in Linux allows local users to
obtain sensitive information by opening various entries in /proc/self
before executing a setuid program. This causes the program to fail to
change the ownership and permissions of already opened entries.
-
CAN-2003-0550: The STP protocol is known to have no security, which
could allow attackers to alter the bridge topology. STP is now turned
off by default.
-
CAN-2003-0551: STP input processing was lax in its length checking,
which could lead to a denial of service.
-
CAN-2003-0552: Jerry Kreuscher discovered that the Forwarding table
could be spoofed by sending forged packets with bogus source addresses
the same as the local host.
|
| Alerts: |
|
Comments (none posted)
apache: multiple vulnerabilities in Apache HTTP server
| Package(s): | apache |
CVE #(s): | CAN-2003-0192
CAN-2003-0253
CAN-2003-0254
|
| Created: | July 11, 2003 |
Updated: | September 22, 2003 |
| Description: |
The Apache Software Foundation and
the Apache HTTP Server Project have announced
the release of the Apache HTTP Server 2.0.47. This release fixes four
security vulnerabilities:
- Certain sequences of per-directory renegotiations and the
SSLCipherSuite directive being used to upgrade from a weak ciphersuite to
a strong one could result in the weak ciphersuite being used in place of
the strong one. [CAN-2003-0192]
- Certain errors returned by accept() on rarely accessed ports could
cause temporal denial of service, due to a bug in the prefork MPM. [CAN-2003-0253]
- Denial of service was caused when target host is IPv6 but ftp proxy
server can't create IPv6 socket. [CAN-2003-0254]
- The server would crash when going into an infinite loop due to too
many subsequent internal redirects and nested subrequests. [VU#379828]
|
| Alerts: |
|
Comments (none posted)
atari800: buffer overflows
| Package(s): | atari800 |
CVE #(s): | CAN-2003-0630
|
| Created: | August 1, 2003 |
Updated: | September 2, 2003 |
| Description: |
Steve Kemp discovered multiple buffer overflows in atari800, an Atari
emulator. In order to directly access graphics hardware, one of the
affected programs is setuid root. A local attacker could exploit this
vulnerability to gain root privileges. |
| Alerts: |
|
Comments (none posted)
autorespond: buffer overflow
| Package(s): | autorespond |
CVE #(s): | CAN-2003-0654
|
| Created: | August 18, 2003 |
Updated: | October 1, 2003 |
| Description: |
Christian Jaeger discovered a buffer overflow in autorespond, an email
autoresponder used with qmail. This vulnerability could potentially
be exploited by a remote attacker to gain the privileges of a user who
has configured qmail to forward messages to autorespond. This
vulnerability is currently not believed to be exploitable due to
incidental limits on the length of the problematic input, but there
may be situations in which these limits do not apply.
CAN-2003-0654 |
| Alerts: |
|
Comments (none posted)
bind buffer overflow vulnerability in DNS resolver libraries
| Package(s): | bind glibc |
CVE #(s): | CAN-2002-0651
CAN-2002-0684
|
| Created: | July 8, 2002 |
Updated: | October 1, 2003 |
| Description: |
The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1)
include fixes for a libc related vulnerability which does not
affect Linux. Updates from
the Internet Software Consortium (ISC)
are available from here.
No release or branch of Openwall GNU/*/Linux (Owl) is known to be
affected, due to Olaf Kirch's fixes for this problem getting into the
GNU C library more than two years ago.
Unfortunatly that does not mean that Linux systems are not vulnerable.
Similar code, without Olaf Firch's fixes,
is in the glibc getnetbyXXX functions.
These functions are described in the SuSE alert as
"
used by very few applications only, such as ifconfig and ifuser,
which makes exploits less likely."
CERT Advisory: CA-2002-19
Buffer Overflow in Multiple DNS Resolver Libraries
CAN-2002-0651
CAN-2002-0684 |
| Alerts: |
|
Comments (1 posted)
Canna server: exploitable buffer overrun
| Package(s): | canna |
CVE #(s): | CAN-2002-1158
CAN-2002-1159
|
| Created: | December 10, 2002 |
Updated: | October 1, 2003 |
| Description: |
Canna is a kana-kanji conversion server which is necessary for Japanese
language character input.
A buffer overflow bug in the Canna server up to and including version 3.5b2
allows a local user to gain the privileges of the user 'bin' which could
lead to further exploits. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2002-1158 to this issue.
A lack of validation of requests has been found that affects Canna version
3.6 and earlier. A malicious remote user could exploit this vulnerability
to leak information, or cause a denial of service attack. (CAN-2002-1159)
See also
http://canna.sourceforge.jp/sec/Canna-2002-01.txt
CAN-2002-1158
CAN-2002-1159 |
| Alerts: |
|
Comments (none posted)
eroaster: insecure temporary file
| Package(s): | eroaster |
CVE #(s): | CAN-2003-0656
|
| Created: | August 19, 2003 |
Updated: | October 1, 2003 |
| Description: |
A vulnerability was discovered in eroaster where it does not take any
security precautions when creating a temporary file for the lockfile. This
vulnerability could be exploited to overwrite arbitrary files with the
privileges of the user running eroaster.
CAN-2003-0656 |
| Alerts: |
|
Comments (none posted)
ethereal: security problems in Ethereal 0.9.12
| Package(s): | ethereal |
CVE #(s): | CAN-2003-0428
CAN-2003-0429
CAN-2003-0431
CAN-2003-0432
|
| Created: | June 23, 2003 |
Updated: | November 10, 2003 |
| Description: |
Several security problems have been found in Ethereal
0.9.12. "It may be possible to make Ethereal crash or run
arbitrary code by injecting a purposefully malformed packet onto the wire,
or by convincing someone to read a malformed packet trace file." |
| Alerts: |
|
Comments (none posted)
Filename disclosure vulnerability in fam
| Package(s): | fam |
CVE #(s): | CAN-2002-0875
|
| Created: | August 19, 2002 |
Updated: | January 5, 2005 |
| Description: |
"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible. |
| Alerts: |
|
Comments (none posted)
fdclone: insecure temporary directory
| Package(s): | fdclone |
CVE #(s): | CAN-2003-0596
|
| Created: | July 23, 2003 |
Updated: | October 1, 2003 |
| Description: |
fdclone creates a temporary directory in /tmp as a workspace.
However, if this directory already exists, the existing directory is
used instead, regardless of its ownership or permissions. This would
allow an attacker to gain access to fdclone's temporary files and
their contents, or replace them with other files under the attacker's
control.
CAN-2003-0596 |
| Alerts: |
|
Comments (none posted)
fetchmail: buffer overflow
| Package(s): | fetchmail |
CVE #(s): | CAN-2002-1365
|
| Created: | December 17, 2002 |
Updated: | October 20, 2003 |
| Description: |
Versions of fetchmail prior to 6.2.0 have (yet another) buffer overflow vulnerability which can be exploited remotely via a suitably crafted message. See this advisory for details. |
| Alerts: |
|
Comments (3 posted)
gallery: cross-site scripting
| Package(s): | gallery |
CVE #(s): | CAN-2003-0614
|
| Created: | July 31, 2003 |
Updated: | September 2, 2003 |
| Description: |
Larry Nguyen discovered a cross site scripting vulnerability in gallery,
a web-based photo album written in php. This security flaw can allow a
malicious user to craft a URL that executes Javascript code on your
website. |
| Alerts: |
|
Comments (none posted)
GDM allows local user to read any file
| Package(s): | GDM, XDMCP |
CVE #(s): | CAN-2003-0547
CAN-2003-0548
CAN-2003-0549
|
| Created: | August 21, 2003 |
Updated: | August 29, 2003 |
| Description: |
GDM is the GNOME Display Manager for X.
Versions of GDM prior to 2.4.1.6 contain a bug where GDM will run as root
when examining the ~/.xsession-errors file when using the "examine session
errors" feature, allowing local users the ability to read any text file
on the system by creating a symlink. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0547 to this issue.
Additional problems may be found in the X Display Manager Control Protocol
(XDMCP) which allow a denial of service attack (DoS) by crashing the gdm
daemon. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names
CAN-2003-0548 and
CAN-2003-0549 to these issues. |
| Alerts: |
|
Comments (none posted)
glibc: DNS stub resolvers contain buffer overflow vulnerability
| Package(s): | glibc |
CVE #(s): | CAN-2002-1146
|
| Created: | November 7, 2002 |
Updated: | February 5, 2004 |
| Description: |
DNS stub resolvers from multiple vendors contain a buffer overflow
vulnerability. The impact of this vulnerability appears to be limited to
denial of service. (See CERT Vulnerability Note
VU#738331)
The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such
as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer
size instead of the actual size when processing a DNS response, which
causes the stub resolvers to read past the actual boundary ("read buffer
overflow"), allowing remote attackers to cause a denial of service
(crash).
|
| Alerts: |
|
Comments (none posted)
gnupg: key validation
| Package(s): | gnupg |
CVE #(s): | CAN-2003-0255
|
| Created: | May 16, 2003 |
Updated: | November 18, 2003 |
| Description: |
A key validation bug was discovered in the GNU Privacy Guard (GPG) which
would cause keys with more then one user ID to trust all user ID's with the
amount of trust given to the most-valid user ID. |
| Alerts: |
|
Comments (none posted)
gtkhtml: malformed messages cause crash
| Package(s): | gtkhtml |
CVE #(s): | CAN-2003-0133
CAN-2003-0541
|
| Created: | April 14, 2003 |
Updated: | April 18, 2005 |
| Description: |
GtkHTML is the HTML rendering widget used by the Evolution mail reader.
GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug
when handling HTML messages. Alan Cox discovered that certain malformed
messages could cause the Evolution mail component to crash. |
| Alerts: |
|
Comments (none posted)
kernel-utils: setuid vulnerability
| Package(s): | kernel-utils |
CVE #(s): | CAN-2003-0019
|
| Created: | February 7, 2003 |
Updated: | January 21, 2005 |
| Description: |
The kernel-utils package contains several utilities that can be used to
control the kernel or machine hardware. In Red Hat Linux 8.0 this package
contains user mode linux (UML) utilities.
The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was
incorrectly shipped setuid root. This could allow local users to control
certain network interfaces, add and remove arp entries and routes, and put
interfaces in and out of promiscuous mode.
All users of the kernel-utils package should update to these packages that
contain a version of uml_net that is not setuid root.
Alternatively, as a work-around to this vulnerability issue the following
command as root:
chmod -s /usr/bin/uml_net |
| Alerts: |
|
Comments (none posted)
libpam-smb: exploitable buffer overflow
| Package(s): | libpam-smb, pam-smb |
CVE #(s): | CAN-2003-0686
|
| Created: | August 26, 2003 |
Updated: | October 1, 2003 |
| Description: |
libpam-smb is a PAM authentication module which makes it possible to
authenticate users against a password database managed by Samba or a
Microsoft Windows server. If a long password is supplied, this can cause a
buffer overflow which could be exploited to execute arbitrary code with the
privileges of the process which invokes PAM services. See this advisory for more information.
CAN-2003-0686 |
| Alerts: |
|
Comments (1 posted)
libpng, libpng3: buffer overflow
| Package(s): | libpng, libpng3 |
CVE #(s): | CAN-2002-1363
|
| Created: | December 19, 2002 |
Updated: | July 14, 2004 |
| Description: |
Glenn Randers-Pehrson discovered a problem in connection with 16-bit
samples from libpng, an interface for reading and writing PNG
(Portable Network Graphics) format files. The starting offsets for
the loops are calculated incorrectly which causes a buffer overrun
beyond the beginning of the row buffer. |
| Alerts: |
|
Comments (none posted)
lynx: CRLF injection vulnerability
| Package(s): | lynx |
CVE #(s): | CAN-2002-1405
|
| Created: | November 19, 2002 |
Updated: | October 1, 2003 |
| Description: |
If lynx is given a url with some special characters on the command line, it
will include faked headers in the HTTP query. This feature can be used to
force scripts (that use Lynx for downloading files) to access the wrong
site on a web server with multiple virtual hosts.
CAN-2002-1405 |
| Alerts: |
|
Comments (none posted)
perl-MailTools: remote command execution
| Package(s): | MailTools |
CVE #(s): | CAN-2002-1271
|
| Created: | November 5, 2002 |
Updated: | September 19, 2003 |
| Description: |
The SuSE Security Team reviewed critical Perl modules, including the
Mail::Mailer package. This package contains a security hole which allows
remote attackers to execute arbitrary commands in certain circumstances.
This is due to the usage of mailx as default mailer which allows commands
to be embedded in the mail body.
Note that mail processing programs which use this package can be affected by this vulnerability; in particular, SpamAssassin is vulnerable if you use the -r or -w flags.
|
| Alerts: |
|
Comments (none posted)
mikmod: buffer overflow
| Package(s): | mikmod |
CVE #(s): | CAN-2003-0427
|
| Created: | June 16, 2003 |
Updated: | June 16, 2005 |
| Description: |
Ingo Saitz discovered a bug in mikmod whereby a long filename inside
an archive file can overflow a buffer when the archive is being read
by mikmod. |
| Alerts: |
|
Comments (none posted)
mpg123 - buffer overflow
| Package(s): | mpg123 |
CVE #(s): | CAN-2003-0577
|
| Created: | July 16, 2003 |
Updated: | September 30, 2003 |
| Description: |
The mpg123 utility contains a buffer overflow vulnerability which can allow an attacker to execute arbitrary code by way of a malicious MP3 file. |
| Alerts: |
|
Comments (none posted)
Nessus NASL scripting engine security issues
| Package(s): | nessus |
CVE #(s): | |
| Created: | May 27, 2003 |
Updated: | August 12, 2004 |
| Description: |
Some some vulnerabilities exsist in the Nessus NASL scripting engine. To
exploit these flaws, an attacker would need to have a valid Nessus account
as well as the ability to upload arbitrary Nessus plugins in the Nessus
server (this option is disabled by default) or he/she would need to trick a
user somehow into running a specially crafted nasl script. Read the full
advisory for additional information. |
| Alerts: |
|
Comments (none posted)
netris: buffer overflow
| Package(s): | netris |
CVE #(s): | CAN-2003-0685
|
| Created: | August 18, 2003 |
Updated: | October 1, 2003 |
| Description: |
Shaun Colley discovered a buffer overflow vulnerability in netris, a
network version of a popular puzzle game. A netris client connecting
to an untrusted netris server could be sent an unusually long data
packet, which would be copied into a fixed-length buffer without
bounds checking. This vulnerability could be exploited to gain the
priviliges of the user running netris in client mode, if they connect
to a hostile netris server.
CAN-2003-0685 |
| Alerts: |
|
Comments (none posted)
net-snmp: denial of service vulnerability
| Package(s): | net-snmp |
CVE #(s): | CAN-2002-1170
|
| Created: | December 17, 2002 |
Updated: | November 7, 2003 |
| Description: |
The SNMP daemon included in the Net-SNMP package versions 5.0.1 through
5.0.4 can be caused to crash if it is sent a specially crafted packet. |
| Alerts: |
|
Comments (none posted)
nfs-utils xlog() off-by-one bug
| Package(s): | nfs-utils |
CVE #(s): | CAN-2003-0252
|
| Created: | July 14, 2003 |
Updated: | March 8, 2004 |
| Description: |
Linux NFS utils package contains remotely exploitable off-by-one bug.
A local or remote attacker could exploit this vulnerability by sending
specially crafted request to rpc.mountd daemon. See this BugTraq post for more details. |
| Alerts: |
|
Comments (none posted)
openssh: timing attack leads to information disclosure
| Package(s): | openssh |
CVE #(s): | CAN-2003-0190
|
| Created: | May 2, 2003 |
Updated: | November 30, 2004 |
| Description: |
From the advisory:
"During a pen-test we stumbled across a nasty bug in OpenSSH-portable
with PAM support enabled (via the --with-pam configure script switch). This
bug allows a remote attacker to identify valid users on vulnerable systems,
through a simple timing attack. The vulnerability is easy to exploit and
may have high severity, if combined with poor password policies and other
security problems that allow local privilege escalation." |
| Alerts: |
|
Comments (1 posted)
pam-pgsql: format string vulnerability
| Package(s): | pam-pgsql |
CVE #(s): | CAN-2003-0672
|
| Created: | August 11, 2003 |
Updated: | October 1, 2003 |
| Description: |
Florian Zumbiehl reported a vulnerability in pam-pgsql whereby the
username to be used for authentication is used as a format string when
writing a log message. This vulnerability may allow an attacker to
execute arbitrary code with the privileges of the program requesting
PAM authentication.
CAN-2003-0672 |
| Alerts: |
|
Comments (none posted)
perl: cross site scripting vulnerability in CGI.pm module
| Package(s): | perl |
CVE #(s): | CAN-2003-0615
|
| Created: | July 29, 2003 |
Updated: | October 1, 2003 |
| Description: |
obscure@eyeonsecurity.org reported a
cross site scripting vulnerability in the CGI.pm perl module. This module
is used to facilitate the creation of web forms and is part of the
perl-modules RPM package.
CAN-2003-0615 |
| Alerts: |
|
Comments (none posted)
PHP: vulnerability in mail function
| Package(s): | php |
CVE #(s): | CAN-2002-0985
CAN-2002-0986
|
| Created: | November 13, 2002 |
Updated: | October 1, 2003 |
| Description: |
Two vulnerabilities exists in the mail() PHP function. The first one allows
the execution of any program/script bypassing safe_mode restriction, the
second one may give an open-relay script if the mail() function is not
carefully used in PHP scripts. See this Bugtraq
report for more details. Note that this is a different vulnerability than the previous PHP mail() problem, which affected versions through 4.1.0.
CAN-2002-0985
CAN-2002-0986 |
| Alerts: |
|
Comments (none posted)
phpgroupware - cross-site scripting and other exploits
| Package(s): | phpgroupware |
CVE #(s): | CAN-2003-0504
CAN-2003-0582
|
| Created: | July 16, 2003 |
Updated: | October 1, 2003 |
| Description: |
Several vulnerabilities were discovered in all versions of phpgroupware
prior to 0.9.14.006. This latest version fixes an exploitable condition in
all versions that can be exploited remotely without authentication and can
lead to arbitrary code execution on the web server. This vulnerability is
being actively exploited.
Version 0.9.14.005 fixed several other vulnerabilities including cross-site
scripting issues that can be exploited to obtain sensitive information such
as authentication cookies.
See this
Security Corportation report for more information.
