LWN.net Weekly Edition for October 16, 2003

LinkSys and binary modules

In response to pressure from the Free Software Foundation and the community, LinkSys has made a new tarball available containing the source for the firmware running in its WRT56G wireless router. This new source distribution (available here; get the 1.41.2 version) contains a good deal of new code, including the modifications to the kernel to support the Broadcom 4702 processor. Many of those who have been pursuing this particular GPL violation case are now satisfied.

The celebration is not universal, however; the new kernel source still lacks the driver for the wireless interface. Unlike the other kernel modifications found in the WRT54G router, the wireless interface is packaged as a separate, binary module. In the eyes of many, that packaging is sufficient to ensure that the driver is not a derived product of the kernel, and, thus, it need not be licensed under the GPL. But not everybody agrees.

The status of binary modules remains the subject of a great deal of confusion; it deserves (yet another) look. There is a widespread impression that Linus Torvalds has issued a blanket exemption to the GPL for closed-source modules. There are only two problems with this idea: (1) it is not entirely true, and (2) the relevance of Linus's opinion is limited. On the first point, consider this pronouncement from Linus, issued almost exactly one year ago:

On the second point, it suffices to remember that Linus is far from the only kernel copyright holder. He made a crucial decision years ago to not require copyright assignments from contributors, and, thus, to allow each contributor to retain copyrights on his or her code. As Linus's role has shifted from coding to rejecting contributions from others, the portion of the kernel code base carrying his copyright has shrunk. Linus can speak for himself, but not for the other kernel copyright holders. And some of the others are getting increasingly grumpy about closed-source modules.

The crucial question here is whether a court would find that a kernel module is a derived product of the kernel itself or not. There is a difference of opinion on that score, to say the least. Eight years ago, Linus suggested that kernel modules, by virtue of the module API which only allowed modules to link to "logically independent" functions within the kernel, were not derived products. As others have pointed out, the list of functions available to modules is rather less controlled these days. 2.6 loadable modules have access to a great many kernel functions (a quick grep turns up over 8000 exported symbols) and require a great deal of inline code from the kernel header files. By some accounts, any code that is so intimately tied into the kernel must be a derived product.

Others have taken the view that anything which can be unplugged and replaced is not a derived product. The existence of a plug-in interface creates a boundary which the GPL cannot cross. In some cases, this must be true; consider, for example, Linuxant's controversial new DriverLoader product. DriverLoader is a proprietary module which will interface Windows NDIS network drivers to the Linux kernel. The legal status of DriverLoader may be unclear, but nobody would argue that a binary Windows driver, when shoehorned into the Linux kernel in this way, becomes a derived product of the kernel. On the other hand, with a small (GPL-licensed) patch, the kernel could be opened to "pluggable" modules implementing proprietary network protocols, memory managers, schedulers, etc. This scheme, if considered legal, would allow proprietary code to be lodged within the heart of the Linux kernel. At that point, there would be no restriction on derived products at all.

Another view, less often heard, notes that the kernel module loader checks the license of every module loaded into the system. If the module lacks a free license, the kernel complains, but loads the module anyway. One could argue that this behavior is an explicit acknowledgment that closed-source modules are permissible.

The only way to get a definitive answer on the location of the GPL boundary will be to go in front of a judge. Even then, the answer is unlikely to be useful beyond the specific case considered there.

In the LinkSys case, some developers are claiming that the source for the binary modules should be released even if they are not strictly seen to be derived products. This claim is based on the following language from section 2 of the General Public License:

Some feel that the LinkSys WRT56G router is, indeed, a "whole which is a work based on the Program" and that the entire system must be licensed under the GPL if it is to be distributed legally. This view relies on the contract provisions of the GPL, and not just on copyright law; it is controversial, to say the least. By this reasoning, a Linux distribution with, say, a proprietary installer could be seen to be violating the GPL. In the end, this claim, too, can only be verified in a courtroom. Until then, the definition of a "whole" is subject to debate.

The status of closed-source modules has always been somewhat unclear, and one gets the impression that the kernel developers have been happy to keep it that way. There is a strong desire to discourage such modules, but, seemingly, little wish to abolish them altogether. The system has worked reasonably well so far, but it may well be asking for trouble in the longer term. With the current state of affairs, it seems certain that, sooner or later, a company or individual holding kernel copyrights will take a proprietary module vendor to court.

One of the best features of free software is the fact that users don't need to worry. The rights of users are broad and well defined; there is no equivalent of the Business Software Alliance looking for companies to raid. The distribution of closed-source kernel modules is an exception, however; nobody really knows if this distribution is legal or not. The free software community is not helped by this uncertainty; it really is past time to clarify the status of closed-source modules. Doing so will be a challenging task, but doing nothing will bring unwanted challenges of its own. The free software community does not need any more litigation, be it instigated by ourselves or by others.

Comments (30 posted)

Two views of the Unix philosophy

We have recently received two books, both of which attempt to set down the Unix philosophy. This philosophy is said to underlie the work we all do with Linux, so discussions of it are worth a look. Maybe we can finally find out what we have been trying to do all these years.

The first is The Art of Unix Programming by Eric Raymond (published by Addison Wesley). We have discussed this book before on these pages, so a detailed look is not necessary at this time. Suffice to say that Eric's book is now available in the stores. It is also available on the net under a relatively restrictive Creative Commons license.

The other entry is Linux and the Unix Philosophy by Mike Gancarz, published by Digital Press. This book appears to be a fairly straightforward remake of Mr. Gancarz's The Unix Philosophy, published in 1994. References to Linux have been retrofitted in, but the book is little changed. If the underlying Unix philosophy is as enduring as these books would have us believe, a book from 1994 should still be current now. Unfortunately, Linux and the Unix Philosophy looks old; consider, for example, the author's advice that a function's parameter list should fit on a single line of an (80-column) screen. That might have been good advice for an old-style C function, but, in the modern world, where parameter names and types all go together, even a very short parameter list can take multiple lines.

This book also ignores many of the features of modern Unix/Linux programming, including scripting languages (beyond the shell) and graphical interfaces. In Mr. Gancarz's view, all programs are small, and their functions are minimal; he even states that multi-column output has bloated the ls command excessively. Or consider:

This discussion does not fit your editor's world, where the best way to improve the performance of a system is often to add memory.

The most interesting area of investigation, however, would be how the two books characterize the Unix philosophy. Happily, both of them provide nice sets of rules suitable for slides in any executive briefing - or a summary table in LWN. So, without further ado...

The Art of Unix Programming	Linux and the Unix Philosophy
Write a big program only when it is clear by demonstration that nothing else will do.	Small is beautiful.
Design for simplicity; add complexity only where you must.	Make each program do one thing well.
Prototype before polishing. Get it working before you optimize it.	Build a prototype as soon as possible.
(No rule, but portability is listed as one of the things Unix got right).	Chose portability over efficiency.
Design programs to be connected with other programs.	Store data in flat text files. Make every program a filter
Avoid hand-hacking; write programs to write programs when you can.	Use software leverage to your advantage. [i.e. reuse code].
Programmer time is expensive; conserve it in preference to machine time.	Use shell scripts to increase leverage and portability.
In interface design, always do the least surprising thing.	Avoid captive user interfaces.
When a program has nothing to say, it should say nothing.	Silence is Golden
	Look for the 90-percent solution. Worse is better.
Design for visibility to make inspection and debugging easier.
Fold knowledge into data so program logic can be stupid and robust.
Repair what you can, but when you must fail, fail noisily and as soon as possible.
Separate policy from mechanism; separate interfaces from engines.
Distrust all claims for the "one true way."

The further expression of these rules shows the relative age and limited scope of Gancarz's book. He talks about flat text files, while Raymond discusses the importance of transparent, textual network protocols as well. Raymond covers the network, modern languages, and the ups and downs of programming techniques as an integral part of his book; Gancarz has a brief "Brave New World" chapter at the end where he treats bleeding-edge technologies like the Internet, artificial intelligence, object-oriented programming, and Java.

On the other side, Eric Raymond's tendencies are well known. The Art of Unix Programming can be verbose and gives a lot of coverage to Mr. Raymond's own work and beliefs. Most people would have found a way to write a Unix book without including quotes from famous people on the evils of gun control, for example.

Both books neglect areas of great concern for any contemporary software developer. Neither will give as much help as the implementer of a web browser, office suite, or DVD player might like. No developer can afford to be unaware of security issues in the current environment, but neither author devotes any space to security. What is the Unix philosophy's approach to security? Silence in response to that question is all too telling.

In the end, if your editor had to choose between the two books, he would go with The Art of Unix Programming, though both have their merits. Readers of either would be well advised to heed Mr. Raymond's last rule, however: distrust anybody who claims to know the "one true way."

Comments (5 posted)

Background on Citizens Against Government Waste

After Citizens Against Government Waste (CAGW) issued a strongly-worded press release against the state of Massachusetts's initiative to move toward open systems, we at LWN decided to take a longer look at this organization's background and see why they might exhibit such hostility toward open source.

According to CAGW's website, the group has been in operation since 1984. It is, according to its press materials "a private, non-partisan, non-profit organization" on a mission to eliminate "waste, mismanagement, and inefficiency in the federal government." It claims to be "nationally recognized as the source of information on government waste," with more than one million members.

Apparently, Microsoft has been one of the corporate donors that provided funding to CAGW in the past. But the group prefers to remain mum on whether Microsoft continues to fund them and what other groups may be providing funding.

We contacted CAGW directly to find out whether Microsoft is still donating money, and how they came to form their opinions on open source use in government. We spoke to CAGW President Tom Schatz, who also declined to specify whether CAGW is still receiving money from Microsoft and said that interested parties could examine CAGW's IRS 990 filing. CAGW is required to make this document available upon request, but is not required to provide the names of its donors.

We located CAGW's filings for 2000 and 2001 online, but the donor information had been whited out. According to CAGW's website, about 85 percent of the organization's funding comes from individual contributors, with the remaining 15 percent coming from corporate and foundation gifts. In 2001, three contributors donated a total of $490,765 to CAGW, accounting for only 10 percent of the non-profit group's entire income of $4,898,720 for the year. In 2000, CAGW brought in $4,846,934 with a single anonymous donor of $150,000. If Microsoft or one of the foundations it supports is still a contributor to CAGW, the contributions are only a minor percentage of overall contributions.

To be sure, CAGW does not exist solely as an apologist or mouthpiece for Microsoft. The organization tracks government spending in many areas unrelated to the software industry, and provides ratings for members of congress, according to their criteria of eliminating government waste.

However, the group has been unrelenting in its opposition to the governments' antitrust suit against Microsoft, and was part of the "grass-roots" effort to stir up public support against the suit. The group made headlines after some of their form letters were mailed in by CAGW members who had died.

When news hit the wires late last month that Massachusetts may be favoring open source, CAGW was quick to oppose the idea -- apparently without bothering to get all the facts on the issue first. Schatz admitted that he later found that, contrary to the position stated in the release, Massachusetts was not barring proprietary vendors from competing for state contracts. Schatz says he will issue a second release with a correction "if something does come out in writing from the state...we've seen quotes, but nothing in writing."

We asked Schatz if he opposes open source software in government, and he replied that he was not opposed to open source software but was opposed to a policy that prefers or requires single-sourcing.

We also asked Schatz about the communist rhetoric contained in their "Mass. Taxpayers Hurt by Proposed Software Monopoly" release. Schatz denied that comparisons of Massachusetts' open source policy were designed to tie in with other comparisons of open source and free software to communism or socialism.

Schatz also mentioned that CAGW group received a number of e-mails from the Linux community on the topic, and had discovered that the community does not appreciate comparisons to communism or socialism. He also noted that CAGW receives strong reactions to many of their releases, not just those on the topic of Linux or open source. A cursory search of CAGW's website did not turn up references to socialism or communism as metaphors for other government waste. The reader can judge for themselves whether the tone in other CAGW releases is similar to the tone of the "Proposed Software Monopoly" release.

It may be that CAGW is poorly informed on the benefits of open source, and too easily swayed by pro-Microsoft studies. Schatz acknowledged that CAGW had not performed any studies independently to determine the cost benefits of open source products versus proprietary software.

It's clear that CAGW carries a substantial amount of influence with a widespread public audience, and with elected officials. Open source advocates would do well to keep tabs on future pronouncements from the group, and to work toward politely educating CAGW on the benefits of free software and the unnecessary waste of government funds on proprietary software.

Comments (7 posted)

Page editor: Jonathan Corbet

Security

Open spam filtering rules considered harmful?

Readers of LWN know that we have long been a fan of SpamAssassin. Your editor, whose personal spam load is approaching 500 messages per day, would long have ceased to function without it. Network life in the 21st century requires either a well-hidden email address, or some sort of effective filtering.

SpamAssassin's extensive arsenal of tests has traditionally included checks for legitimate mail. In the past, mail which identified itself as having been created with certain free email agents or which contained a software patch was given some extra credit in the scoring process. Spammers have often found and exploited those tests; for a while, some of us were receiving mail which had been simultaneously "created" with mutt and evolution. The usual response to such activity has been to remove the tests in question.

Most recently, some spammers have started adding fake PGP signatures (in full HTML glory) to their output, in the hopes of slipping past SpamAssassin. The PGP signature test was removed some time ago, but the exploit was still enough to inspire this News.com article which, among other things, says:

The open nature of SpamAssassin's filtering is, thus, a "danger." Lest one become too concerned about the "dangers" involved in using SpamAssassin, however, there are a few things which should be kept in mind:

• Prospective spam can be tested against any filter, open or closed. It would be surprising if spammers were not trying their products against SpamAssassin in this way. They also, most likely, maintain accounts with large ISPs and try to craft messages that get past the filters those ISPs employ as well.

• SpamAssassin remains highly effective, even when spammers have had plenty of time to study its tests and work out ways to get around it. Open or not, SpamAssassin's rules are very good at identifying spam, and they appear to be hard to get around. Fighting spam is an arms race; it is surprising, actually, how rarely one has to upgrade SpamAssassin to keep it effective.

• The bayesian filtering techniques used by SpamAssassin (and many other spam filtering systems) cannot be worked around in any easy way. A quick test on about 6400 messages which had accumulated in your editor's spam folder shows that the bayesian filter is the decisive test which condemns 15-25% of all incoming spam. Bayesian filters are highly individualized, and they are inaccessible to spammers. The algorithm is entirely open, but that is little comfort to those who would bury us in unwanted trash.

The real lesson from the PGP signature "exploit," most likely, is that negative tests will always be relatively easy for spammers to abuse. That will be why SpamAssassin 2.60 contains almost none of these tests.

The most important point, however, is entirely different. For many of us, email is a vital connection to the world. It is natural to be concerned about trusting a program to filter our incoming mail for us; mistakes can have real consequences. Would you really want to trust your mail to a hidden, proprietary filtering scheme? Don't you want to know what assumptions and biases have gone into the filtering decisions? Or, at least, don't you want that information to be available to those with the time and interest to check it out? Allowing a black box to pass judgment on one's incoming mail stream poses more dangers than an open, free system ever could.

Comments (19 posted)

New vulnerabilities

glibc - buffer overflow

Package(s):	glibc	CVE #(s):	CAN-2003-0689
Created:	October 15, 2003	Updated:	November 25, 2003
Description:	The GNU C library contains a buffer overflow in the getgrouplist() function. If the user belongs to more groups than the calling application expects, the allocated storage will be overrun.
Alerts:	Gentoo 200311-05 2003-11-22 Mandrake MDKSA-2003:107 2003-11-18 Trustix 2003-0039 2003-11-15 Red Hat RHSA-2003:325-01 2003-11-12 Conectiva CLA-2003:762 2003-10-14

Comments (none posted)

tomcat4: denial of service vulnerability

Package(s):	tomcat	CVE #(s):
Created:	October 15, 2003	Updated:	October 15, 2003
Description:	Aldrin Martoq has discovered a denial of service (DoS) vulnerability in Apache Tomcat 4.0.x. Sending several non-HTTP requests to Tomcat's HTTP connector makes Tomcat reject further requests on this port until it is restarted.
Alerts:	Debian DSA-395-1 2003-10-15

Comments (none posted)

Updated vulnerabilities

2.4 kernel - several vulnerabilities

Package(s):	2.4 kernel	CVE #(s):	CAN-2003-0461 CAN-2003-0462 CAN-2003-0464 CAN-2003-0476 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552
Created:	July 21, 2003	Updated:	December 24, 2003
Description:	Several security issues have been discovered affecting the Linux kernel: CAN-2003-0461: /proc/tty/driver/serial reveals the exact character counts for serial links. This could be used by a local attacker to infer password lengths and inter-keystroke timings during password entry. CAN-2003-0462: Paul Starzetz discovered a file read race condition existing in the execve() system call, which could cause a local crash. CAN-2003-0464: A recent change in the RPC code set the reuse flag on newly-created sockets. Olaf Kirch noticed that his could allow normal users to bind to UDP ports used for services such as nfsd. CAN-2003-0476: The execve system call in Linux 2.4.x records the file descriptor of the executable process in the file table of the calling process, allowing local users to gain read access to restricted file descriptors. CAN-2003-0501: The /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program. This causes the program to fail to change the ownership and permissions of already opened entries. CAN-2003-0550: The STP protocol is known to have no security, which could allow attackers to alter the bridge topology. STP is now turned off by default. CAN-2003-0551: STP input processing was lax in its length checking, which could lead to a denial of service. CAN-2003-0552: Jerry Kreuscher discovered that the Forwarding table could be spoofed by sending forged packets with bogus source addresses the same as the local host.
Alerts:	Red Hat RHSA-2003:408-00 2003-12-19 Gentoo 200308-01 2003-08-14 Debian DSA-358-4 2003-08-13 SuSE SuSE-SA:2003:034 2003-08-12 Debian DSA-358-2 2003-08-05 Debian DSA-358-3 2003-08-04 Debian DSA-358-1 2003-07-31 EnGarde ESA-20032407-018 2003-07-24 Red Hat RHSA-2003:238-01 2003-07-21

Comments (none posted)

apache2: Denial of Service vulnerability

Package(s):	apache2	CVE #(s):
Created:	September 29, 2003	Updated:	March 25, 2004
Description:	A problem was discovered in Apache2 where CGI scripts that write more than 4k to the standard error stream will hang the script's execution. This problem can lead to a denial of service situation. See this bug report for additional details.
Alerts:	Gentoo 200403-04 2004-03-22 Netwosix NW-2004-0006 2004-03-25 Mandrake MDKSA-2003:096-1 2003-10-24 Mandrake MDKSA-2003:096 2003-09-26

Comments (none posted)

cfengine: stack overflow

Package(s):	cfengine	CVE #(s):
Created:	October 8, 2003	Updated:	October 8, 2003
Description:	Versions of cfengine prior to 2.0.8 contain a stack overflow in the network I/O code which can be exploited remotely. See this advisory for details.
Alerts:	Gentoo 200310-2 2003-10-04

Comments (none posted)

ethereal: security problems in Ethereal 0.9.12

Package(s):	ethereal	CVE #(s):	CAN-2003-0428 CAN-2003-0429 CAN-2003-0431 CAN-2003-0432
Created:	June 23, 2003	Updated:	November 10, 2003
Description:	Several security problems have been found in Ethereal 0.9.12. "It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire, or by convincing someone to read a malformed packet trace file."
Alerts:	SCO Group CSSA-2003-030.0 2003-11-07 Yellow Dog YDU-20030718-2 2003-07-18 Red Hat RHSA-2003:203-01 2003-07-03 Gentoo 200306-13 2003-06-25 Conectiva CLA-2003:662 2003-06-25 Mandrake MDKSA-2003:070 2003-06-23

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail: buffer overflow

Package(s):	fetchmail	CVE #(s):	CAN-2002-1365
Created:	December 17, 2002	Updated:	October 20, 2003
Description:	Versions of fetchmail prior to 6.2.0 have (yet another) buffer overflow vulnerability which can be exploited remotely via a suitably crafted message. See this advisory for details.
Alerts:	Immunix IMNX-2003-7+-023-01 2003-10-17 Mandrake MDKSA-2003:011 2003-01-27 EnGarde ESA-20030127-002 2003-01-27 SCO Group CSSA-2003-001.0 2003-01-09 SuSE SuSE-SA:2003:001 2003-01-02 Debian DSA-216-1 2002-12-24 Red Hat RHSA-2002:293-09 2002-12-17 Conectiva CLA-2002:554 2002-12-16

Comments (3 posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

gnupg: key validation

Package(s):	gnupg	CVE #(s):	CAN-2003-0255
Created:	May 16, 2003	Updated:	November 18, 2003
Description:	A key validation bug was discovered in the GNU Privacy Guard (GPG) which would cause keys with more then one user ID to trust all user ID's with the amount of trust given to the most-valid user ID.
Alerts:	SCO Group CSSA-2003-034.0 2003-11-17 Conectiva CLA-2003:694 2003-07-11 Yellow Dog YDU-20030602-4 2003-06-02 Mandrake MDKSA-2003:061 2003-05-22 Slackware ssa:2003-141-04 2003-05-22 Red Hat RHSA-2003:175-01 2003-05-20 Gentoo 200305-04 2003-05-16 OpenPKG OpenPKG-SA-2003.029 2003-05-16 EnGarde ESA-20030515-016 2003-05-15

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

KDE: Two issues in KDM

Package(s):	kde, xfree86	CVE #(s):	CAN-2003-0690 CAN-2003-0692
Created:	September 16, 2003	Updated:	December 19, 2003
Description:	According to this advisory two issues have been discovered in KDM: CAN-2003-0690: Privilege escalation with specific PAM modules. The XDM display manager that ships with XFree86 prior to 4.3 is also vulnerable. CAN-2003-0692: Session cookies generated by KDM are potentially insecure All versions of KDM as distributed with KDE up to and including KDE 3.1.3 are affected.
Alerts:	Mandrake MDKSA-2003:118 2003-12-19 Gentoo 200311-01 2003-11-15 Debian DSA-388-1 2003-09-19 Conectiva CLA-2003:747 2003-09-19 Mandrake MDKSA-2003:091 2003-09-16 Red Hat RHSA-2003:269-01 2003-09-16

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mplayer: remotely exploitable buffer overflow vulnerability

Package(s):	mplayer	CVE #(s):	CAN-2003-0835
Created:	September 29, 2003	Updated:	April 6, 2004
Description:	A remotely exploitable buffer overflow vulnerability was found in MPlayer. A malicious host can craft a harmful ASX header, and trick MPlayer into executing arbitrary code upon parsing that header. Read the full advisory for details.
Alerts:	Mandrake MDKSA-2004:026 2004-04-05 Gentoo 200403-13 2004-03-31 Conectiva CLA-2003:760 2003-10-06 Mandrake MDKSA-2003:097 2003-09-30 Gentoo 200309-15 2003-09-27

Comments (none posted)

mysql: arbitrary code execution

Package(s):	mysql	CVE #(s):	CAN-2003-0780
Created:	September 15, 2003	Updated:	October 9, 2003
Description:	Frank Denis reported a vulnerability in MySQL affecting MySQL3 versions 3.0.57 and earlier and MySQL4 versions 4.0.14 and earlier. Passwords of MySQL users are stored in the "Password" field of the "User" table, part of the "mysql" database. The passwords are hashed and stored as a 16 characters long hexadecimal value. Unfortunately, a function involved in password checking misses correct bounds checking. By filling a "Password" field a value wider than 16 characters, a buffer overflow will occur. The Common Vulnerabilities and Exposures (CVE) project assigned the id CAN-2003-0780 to the problem.
Alerts:	Red Hat RHSA-2003:281-01 2003-10-09 SuSE SuSE-SA:2003:042 2003-10-01 Mandrake MDKSA-2003:094 2003-09-18 Conectiva CLA-2003:743 2003-09-18 EnGarde ESA-20030918-025 2003-09-18 Trustix 2003-0034 2003-09-17 Gentoo 200309-08 2003-09-15 OpenPKG OpenPKG-SA-2003.038 2003-09-15 Debian DSA-381-1 2003-09-13

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

net-snmp: denial of service vulnerability

Package(s):	net-snmp	CVE #(s):	CAN-2002-1170
Created:	December 17, 2002	Updated:	November 7, 2003
Description:	The SNMP daemon included in the Net-SNMP package versions 5.0.1 through 5.0.4 can be caused to crash if it is sent a specially crafted packet.
Alerts:	Conectiva CLA-2003:778 2003-11-07 Red Hat RHSA-2002:228-11 2002-12-17

Comments (none posted)

nfs-utils xlog() off-by-one bug

Package(s):	nfs-utils	CVE #(s):	CAN-2003-0252
Created:	July 14, 2003	Updated:	March 8, 2004
Description:	Linux NFS utils package contains remotely exploitable off-by-one bug. A local or remote attacker could exploit this vulnerability by sending specially crafted request to rpc.mountd daemon. See this BugTraq post for more details.
Alerts:	Trustix TSLSA-2004-0009 2004-03-05 SCO Group CSSA-2003-037.0 2003-11-17 Conectiva CLA-2003:700 2003-07-22 Mandrake MDKSA-2003:076 2003-07-21 Gentoo 200307-07 2003-07-19 Yellow Dog YDU-20030718-1 2003-07-18 Slackware SSA:2003-195-01b 2003-07-15 Immunix IMNX-2003-7+-018-01 2003-07-14 SuSE SuSE-SA:2003:031 2003-07-15 Slackware SSA:2003-195-01 2003-07-14 Debian DSA-349-1 2003-07-14 Red Hat RHSA-2003:206-01 2003-07-14

Comments (none posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

openssl: vulnerabilities in ASN.1 code

Package(s):	openssl	CVE #(s):	CAN-2003-0543 CAN-2003-0544 CAN-2003-0545
Created:	September 30, 2003	Updated:	November 4, 2003
Description:	Vulnerabilities have been found in OpenSSL ASN.1 code. This advisory contains details of 4 separate problems in versions of OpenSSL up to and including 0.9.6j and 0.9.7b and all versions of SSLeay. An attack against other applications that use OpenSSL could result in a Denial of Service. See CAN-2003-0543 and CAN-2003-0544. It may be possible for an attacker to exploit this issue to execute arbitrary code. See CAN-2003-0545. CERT has an updated OpenSSL advisory identifying additional OpenSSL vulnerabilities.
Alerts:	EnGarde ESA-20031104-029 2003-11-04 Debian DSA-394-1 2003-10-11 Conectiva CLA-2003:759 2003-10-03 EnGarde ESA-20031003-028 2003-10-03 Tawie 2003-0001 2003-10-02 SuSE SuSE-SA:2003:043 2003-10-01 Slackware SSA:2003-273-01 2003-09-30 Mandrake MDKSA-2003:098 2003-09-30 Gentoo 200309-19 2003-10-01 Debian DSA-393-1 2003-10-01 Conectiva CLA-2003:751 2003-09-30 EnGarde ESA-20030930-027 2003-09-30 Immunix IMNX-2003-7+-022-01 2003-09-29 OpenPKG OpenPKG-SA-2003.044 2003-09-30 Red Hat RHSA-2003:292-01 2003-09-30 Red Hat RHSA-2003:291-01 2003-09-30