CAN-2003-0504
CAN-2003-0582 |
| Alerts: |
|
Comments (none posted)
postfix: denial of service vulnerabilities
| Package(s): | postfix |
CVE #(s): | CAN-2003-0468
CAN-2003-0540
|
| Created: | August 5, 2003 |
Updated: | May 27, 2004 |
| Description: |
The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details. |
| Alerts: |
|
Comments (none posted)
PostgreSQL - more buffer overflows
| Package(s): | postgresql |
CVE #(s): | |
| Created: | February 12, 2003 |
Updated: | November 7, 2003 |
| Description: |
A new set of buffer overflows has been discovered in PostgreSQL 7.2.2; they affect the circle_poly(), path_encode(), and path_addr() functions. Exploiting these overflows requires that the attacker first obtain a connection to the PostgreSQL server. |
| Alerts: |
|
Comments (1 posted)
Local arbitrary code execution vulnerability in Python
| Package(s): | python |
CVE #(s): | CAN-2002-1119
|
| Created: | August 28, 2002 |
Updated: | October 1, 2003 |
| Description: |
Zack Weinberg discovered that
os._execvpe from os.py uses a predictable name which could lead
to execution of arbitrary code. According to the Debian
advisory, the problem
was present in Python versions 1.5, 2.1 and 2.2.
CAN-2002-1119 |
| Alerts: |
|
Comments (none posted)
Multiple-use vulnerability in Safe.pm
| Package(s): | Safe.pm |
CVE #(s): | CAN-2002-1323
|
| Created: | October 9, 2002 |
Updated: | February 20, 2004 |
| Description: |
usePerl has a
description of a vulnerability in the Safe.pm Perl module. It seems
that if a Safe compartment is used more than once, it ceases to be safe.
The problem is fixed in Safe 2.08. |
| Alerts: |
|
Comments (none posted)
semi: insecure temporary file
| Package(s): | semi, wemi |
CVE #(s): | CAN-2003-0440
|
| Created: | July 7, 2003 |
Updated: | October 1, 2003 |
| Description: |
semi, a MIME library for GNU Emacs, does not take appropriate
security precautions when creating temporary files. This bug could
potentially be exploited to overwrite arbitrary files with the
privileges of the user running Emacs and semi, potentially with
contents supplied by the attacker.
wemi is a fork of semi, and contains the same bug.
CAN-2003-0440 |
| Alerts: |
|
Comments (none posted)
sendmail: bad DNS reply causes crash
| Package(s): | sendmail |
CVE #(s): | CAN-2003-0688
|
| Created: | August 26, 2003 |
Updated: | October 1, 2003 |
| Description: |
There is a potential problem in sendmail 8.12.8 and earlier sendmail 8.12.x
versions with respect to DNS maps. The bug did not exist in versions before
8.12 as the DNS map type is new to 8.12. The bug was fixed in 8.12.9,
released March 29, 2003. See this advisory for more
information.
CAN-2003-0688 |
| Alerts: |
|
Comments (none posted)
stunnel: signal handler reentrancy DoS
| Package(s): | stunnel |
CVE #(s): | CAN-2002-1563
|
| Created: | July 25, 2003 |
Updated: | November 25, 2003 |
| Description: |
Stunnel is a wrapper for network connections. It can be used to tunnel an
unencrypted network connection over a secure connection (encrypted using
SSL or TLS) or to provide a secure means of connecting to services that do
not natively support encryption.
When configured to listen for incoming connections (instead of being
invoked by xinetd), stunnel can be configured to either start a thread or a
child process to handle each new connection. If Stunnel is configured to
start a new child process to handle each connection, it will receive a
SIGCHLD signal when that child exits.
Stunnel versions prior to 4.04 would perform tasks in the SIGCHLD signal
handler which, if interrupted by another SIGCHLD signal, could be unsafe.
This could lead to a denial of service. |
| Alerts: |
|
Comments (none posted)
sup: insecure temporary file
| Package(s): | sup |
CVE #(s): | CAN-2003-0606
|
| Created: | July 29, 2003 |
Updated: | October 1, 2003 |
| Description: |
sup, a package used to maintain collections of files in identical
versions across machines, fails to take appropriate security
precautions when creating temporary files. A local attacker could
exploit this vulnerability to overwrite arbitrary files with the
privileges of the user running sup.
CAN-2003-0606 |
| Alerts: |
|
Comments (none posted)
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip |
CVE #(s): | CAN-2001-1267
CAN-2001-1268
CAN-2001-1269
CAN-2002-0399
|
| Created: | October 1, 2002 |
Updated: | April 10, 2006 |
| Description: |
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability. |
| Alerts: |
|
Comments (1 posted)
teapop: SQL injection
| Package(s): | teapop |
CVE #(s): | CAN-2003-0515
|
| Created: | July 9, 2003 |
Updated: | October 1, 2003 |
| Description: |
teapop, a POP-3 server, includes modules for authenticating users
against a PostgreSQL or MySQL database. These modules do not properly
escape user-supplied strings before using them in SQL queries. This
vulnerability could be exploited to execute arbitrary SQL under the
privileges of the database user as which teapop has authenticated.
CAN-2003-0515 |
| Alerts: |
|
Comments (none posted)
Multiple vendor telnetd vulnerability
| Package(s): | telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5 |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | October 5, 2004 |
| Description: |
This vulnerability,
originally thought to be confined to BSD-derived systems, was first covered
in the July 26th Security
Summary. It is now known that Linux telnet daemons are vulnerable as
well.
|
| Alerts: |
|
Comments (none posted)
unzip: directory traversal vulnerability
| Package(s): | unzip |
CVE #(s): | CAN-2003-0282
|
| Created: | July 1, 2003 |
Updated: | November 13, 2003 |
| Description: |
A vulnerabilitiy in unzip version 5.50 and earlier allows attackers to
overwrite arbitrary files during archive extraction by placing invalid
(non-printable) characters between two "." characters. These non-printable
characters are filtered, resulting in a ".." sequence. See the full
advisory for further information. |
| Alerts: |
|
Comments (none posted)
vim - modeline vulnerability
| Package(s): | vim |
CVE #(s): | CAN-2002-1377
|
| Created: | January 16, 2003 |
Updated: | February 10, 2004 |
| Description: |
VIM allows a user to set the modeline differently for each edited text file
by placing special comments in the files. Georgi Guninski found that these
comments can be carefully crafted in order to call external programs. This
could allow an attacker to create a text file such that when it is opened
arbitrary commands are executed. |
| Alerts: |
|
Comments (4 posted)
vixie-cron: Local vulnerability
| Package(s): | vixie-cron |
CVE #(s): | CVE-2001-0559
|
| Created: | April 17, 2003 |
Updated: | October 3, 2003 |
| Description: |
From the ISS
advisory:
"Vixie Cron is a scheduling daemon that ships with several Linux
distributions. Vixie Cron version 3.0pl1 could allow a local attacker to
gain root privileges. Crontab fails to properly drop privileges in certain
cases after a crontab modification operation. A local attacker could
exploit this vulnerability to gain root privileges on the system since
crontab is installed setuid root."
Note: this vulnerability is dated May 07 2001, and was first mentioned in
LWN on the May 10,
2001 security page. |
| Alerts: |
|
Comments (none posted)
vmware-workstation: vulnerability allows full host access
| Package(s): | vmware-workstation |
CVE #(s): | CAN-2003-0480
CAN-2003-0631
|
| Created: | August 25, 2003 |
Updated: | September 2, 2003 |
| Description: |
According to this
advisory vulnerabilities exist in VMware GSX Server 2.5.1 and earlier,
and in VMware Workstation 4.0 and earlier releases. "By manipulating
the VMware GSX Server and VMware Workstation environment variables, a
program such as a shell session with root privileges could be started when
a virtual machine is launched. The user would then have full access to the
host."
See also
CAN-2003-0480 and
CAN-2003-0631 |
| Alerts: |
|
Comments (1 posted)
webmin: session ID spoofing
| Package(s): | webmin |
CVE #(s): | CAN-2003-0101
|
| Created: | June 13, 2003 |
Updated: | November 18, 2003 |
| Description: |
miniserv.pl in the webmin package does not properly handle
metacharacters, such as line feeds and carriage returns, in
Base64-encoded strings used in Basic authentication. This
vulnerability allows remote attackers to spoof a session ID, and
thereby gain root privileges. |
| Alerts: |
|
Comments (none posted)
wget:directory traversal bug
| Package(s): | wget |
CVE #(s): | CAN-2002-1344
|
| Created: | December 10, 2002 |
Updated: | October 1, 2003 |
| Description: |
Versions of wget prior to 1.8.2-4 contain a bug that permits a malicious
FTP server to create or overwrite files anywhere on the local file system.
FTP clients must check to see if an FTP server's response to the NLST
command includes any directory information along with the list of filenames
required by the FTP protocol (RFC 959, section 4.1.3).
If the FTP client fails to do so, a malicious FTP server can send filenames
beginning with '/' or containing '/../' which can be used to direct a
vulnerable FTP client to write files (such as .forward, .rhosts, .shosts,
etc.) that can then be used for later attacks against the client machine.
See also
this Bugtraq article from 1997.
CAN-2002-1344 |
| Alerts: |
|
Comments (none posted)
wget: buffer overflow
| Package(s): | wget |
CVE #(s): | CAN-2003-1565
|
| Created: | August 5, 2003 |
Updated: | December 10, 2003 |
| Description: |
The wget utility contains a buffer overflow which, when exploited with an over-long URL, can enable arbitrary code execution. |
| Alerts: |
|
Comments (1 posted)
wu-ftpd: off-by-one bug
| Package(s): | wu-ftpd |
CVE #(s): | CAN-2003-0466
|
| Created: | July 31, 2003 |
Updated: | October 5, 2003 |
| Description: |
An off-by-one bug has been discovered in versions of wu-ftpd up to and
including 2.6.2. On a vulnerable system, a remote attacker would be able
to exploit this bug to gain root privileges. See this advisory for more details. |
| Alerts: |
|
Comments (none posted)
Wwwoffle remote privilege escalation vulnerability
| Package(s): | wwwoffle |
CVE #(s): | CAN-2002-0818
|
| Created: | August 14, 2002 |
Updated: | October 1, 2003 |
| Description: |
The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests
with negative Content Length values.