Comments (none posted)

postfix: denial of service vulnerabilities

Package(s):	postfix	CVE #(s):	CAN-2003-0468 CAN-2003-0540
Created:	August 5, 2003	Updated:	May 27, 2004
Description:	The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:	Mandrake MDKA-2004:028 2004-05-26 Trustix 2003-0029 2003-08-04 Mandrake MDKSA-2003:081 2003-08-04 EnGarde ESA-20030804-019 2003-08-04 Conectiva CLA-2003:717 2003-08-04 SuSE SuSE-SA:2003:033 2003-08-04 Red Hat RHSA-2003:251-01 2003-08-04 Debian DSA-363-1 2003-08-03

Comments (none posted)

PostgreSQL - more buffer overflows

Package(s):	postgresql	CVE #(s):
Created:	February 12, 2003	Updated:	November 7, 2003
Description:	A new set of buffer overflows has been discovered in PostgreSQL 7.2.2; they affect the circle_poly(), path_encode(), and path_addr() functions. Exploiting these overflows requires that the attacker first obtain a connection to the PostgreSQL server.
Alerts:	Debian DSA-397-1 2003-11-07 Immunix IMNX-2003-7+-005-01 2003-04-08 Trustix 2003-0004 2003-02-20 Mandrake MDKSA-2002:062-1 2003-02-11

Comments (1 posted)

proftpd: remote root shell

Package(s):	proftpd	CVE #(s):	CAN-2003-0831
Created:	September 24, 2003	Updated:	January 2, 2004
Description:	The ASCII translation mechanism in ProFTPD 1.2.8 contains a vulnerability which will provide a remote attacker with a root shell - if the attacker is able to download a specially-crafted file. See this ISS advisory for more information.
Alerts:	Mandrake MDKSA-2003:095-1 2003-12-31 Conectiva CLA-2003:750 2003-09-29 Gentoo 200309-16 2003-09-28 Trustix 2003-0037 2003-09-27 Mandrake MDKSA-2003:095 2003-09-26 OpenPKG OpenPKG-SA-2003.043 2003-09-25 Slackware SSA:2003-259-02 2003-09-23

Comments (2 posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

sane-backends: several vulnerabilities

Package(s):	sane-backends	CVE #(s):	CAN-2003-0773 CAN-2003-0774 CAN-2003-0775 CAN-2003-0776 CAN-2003-0777 CAN-2003-0778
Created:	September 11, 2003	Updated:	February 20, 2004
Description:	Alexander Hvostov, Julien Blache and Aurelien Jarno discovered several security-related problems in the sane-backends package, which contains an API library for scanners including a scanning daemon (in the package libsane) that can be remotely exploited. These problems allow a remote attacker to cause a segfault fault and/or consume arbitrary amounts of memory. The attack is successful, even if the attacker's computer isn't listed in saned.conf. You are only vulnerable if you actually run saned e.g. in xinetd or inetd. If the entries in the configuration file of xinetd or inetd respectively are commented out or do not exist, you are safe. Try "telnet localhost 6566" on the server that may run saned. If you get "connection refused" saned is not running and you are safe. The Common Vulnerabilities and Exposures project identifies the following problems: CAN-2003-0773: saned checks the identity (IP address) of the remote host only after the first communication took place (SANE_NET_INIT). So everyone can send that RPC, even if the remote host is not allowed to scan (not listed in saned.conf). CAN-2003-0774: saned lacks error checking nearly everywhere in the code. So connection drops are detected very late. If the drop of the connection isn't detected, the access to the internal wire buffer leaves the limits of the allocated memory. So random memory "after" the wire buffer is read which will be followed by a segmentation fault. CAN-2003-0775: If saned expects strings, it mallocs the memory necessary to store the complete string after it receives the size of the string. If the connection was dropped before transmitting the size, malloc will reserve an arbitrary size of memory. Depending on that size and the amount of memory available either malloc fails (->saned quits nicely) or a huge amount of memory is allocated. Swapping and OOM measures may occur depending on the kernel. CAN-2003-0776: saned doesn't check the validity of the RPC numbers it gets before getting the parameters. CAN-2003-0777: If debug messages are enabled and a connection is dropped, non-null-terminated strings may be printed and segmentation faults may occur. CAN-2003-0778: It's possible to allocate an arbitrary amount of memory on the server running saned even if the connection isn't dropped. At the moment this can not easily be fixed according to the author. Better limit the total amount of memory saned may use (ulimit).
Alerts:	SCO Group CSSA-2004-005.0 2004-02-19 SuSE SuSE-SA:2003:046 2003-11-18 Conectiva CLA-2003:769 2003-10-22 Mandrake MDKSA-2003:099 2003-10-09 Red Hat RHSA-2003:278-01 2003-10-07 Debian DSA-379-1 2003-09-11

Comments (none posted)

sendmail: remotely exploitable buffer overflow

Package(s):	sendmail	CVE #(s):	CAN-2003-0694 CAN-2003-0681
Created:	September 17, 2003	Updated:	November 18, 2003
Description:	Michal Zalewski has reported a buffer overflow in sendmail. This overflow, apparently, may be exploited remotely, but only in certain (non-default) configurations. Sendmail 8.12.10 has the fix.
Alerts:	SCO Group CSSA-2003-036.0 2003-11-17 SuSE SuSE-SA:2003:040 2003-09-20 OpenPKG OpenPKG-SA-2003.041 2003-09-19 Conectiva CLA-2003:742 2003-09-18 Yellow Dog YDU-20030917-2 2003-09-17 Immunix IMNX-2003-7+-021-01 2003-09-17 Mandrake MDKSA-2003:092 2003-09-17 Debian DSA-384-1 2003-09-17 Red Hat RHSA-2003:283-01 2003-09-17 Slackware SSA:2003-260-02 2003-09-17 Gentoo 200309-13 2003-09-17

Comments (none posted)

stunnel: signal handler reentrancy DoS

Package(s):	stunnel	CVE #(s):	CAN-2002-1563
Created:	July 25, 2003	Updated:	November 25, 2003
Description:	Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over a secure connection (encrypted using SSL or TLS) or to provide a secure means of connecting to services that do not natively support encryption. When configured to listen for incoming connections (instead of being invoked by xinetd), stunnel can be configured to either start a thread or a child process to handle each new connection. If Stunnel is configured to start a new child process to handle each connection, it will receive a SIGCHLD signal when that child exits. Stunnel versions prior to 4.04 would perform tasks in the SIGCHLD signal handler which, if interrupted by another SIGCHLD signal, could be unsafe. This could lead to a denial of service.
Alerts:	Red Hat RHSA-2003:296-01 2003-11-24 SCO Group CSSA-2003-026.0 2003-10-03 Conectiva CLA-2003:736 2003-09-05 Trustix 2003-0030 2003-08-07 EnGarde ESA-20030806-020 2003-08-06 Red Hat RHSA-2003:221-01 2003-07-25

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

unzip: directory traversal vulnerability

Package(s):	unzip	CVE #(s):	CAN-2003-0282
Created:	July 1, 2003	Updated:	November 13, 2003
Description:	A vulnerabilitiy in unzip version 5.50 and earlier allows attackers to overwrite arbitrary files during archive extraction by placing invalid (non-printable) characters between two "." characters. These non-printable characters are filtered, resulting in a ".." sequence. See the full advisory for further information.
Alerts:	SCO Group CSSA-2003-031.0 2003-11-07 Debian DSA-344-2 2003-08-26 Slackware SSA:2003-237-01 2003-08-25 Mandrake MDKSA-2003:073-1 2003-08-19 Conectiva CLA-2003:724 2003-08-18 Red Hat RHSA-2003:199-02 2003-08-15 Yellow Dog YDU-20030710-1 2003-07-10 Gentoo 200307-02 2003-07-11 OpenPKG OpenPKG-SA-2003.033 2003-07-10 Debian DSA-344-1 2003-07-08 Mandrake MDKSA-2003:073 2003-07-07 Conectiva CLA-2003:672 2003-07-02 Immunix IMNX-2003-7+-017-01 2003-07-02 Red Hat RHSA-2003:199-01 2003-07-01

Comments (none posted)

vim - modeline vulnerability

Package(s):	vim	CVE #(s):	CAN-2002-1377
Created:	January 16, 2003	Updated:	February 10, 2004
Description:	VIM allows a user to set the modeline differently for each edited text file by placing special comments in the files. Georgi Guninski found that these comments can be carefully crafted in order to call external programs. This could allow an attacker to create a text file such that when it is opened arbitrary commands are executed.
Alerts:	Conectiva CLA-2004:812 2004-02-10 Mandrake MDKSA-2003:012 2003-02-03 Yellow Dog YDU-20030127-3 2003-01-27 Gentoo 200301-13 2003-01-22 OpenPKG OpenPKG-SA-2003.003 2003-01-21 Red Hat RHSA-2002:297-17 2003-01-15

Comments (4 posted)

webmin: session ID spoofing

Package(s):	webmin	CVE #(s):	CAN-2003-0101
Created:	June 13, 2003	Updated:	November 18, 2003
Description:	miniserv.pl in the webmin package does not properly handle metacharacters, such as line feeds and carriage returns, in Base64-encoded strings used in Basic authentication. This vulnerability allows remote attackers to spoof a session ID, and thereby gain root privileges.
Alerts:	SCO Group CSSA-2003-035.0 2003-11-17 Debian DSA-319-1 2003-06-12

Comments (none posted)

wget: buffer overflow

Package(s):	wget	CVE #(s):	CAN-2003-1565
Created:	August 5, 2003	Updated:	December 10, 2003
Description:	The wget utility contains a buffer overflow which, when exploited with an over-long URL, can enable arbitrary code execution.
Alerts:	Red Hat RHSA-2003:372-01 2003-12-10 SCO Group CSSA-2003-025.0 2003-10-03 Conectiva CLA-2003:716 2003-08-04

Comments (1 posted)

XFree86 4.3.0 integer overflows in font libraries

Package(s):	XFree86	CVE #(s):	CAN-2003-0730
Created:	September 12, 2003	Updated:	November 25, 2003
Description:	Several vulnerabilities were discovered by blexim(at)hush.com in the font libraries of XFree86 version 4.3.0 and earlier. These bugs could potentially lead to execution of arbitrary code or a DoS by a remote user in any way that calls these functions, which are related to the transfer and enumeration of fonts from font servers to clients. See the advisory for additional details.
Alerts:	Red Hat RHSA-2003:286-01 2003-11-25 Red Hat RHSA-2003:287-01 2003-11-25 Red Hat RHSA-2003:288-01 2003-11-17 Debian DSA-380-1 2003-09-12 Mandrake MDKSA-2003:089 2003-09-11

Comments (none posted)

xinetd: Memory leak in xinetd 2.3.10

Package(s):	xinetd	CVE #(s):	CAN-2003-0211
Created:	May 13, 2003	Updated:	November 13, 2003
Description:	Xinetd is a 'master server' that is used to to accept service connection requests and start the appropriate servers. Because of a programming error, memory was allocated and never freed if a connection was refused for any reason. An attacker could exploit this flaw to crash the xinetd server, rendering all services it controls unavailable. In addition, other flaws in xinetd could cause incorrect operation in certain unusual server configurations. All users of xinetd are advised to update to xinetd-2.3.11 which is not vulnerable to these issues.
Alerts:	Conectiva CLA-2003:782 2003-11-12 Yellow Dog YDU-20030602-1 2003-06-02 Gentoo 200305-08 2003-05-19 Mandrake MDKSA-2003:056 2003-05-14 Red Hat RHSA-2003:160-01 2003-05-13

Comments (none posted)

Resources

This month's CRYPTO-GRAM

Bruce Schneier's CRYPTO-GRAM newsletter for October is out. This month's topics include the future of surveillance, the expanding use of the "Patriot" act, pirating movies, identity cards, and the security risks of monocultures. "The upshot of this is that you should consider the possibility, albeit remote, that you are being observed whenever you're out in public. Assume that all public Internet terminals are being eavesdropped on; either don't use them or don't care. Assume that cameras are watching and recording you as you walk down the street. (In some cities, they probably are.) Assume that surveillance technologies that were science fiction ten years ago are now mass-market."

Full Story (comments: 2)

Linux Security Week

The October 14 issue of Linux Security Week from LinuxSecurity.com is available.

Full Story (comments: none)

New CERT Coordination Center (CERT/CC) PGP Key

CERT has adopted a new PGP key which will be used in its outgoing email. See the announcement for details on how to get the new key. Apparently the passphrase for the previous key was spread a little more widely than CERT had intended.

Full Story (comments: none)

Events

FIRST Conference

The 16th Forum of Incident Response and Security Teams (FIRST) will be held June 13 to 18 in Budapest, Hungary. The call for papers is out now, with a submission deadline of December 1.

Full Story (comments: none)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current development kernel is 2.6.0-test7; there have been no development kernel releases in the last week.

Linus's BitKeeper tree does contain a pile of patches, most of which are stability fixes as one would expect. It also includes a (controversial) patch to allow kernel threads to handle signals properly, a fix for a possible interrupt handling deadlock, and a workaround for the AMD Opteron prefetch bug.

The current stable kernel is 2.4.22. Marcelo released 2.4.23-pre7 on October 9; it includes Jens Axboe's laptop mode patch, a new MegaRAID driver, BIOS enhanced disk detection support, USB gadget support, and various other fixes and updates. The plan is apparently to get the first release candidate out within a month.

Comments (1 posted)

Kernel development news

Looking forward to 2.7

Some attention has been given to the "2.7 thoughts" list which has been circulating on linux-kernel. Looking forward to what can be done in the next development series can be an interesting exercise. In this case, though, the exercise has mostly been carried out by people who will not actually be doing the work; as a result, the list has been dismissed by a few kernel hackers; one called it "crackpot wishlist gunk."

So what are the crackpots wishing for? Some of the items they want (marked "mandatory features" on the list) are already in the works; these include support for CPU hotplugging, full NTFS support and virtual machine support. Others are somewhat vague, including "complete user quota centralization" and "improve kobject model for security, quota rendering." And some will never happen; there is just not a whole lot of call for features like an in-kernel Gopher server or a /proc implementation of the loadable module tools.

Kernel hackers have far more respect for code (and those who produce it) than they do for list makers. The 2.7 thoughts list may yet inspire somebody to do some hacking, but its influence on the development process is likely to remain small.

A more interesting view into what could happen with 2.7 might be found in a conversation between Linus and Joel Becker of Oracle. The discussion turned to what information was needed from the kernel to perform direct I/O, which lead to this outburst from Linus:

Linus went on to wish an early death upon disk-based databases; he seems to think that all but the largest databases should just be done in-memory.

Direct I/O does bring its share of problems. It is hard to keep the kernel page cache in a coherent condition when I/O operations are allowed to circumvent it; page cache confusion can lead to corrupted data. Getting good performance out of direct I/O is hard unless asynchronous I/O is used as well. Direct I/O can also confuse the disk I/O scheduler by creating request patterns (especially overlapping requests) which don't otherwise happen. In other words, the direct I/O idea is hard to get right for both kernel and user space.

But systems like Oracle do need some of the capabilities that direct I/O provides. They need to be able to move large amounts of data without polluting the page cache with stuff that will not be used. Databases which use shared storage need to be able to force data to be reread from disk when another system has changed it. Large applications also tend to have a better idea of how their access patterns work than the kernel does; they know when a particular block of data will not be used any more. The need for the level of control and performance direct I/O can provide will persist, whether it is a "piece of crap" or not.

Linus seems to understand this need; he would just like to push development toward what he sees as a better interface. Such an interface would work with the page cache, rather than trying to circumvent it. Some of his thoughts, as expressed in this posting, include:

• A mechanism for moving pages between user space and the page cache. An application wishing to do a direct write would then just transfer ownership of the pages containing the data to the kernel, which would put them into the page cache. A simple flush finishes the job.

• A way for an application to tell the kernel that certain pages in the cache are stale and should not be used. This mechanism could also be used to tell the kernel about pages which are no longer needed and can be dropped from the cache. The fadvise() system call already does part of this task.

• The ability to mark I/O on a particular file descriptor (or by a particular process) as being a one-shot affair that should not be cached. This idea was suggested in response to a description of performance problems triggered by the PostgreSQL vacuum operation, which touches much of the database exactly once.

Much time and effort over the 2.5 development series went into making direct I/O work well. This work helped to close a gap between Linux and some proprietary Unix systems. It could well be that, in 2.7, that effort goes into coming up with a better way of solving the problem altogether.

Comments (6 posted)

Making write barriers actually work

Certain kernel subsystems - journaling filesystems in particular - have some strict requirements about how their disk I/O operations are ordered. Open transactions must be committed to the journal before the actual filesystem structure can be touched. If this requirement is not met, the integrity of the filesystem could be lost if a crash happens at the wrong time.

One way to implement ordering is to explicitly wait on the buffers that must make it to disk. If no new operations are submitted before the old ones complete, the ordering requirements will be met (though write caching in disk drives can create problems of their own). This waiting is hard on performance, however; the filesystem would be better off setting up more requests than waiting for the old ones.

As a way of improving journaling filesystem performance, the design goals for the block layer rework in 2.5 included write barriers. A write barrier is simply a specially marked I/O request; the block layer will not reorder any other request past a barrier request in either direction. In this way, all requests issued prior to the barrier request are guaranteed to be completed before any requests issued after the barrier are begun. With this feature, a journaling system can simply issue a barrier request when it commits its journal, then go on with implementing the next transaction.

The problem is that barriers don't actually work yet. That little shortcoming shouldn't last much longer, however, now that Jens Axboe has dusted off his write barrier patch and is actively working on it again.

Barrier requests still work pretty much as described in the LWN Driver Porting series. A driver which honors barriers must now inform the block layer of that fact, however, with a call to:

    void blk_queue_ordered(request_queue_t *queue, int flag);

where flag is QUEUE_ORDERED_NONE if the device does not support barriers (the default), QUEUE_ORDERED_TAG if barriers are implemented with ordered command tags, or QUEUE_ORDERED_FLUSH if an explicit hardware flush command is used. If higher-level code attempts to create a barrier request for a device which does not support them, the block layer will return an error. The code does not currently appear to care which of the two methods a driver says it implements, as long as it picks one.

Also included with the patch is a barrier implementation for IDE drives (using QUEUE_ORDERED_FLUSH) and simple patches to a couple of filesystems to make them use the barrier feature. Now it's mostly a matter of waiting to see whether Linus considers barriers to be a stability-related patch.

Comments (5 posted)

Sysfs and small memory machines

William Lee Irwin recently tried the 2.6.0-test kernel on a system limited to 16MB of memory. In the modern world, that is a shockingly small amount of RAM, just slightly above storing your data on an abacus. There are people out there, however, who are doing their best to get work done on limited hardware, and, as Andrew Morton says, "we should try to not suck in this situation." William's results indicate that some work is still required for 2.6 to perform adequately on low-end hardware.

One of the more striking results from this test is that a substantial chunk of the system's memory is consumed by the inode and dentry caches. Those caches, in fact, took up over 10% of the memory which was available at boot time. If some way could be found to reduce the size of the inode and dentry caches, enough memory would be freed to make a noticeable difference on low-memory systems.

The culprit in this case is sysfs. Each entry in sysfs creates an inode and a directory entry, and both are pinned into memory for the life of the system. Pinning the entries is a standard way of creating virtual filesystems in the kernel; it frees the code from the need to create any sort of backing store for the filesystem. This scheme works less well when a filesystem can have thousands of entries, however. Even a minimal system's sysfs directory can have several hundred files and directories, and there is a clear intent to add many more.

One approach to the problem is to simply get rid of sysfs; Andrew Morton has posted a patch which adds a "nosysfs" boot-time option. This capability may be of interest to creators of embedded systems and such, but it is hard to see its utility extending much beyond that. Sysfs is becoming an increasingly important communications channel between user and kernel space; it can't just be ripped out without breaking things.

So the kernel hackers will have to figure out how to preserve sysfs while trimming its memory requirements. One set of patches posted recently tried to achieve this goal by adding a real, in-kernel backing store for sysfs. The patch did not get very far, however, because it made the kobject structure significantly bigger. The real solution will probably involve a bit of clever filesystem hacking. The internal kobject hierarchy contains the information that is really needed to implement sysfs; the existing cached inodes and dentries just make it work easily. But those cached entries - especially those for the attributes that make up the bottom leaves of sysfs - could be generated on demand when user space actually needs them. It will take some work, but users of small systems will doubtless be thankful for the result.

Comments (1 posted)

Letting sleeping processors lie

The Linux kernel tries to save power by, among other things, halting the processor when there is no work to be done. The processor's sleep can be fitful, however; even when there is no work, the timer interrupt will continue to wake the processor every 1/1000 to 1/100 second. George Anzinger's new variable scheduling timeouts (VST) patch seeks to solve this problem by eliminating timer interrupts when there is nothing for that interrupt to do.

The kernel timer interrupt is responsible for keeping track of time for the kernel by updating the value of jiffies and handling other housekeeping and process accounting functions. When processing the timer interrupt, the kernel will periodically also check the timer list to see if any kernel timers have expired and if so, call the completion function for that timer. Timers in the kernel are one of the mechanisms used to schedule work that needs to be done in the future. In the absence of a running process, the only real work that needs to be done in the timer interrupt is the maintenance of the timer list.

When no processes are running, the VST patch causes the idle task to scan the timer list and delay the timer interrupt if there are no timers that will expire in the next timer tick. It does this by changing the value in the Programmable Interrupt Timer (PIT) to generate an interrupt when the next timer is set to expire. The resolution of the PIT only allows values up to about 50ms and thus that is currently the limit of how long a timer interrupt can be held off, but there are plans to use the Real Time Clock hardware in the future to remove this restriction. When the timer interrupt eventually occurs, the VST code will update jiffies and do the necessary housekeeping to handle the amount of time that has been missed.

If the system is idle, there are no runnable tasks currently active, but an interrupt from the hardware could change that situation. To handle this case, the VST patch hooks into the low-level interrupt handling code to re-enable the timer interrupt when another interrupt occurs. It also runs the timer interrupt service routine at that time to update the kernel time information as if the timer interrupts had occurred normally.

The benefit of this patch is that when the system is idle the kernel can halt the processor in order to conserve power. Eliminating needless timer interrupts help to keep the processor idle longer. The result is that battery operated Linux based devices can operate longer on a single charge, which should make PDA and laptop users happier. As of this writing, there are no hard numbers on how well this patch reduces power consumption, hopefully some information on that will be forthcoming.

Comments (6 posted)

Patches and updates

Kernel trees

• Andrew Morton: 2.6.0-test7-mm1. (October 15, 2003)

• Stephen Hemminger: 2.6.0-test7-netx1. (October 10, 2003)

• Stephen Hemminger: 2.6.0-test7-netx2. (October 15, 2003)

• Marcelo Tosatti: Linux 2.4.23-pre7. (October 10, 2003)

• Bernhard Rosenkraenzer: 2.4.23-pre7-pac1. (October 12, 2003)

• Bernhard Rosenkraenzer: 2.4.23-pre7-pac2. (October 14, 2003)

Core kernel code

• George Anzinger: VST (tick elimination) is now available. (October 11, 2003)

• Con Kolivas: Batch scheduling for 2.6.0-test7. (October 13, 2003)

• David Woodhouse: Kernel thread signal handling.. (October 13, 2003)

• Simon Derr: cpuset proposal. (October 13, 2003)

• Andrew Morton: nosysfs boot-time option. (October 15, 2003)

Device drivers

• Matt Domsch: EDD 4-byte MBR disk signature for the boot disk. (October 11, 2003)

• Matthew Wilcox: sym 2.1.18f. (October 13, 2003)

• Jeff Garzik: 2.6.x net driver updates. (October 15, 2003)

• Jeff Garzik: 2.6.x experimental net driver updates. (October 15, 2003)

Documentation

• Xose Vazquez Perez: state of scsi drivers. (October 13, 2003)

Filesystems and block I/O

• Jens Axboe: ide write barrier support. (October 13, 2003)

• Jens Axboe: ide barrier support, #2. (October 14, 2003)

• Jens Axboe: ide barrier support, #3. (October 14, 2003)

• Alex Tomas: EXT3 extents against 2.6.0-test7. (October 13, 2003)

Networking

• Douglas Leith: patch to implement RFC3517 in linux 2.4.22. (October 14, 2003)

• Shirley Ma: Implementation for IPv6 MIB:ipv6InterfaceTable. (October 15, 2003)

Benchmarks and bugs

• Judith Lebzelter: OSDL Iozone results for latest kernels. (October 11, 2003)

Miscellaneous

• Mika Kukkonen: OSDL CGL V2.0 Requirements Definition is now available. (October 10, 2003)

• Adam Litke: New Release: Kernel Call Graphing. (October 15, 2003)

Page editor: Jonathan Corbet

Distributions

News and Editorials

A Review of LindowsOS 4.0

Introduction

Lindows.com was established in October 2001 in San Diego, California, USA by Michael Robertson, the founder and former CEO of mp3.com. It was a stormy start. The company had initially succeeded in attracting media attention on two fronts - by ambitious claims about the future ability of LindowsOS to run many popular Windows applications, and by engaging in a legal battle with Microsoft over alleged trademark infringement. While in the following months Lindows.com quietly shelved their original plans, they were successful in defending the right to use the word "Lindows" both in their company name (Lindows.com) and their product name (LindowsOS).

After many months of development, Lindows.com finally announced the first general release of LindowsOS, version 3.0, in November 2002. Unfortunately, many reviewers found the comparatively expensive product buggy and still a lot harder to use than the operating system it was meant to replace. Yet, it wasn't all bad news. The company's developers had clearly done some much needed usability studies to bring Linux closer to general population and developed an excellent software installation utility called Click-N-Run. Lindows.com also sponsors several open source projects, including Mozilla, GAIM and KDE-look.org.

LindowsOS 4.0 was released in June 2003 and the first reviews gave an indication of a vastly improved product. For this brief overview, LindowsOS 4.0 was installed on a fairly standard system with Intel Pentium 4 1.4 GHz processor, ASUS P4T motherboard, 384 MB RDRAM, nVidia GeForce4 Ti4200, onboard Realtek 8139too network card and Lemel 17" TFT monitor.

Installation

The installation of LindowsOS 4.0 was uneventful. As expected, the user is not required to make many decisions, with the only exception being the screen prompt to select between the "take over an entire hard disk" option and the "advanced install" option. The term "advanced install" is grossly misleading as the sole available "advanced" choice is the selection of a pre-existing partition on which to install the operating system. There are no options to create/resize partitions or select more than one partition for installation, and neither there are options for specifying the file system or boot sector. LindowsOS automatically formats the hard disk or the selected partition with ReiserFS, while lilo simply overwrites the master boot record, no questions asked. There is no package selection screen either, but users are prompted to enter an optional root password if they so desire.

The entire installation took no more than a few minutes. In fact, in took less time than the subsequent first boot - presumably due to all the behind-the-scenes hardware autodetection and configuration, and also because the OS laboriously mounted all 22 partitions on my two hard disks. Some, but not all of the Linux distributions on these partitions and their correct names were present on the LindowsOS boot menu. Once the long boot completed, I found myself inside the KDE desktop environment and the first window calling for attention was a message asking me to accept the LindowsOS license agreement together with a chance to adjust a few simple configuration options. The hardware detection was flawless.

I was logged in as root with no password requested. Although LindowsOS does provide a place to add individual users to the system from within the initial configuration screen, it makes no effort to encourage the user to do so. Neither is user addition mentioned in the accompanying "Getting Started" guide. As such, it is probably fair to assume that the majority of LindowsOS users do run their operating system as superusers with no passwords set.