"It is believed
that an attacker could exploit this bug to gain remote wwwrun access
to the system wwwoffled is running on."
CAN-2002-0818 |
| Alerts: |
|
Comments (none posted)
xinetd: Memory leak in xinetd 2.3.10
| Package(s): | xinetd |
CVE #(s): | CAN-2003-0211
|
| Created: | May 13, 2003 |
Updated: | November 13, 2003 |
| Description: |
Xinetd is a 'master server' that is used to to accept service connection
requests and start the appropriate servers.
Because of a programming error, memory was allocated and never freed if a
connection was refused for any reason. An attacker could exploit this flaw
to crash the xinetd server, rendering all services it controls unavailable.
In addition, other flaws in xinetd could cause incorrect operation in
certain unusual server configurations.
All users of xinetd are advised to update to xinetd-2.3.11 which is not
vulnerable to these issues. |
| Alerts: |
|
Comments (none posted)
zblast: buffer overflow
| Package(s): | zblast |
CVE #(s): | CAN-2003-0613
|
| Created: | August 11, 2003 |
Updated: | October 1, 2003 |
| Description: |
Steve Kemp discovered a buffer overflow in zblast-svgalib, when saving
the high score file. This vulnerability could be exploited by a local
user to gain gid 'games', if they can achieve a high score.
CAN-2003-0613 |
| Alerts: |
|
Comments (1 posted)
Resources
The Open Source Security Testing Methodology Manual (OSSTMM) is an open
standard method for performing security tests, focusing on the items that
need to be tested, what to do during a security test, and when different
types of security tests should be performed.
Full Story (comments: none)
Page editor: Jonathan Corbet
Kernel development
Brief items
The current development kernel is 2.6.0-test4; Linus has not
released any kernels since August 22.
That situation may have changed by the time you read this, however; Linus
is back from his vacation and has merged a great many changes into his
BitKeeper tree. Patches there include
a reworked de4x5 driver, "very basic" VIA 8237 serial ATA controller
support, a set of MODULE_ALIAS() calls (see below), support for a
software-implemented hard disk activity LED, Intel High Precision
Event Timers support, Al Viro's first set of large dev_t
support patches (covered here last week),
some IDE work, a large USB update, lots of network driver fixes, a new set
of iptables modules, and many other fixes.
The current stable kernel is 2.4.22. Marcelo released the second 2.4.23 prepatch on
August 30; it contains a set of IDE patches, some
USB and networking fixes, and a number of other updates.
2.4.23-pre3 followed on September 3,
with a fair amount of networking work, a backport of the 2.6
request_firmware() interface, a DRI/DRM update, gcc-3.3 support, and
various other fixes.
Marcelo also notes that he has left Conectiva; his kernel work is now being
supported by Cyclades.
Comments (3 posted)
Kernel development news
The
Class-based Kernel Resource Management
(CKRM) project is an effort at IBM to provide the hooks for better control
over resource consumption by processes. The CKRM project sees the existing
resource management tools (
nice,
ulimit) as not being up
to the task. So the CKRM hackers have set out to provide a whole new
infrastructure for process control. The ideas were presented at the Ottawa
Linux Symposium last July; now, the first set of patches has been posted.
The
overview posting describes the other
patches in the set and gives some pointers to further information.
The core concept behind CKRM is the division of processes into distinct
classes, each of which has a separate set of policies applied to it. A
kernel API has been provided which enables the loading of classifier
modules, enabling different sites to have entirely different ways of
classifying processes. Most would likely stick with the rule-based classifier, which is provided with
the CKRM patch set; it allows
classification based on various task structure fields. So, for example,
processes can be classified based on their UID, which program they are
running, etc.
Tasks can be reclassified any number of times over their lifetime. The CKRM core patch places hooks in the logical
spots where a process could change classification: when a user or group ID
is changed, when a program calls exec(), when a new process is forked,
etc. There is also a plan for a system call allowing a process to request
reclassification at any time, but that call does not appear to be present
in the current patches.
Once a task is classified, the system can apply policies to that task. So,
for example, the CPU control patch enforces
CPU usage policies on processes. Essentially, each class (as a whole) can
be restricted to (and guaranteed) access to a administrator-specified
percentage of the available processor time. To implement this policy, the
patch modifies the scheduler by creating a new run queue for each class.
Before the scheduler picks a new process to run, it first decides which
class has the highest-priority claim on the CPU. The process to run can
then be chosen from that class's queue in the usual way.
The memory control patch, instead,
implements policies stating how much physical memory each class can use.
The patch hooks into the page reclamation code, making that code rather
more selective in how it choses pages to kick out of main memory. Whenever
possible, the page reclaimer only choses pages from classes which are going
over their maximum allowed share of physical memory. As memory gets
tighter, each class will be trimmed down to its minimum share, as set up by
the administrator. If there is no real pressure on memory, however,
processes are allowed to grow beyond the bounds set for their class.
The memory control problem is complicated by shared pages: what happens
when pages are shared between processes in different classes? The
documentation on the CKRM web site describes an elaborate mechanism where
classes are set up in a hierarchy and shared pages are divided across the
appropriate parts of that hierarchy. What the current code appears to do,
however, is to simply assign shared pages to the class with the largest
share of physical memory.
The CKRM team also describes mechanisms which allow control over the disk
I/O bandwidth used by each class and the number of incoming network
connections each class can be handling at a given time. The I/O
limitations are implemented by adding per-class queues to the disk I/O
scheduler and merging requests into a single dispatch queue with the
bandwidth policies taken into account. The networking policies involve the
creation of yet another set of class-specific queues; in this case,
incoming connections are divided into classes through the use of iptables
rules. Patches for I/O bandwidth and incoming network connection control
have not been released at this time, however.
CKRM is clearly a work in progress; much of the structure is in place, but
not everything has been implemented and the code is full of "this needs to
be cleaned up" comments. The CKRM hackers hope to get their work into 2.7,
however, so they have some time yet to work things into shape.
Comments (4 posted)
One of the surprises in 2.6.0-test4 was the merge of a pile of power
management patches from Patrick Mochel. The patches themselves were not a
surprise; their arrival has been expected for some time. In fact, at the
Ottawa Linux Symposium, Patrick had promised to try to get them in by
August 20. The surprising part is that they went straight to Linus,
with no prior appearance on linux-kernel.
The -test4 patches made a number of changes. Perhaps the most significant
were the move of the device suspend() and resume()
methods out of the device structure and into the bus_type
structure. Bus-level code now is explicitly responsible for handling power
management operations on devices attached to the bus.
Also changed in -test4 was the software suspend code; this code has been
massively reworked and cleaned up. A number of panic() calls have
been removed, requirements have been made explicit, the underlying
mechanisms are more flexible, and the code is somewhat easier to read. The
only problem is that, in -test4, software suspend also no longer works.
The various problems which were introduced are being fixed, but one kernel
developer in particular - the 2.6 software suspend maintainer - has been
very loud in his criticisms and complaints. As a result, Patrick has
stated that he will no longer go anywhere near the software suspend code.
He evidently has his own implementation which he has chosen not to merge so
far; it may put in an appearance in the near future.
Patrick also took some grief for the removal of /proc/acpi/sleep,
which no longer fits well into the power management structure. It is,
however, an interface which has been present for a while, and can thus
break user-space programs.
Given all that, it is perhaps not surprising that Patrick announced his next set of changes on
linux-kernel before sending them off to Linus. With these changes, the
various suspend states all work with ACPI - at least, on a system without
much going on. There is still a lot of work to do, especially with regard
to adding driver support. But things appear to be heading in the right
direction.
The new set of patches restores /proc/acpi/sleep, and the older
software_suspend() function (as a wrapper for the current
pm_suspend() function) as well. A number of software suspend
improvements have been added. And various other aspects of the code
have been cleaned up. With one exception, the developers are not
complaining about the new power management code. With luck, one of the
remaining 2.6 rough edges will soon be smoothed out.
Comments (none posted)
The Linux kernel has long had the capability to load modules on demand when
external events make their presence necessary. In many cases, the kernel
knows exactly which module is required, and can simply ask for it by name.
So, for example, the IDE subsystem can call:
request_module("ide-cd");
should it encounter a CD needing a driver. In many cases, however, the
kernel does not know exactly which module should be loaded; in these cases
it punts the question into user space. So, for example, if a user program
tries to open a block device node with major number 100, and no driver has
registered that number, the kernel will try to load a module called
block-major-100. The job of finding a module then falls on
modprobe, which will expect to find an alias line in
/etc/modules.conf telling it what module should really be loaded.
The only problem with this scheme is that device drivers usually already
know which device numbers they are prepared to support. Adding
configuration information to /etc/modules.conf is, at best,
redundant. It can also be misleading; the poor administrator who tries to
connect a driver to a different device number via modules.conf is
unlikely to experience much joy.
When the new module loader was added - almost one year ago, now - it
included a new MODULE_ALIAS macro. The purpose of this macro is
to allow driver authors to specify directly which aliases the module should
be responsible for. It is an idea that makes sense, but uptake has been
slow; a quick grep of the 2.6.0-test4 source shows that there is not a
single use of MODULE_ALIAS in the kernel tree.
That situation appears to be about to change, now that Rusty Russell has
released a set of patches which insert actual MODULE_ALIAS calls
into the kernel source. The actual variants used depend on the subsystem;
block drivers use MODULE_ALIAS_BLOCKDEV, for example, while char
devices use MODULE_ALIAS_CHARDEV or MODULE_ALIAS_MISCDEV
and network protocols use MODULE_ALIAS_NETPROTO.
There are still situations which require alias commands in the
modules.conf file: there is no way for a driver author to know
which module should be loaded to implement eth0, for example. But
many of the boilerplate aliases can be, eventually, removed. Internal
alias support has been present in module-init-tools for some time, so all
that's needed before the alias commands can be cleaned up is to
get rid of all those legacy 2.4 (and prior) kernels.
Comments (none posted)
Patches and updates
Kernel trees
- Andrew Morton: 2.6.0-test4-mm5. "<span>Dropped out Con's CPU scheduler work, added Nick's. This is to help us
in evaluating the stability, efficacy and relative performance of Nick's
work.</span>"
(September 3, 2003)
- Andrea Arcangeli: 2.4.22aa1.
(September 2, 2003)
Core kernel code
- Con Kolivas: O19int.
(August 29, 2003)
- Con Kolivas: O20int.
(September 3, 2003)
Development tools
Device drivers
Filesystems and block I/O
Janitorial
Kernel building
Memory management
Networking
Architecture-specific
Benchmarks and bugs
Miscellaneous
Page editor: Jonathan Corbet
Distributions
News and Editorials
[This article was contributed by Ladislav Bodnar]
September traditionally means back to school in many parts of the Northern
Hemisphere and this year is no different. What
will be different,
however, is the operating system that many Norwegian pupils will find on
their school's computers once they return to the classrooms. That's because
despite the excruciating heat wave that hit much of Europe this summer, the
Skolelinux developers did not take a
break. Skolelinux? Yes, Skolelinux, a project to create a Linux distribution
with the goal of replacing the proprietary operating systems in schools
throughout Norway. The project's two primary objectives are the ability to
run on low-end computer systems as well as a complete support for all
Norwegian languages, including the minority ones.
Knut Yrvin, the Project Leader at Skolelinux kindly agreed to answer a few
questions for LWN.
Knut, thank you very much for your time. Firstly, can you tell us about the
beginnings of Skolelinux? What motivated the initiation of the project?
It all started when Petter [Reinholdtsen, the project's
system architect] and myself, were attending a summer party one day in June
2001. We talked about how sad it was that most local schools had little
besides old computers and a few applications running on Windows, and very
little money for upgrades. We found it frustrating that closed-source
software prevented our pupils interested in technical, under-the-hood things
from learning by example - from source code written by expert programmers.
That's when we decided to stop talking about it and simply do it. We had a
start-up meeting on July 2, 2001, with 13 participants and 12 other
interested parties who could not attend personally.
As the name suggests, Skolelinux is specifically designed for deployment in
schools. How do you go about convincing schools to switch to Skolelinux?
We use the "seeing is believing" strategy. We let
teachers try Skolelinux for themselves and make a decision only once they've
used it. We also get a lot of help from the Unix/Linux User Groups around the
country who are helping with deployment. The whole process is then
self-propagating; we often get references and hear about installations in
places we didn't even know existed!
We have also written a considerable amount of tailor-made documentation for
teachers. We provide a day-to-day Operation Handbook, a Getting Started
guide, a Get-to-know Skolelinux course, and other documents. Everything is
written in Norwegian in a simple, non-technical language.
IBM Norway is helping as well. They started promoting Skolelinux in December
2002 and soon afterwards many more hardware vendors jumped on the bandwagon.
Suddenly there seems to a be a lot of momentum behind the Skolelinux project!
How many schools are using Skolelinux at present?
Officially about 20. But unofficially we have reports of
entire towns, municipalities and counties that are testing Skolelinux in one
or two schools before making an official commitment. We know of an IT
department responsible for all schools in one city which has agreed not to
disclose their plans to deploy Skolelinux just to avoid the inevitable
bureaucracy associated with such a transition. We also know of 8 or 9
communities, which are going to switch to Skolelinux later this year. We have
asked them to do it slowly in the beginning to gain experience (and to let us
sort out the 5 remaining release critical bugs ;-)).
What kind of response have you been getting from schools? Would you say that
there is a lot of enthusiasm for Linux? Have you met with any resistance?
Yes, we have met with opposing ideas. These usually come
from the administration in municipalities and Microsoft professionals who
believe that "Windows is the answer, what's the question again?". We try to
by-pass them and go straight to the schools' principals asking them about
important values, such as the use of the Norwegian languages, IT budgets, and
Internet-based solutions in cases where The Ministry of Education and Science
mandates that schools conduct their examinations on the Internet.
In Spain, there are several provinces the governments of which have mandated
exclusive use of Linux in all levels of schools. Is there a similar situation
in Norway? Do you get any support from the Norwegian government?
The government helped financing the initial project
report which discussed the use of free software in education and funding of
associated activities. There is a will to continue contributing in the future
so that the mostly voluntary work can be transformed into secure jobs for the
people involved.
The development, translation, deployment, maintenance and support of
Skolelinux costs money. How do you go about raising funds for your work?
Initially, it was the
NUUG Foundation which helped funding the effort.
They have covered the cost of travel to developer meetings from various parts
of Norway and even from other countries. Now there are 4 or 5 of us on their
payroll to ensure the continuity of the development, effective project
leadership and translation work.
Every successful deployment of Skolelinux in a Norwegian school means a lost
sale for Microsoft. Has there been any reaction from Microsoft Norway?
Well, we did receive a letter from Steve Ballmer wishing
us good luck with the Skolelinux project. This was after a meeting with
Microsoft and a round-table conference with some well known IT-personalities
in Norway. The meeting was initiated by Microsoft Norway who invited us to
join a 60-minute discussion to talk about some controversial issues regarding
the way Microsoft conducts some of their business. It was interesting and
Ballmer was up to speed on questions like security, intellectual property
rights, etc. Unfortunately, he had to leave early, just when the discussion
was beginning to heat up. Anyway, we are of the opinion that Microsoft people
are nice, and hopefully they think the same about us. We don't agree on some
crucial principles concerning the ownership of the source code, but we try to
focus on our task, rather than politics. However, we know that Microsoft has
offered some Norwegian schools huge discounts to undermine the advancements
of Skolelinux.
You have chosen Debian GNU/Linux as a base for your distribution. Any
particular reasons?
The openness, Debian project's acceptance of our
contributions, apt-get, the conservative and well-tested packages and of
course, the community - these were the main reasons.
From the technical point of view, what exactly is the main focus of your
development work?
We currently work on a new Debian installer as well as
an out-of-the-box services and network setup. We have also created a user
administration system with LDAP, Webmin, and netgroups. This is because the
IT coordinators in schools need an easy-to-use, web-based and secure system
for creating and managing user accounts for pupils and teachers. Another
essential area of our work is writing user-friendly documentation in local
languages.
Knut, thank you very much for your time and good luck with your project!
Comments (2 posted)
Distribution News
The
Debian Weekly News for September 2, 2003
is out. This week's edition looks at software patents in Europe; a talk on
Debian GNU/Linux as a Japanese language teaching platform; Opteron support;
for Debian Developers; and much more.
Branden Robinson reports on the results of a
survey which followed a lengthy debate on the debian-legal mailing
list concerning whether the GNU Free Documentation License satifies the
Debian Free Software Guidelines. Meanwhile, the debate continues.
Last October, Bdale Garbee arranged a group
subscription to LWN.net for Debian developers, sponsored by HP. In
response to questions, Bdale has recently noted that the Debian group subscription is
still available. For those
of you who have opted to keep your own subscription to help out LWN, you
have our thanks. However, if you are a Debian developer and not currently
subscribed to LWN you might want to take advantage of Debian's group
subscription.
Comments (none posted)
The September 1 Gentoo Weekly Newsletter is out; it looks at the
availability of portage tarballs for OpenBSD and FreeBSD and the second
Gentoo BugDay. The project is also looking for a new lead French
translator.
Full Story (comments: none)
LinuxQuestions.org has
announced
the addition of a Red Hat
forum that is officially recognized by Red Hat.
Comments (none posted)
At
Slackware Linux the
slackware-current
changelog shows lots of activity. Lots of packages have been upgraded,
including the Linux kernel (to 2.4.22). Bugs have been created and
squashed in the process.
Comments (1 posted)
NewsForge
interviews Alex de Landgraaf, founder of Morphix. "
When did you start Morphix and why? I actually started playing around with Knoppix, was pretty active on knoppix.net, in December 2002. I had a remastered version called KnopNL, because I was planning to make a light-weight Dutch distribution. There was (and still is) a lively community working on making specific distributions using Knoppix, but I saw time and time again that people had to "put Knoppix on a diet" and merge new changes from Knoppix before they could do anything useful."
Comments (none posted)
O'ReillyNet
looks
at FreeBSD's portupgrade utility. "
The ports collection is
constantly being updated. New ports are added regularly, usually on a daily
basis. If you're the curious type and like to see a layout of which ports
were added when, you'll find FreshPorts an invaluable resource."