Applications and System Configuration

The first impression was extremely favorable. It was immediately obvious that a lot of thought had been put into making the desktop as pleasant as possible and LindowsOS has certainly succeeded in creating an intuitive and highly likable working environment. From the desktop, panel and system tray icons to careful menu design, one could immediately see that this is not just a standard default desktop as designed by KDE developers, but a highly polished and well organized setup by professional usability experts. Unlike Lycoris Desktop/LX, LindowsOS does not go out of its way to create a Windows XP lookalike, choosing instead to retain a distinct LindowsOS look and style.

The basic edition of LindowsOS does not come with many applications. Mozilla serves as a default program for web browsing and email, while GAIM is the preferred instant messenger. It is interesting to note that LindowsOS keeps GAIM up-to-date, despite never-ending changes in authentication schemes of Yahoo! Messenger and other popular instant messengers. Among the multimedia tools, only basic CD and MP3 players are supplied, while the system lacks a video player. Office applications are also missing. A simplified KDE Control Center, called LindowsOS Control Panel, is used for system configuration tasks.

Click-N-Run

The Click-N-Run warehouse is the major selling point behind the distribution. While it is essentially just a giant repository of Debian packages, its design, execution, features and general user-friendliness make this service unique among Linux distributions. At $50 per year, it is a bargain. Click-N-Run not only provides for a single-click installation, it also serves as an all-purpose tool for system and security updates (inclusive of automatic download and installation of critical updates), with useful information about the hundreds of available packages. These can be grouped into custom categories, or "aisles" in LindowsOS terms, based on user preferences. Many aisles containing task-specific package groups are already pre-configured for a single-click installation, and although they often include proprietary software requiring extra payment, they are generally useful for installing a whole group of packages without going through a tedious search process. Installed packages immediately appear on the system menu, as well as on the desktop as icons.

For those who are unable or unwilling to part with the necessary cash to join Click-N-Run, LindowsOS comes pre-configured with apt-get, with its sources pointing to Debian's testing branch.

Pros and Cons

The overall experience using LindowsOS was surprisingly positive. Besides the excellent Click-N-Run warehouse, there are many small touches where the product's attention to detail is immediately visible, such as CD automount or automatic MIME type configuration after installing new applications. Inserting a CD into the CD tray magically starts the relevant application or the file manager, just like in Windows. The Audio Assist Tutorial set provides a convenient introduction to the system, while the brief, but well-designed "Getting Started" guide is all that a new user needs to get up to speed with the new software. Hardware autodetection and configuration was amazing and even the K3B CD-burning application was all set up and ready requiring no further configuration. Lindows.com also provides active user forums with Lindows.com staff (including Michael Robertson) actively participating in the discussions.

On the negative side, the system defaults to running as a "passwordless root" and LindowsOS makes no effort to encourage proper user setup. Excessive commercialization has to be noted as another shortcoming - even inserting an unencrypted DVD promptly directs the user toward purchasing a Lindows DVD player - a commercial edition of xine with a license for DVD decoding, although even a plain xine would play the DVD just fine. The default system tray includes icons for commercial Lindows.com products, such as Virus Safe and Surf Safe, some of which are of questionable value.

Conclusion

Lindows.com has done an excellent job with LindowsOS 4.0. While some of the earlier editions came under heavy criticism by reviewers, it is clear that the developers had read those reviews and made the necessary improvements. LindowsOS 4.0 is an aesthetically pleasing, highly usable operating system with superior hardware autodetection and excellent Click-N-Run software warehouse. However, the system's default of running as a passwordless superuser is a sore point, which from a point of view of any veteran UNIX user, makes it hard to express wholehearted recommendation for the product - it would be unfair on the users and their data. There has to be a better solution to the convenience versus security compromise than the present default, or at the very least, Lindows.com should make more effort to educate and encourage users to set up proper user accounts.

Comments (10 posted)

Distribution News

Mandrake Linux

Mandrake Linux 9.2 has been released, with many new features. It can be downloaded in advance by MandrakeClub.com Members and by all 9.2 contributors, with the help of the BitTorrent technology. Mandrake 9.2 packs are available for pre-ordering at MandrakeStore.com. The 9.2 raw tree (binary packages + contribs + sources) are also available publicly through MandrakeSoft.com and on regular mirrors.

Those Mandrake 9.1 & 9.2 users who the stock ticker applet on Yahoo might want to grab the new gnome-applets package.

Comments (none posted)

Debian GNU/Linux

The Debian Weekly News for October 14, 2003 contains news about Russian Debian, a Libranet review, the SPI/Debian Trademark Committee, Debian GNU/Linux wins Linux Journal award, and much more.

Debian has been named "Favorite Distribution" in the Linux Journal Ninth Annual Readers' Choice Awards. Congratulations!

Software in the Public Interest, Inc. (SPI), owner of the "Debian" trademark, and the Debian Project have formed a committee to better define Debian trademark policy.

Voting on a General Resolution to amend the Debian Constitution has been delayed due to changes in the proposals.

Comments (none posted)

Updated Fedora Core test release: Severn

Another test release of Severn, code name for the current incarnation of the Fedora core, is now available. The announcement (click below) contains a list of mirror sites where Severn is available for download.

Full Story (comments: none)

Gentoo Weekly Newsletter -- Volume 2, Issue 41

The Gentoo Weekly Newsletter for the week of October 13, 2003 is out. The top news this week - GNOME 2.4 has now been marked stable on x86.

Full Story (comments: none)

MontaVista Launches Carrier Grade Linux Upgrade

MontaVista Software Inc. has announced MontaVista Linux Carrier Grade Edition 3.1 (CGE). This version adds support for the IBM PowerPC architecture.

Full Story (comments: none)

SOT issues call for developers

GNU/Linux software house SOT Finnish Software Engineering Ltd. is inviting Open Source developers to its online community, and is making 500 SOT Linux and SOT Office CDs available free of charge to interested volunteers.

Full Story (comments: none)

New Distributions

Ankur Bangla Live

Footnotes reports on the release of the second beta for Ankur Bangla Live. This is a Morphix-based Live CD with GNOME 2.4, localized into Bangla (Bengali).

Comments (none posted)

Office optimized Linux (OoL)

Office optimized Linux (OoL) is a distribution that has been customized and optimized for office use. It features the KDE desktop with lots of programs for managing documents, appointments, email, and media. The current version includes Open Office 1.1.0, which offers the ability to directly export files into PDF and Flash. OoL is is brought to you by the folks at SoL (Server Optimized Linux). OoL joins the list at version 17.00o, released October 13, 2003.

Comments (none posted)

Minor distribution updates

Adamantix

Adamantix has released v1.0.2. "Changes: Many new packages, security fixes (OpenSSL, OpenSSH, etc.), new kernel 2.4.21 packages (with newer versions of PaX, RSBAC v1.2.2, transparent proxy patch, etc.), MD5 checksums added to packages that lacked this so far, and fixes for compilation/linking problems."

Comments (none posted)

CDLinux

CDLinux has released v0.4.6 with minor bugfixes. "Changes: This version fixes a path error in rc.sysinit, and now pcmciacs can now be started automatically again. rc.extra was fixed to be more careful about null strings."

Comments (none posted)

Devil-Linux

Devil-Linux has released 1.0-RC2. The announcement (click below) contains a list of things that have changed since the first release candidate.

Full Story (comments: none)

GNOPPIX

Footnotes reports on the release of GNOPPIX 0.6.0 beta 1. "This new version comes with Gnome 2.4 woody backports, updates and alot of improvements."

Comments (none posted)

MoviX

MoviX has released v0.8.1pre2 with major feature enhancements. "Changes: Many new MPlayer features have been imported from GeexBox (including subtitle and audio channel on-the-fly switching and the ability to use the MPlayer menu during audio-only playback). Support has been added for slideshows, and many improvements have been made to the MoviX menu."

Comments (none posted)

Snootix

Snootix has released v0.3 with major feature enhancements. "Changes: This version now installs a full LFS-4.1 system."

Comments (none posted)

VectorLinux

VectorLinux has released v4.0 with major feature enhancements. "Changes: This version is based on Slackware 9.0 and the 2.4.22 kernel. Automatic hardware configuration was implemented and XFree 4.3.0 was included. XFree 3.3.6 is no longer supported. The minimum system supported is now a Pentium 100 with 32MB of RAM and 650MB of hard drive space for the full GUI install. All of the system software was updated and a choice between IceWM, XFCE, and Fluxbox is now available. Much work was made on the ease of configuration and use."

Comments (none posted)

Distribution reviews

Babe in the Woods: A Linux User Migrates to FreeBSD (OfB.biz)

In this Open for Business article a Linux user a takes a look at FreeBSD. "I had no intention of running a thorough test of everything, just the things I needed to use. What really keeps me working with all this is not some hard-headed persistence, but that I found in FreeBSD at least two things that I came looking for: a speedy system on my aging hardware, and a chance to get off the upgrade merry-go-round."

Comments (17 posted)

FIRST LOOK: Mandrake Linux 9.2 Discovery Edition (OfB.biz)

Open for Business reviews Mandrake Linux 9.2. "For the purposes of this brief preview of Mandrake Linux 9.2, we tested a copy of the new "Discovery Edition" provided to us by MandrakeSoft. The Discovery Edition replaced the "Standard Edition" offered in previous releases, but it isn't just a fancy new name - it's a desktop focused distribution intended especially for novices (although, we feel more advanced users may be pleased with the simplicity of the Discovery Edition as well)."

Comments (none posted)

Debian on Steroids II.1: When a Dot Means a Lot (Linux Journal)

Linux Journal reviews Libranet 2.8.1. "While Libranet 2.8.1 may be only a dot release, it is a compelling offering for desktop users looking for an easy to install and maintain Linux distribution. Anyone looking for a distribution that arrives ready and able to do some serious work should give this Debian distribution a try."

Comments (3 posted)

Swiss Firm Intros Linux Suite (unstrung)

unstrung takes a look at Lightning-Linux 3.6, 'the "Telecom networks Linux" distribution'. "The Swiss specialist in applying full Linux systems to embedded networking, security, telecoms, industrial systems and even aerospace projects, Apliware, is announcing its newest software release 3.6 of its Lightning-Linux distribution. This new release now integrates carrier-class features for Linux, such as scalable High-Availability clustering, IP-networking protocols, and telecom-protocols." We were unable to find a place from which to download Lightning-Linux 3.6, however this page lists "Linux patches for embedded firmware 3.5".

Comments (none posted)

Page editor: Rebecca Sobol

Development

The Meld Graphical Comparison Tool

Version 0.9.0b of Meld has just been released. Meld is a tool that gives a graphical comparison between different files, directories, and CVS contents.

Take a look at the Meld Screenshots page to see the tool in action. The page also offers more in-depth descriptions of the tool's different sections. Meld looks like a very useful tool for tracking down subtle differences in code and source trees. The output is much more human readable than that of the diff utility; it will certainly remind some readers of the emacs "ediff" tool.

Recent changes include user editable regex filters, new preferences, and compatibility with Python 2.3. The change history indicates a need for help with i18n translations. User feedback has been requested by the developer.

Meld is available for download here, see the installation instructions to get it running. Meld packages are available for several popular Linux distributions.

Comments (3 posted)

System Applications

Audio Projects

ALSA 0.9.7c released

Version 0.9.7c of the ALSA sound driver has been released. The comments say: "PDE and vortex driver compilation fixes".

Comments (none posted)

Planet CCRMA Changes

The latest changes from the Planet CCRMA audio utility packaging project include a repository restructuring, updates to SWH Plugins and JackEQ, and more online documentation.

Comments (none posted)

CORBA

MICO Version 2.3.11 available

Version 2.3.11 of MICO (MICO Is CORBA), has been released. See the CHANGES document for more information on this version.

Comments (1 posted)

Database Software

ZODB 3.2 released

Version 3.2 of ZODB, the Zope Object DataBase, is out. "This release is identical to the release candidate that was issued last week."

Full Story (comments: none)

Mail Software

bogofilter-0.15.7 Released (SourceForge)

A new version of bogofilter, a Bayesian email filter, has been announced. Changes include: "Conversion of escaped html characters to the corresponding character plus minor bugfixes and enhancements."

Comments (none posted)

Macho 0.3 released

Version 0.3 of Macho, an email web archiving system written in Common Lisp, is available. "This version uses templates instead of programmatically generating HTML, includes all required libraries, refines formatting and fixes several bugs."

Full Story (comments: none)

Building an Advanced Mail Server, Part 2 (O'ReillyNet)

Joe Stump continues his series on Building an Advanced Mail Server with part two. "A modern mail server just isn't quite complete unless you allow your users to roam; while secure IMAP works for some people, others swear by webmail. In the second installment of "Building an Advanced Mail Server," Joe Stump explains how to install, secure, and extend your mail server with SquirrelMail."

Comments (none posted)

Printing

Common UNIX Printing System 1.1.20rc3

Version 1.1.20rc3 of CUPS, the Common Unix Print System, has been announced. "CUPS 1.1.20 is primarily a bug fix and performance tuning release and includes fixes for 64-bit platforms, deadlock problems in the signal handling code, PDF printing issues, web interface issues, and various operating system-specific issues. The new release also adds new CUPS API functions for reading and writing files via HTTP, performing authentication, and controlling the required PPD conformance level."

Comments (none posted)

ESP Ghostscript 7.07.1 released

The CUPS project has an announcement for ESP Ghostscript version 7.07.1. "With the increasing number of Linux distributions shipping, or considering shipping CUPS as their standard printing system, we have had many requests to provide patches to the standard GNU Ghostscript source distribution so that they can ship a single version of Ghostscript. Thanks to funding from EPSON, this has finally happened. Easy Software Products now produces maintenance updates of GNU Ghostscript under the name ESP Ghostscript. These updates incorporate bug fixes to the current GNU version of Ghostscript as well as the latest CUPS, GIMP-print, and other add-ons to Ghostscript."

Comments (none posted)

Security

Xprobe 2.0.2 released

Version 2.0.2 of Xprobe, a remote active operating system fingerprinting tool, has been released.

Full Story (comments: none)

Web Site Development

eGroupWare pre release 0.9.99.005 (SourceForge)

Pre release 0.9.99.005 of eGroupWare is available. "In this release we have a lot of bufixes, but also, we have some new features, like the TTS with Petri Net Support. Also a new setup is available, which we will extend for the next release. eGroupWare is a multi-user web-based groupware suite written in PHP. Included are modules for Email, Adressbook, Calendar, Infolog (Notes, Todo, Phone Calls), CMS, Forum, Bookmarks, Wiki, Knowledgebase, Polls and also included is a powerful API."

Comments (none posted)

Spanish GPL Content Manager System

The Ferret CMS Spanish language content management system is now available. "openSistemas (http://www.opensistemas.com) has recently released "Ferret CMS", which is a Content Management System based on Zope. It is oriented to small to medium companies and to Government sites. It is very easy to install and manage, and has all the basic features of a CMS such as workflows, permissions or templates." Thanks to Fernando Monera Daroqui.

Comments (none posted)

Gallery 1.4-pl2 security release (SourceForge)

SourceForge has an announcement for a new security release of Gallery, a photo viewing package. "On Unix, this vulnerability only affects systems where Gallery is left in configuration mode (a relatively small percentage of Gallery users since Gallery is not operational in configuration mode)."

Comments (none posted)

mod_lisp 2.33 released

Version 2.33 of mod_lisp, the lisp bindings to the Apache web server, is available. "This version provides various additions and changes to headers."

Full Story (comments: none)

opensurveypilot 1.0.1RC1 released

Version 1.0.1RC1 of opensurveypilot, a web-based voting, polling, and surveying system, is available. Changes include a new install script, bug fixes, and more. Thanks to Robin Meijerink.

Comments (none posted)

A Methodology for Web Load Testing (zopemafia)

Zopemafia has an article by Chris M. on web site load testing. "Everybody seems to want their software to work at high load, but when you get down to it, nobody is really willing to pay the price to know that it will work under extreme load. But here's to hoping. The methodology I provide here might reduce confusion about what it means to do web load testing. Maybe if through some kind of methodology people have a clear idea of what load testing will accomplish (and what it won't), it will become an easier sell."

Comments (1 posted)

Miscellaneous

GNOME System Tools 0.28.0 ''Juggling knives'' is out! (GnomeDesktop)

Version 0.28.0 of the GNOME System Tools is out. "The GNOME System Tools are a fully integrated set of tools aimed to make easy the job that means the computer administration on an UNIX or Linux system. The 0.28.0 release is mostly a bugfix and distro porting release, fixing several crashers and adding full support for Mandrake and OpenNA".

Comments (none posted)

Desktop Applications

Audio Applications

Ardour 0.9beta5 released

Version 0.9 beta 5 of Ardour, a multi-track sound recording package, has been released. New features include support for the University of Glasgow's Animatics server, support for the new JACK transport API, and bug fixes.

Comments (none posted)

jackEQ 0.3.3 released

The initial package release of jackEQ version 0.3.3, an audio equalizer for the Jack Audio Connection Kit, is available.

Full Story (comments: none)

CAD

PythonCAD Release 10 available

Release 10 of PythonCAD has been announced. "The tenth release contains many fixes for running PythonCAD on Python 2.3. The latest Python release has a variety of internal changes, and various bits of code in PythonCAD triggered deprecation warnings from Python. All known warnings have been removed, so PythonCAD should run cleanly on this new Python release, as well as the older 2.2 releases."

Full Story (comments: none)

Desktop Environments

Gtk2-Perl 1.00-Final Released (GnomeDesktop)

Version 1.00-Final of Gtk2-Perl, the Gtk 2 bindings for Perl, has been announced. "This is the first stable release, supporting GTK+ 2.0.x and 2.2.x, tested on X11 and Win32."

Comments (none posted)

KDE-CVS-Digest

The October 11, 2003 KDE-CVS-Digest has been published. Here's the summary: "CSS and other bugfixes in Konqueror . amaroK adds a dcop interface. Two new applications; Viki, a visual keyboard and Kolourpaint, yet another paint program. Klaptopdaemon adds PMU support, and now compiles on your S/390."

Comments (none posted)

Icons Galore (KDE.News)

KDE.News has posted a list of new icon sets for KDE. "In the last few weeks fans of users the K Desktop Environment have been treated to a shipload of spectacular icon sets from well known and talented artists. Go ahead, liven up your desktop, there is bound to be a style that's right for you!"

Comments (none posted)

Games

Atlantik To Adopt KSVG

KDE.News reports on the adoption of KSVG by Atlantik, an open-source game client. "Atlantik will adopt KSVG to render game boards. KSVG, KDE's implementation of the Scalable Vector Graphics specification, will be included in KDE 3.2, adding support for a growing technology. KSVG has been maturing in the kdenonbeta development module for a long while and the enthusiasm of the developers is spreading to other parts of KDE. Atlantik, the leading open-source game client for Monopoly-like board games, is one of the first KDE applications slated to adopt KSVG for more than fancy icons."

Comments (none posted)

Kitten 0.0.2 released (WorldForge)

Version 0.0.2 of Kitten has been released by the WorldForge game project. "Kitten is an experimental Java based client and real-time landscape rendering engine. It is intended as a testbed for procedural landscape generation and rendering. For the moment network code and user input will take a lower priority compared to generation and rendering of terrain, forests, plants, cities, buildings, and so on."

Comments (none posted)

PCGen 5.3.12 is available (SourceForge)

Version 5.3.12 of PCGen, a character generator for role-playing games, has been announced. Version 5.4 is expected out very soon.

Comments (none posted)

Graphics

PNGwriter version 0.3.7 (SourceForge)

Version 0.3.7 of PNGwriter, a C++ library for creating PNG images, has been announced. "PNGwriter 0.3.7 is the most polished and useful version yet. First, PNGwriter is now a library! Second, the package layout has been reorganized to conform to a better standard. Significant speed increases in the line() algorithms, assignment operator overloading, better error handling, the ability to rename the file given just a number, and many more improvements."

Comments (none posted)

GUI Packages

Fltk for Tcl/Tk 0.4

Version 0.4 of Fltk for Tcl/Tk is available. "Improvements over the previous release include additional widgets, improved documentation and migration to the current release of FLTK."

Comments (none posted)

Instant Messaging

Gaim 0.71 is available (GnomeDesktop)

Version 0.71 of Gaim is available. The GnomeDesktop announcement says: "This is a major new version of Gaim, it includes an even newer Y! authentication system, re-write of Jabber protocol plugin, conversation API changes, massive core/UI splitting and more." See the ChangeLog for the complete list of new features.

Comments (none posted)

Interoperability

Samba 3.0.1pre1 available for download

Version 3.0.1 pre 1 of Samba is available. "This is a preview release of the Samba 3.0.1 code base and is provided for testing only. This release is *not* intended for production servers. Use at your own risk. There have been several bug fixes since 3.0.0 that we feel are important to make available to the Samba community for wider testing."

Full Story (comments: none)

Wine Traffic

Issue #191 of Wine Traffic is out. Take a look for the latest Wine project news.

Comments (none posted)

Medical Applications

Tkfp EMR supports HIPAA Insurance Format (LinuxMedNews)

LinuxMedNews reports that the Tkfp Electronic Medical Record application now supports the current US insurance claim format. "The latest version of the Tkfp open source EMR has the ability to produce the HIPAA required ANSI X12 400A1 claim format required for electronic insurance claims in the U.S. It is written in Tcl/Tk and integrates with the demographic/insurance, accounting and note generating modules of Tkfp."

Comments (none posted)

Multimedia

GStreamer "Moo" 0.6.4 released

Version 0.6.4 of GStreamer, an open-source multimedia framework, has been announced. "At this point in time GStreamer is fully functional for creating audio-based applications, as shown by applications such as gnome-sound-recorder, rhythmbox, sound-juicer and nautilus-media. The video part is known to be somewhat less functional than the audio part, but applications such as gst-player work very well."

Comments (none posted)

Office Applications

Gnumeric 1.2.1 Released (GnomeDesktop)

Version 1.2.1 of the Gnumeric spreadsheet has been announced. "Numerous minor changes were made in 1.2.1 (source). Ancient XLS files can now be imported. A new standalone binary, called "ssconvert", was added which provides command line access to Gnumeric's importers and exporters."

Comments (none posted)

Digital Photography

GNOME Photo Printer V0.5b (GnomeDesktop)

GnomeDesktop.org has an announcement for GNOME Photo Printer V0.5b. "This program is intended to make printing pictures/photos easy. It does all the calculation, transformation and arrangements of your pictures on a sheet of paper."

Comments (none posted)

Science

mmLib: Python Macromolecular Library

Version 0.3pre1 of mmLib, the Python Macromolecular Library, has been released. "The Python Macromolecular Library (mmLib) is a software toolkit and library of routines for the analysis and manipulation of macromolecular structural models, implemented in the Python programming language."

Comments (none posted)

Web Browsers

Releases from Mozilla

Mozilla 1.5 is out; see the release notes for details. Among other things, this release includes a built-in spelling checker, some tabbed browsing improvements, improved performance, and more. Also released is Mozilla Firebird 0.7 (with new auto download and web panel features) and version 0.3 of the Thunderbird mail application. The Mozilla Foundation is also offering CDs for those who don't want to download all that stuff; see mozilla.org for more information.

Comments (11 posted)

Mozilla Builds for Older Linux Distributions (MozillaZine)

MozillaZine has an announcement for a project that has created Mozilla builds for Red Hat 7.1, 7.2, 7.3, and SuSE 7.3 and 8.0.

Comments (1 posted)

Independent Status Reports (MozillaZine)

MozillaZine has posted a summary of the October 9, 2003 Mozilla Independent Status Reports. "The latest set of status reports includes updates from QuickManager, Quote Colors, Sardine, Jazilla, HONcode, Mozedit and Camino. This will be the last set of independent status reports to be contributed by David Boswell, who is retiring after more than two years. Future updates will come from Brian King."

Comments (none posted)

Mozilla Links Newsletter

Issue #4 of the Mozilla Links Newsletter is out with another collection of Mozilla news and articles.

Full Story (comments: none)

Word Processors

AbiWord Weekly News

Issue #165 of the AbiWord Weekly News is out. "Two new features, Win32 on the way Real Soon Now™ and users helping users! Also, changes to come to the AWN and talk of going subscription-based/retirement."

Comments (none posted)

Miscellaneous

BloGTK 0.8 Released (GnomeDesktop)

Version 0.8 of BloGTK has been released. "BloGTK is a weblog client that allows you to post to your weblog from Linux without the need for a separate browser window. BloGTK allows you to connect with many weblog systems such as Blogger, Movable Type, pMachine, and more."

Comments (none posted)

K3b 0.10: KDE-Flavored DVD Burning

According to KDE.News, K3b is now able to burn DVDs. "Well, the basic news is quite short: K3b is now able to burn DVDs. But this would be a little too short. ;) So for all of you who do not know what K3b is (the name does not really mean anything): K3b is (was) a CD burning application for KDE (screenshots). It uses cdrecord and cdrdao for actually burning the CDs but implements its own methods for all CD information retrieval functionality."

Comments (1 posted)

Linux Brochure Project 1.1.0 available

Version 1.1.0 of the Linux Brochure Project has been released. The project was examined in last week's LWN development section. The latest version adds support for A4 sized paper.

Full Story (comments: none)

SCREEM 0.8.2 & 0.9.0 Released (GnomeDesktop)

GnomeDesktop.org has an announcement for a stable and an unstable release of SCREEM, a tag-based html editor.

Comments (none posted)

Languages and Tools

Caml

Caml Weekly News

The Caml Weekly News for October 7-14, 2003 is out with another week's worth of Caml language development news.

Full Story (comments: none)

The Caml Light / OCaml Hump

Take a look at the The Caml Light / OCaml Hump to see the latest Caml language application releases.

Comments (none posted)

Lisp

pg-dot-lisp 0.19 released

Version 0.19 of pg-dot-lisp is available. "Pg-dot-lisp is a Common Lisp library implementing the socket-level client protocol for accessing the PostgreSQL DBMS."

Full Story (comments: none)

Perl

This Week on perl5-porters (use Perl)

The October 6-12, 2003 edition of This Week on perl5-porters is online. Take a look for the latest Perl 5 news.

Comments (none posted)

A Refactoring Example (O'Reilly)

Michael Schwern shows how to clean up Perl code on O'Reilly. "In his book, Martin Fowler defines Refactoring as "the process of changing a software system in such a way that it does not alter the external behavior of the code yet improves its internal structure." In other words, you clean up your code but don't change what it does."

Comments (none posted)

PHP

PHP Weekly Summary for October 13, 2003

The PHP Weekly Summary for October 13, 2003 is out. Topics include: PHP REP, object equality issue, Apache's scoreboard, version_compare(), long standing bison bug, SimpleXML schema support, Array_merge changes.

Comments (none posted)

Turck MMCache for PHP version 2.4.2 is released (SourceForge)

Version 2.4.2 of Turck MMCache, a PHP Accelerator, Optimizer, Encoder and Dynamic Content Cache, has been announced. Numerous bugs have been fixed.

Comments (none posted)

PHP Security, Part 3 (O'ReillyNet)

O'Reilly has published part three of John Coggeshall's series on PHP Security. "A malicious user will likely start his attack by using your system in ways you never anticipated. Your system logs are an oft-neglected defense tool. John Coggeshall shows how PHP's error logging and reporting functions can help you secure your applications."

Comments (none posted)

Python

python-dev Summary

The python-dev Summary for September 16-30, 2003 is out with another round of Python language articles and links.