Comments (none posted)
Beehive Linux is dead. From the
obituary:
My reasons for stopping Beehive are 1) Mac OSX simply kicks ass as a
desktop. Been using it as my only desktop since 10.0 came out. No more
futzing with configs, things just work. 2) Gentoo works well enough, and
it's reasonably easy to mod the build configs for a given package
(Apache, MySQL, Postgres, etc) to put the install where I want
it. Overall it's 'good enough' and the Portage tool is really nice.
Comments (none posted)
Minor distribution updates
Astaro Security Linux
has released
v4.011
with minor security fixes and
v4.012 with minor
bugfixes. "
Changes: This Up2Date added LOGACCEPT to packet filtering
and year support for log files. It also fixed the WebAdmin port after
importing a backup, the Autofilter bug with PSK authentication, an iptables
rules/DNSproxy settings conflict when the proxy was disabled, and a PPTP
daemon connection limitation. The POP3 proxy was fixed for clients that
didn't terminate connections properly." Version 4.012 fixes a small
issue with SMTP domain routing which occurs in very rare cases.
Comments (none posted)
BG-Rescue Linux
has released
v0.2.0
with major feature enhancements. "
Changes: This release updates
uClibc to 0.9.20, e2fsprogs to 1.3.4, reiserfsprogs to 3.6.11, LILO to
22.5.7.2, and mdadm to 1.3.0. It adds cmdftp 0.62 and a new Linux kernel
2.4.22 (bzip2) with additional support for USB 2.0 EHCI, PCMCIA serial
devices, and the following ethernet adaptors: 3c590/3c900, eepro100, VIA
Rhine, TI ThunderLAN, USB-Realtek RTL8150, and USB-ASIX AX88172."
Comments (none posted)
bootE Linux has released
v0.20-r2 with minor
feature enhancements. "
Changes: In addition to a few minor
adjustments, support for MS-DOS and VFAT file systems were compiled back
into the kernel. Furthermore support for ReiserFS was added."
Comments (none posted)
Damn Small Linux has released
v0.4.5 with minor
feature enhancements. "
Changes: This version adds generic printer
support. Fluxbox and most X applications are now running under user instead
of root. sudo and Microcom were added. Oneko was added for the kids. The
swap partition should now be properly recognized which makes DSL more
compatible with low RAM systems. A tabs- and frames-enabled, patched
version of Dillo was added. The icons were remapped so that they fit in the
smallest resolution setting. The enhance feature is now smarter, so that it
will not launch duplicate applications, but will bring bbpager into theme
compliance."
Comments (none posted)
floppyfw has released
stable v2.0.7 with minor
bugfixes and the 2.4.22 kernel was included.
Comments (none posted)
L.A.S. Linux has released 0.4b MAIN of its 'live CD'
distribution. "
Changes in this latest version of L.A.S. include the
addition of Ettercap-GTK, Clam Anti-Virus, MiniCOM, SpikeProxy, MRTG, and
many of the Cisco-centric Open Source Exchange tools."
Full Story (comments: none)
MoviX has released
v0.8.0 with minor feature
enhancements. "
Changes: Support for remotes has been improved, the
size of initrd has been reduced, and Italian translations have been
added."
Comments (none posted)
Onebase Linux has released
version 1.0 for x86 systems. Also Onebase is now set to form a Developer
base for this project and
everyone is invited to join.
Comments (none posted)
Recovery
Is Possible! (RIP) has released
v6.0 with major feature
enhancements. "
Changes: The kernel has been updated to 2.4.22. There
are a lot of changes, and new floppy versions (1.44 MB and 1.68
MB)."
Comments (none posted)
Rock Linux has released
v2.0.0-rc1 with minor
bugfixes. "
Changes: In this release, more help text was added, a
major cleanup of Emerge-Pkg was made, some new packages were added forming
a total package count of nearly 900 packages, there were boot CD
improvements, some init scripts were corrected for LSB conformance, and a
better optimization selection for PowerPC resulting in better optimization
settings, as well as many more cleanups and bugfixes."
dRock v2.0.0-rc1 is
also out. "Changes: This release is based on ROCK Linux
2.0.0-rc1. It includes minor bugfixes and feature additions, including
better optimization settings for PowerPC."
Comments (none posted)
Distribution reviews
Open for Business
reviews Mandrake Linux 9.1 ProSuite. "
For our evaluation of
Mandrake Linux 9.1, we received a copy of Mandrake Linux ProSuite
9.1. ProSuite is Mandrake's high-end package that offers a number of useful
features for enterprise deployment on both desktops and servers. Of
particular interest is the DVD-ROM that is included, something that makes
deploying Mandrake much more of a joy. Like SuSE's Professional Edition DVD
(actually the latest SuSE includes two DVD's, but we only needed the one),
Mandrake ProSuite's DVD allows you to use just one disc to install pretty
much everything you could ever want on a GNU/Linux system."
Comments (none posted)
Page editor: Rebecca Sobol
Development
The second beta release of the GNOME 2.4 desktop is now available; see
the
announcement on FootNotes for download information. Given that the
real 2.4 release is intended to happen in early September, it seems like a
good idea to have a look at what this release will bring. It would appear,
however, that the GNOME folks have been too busy hacking to put together a
comprehensive document on what's been done in the 2.3 development series.
So the best place to look is
this writeup by Sayamindu
Dasgupta, who played around with the 2.3.5 release for a bit.
One enhancement in 2.4 will be a new set of system administration tools.
There have been a number of attempts at graphical adminstration tools for
Linux over the years; with mixed success. Combining the numerous
utilities, configuration files, and setup schemes into a unified interface
is a hard problem. It is good to see that work is continuing in this area,
however. Eventually somebody will get it right.
A good step in that direction is the new "change screen resolution"
dialog. Linux doesn't require constant tweaking of the display settings
the way certain other desktop operating systems seem to, but it's still a
good idea to make it easy when the need arises.
On the browser front, Galeon is gone. Epiphany is now the browser bundled
with GNOME. Some quick tests here in LWN labs (where Galeon has long ruled
supreme) show that Epiphany pretty much works as expected; it is a
reasonable, functioning browser. But we'll probably keep Galeon around for
a while yet.
Accessibility is an important theme with 2.4; the "gnopernicus" screen
reader has been improved and fixed up. There's a new set of "assistive
technology" preferences which control which accessibility tools are started
up at the beginning of a session. And, to help keep people from needing
assistance in the future, GNOME now includes the obnoxious "time to take a
typing break" nagging utility.
There's many other additions, of course; gedit has syntax highlighting,
nautilus is improved, etc. See the writeup for more information. Or,
better, download the beta and help shake out the last bugs so that 2.4 can
be a truly stable release.
Comments (5 posted)
System Applications
Audio Projects
Version 0.80.0 of the JACK Audio Connection Kit is
available.
Changes include improved portability, a new transport API, support for
asymmetric sound cards, and more.
Comments (2 posted)
Database Software
The August 28, 2003 edition of the PostgreSQL Weekly News
has been published. Take a look for the latest PostgreSQL database news.
Full Story (comments: none)
Education
Version 1.1 of Moodle
has been released.
"
Moodle 1.1, the best system for managing and conducting online courses, is
now available. Highlights include: A completely new packaging
system for backup, transfer and restore of courses."
Comments (none posted)
Printing
AFPL Ghostscript (i.e. the one with a "not quite entirely free" license)
8.11 has been
released; this is the
first stable release since 8.00.
Improved font rendering is the most significant new feature this time
around.
The second release candidate of ESP Ghostscript 7.07.1 is available. ESP Ghostscript
is the "Easy Software Products" version, which has been patched to work
well with the CUPS print system.
Comments (1 posted)
Desktop Applications
Audio Applications
Version 0.4.9 of KGuitar
is available.
"
KGuitar aims to develop a free, full-featured guitarist helper program, focusing on tabulature editing and MIDI synthesizers support." This version adds support for KDE 3.0.
Comments (none posted)
Ecasound 2.3.0 has been
released.
It includes a number of important bug fixes, JACK 0.80 support, and
numerous other enhancements; see the announcement for details.
Comments (none posted)
Desktop Environments
Issue #62 of
KDE Traffic
is online. The KDE.News
summary says:
"
A whole lot of news in this
one, including some discussion on the new KPrefs, GConf2, quick tab access in
Konqueror, a lot of KOffice news (beta 3 feature freeze, better support for
Word 6 and Word 95), and mention of the new pim.kde.org design. Thanks
Russell!"
Comments (none posted)
The
August 29 KDE-CVS-Digest is available. "
Some new applications: Knot, a service location server, Kickme, a lightweight dcop messenger and event viewer, kio-ldap kioslave, KWifiManager, for monitoring wireless cards, the new Plastik widget style, an snmp plugin for Ksim. ARts adds Media Application Server output support."
Comments (none posted)
As seen on FootNotes: version 1.99.1 of the GNOME Network package - a set of network-oriented tools - has been released. This is a development release, and thus may not be for everybody.
Comments (none posted)
Graphics
Version 1.3.19 of the Gimp
has been announced.
"
GIMP is now very close to a 2.0 prerelease, so your testing efforts are particularly appreciated."
The announcement lists the changes in detail.
Comments (none posted)
Interoperability
The second release candidate of Samba 3.0.0 is available.
See the
release notes for change information.
Full Story (comments: none)
Mail Clients
Version 2.0.14 of Balsa, and email client for GNOME,
is available.
New features include message wrapping improvements, delsp draft support,
experimental LDAP write support, and bug fixes.
Comments (none posted)
Version 0.65 of Mahogany, an email client,
has been released.
"
All existing users should upgrade to this version, it adds
many new features (real Drafts folder with automatic messages saving
in case of crash; TLS and PGP/GPG support; many, many UI enhancements)
and fixes tons of bugs."
Comments (none posted)
Multimedia
Version 0.6.3 of GStreamer, an open-source extendable multimedia framework,
has been announced.
"
This, along with the merge of netRhythmbox into Rhythmbox is excellent news for the open-source community. With the development of Totem, sound-juicer, and gnome multimedia support GStreamer is getting to be nearing a point where it can be used for everyday media playing. The Pipeline Editor is also becoming quite stable."
Comments (none posted)
Office Applications
The August 31 edition of the
AbiWord Weekly News is out; it includes a call
for assistance with the Windows port along with the usual summary of
AbiWord development themes and activities.
Comments (none posted)
Web Browsers
Version 2.0.0 of Linky
has been announced.
"
Linky is an add-on for the Mozilla Application Suite and Mozilla Firebird
that adds extra link-related items to the standard page context menu. It
allows users to perform tasks such as opening all links on a page in new tabs
or copying selected links to the clipboard."
Comments (none posted)
Mozilla 1.5 beta is out. A number of fixes and enhancements have gone in
since the 1.5 alpha release; see
the release notes
for details.
Comments (none posted)
Miscellaneous
gDesklets is a GNOME architecture for desktop applets. A new site has popped up at
gdesklets.gnomedesktop.org to support desklet development. Have a look for the latest release from the desklet hackers.
Comments (none posted)
Languages and Tools
C++
QuantLib 0.3.3 (a financial modeling library) has been
released.
"
Major additions of this
release are an extensive test suite, a partial port to the new Pricing Engine
framework, and the support of low-discrepancy Monte Carlo simulation."
Comments (none posted)
Java
Version 3.0 of the JGraph "powerful, lightweight, feature-rich, and thoroughly
documented open-source graph component" for Java has been
released. It is accompanied by the JGraphPad diagram editor.
Comments (none posted)
Lisp
Steel Bank Common Lisp version 0.8.3 is out.
"
This version, which now also
builds on MacOS X, features new optimizations, improved compiler
validation, support for automatic dowload and installation of code
from CCLAN, the SB-THREAD:INTERRUPT-THREAD function and the usual bug
fixes."
Full Story (comments: 2)
Version 0.14 of CL-GD - a Common Lisp library for dynamic image creation -
has been released. This is the first public release of CL-GD, which is
built on top of the classic "GD" graphics library.
Full Story (comments: none)
Macho is a web archiving system for electronic mail, written in Lisp.
Version 0.2 has just been released, with new support for better quoting
highlighting, an improved message parser, and improved performance.
Full Story (comments: none)
Perl
This week on perl5-porters for August 31 is out, with looks at the Cwd module, base.pm,
next and dynamic labels, Spambench, and more.
Comments (none posted)
use Perl has
an announcement from Simon Cozens on the creation of the Perl code ladder review mailing list. The idea is to create a forum where Perl code can be reviewed by interested hackers before being submitted to CPAN or whatever else may be its eventual destination. With luck, the list will lead to a higher-quality CPAN in the future.
Comments (none posted)
usePerl
notes the creation of a mailing list to support the Esperanto translation, which, it seems, beat out Swedish_Chef to be the official YAPC::Europe language.
Comments (none posted)
PHP
The
PHP Weekly Summary for September 1, 2003 is out. Topics include:
4.3.3 ships, Servlet SAPI, phpize broken, libxml2, and Zend Engine optimizations.
Comments (none posted)
John Coggeshall continues his O'Reilly series on PHP security with
part two.
"
Welcome back to PHP Foundations. In my previous article, I continued my mini-series on best practices in PHP by introducing you to some of the ways that security can be compromised in your PHP scripts. This article continues that discussion with more examples of potential security holes and the tools and methods you can use to help plug them. Today I'll start by talking about one of the more critical potential security holes in PHP development writing scripts that make calls to the underlying operating system."
Comments (none posted)
Python
Dr. Dobb's Python-URL for September 1 is out with the latest from the
Python development community.
Full Story (comments: none)
"And now for something completely different..."
Cleese is a project to write
a new operating system entirely in Python - or, at least, as much as
possible. The project is young, but it has recently released "HalfPy," a
stripped-down version of the Python interpreter, and a bootloader setup
that works within Bochs.
Comments (none posted)
Tcl/Tk
Dr. Dobb's Tcl-URL for September 1 is available, with the usual summary of
happenings in the Tcl/Tk development community.
Full Story (comments: none)
Debuggers
Svend Tofte has put together
a tutorial
on Venkman, a JavaScript Debugger that is integrated into the Mozilla
browser.
"
Realizing that most people who program JavaScript are not programmers, and thus might not be familiar with debuggers in general, I wanted to make a visual guide, that together with a bunch of screenshots and files, would explain how to use Venkman. For while a debugger is usually an arcana piece of software, most webdevelopers couldn't care less about, using Venkman can improve your productivity, by finding the bugs faster."
Comments (none posted)
Page editor: Jonathan Corbet
Linux in the news
Recommended Reading
The Globe and Mail
reports
that Linux is gaining ground on proprietary UNIX. "
A major factor in
Linux adoption is support from application software vendors. For instance,
Ms. Day says Red Hat Linux is widely used to run Oracle Corp.'s popular
database software. One reason, Mr. Dean says, is that Oracle has promoted
the fact that its software supports Linux. More and more application
vendors are doing so." (Thanks to Jim Gallacher)
Comments (36 posted)
GrepLaw
interviews
Ian Clarke. "
Freenet is in active use in countries such as China
to permit the free distribution of information there despite government
censorship. A group, Freenet-China has taken Freenet and translated it to
Chinese for this very purpose. Freenet is also actively used in other
countries, including the United States, to distribute censored information
such as the Church of Scientology 'Operating Thetan' documents."
(Thanks to Joe "Zonker" Brockmeier).
Comments (6 posted)
LinuxWorld.com.au
interviews
Samba creator Andrew Tridgell. "
Andrew Tridgell: Over the last seven
months I have been building the basic infrastructure for Samba version
4. As you know, Samba version 3 is only now nearing its final release, but
while that is an important release its scope is much narrower than what we
are aiming for in Samba4." (Thanks to Sydney King)
Comments (3 posted)
The SCO Problem
The Economist
catches
up with the SCO case. "
Indeed
'the SCO case' of 2003 sounds increasingly like the famous
Scopes Monkey Trial of 1925, which pitted religious fundamentalists against
progressives wanting to teach Darwin alongside the Bible in American
classrooms. The SCO case plays the same role in a culture war now consuming
the software industry. On one side are the equivalents of the
fundamentalists -- buttoned-down types clinging to proprietary and
closed computer systems. Facing them are today's evolutionists -- the
pony-tailed set championing collaboration and openness in the form of
Linux, an operating system that anybody can download and customise for
nothing."
Comments (58 posted)
There is
a
brief article (in German) on Heise Online stating that SCO has been
found to be in violation of a court order prohibiting the company from
stating (without proof) that Linux contains stolen SCO property. SCO has been fined
EUR 10,000. English text is available
via
Babelfish. (Thanks to Florian Kuhnke).
Comments (11 posted)
News.com
reports on a speech by Michael Dell in which he states that Dell will not be offering indemnification for its Linux customers. He also talks about other directions being taken by the company:
"
'Eight-way (servers) are less than 1 percent of the market and shrinking pretty dramatically,' Dell said. 'If our competitors want to claim they're No. 1 in eight-ways, that's fine. We want to lead the market with two-way and four-way (processor machines).'" This comment has already rekindled the "how far should we scale" debate on linux-kernel.
Comments (12 posted)
Companies
TechWeb
covers
an open source project from an unlikely source. "
Brunswick Corp.,
maker of billiard tables, boats, and bowling balls, has produced an
open-source code engine to exchange business data over the Internet, and
the Securities and Exchange Commission is an early adopter. The SEC will
use the engine to feed a system that analyzes stock trades as part of its
regulation of insider trading."
Comments (3 posted)
NewsForge
covers an IBM
announcment that the latest version of the open source Eclipse
development platform will now run on the Java-based, open-source Jikes
Research Virtual Machine.
Comments (4 posted)
The Register
looks inside
Motorola phone software. "
The fact that Motorola is selling its
stake in Symbian (the corporation) doesn't mean that Motorola is stopping
selling Symbian (the software) in its phones. But it does mean that
Motorola thinks the future in phone software is elsewhere. Linux, to be
precise."
Comments (none posted)
ZDNet has
a brief report on a new partnership between HP and Chinese distributor Red Flag.
"
HP will support the Red Flag Server 4 series operating system and its subsequent products on the HP Integrity and ProLiant server lines.
Red Flag will work with HP on product quality control, market sales, applications research, management training and applications support services."
Comments (none posted)
News.com
reports that the Eclipse project is separating from IBM.
"
Given the organizational changes under way at Eclipse, Sun is considering joining the open-source project, according to a company representative. Sun wants a number of issues to be addressed before it joins, however. The company may push for a change in the organization's name, along with a resolution of technical problems over how Java applications present information, the representative said."