Full Story (comments: none)

Data Structures and Algorithms with Object-Oriented Design Patterns in Python

Bruno R. Preiss has published an online version of his book on working with data structures in Python. "This book is about the fundamentals of data structures and algorithms--the basic elements from which large and complex software artifacts are built."

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The October 13, 2003 edition of Dr. Dobb's Tcl-URL! is out with the week's Tcl/Tk development news.

Full Story (comments: none)

XML

XML Parsing in a Producer-Consumer Model (O'Reilly)

Prabu Arumugam parses XML in Java on O'Reilly. "XML plays a vital role in integrating business-to-business applications. To parse XML files, these applications use either a Simple API for XML (SAX) or a Document Object Model (DOM) parser. Parsing in single-threaded applications is straightforward. However, it is quite complex and challenging in a multithreaded application, such as an application server, because the applications often create a dedicated thread to parse XML, serving many concurrently running threads with the parsed data. This article describes one implementation of parsing XML in concurrent applications."

Comments (none posted)

Namespaces, Name With Spaces, and Attribute Values (O'Reilly)

John E. Simpson answers XML name space questions in the O'Reilly XML Q&A column. "Although the W3 Schema specification uses the namespace prefix xsd:, it looks as though in current practice only xs: is used. Could you please confirm if this is the case and is the reason just that it is shorter?"

Comments (none posted)

Diagramming the XML Family (O'Reilly)

Daniel Zambonini presents an overview of XML family members on O'Reilly. "In this article we'll introduce some of the XML family members and discuss how they relate to one another. We'll then use these technologies to create a diagram of their relationships in order to demonstrate how they work together in practice."

Comments (1 posted)

Miscellaneous

OpenSP 1.5.1 released (SourceForge)

OpenSP 1.5.1 is available. "This is mainly a maintenance release - added support for new compilers etc. OpenSP is a free, object-oriented toolkit for SGML parsing and entity management maintained by the OpenJade project."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Linux's Hit Men (Forbes)

It's time for the FUD of the month. Here's is a Forbes article on the Free Software Foundation's GPL enforcement efforts (and the LinkSys case in particular) which makes a rather interesting contrast to that magazine's coverage of the SCO case. "The dispute, which was leaked to an Internet message board, offers a rare peek into the dark side of the free software movement--a view that contrasts with the movement's usual public image of happy software proles linking arms and singing the "Internationale" while freely sharing the fruits of their code-writing labor."

Comments (33 posted)

Leader of the Free World (Wired)

Wired Magazine has posted a lengthy look at Linus Torvalds. "He works from home as a fellow for the Open Source Development Lab, a corporate-funded consortium created to foster improvements to Linux. His commute is a walk down a flight of stairs to an office he shares with Tove, his wife of nine years. It's jammed with Linux-related books, few of which he's read, and looks out onto the narrow walkway between his home and the neighbor's. The early July day he invites me to visit is his first official one as an OSDL employee, but it isn't long after my arrival that he excuses himself to take out the garbage because Tove nags him about the smell."

Comments (36 posted)

Samba beats Windows (vnunet)

Vnunet covers tests of Samba vs. Windows. "Samba 3's scalability is as impressive as its performance. While Windows performance scales up well initially, it then drops off quickly as more clients access the server. In contrast, Samba 3 offered excellent throughput up to the limit of our test, conducted on a low-spec Intel server."

Comments (9 posted)

Trade Shows and Conferences

Why You Should Go to Defcon (Linux Journal)

Here is a Defcon trip report on Linux Journal. "As for the presentations themselves, the majority I attended were superb and very practical. They provided information you can use straightway and demonstrated new tools out for downloading, the features and inner workings being explained by the creators. It was striking that very few presenters were representatives of well known IT companies or what the general public thinks of as the IT industry. The majority were individual, independent security consultants, often running their own companies, or enthusiasts programming and researching for fun--in one word, hackers, in the definition of the word I support."

Comments (none posted)

The SCO Problem

Copyright Lawsuit Is Turnabout for SCO (New York Times)

Here's a New York Times article (registration required) on the SCO suit and its similarities with a just-settled GPL suit filed by MontaVista against Lineo. "But in an unpublicized case, one of SCO's former sister companies, Lineo, has agreed to quietly settle a third party's accusations that it engaged in the same kind of copyright infringement that is at the heart of SCO's claim against I.B.M., industry executives who have been briefed on the matter said. The case spotlights the behind-the-scenes role of Canopy, an investment firm formed by Ray Noorda, the founder of Novell and a personal computer industry pioneer. Canopy is SCO's largest shareholder and formerly controlled Lineo."

Comments (17 posted)

SCO Gets Lift in Form of 'Buy' Rating (InternetNews.com)

InternetNews.com has taken a look at the Deutsche Securities report that has pumped so much air into SCO's stock. "'We view SCOX as a call option on a substantial lawsuit against IBM and the potential to capitalize on Linux,' the authors wrote. 'Investors should consider an investment in SCOX as extremely high risk that may yield a substantial return or may collapse in value.'"

Comments (17 posted)

Companies

Linux PC maker plans e-mail service (News.com)

News.com covers Linare's plans for the Linux.net domain. "The company plans to begin offering the e-mail service this week to those who want an e-mail address that ends in "@linux.net," Linare CEO Soma Sundaram said. The Web-based e-mail service with 6MB of storage space will be free; two other options, with features such as more storage space or spam blocking, will cost $1.67 or $2.33 per month."

Comments (4 posted)

Linux Adoption

UK tests open source waters (BBC News)

The BBC News reports on what the UK's Office of Government Commerce is up to, and why it worries Microsoft. "The OGC has just announced a deal with IBM to trial open source software - programs where the source code is available to users to read, change and even give away to other people - in nine different areas of government." (Thanks to Dave Killick)

Comments (3 posted)

Open Asia: Open source in the Philippines, Saudi Arabia, South Korea, and Singapore (NewsForge)

NewsForge continues its survey of open source in Asia. "University of the Philippines, Quezon City, President of the Board of Regents Dr. Francisco Nemenzo -- in an open letter -- advocated users "install the Linux operating system and use OpenOffice or StarOffice for word processing, making ... presentations, spreadsheets, data bases, etc., sending emails, and accessing the Internet." Greenpeace Southeast Asia (Philippines) recently began a shift to Linux desktops."

Comments (1 posted)

Legal

Student faces suit over key to CD locks (News.com)

News.com reports that SunnComm is planning to sue John Halderman for the crime of showing how to evade SunnComm's new CD "copy protection" scheme. As predicted, the shift key is now a DMCA violation. "On Thursday, SunnComm CEO Peter Jacobs said the company plans legal action and is considering both criminal and civil suits. He said it may charge the student with maligning the company's reputation and, possibly, with violating copyright law that bans the distribution of tools for breaking through digital piracy safeguards."

Comments (29 posted)

Threat of lawsuit passes for student (Daily Princetonian)

The Daily Princetonian reports that SunnComm will not be suing John Halderman after all. "[CEO Peter] Jacobs said in an interview late last night that a successful lawsuit would do little to reverse the damage done by the paper Halderman published Monday about his research, and any suit would likely hurt the research community by making computer scientists think twice about researching copy-protection technology."

Comments (11 posted)

Resources

Introduction to Linux filesystems and files (NewsForge)

This NewsForge article looking at Linux filesystems, is an excerpt from the book Linux Power Tools. "Unfortunately, the best filesystem to use is not always obvious. For many installations, it's not even terribly important, but for some applications it is. Filesystem design differences mean that some perform some tasks better than others. Varying support tools also mean that advanced filesystem features differ. This section describes the pros and cons of the popular Linux filesystems in several different areas, such as filesystem portability, disk check times, disk speed, disk space consumption, support for large numbers of files, and advanced security features."

Comments (1 posted)

Optimizing Linux filesystems (NewsForge)

NewsForge has another excerpt from Linux Power Tools. "Most filesystems support a variety of options that may impact performance. For instance, large allocation blocks can improve performance by reducing fragmentation and the number of operations needed to retrieve an entire file. Some of these options can be set only at filesystem creation time, but some can be changed after the fact. Not all of these features are available in all filesystems."

Comments (none posted)

Resizing and defragmenting Linux filesystems (NewsForge)

Here's another piece of the book Linux Power Tools in this NewsForge article. "All too frequently, you discover only after installing Linux that your partitions aren't the optimum size. For instance, you might have too much room in /usr and not enough room in /home. Traditional fixes for this problem include using symbolic links to store some directories that are nominally on one partition on another partition; and backing up, repartitioning, and restoring data. In many cases, a simpler approach is to use a dynamic partition resizer. Fortunately, partition resizers exist for the most popular Linux filesystems, as well, so you can use these tools to manage your Linux installation."

Comments (13 posted)

Roll Your Own Firewall with Netfilter (Linux Journal)

Linux Journal explains how-to build a firewall. "Every self-respecting Linux guru should be familiar with firewalls and how to install and configure them. With this in mind, Linux gurus also should be curious about how firewalls function and how to build a firewall of his or her own. Explaining exactly these two things is the goal of this article. Here, we attempt to write a firewall in less than 60 lines of C code. As impossible as this may sound, it actually is quite simple to do using the power of Linux kernel modules and Netfilter."

Comments (none posted)

An introduction to Firebird, part 3 (Nidelven IT)

Kay Frode continues the series on the Mozilla Firebird browser with part three. "With a multi function application like Mozilla Firebird, it's important you know your way with the keyboard, and the mouse. In this part of the article I will talk about some basic commands, where to find them and how to keep things efficient. In addition I will talk a bit about blocking pop-ups."

Comments (none posted)

Build a network router on Linux (IBM developerWorks)

IBM's developerWorks has an article by Dominique Cimafranca and Rex Young that shows how to use Zebra to build a Linux-based network router. "Zebra is open source TCP/IP routing software that is similar to Cisco's Internetworking Operating System (IOS). Flexible and powerful, it can handle routing protocols such as Routing Information Protocol (RIP), Open Shortest Path First (OSPF), Border Gateway Protocol (BGP), and all of their various flavors. This article shows how our authors set up Zebra and used it to manage routes dynamically in conjunction with real Cisco hardware."

Comments (1 posted)

Linux lab upgrades software for telecoms (News.com)

News.com covers the Open Source Development Lab's (OSDL) new Carrier Grade Linux (CGL) specifications. "The CGL effort is geared toward telecommunications servers--the machines that handle tasks such as connecting phone calls, playing voice mail messages and recording a phone call's duration for billing purposes. But one effect of developing Linux for this market has been to make it better for all users, Illuminata analyst Gordon Haff said." The press release from OSDL announcing CGL Requirements Definition version 2.0 can be found here.

Comments (none posted)

Seven open source OS distributions for 64-bit processors (NewsForge)

NewsForge lists seven distributions that support AMD's new 64-bit chips; Debian GNU/Linux, FreeBSD, Mandrake, NetBSD, Red Hat, SuSE, and Turbolinux.

Comments (8 posted)

Reviews

Egenera's blades are blooming (Register)

The Register takes a look at who is buying Egenera blade servers. "Egenera today announced a deal with America Online, which will see the ISP use BladeFrame systems to power the MapQuest service. AOL cited price/performance advantages of running Linux on blades as a major reason for the move."

Comments (none posted)

High-Performance Computing (Linux Journal)

Linux Journal looks at HPC, past and present. "Will Linux clusters stay in the HPC niche? Big vendors are putting their money on "no". Oracle is dropping UNIX boxes for cheap racks of generic machines. Penguin Computing acquired Beowulf-originator Donald Becker's cluster company, Scyld. Dell and IBM will sell you turnkey clusters with service contracts--maybe not with one click from the Web site, but close."

Comments (2 posted)

Synaptic: Point-n-Click Software Management (LinMagAuOrg)

LinMagAu.org takes a look at Synaptic, a package management tool for Debian systems. "Unlike Apt, which performs all actions immediately, Synaptic lets you queue up a number of actions until you're satisfied with your choices. Selecting a package in the list and marking it to be installed or removed won't cause a sudden flurry of activity. In fact, it'll look like nothing much is happening at all. Synaptic just makes a little internal note about your selection and waits to see what you do next. That means you can browse through the packages at your leisure without waiting for your computer to go through a potentially lengthy download-configure-install cycle for every item you select."

Comments (6 posted)

View from the Trenches: Alternative Package Sources (Linux Journal)

The Linux Journal looks at alternative package sources for popular distributions. "For the Debian folks, punch up Apt-get.org (of course) and have yourself a blast. This is not your ordinary package search engine; search for a program here, and it returns not links to individual packages, but the appropriate deb lines for your sources.list file. It also serves links so you can find what other packages are in the same repository and a rating as to the current status of the repository."

Comments (none posted)

Miscellaneous

Mozilla Charts an Independent Course (eWeek)

eWeek looks at a strategy shift from the Mozilla Foundation. "Now known as the Mozilla Foundation after splitting from America Online Inc.'s Netscape Communications subsidiary in July, the project is turning its focus to the end user after five years as strictly a development organization. Starting this month, end users and enterprises can expect to see the first signs of that shift. Mozilla is preparing greater user support, a set of new releases and greater enterprise outreach."

Comments (none posted)

E-mail filters not fooled by signed spam (News.com)

News.com discusses spam with fake signatures which is designed to get past SpamAssassin. "The attack on the software's filtering process highlights the dangers of open-source projects, but it also reinforces the ability of projects with active development teams to quickly respond to such security holes."

Comments (23 posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

Linux More Secure Than Windows XP

The latest Evans Data North American Development Survey finds Linux more secure than Windows XP, according to this press release. "Linux has increased its lead in developers' minds as the "most innately secure operating system" from 19% six months ago to 23% today. At the same time, the percentage of developers who said that Windows XP is the most secure dropped by more than 40%, from 14% six months ago to 8% today."

Comments (10 posted)

OpenOffice.org turns three

OpenOffice.org has announced that it has reached the three year old mark. "What has been accomplished this last year? The last year has seen the extraordinary growth of the community and user base; the release of OpenOffice.org 1.1 , and the maturation of the project: Our Community Council is established and working."