Comments (5 posted)
Business
The NYTimes has picked up a
Reuters
article about Linux in consummer electronics. "
Linux's key
advantage over other operating systems is that the core software is freely
available and widely embraced. In the cut-throat electronics business where
profit margins are one or two percent at the best of times, every saving is
welcome." (Registration required)
Comments (10 posted)
Linux Adoption
InfoWorld is running
a lengthy
report on the costs and benefits of switching to Linux. "
The
more fully an enterprise adopts Linux across its infrastructure, the more
financial leverage it is likely to get out of up-front investments in the
OS. Those investments, which can be considerable, include Linux training
and tools, and the costs of migrating from a Unix or Windows
environment. And that financial leverage is improving steadily as better
management tools, more third-party vendor support, and more skilled Linux
system administrators arrive on the market." (Thanks to Max Hyre).
Comments (1 posted)
NewsForge
looks into the
availability of open source software in Burma (also known as Myanmar),
Cambodia, and China. "
The PeguNC-Linux distribution, aimed at
Myanmar, is intended to encourage native data processing. According to a
message in the Myanmar Linux Users Club Yahoo! group, Myanmar has just a
font, but no language support with sorting and searching. Byteklay, a
member of the project, says, "(We) started with a so-called PeguNC-linux
project at mmlinux.org . When I couldn't continue mmlinux, friends from mm
carried that project on myanmarlug.org, a site developed and maintained by
Ko Wiston [Compunut].""
Comments (1 posted)
Legal
Heise Online is running
an article (in
German) on the delay of the vote on software patents in Europe. Among
other things, it notes that pro-patent forces are still hard at work
trying to get an interoperability exemption removed from the proposed law.
English text of a sort is available
via
Babelfish. (Thanks to Dirk Hillbrecht). Dirk has also supplied
this translation.
Comments (none posted)
Interviews
Linux Journal
interviews Bjarne
Stroustrup, the creator of the C++ programming language. "
LJ:
Did you have a computer at home when you were growing up?
BS: No, it was too early for that. Computers were very expensive and lived
in university departments and large companies. The first computer I saw was
my university's Math department's GIER. It was an old Danish computer that
filled a room and was fed programs on paper tape. I learned to program in
Algol 60 on that one."
Comments (8 posted)
GnomeDesktop points to two articles about Gnumeric, which plans to release
version 1.2.0 soon.
Here is a review of
Gnumeric beta 1.1.19 is available from ILUG-Cal. (Found here)
LinMagAu has an interview
with Jody Goldberg and Andreas L. Guelzow. (Found here)
Comments (2 posted)
Resources
This O'ReillyNet article
looks at how Extreme Programming lessons can benefit open source
programmers. "
Open source projects usually don't have the time or
budget constraints to require hard and fast release dates, but getting
frequent feedback from users and customers is vital to the survival of the
project. Since "customers" are often potential developers, having a good
feedback loop can increase the resources at your disposal. Keeping the
source code public with regular snapshots or anonymous CVS or Subversion
access helps, but if features take a long time to land or to stabilize, it
can be difficult to know when the code is worth using."
Comments (none posted)
Reviews
eWeek
reviews
Mozilla 1.5 beta. "
With the Mozilla 1.5 Beta, the project is
promising improvements in performance, stability, standards support and Web
compatibility. But new features are not the primary focus. The beta release
marks the beginning of the project's journey to focus more energy on end
users and promotion of its efforts now that it is an independent
organization, Mozilla President Mitchell Baker said."
Comments (13 posted)
Page editor: Rebecca Sobol
Announcements
Non-Commercial announcements
The Open Group has announced that the latest update to the Test Environment
Toolkit, TET3.6, is now available. TET is used to drive the LSB
Certification tests for Linux distributions.
Full Story (comments: none)
The
September/October issue
of LinuxFocus is available. This month you can learn how to model a 3D
train in Blender, explore the MySQL C API, see why older people love Linux,
enhance photos with Gimp, and much more.
Comments (none posted)
The Linux Professional Institute's newsletter for the month of August is
available. Look for LPI at TechXNY New York, Linux Expo UK, and Wow-Gao
Canada; LPI-Brazil becomes an official affiliate; Update on Linux World San
Francisco; LPI in Vietnam and Australia; and much more.
Full Story (comments: none)
The September 2003
edition of Linux
Gazette is out. Articles include
From C To Assembly Language by
Hiran Ramankutty;
Linux based Radio Timeshifting by Yan-Fa Li;
Python Weather Station by Phil Hughes;
SCO Interview by
Anonymous; and more.
Comments (3 posted)
ibiblio.org has announced the designation of September as "Linux Month", in
celebration of the twelfth anniversary of the birth of the Linux software
created by developer Linus Torvalds.
Full Story (comments: none)
Commercial announcements
IBM has sent out a press release announcing that the Library of Congress
Moving Images Collection - a project of three university libraries - will
be hosted on IBM servers and, of course, Linux.
Full Story (comments: none)
Version 1.1.10 of Wing, a commercial IDE for Python
has been announced. This is a maintenance release.
Full Story (comments: none)
Opera Software has released Opera 7.20 Beta versions for the Unix variances
Linux, Solaris and FreeBSD. These three beta releases all add support for
bidirectional languages such as Arabic and Hebrew.
Full Story (comments: none)
New Books
O'Reilly has released
The Linux Web Server CD Bookshelf, Version
2.0, a bookshelf of LAMP technology on a single CD.
Full Story (comments: none)
O'Reilly has released the second edition of the
Perl Cookbook.
Full Story (comments: none)
Contests and Awards
Use Perl
reports on a perl
programming contest for the WebGUI content management system. The contest
lasts for 3 months and ends on December 1.
Comments (none posted)
Event Reports
GnomeDesktop has a
report from the
GNOME-ms booth at the Free and Open Source Conference 2003 (Fosscon
2003) that was held last week in Subang Malaysia.
Comments (none posted)
Upcoming Events
Registration is now open for
linux.conf.au. IBM has signed on
as the event's Penguin Sponsor. The conference will be held at the
University of Adelaide in South Australia, January 14 - 17, 2004. Click
below for more information.
Full Story (comments: none)
The September 15 LUGOD meeting will feature a talk on TiVo hacking.
Full Story (comments: none)
| Date | Event | Location |
| September 8, 2003 | Boundaryless Information Flow: Open Source in the Enterprise | (Hilton London Paddington)London, UK |
| September 11 - 12, 2003 | Python for Scientific Computing Workshop(SciPy'03) | (CalTech)Pasadena, CA |
September 15 - 18, 2003 October 7 - 8, 2003 | LogOn Web Days | Across Europe |
| September 15 - 18, 2003 | Embedded Systems Conference(ESC) | (Hynes Convention Center)Boston, Mass |
| September 26 - 27, 2003 | Third DZUG-Conference | Paderborn, Germany |
| October 12 - 15, 2003 | International Lisp Conference 2003(ILC 2003) | New York, NY |
| October 15 - 17, 2003 | The First Plone Conference | (Tulane University)New Orleans, Louisiana |
October 26, 2003 October 27 - 31, 2003 | Large Installation Systems Administration Conference(LISA) | (Town & Country Resort Hotel)San Diego, CA |
Comments (none posted)
Web sites
Server Central, a provider of managed hosting,
announced it will sponsor PHP by hosting a server for PHP.net.
Comments (none posted)
The new Mozilla Links Newsletter
has been
launched. It is a bi-weekly publication, spawned from the nascent
Mozilla marketing effort, featuring headlines, tips and information about
third-party projects.
Comments (none posted)
MozillaZine
celebrates
five years online, with a special fifth anniversary section.
Comments (none posted)
Software announcements
Here are the software announcements, courtesy of
Freshmeat.net. They are available in
two formats:
Comments (none posted)
Miscellaneous
Use Perl
reports
that Perl has been added to the Oxford Dictionary of English.
"
Perl. noun [mass noun]. Computing. a high-level programming language used especially for
applications running on the World Wide Web.
Comments (none posted)
Page editor: Rebecca Sobol
Letters to the editor
| From: |
| Pete Flugstad <peteflugstad@mchsi.com> |
| To: |
| letters@economist.com, letters@lwn.net |
| Subject: |
| Of monkeys and penguins |
| Date: |
| Fri, 29 Aug 2003 09:31:51 -0500 |
Dear Editors of Economist:
Your article (author UNKNOWN - how about some attribution for this
article):
http://economist.com/printedition/displayStory.cfm?Story_ID=2020889
about SCO and attempting to compare it to something as fundamental as
the Scopes monkey trial is about as off base as it could possibly be.
The SCO trial is about one thing and one thing only: money. SCO is
using the PR and buzz they themselves are stiring up by kicking the
hornets nest that is the Open Source movement. They're doing this
purely in order to pump up their stock price, which they are
proceeding to sell as fast as possible. Numerous news and web sites
have pointed this out and highlighted the sales SCO execs and share
holders have been making, but apparently the oldest motive on the
books is too opaque for some magazine called the "Economist".
Everything SCO is doing, from refusing to actually disclose what
code may or may not have infringed, to sending letters to 1500 large
corporate Linux users, to calling the open source movement
"communist", is designed to generate buzz (good or bad) and that
results in increasing stock price. The whole "open source is
communist" line is sold old and defunct now, I'm stunned your editors
let you print it. Don't you know the new bogeyman is called a
"terrorist" now? I'm surprised SCO didn't try and label the open
source movement with that one (they probably did and I just missed it
in the avalance of press releases they send out).
Please, make an attempt to actually do a little research on stories
before you snap off a silly puff piece like this about it. You've
just contributed to the SCO cause: your uncritical piece, attempting
to "glorify" the SCO case, is *exactly* what they want.
Pete Flugstad
Iowa City
[Editor's note: The Economist, as a matter of policy, does not put bylines on its articles]
Comments (12 posted)
Page editor: Jonathan Corbet