Full Story (comments: none)

ibiblio Celebrates its 11th Birthday in October

ibiblio, the public's library and digital archive, celebrates its 11th birthday in the month of October. "ibiblio is a free and vibrant exchange of ideas among a large community of contributors who share their knowledge across disciplines, and is one of the major distribution hubs for Linux software, and has been a significant supporter of Linux development efforts since its inception."

Full Story (comments: 2)

Init Test Assertion Review

The Open Group has announced that some additional eyes are needed to review the Linux Standard Base (LSB) Init test assertions.

Full Story (comments: none)

OpenZIS Group Formed

OpenZIS is a organization that will be used to develop an open source Zone Integration Server based on the Schools Interoperability Framework (SIF) version 1.1. The OpenZIS Group will be a non-profit development group that will be incorporating all the SIF requirements into a Zone Integration Server licensed under the GNU General Public License. Click below for the full announcement.

Full Story (comments: none)

Commercial announcements

Genestia Group released R4.2.0 of Neoxen Qwinux

Genestia Group, Inc. has released R4.2.0 of Neoxen Qwinux - a distribution of Open Source development tools compiled and certified for Microsoft Windows operating systems.

Full Story (comments: none)

pSeries, Linux & Grid Computing (IBM)

IBM is presenting a course on its pSeries servers in Lisbon, Portugal on November 3-7, 2003. "Topics featured at the 2003 Technical University will include; pSeries product futures, High Availability, eServer 1600 Clustering, AIX5.2L system administration, pSeries Storage, AIX Performance Management, Linux, Grid Computing, logical partitioning and professional certification. In 2003, the focus will be on in-depth technical content allowing you to stay up-to-date with the latest developments in these areas."

Comments (none posted)

Linuxant releases DriverLoader

Linuxant has sent out an announcement (click below) for a new product called DriverLoader. It is a sort of glue module which allows binary Windows NDIS network drivers to be loaded directly into a Linux kernel. It can, thus, enable a Linux system to use hardware (such as Broadcom 802.11g adaptors) which is otherwise not supported. DriverLoader is proprietary software; the license allows redistribution in binary form but nothing else (i.e. no reverse engineering).

Full Story (comments: 60)

Linux Distributions Support OSDL Carrier Grade Linux Requirements

The Open Source Development Lab (OSDL) has announced support from many Linux distributions for the new OSDL Carrier Grade Linux Requirements Definition version 2.0 (CGL 2.0). Miracle Linux, MontaVista Software, SUSE LINUX and Turbolinux are among those who have signed on so far.

Full Story (comments: none)

MySQL AB Acquires Alzato

MySQL AB has acquired clustering company Alzato. "MySQL AB, developer of the world's most popular open source database, today announced that it has acquired Alzato, a venture company started by Ericsson in 2000. Alzato develops and markets NDB Cluster, a high availability data management system designed for the telecom/IP environment."

Comments (none posted)

Nemein to offer Linux maintenance services

Nemein has announced an expansion of its service offerings for Linux systems.

Full Story (comments: none)

Zope Corporation to Offer CMS for Universities

Zope Corporation has announced plans to work with Duke University to develop Zope4Edu, a CMS product platform designed to address the common content-management needs of higher education.

Comments (none posted)

New Books

"Mastering Perl for Bioinformatics" Released by O'Reilly

O'Reilly has published the book "Mastering Perl for Bioinformatics" by James Tisdall.

Full Story (comments: none)

Prentice Hall Announces "Open Source Network Administration"

Prentice Hall PTR has released Open Source Network Administration by James M. Kretchmar. "Kretchmar, a systems programmer and network engineer for MIT Network Operations, is the developer of Neo, an Open Source network administration tool which serves as a front-end for controlling SNMP-managed network devices and is a critical tool in large network deployments such as universities, where Neo is used to locate and disable vulnerable or infected hosts."

Full Story (comments: 1)

Resources

API@OOo Newsletter

A new OpenOffice.org API newsletter has been started. "This is the first issue of the API@OOo NEWSLETTER. From now on, at the beginning of each month, I would like to summarize what was going on in the previous month within the OOo API project and the OOo SDK."

Full Story (comments: none)

LDP Weekly News

The October 15, 2003 edition of the Linux Documentation Project Weekly News is out with the weeks' Linux documentation updates.

Full Story (comments: none)

Upcoming Events

GNOME Summit 2003 (GnomeDesktop)

GnomeDesktop.org has an announcement for the 2003 GNOME Summit. The event will take place at Brooklyn College in New York on November 22-24, 2003.

Comments (none posted)

The ObjectWeb Annual Conference

The ObjectWeb conference will be held in Rocquencourt, France on November 20 and 21, 2003. "This conference, now in its third year, focuses on middleware through the activities of the consortium and associate organizations. It features speakers from corporate members, computer research laboratories and the Open Source software community."

Full Story (comments: none)

Speaker Registration now open for Linux Bangalore/2003

Speaker registration is now open for the Linux Bangalore/2003 conference, to be held in Bangalore, India on December 2-4, 2003.

Full Story (comments: none)

FOSS Events at Fall AMIA 2003 (LinuxMedNews)

LinuxMedNews has posted a list of events related to Free Open Source Software (FOSS) at the American Medical Informatics Association (AMIA) 2003 conference. The event will take place in Washington D.C. on November 8-12, 2003.

Comments (none posted)

Fifth International Conference on Linux Clusters CFP

A call for papers has gone out for the Fifth International Conference on Linux Clusters, to be held on May 17-20, 2004 in Austin, TX.

Full Story (comments: none)

Events: October 16 - December 11, 2003

Date	Event	Location
October 16 - 17, 2003	The First Plone Conference	(Tulane University)New Orleans, Louisiana
October 16, 2003	10th Linux-Kongress	Saarbrücken, Germany
October 21 - 24, 2003	PHP-Con West	Santa Clara, CA
October 22 - 23, 2003	Enterprise Linux Forum	(Washington Convention Center)Washington, D.C.
October 26, 2003 October 27 - 31, 2003	Large Installation Systems Administration Conference(LISA)	(Town & Country Resort Hotel)San Diego, CA
October 27 - 29, 2003	LinuxWorld Conference & Expo 2003	(Fairgrounds Frankfurt)Frankfurt, Germany
October 29 - 31, 2003	Asian Enterprise Open Source Conference(AEOSC)	(Suntec International Convention and Exhibition Centre)Singapore
October 30 - 31, 2003	4to Encuentro Linux	Valparaiso, Chile
November 2 - 3, 2003	International PHP Conference 2003	(Astron Hotel Frankfurt-Mörfelden)Frankfurt, Germany
November 6 - 7, 2003	HiverCon 2003	(Davenport Hotel)Dublin, Ireland
November 6, 2003	Netherlands Unix Users group fall conference	(Conference Center De Reehorst)Ede, the Netherands
November 8, 2003	Lightweight Languages 2003(LL3)	(MIT)Cambridge MA
November 10, 2003	Desktop Linux Conference	(Boston University Corporate Education Center)Tyngsboro, Massachusetts
November 10 - 11, 2003	Congreso Nacional de Software Libre(CONASOL)	(Universidad de Talca)Talca, Chile
November 14 - 16, 2003	Third International Ruby Conference	(Red Lion Hotel)Austin, Texas
November 15 - 21, 2003	Supercomputing Conference(SC2003)	(Phoenix Civic Plaza Convention Center)Phoenix, AZ
November 16 - 19, 2003	ApacheCon 2003	Las Vegas, Nevada
November 20 - 21, 2003	ObjectWeb Conferenc3	(INRIA Rocquencourt)Rocquencourt, France
November 22, 2003	Southern California Linux Expo(SCALE)	(Los Angeles Convention Center)Los Angeles, CA
November 22 - 24, 2003	New York GNOME Summit	(Brooklyn College)New York, NY
November 24 - 26, 2003	Open Standards and Libre Software in Government Conference(EGOVOS 3)	Paris, France
December 2 - 4, 2003	Linux Bangalore/2003	Bangalore, India
December 9 - 13, 2003	International Conference on Logic Programming(ICLP'03)	Mumbai (Bombay), India

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook

Letters to the editor

Rob, are you actually paid to do this?

From:		Leon Brooks <leon-AT-cyberknights.com.au>
To:		renderle-AT-gigaweb.com
Subject:		Rob, are you actually paid to do this?
Date:		Sat, 11 Oct 2003 19:53:01 +0800
Cc:		letters-AT-lwn.net

> Two high-profile organizations recently argued that diverse
> environments are inherently more secure than "monoculture"
> (read: Microsoft-only) environments.

...and from other sources:

> The report's authors said the report was a reflection of their own
> views [...] "I wouldn't put all of the blame on Microsoft," Schneier
> said, "the problem is the monoculture."

From the horse's mouth, the security problem harped on in the report is 
explicitly the monoculture, not the Microsoft. So you've started on a 
misconception. Do you recover from this?

> These arguments were put forward by Gartner

Er... what? Gartner are hardly known for being critical of Microsoft, in 
fact they've got an informal reputation for being on Microsoft's cheer 
squad, if anything.

As if to underscore their reluctance to injure or offend such a 
lucrative and dominant source of income, Gartner speak as little as 
possible to Microsoft, as such, limiting themselves to Windows. I 
believe this to be a mistake, since the majority of reported 
vulnerabilities on desktop PCs have been in Microsoft applications 
other than the OS - such as Outlook, Internet Explorer or IIS.

They also make it plain, regardless of motives, that their primary 
concern is the lack of diversity, and I quote:

> By spreading critical business functions across multiple desktop
> platforms or by maintaining key operating groups on separate
> platforms, you can enhance your ability to keep at least some of your
> key personnel and processes functioning and communicating during
> an attack.

Perhaps Gartner have realised that there is an issue here that they need 
to be seen to be addressing?

Two strikes against Rob. But you go on to say:

> separately, a panel hosted by the anti-Microsoft Computer &
> Communications Industry Association.

Also wrong (third strike), at least in origins: the report now filtered 
through CCIA was originally released by the diverse group of security 
consultants through security firm @Stake - and it seems that @Stake are 
so pro-Microsoft that Dan Geer, then @Stake's CTO, was fired over the 
publication.

This brings to mind an interesting statement from  President of the 
Vermint Library Association:

    If you have to worry about what your reading list might look like to
    an FBI agent, you might decide to censor yourself and not read what
    you really want to read. And the moment you have to think about
    those kinds of decisions, then you are no longer truly free.
      --Trina Magi

To be sure, Microsoft are not the FBI - but the principle is exactly the 
same.

The whole set of premises that you justify your article by are 
completely wrong. This essentially makes it worthless. But even if the 
raison d'etree had been sound, you also muck up the content:

> We have yet to see a cost/benefit analysis that supports the
> conclusion that a heterogeneous computing environment lowers
> the overall threat level of a corporation, or that it is the most cost
> effective of the choices available to you. 

A Microsoft-aimed worm took out one large local ISP's mail service for a 
day, and kept it lagged for about 3 days this last week. A consultant I 
work with lost an AUD$2000 job and probably also all future work from a 
customer becasue they were unable to receive their email.

I haven't even seen a guesstimate of how much this kind of damage 
eventually adds up to be, to say nothing of a cost/benefit study, and 
we're not even dreaming about one not paid for by Microsoft.

Then several of your recommendations, while plausible ont the surface, 
carry additional risks.

> Locking down desktops so users cannot make changes and viruses and
> worms can't install themselves and run.

Unfortunately, the vast majority of recent viruses and worms don't 
require much if any user intervention. Several Outlook vulnerabilities 
haven't even required the user to read email in order to propagate the 
problem.

Locking users down too firmly may actually prevent individual users from 
implemeting many of the safety measures you prescribe. Think about the 
analogy of being trapped inside a burning house by your security 
system.

> Implementing additional security products, such as virus software
> and firewalls.

Funny, but everything competing with Microsoft (ie, OS X, Linux, FreeBSD 
et al) comes with effective firewalling software and so far hasn't 
needed anti-virus software (and without a major paradigm shift, never 
will).

In addition, most of these run on diverse platforms, which makes binary 
intruders so much less effective. Granted that Windows will soon have a 
significant number of Hammer and IA-64 users in addition to the current 
IA-32 monoculture, but it's a little late in the game, and one has to 
ask in the light of their abandonment of Alpha, PPC and MIPS 
architectures whether Microsoft would have adopted Hammer or IA-64 this 
early in the absence of stiff competition from Linux and friends.

> Deploying Windows on alternative hardware. For example, "PC blades"
> centralize the processors, memory and storage of PCs in a datacenter,
> while the display, keyboard and mouse are at the user's desktop.

Who needs specialised hardware? Do this today, for free, on existing 
hardware and run any legacy apps under WINE or Win4Lin. The 
restrictions these translation layers place on bizarre network 
operations alone should help your security enormously. And I do know 
from practical experience that apps die about half as often under 
Win4Lin as they do run natively, as well as running roughly twice as 
efficiently.

Using Linux mounted readonly and running no services for the outliers 
should cut down a *lot* on network vulnerability. Make them diskless 
and fanless for amazing reliability. Running those on a variety of 
architectures involves very little extra cost.

In fact, contra to your assertions, the safest and most economical 
approach is usually to evict all Microsoft software from your network. 
If you want pretty, replace it with Macs; if you want functional for 
minimal cost, use X11 on Linux, FreeBSD or any of the others.

Cheers; Leon

--
http://cyberknights.com.au/   Modern tools; traditional dedication
http://plug.linux.org.au/     Committee Member, Perth Linux User Group
http://slpwa.asn.au/          Committee Member, Linux Professionals WA
http://linux.org.au/          Committee Member, Linux Australia

Comments (2 posted)

Page editor: Jonathan Corbet