LWN.net Weekly Edition for October 30, 2003

Happenings on the DMCA front

It has been a busy week for those who watch the Digital Millennium Copyright Act and its effects. Here's a quick summary of what has been happening.

Every three years, the Librarian of Congress must consider applications for exemptions to the DMCA's anti-circumvention provisions. The decisions for this cycle have just been posted; they may be downloaded in PDF format. Four applications were granted this time:

1. Compilations consisting of lists of Internet locations blocked by commercially marketed filtering software applications... Interestingly, the exemption explicitly does not extend to anti-spam blacklists.

2. Computer programs protected by dongles that prevent access due to malfunction or damage and which are obsolete.

3. Computer programs and video games distributed in formats that have become obsolete and which require the original media or hardware as a condition of access.

4. Literary works distributed in ebook format when all existing ebook editions of the work ... contain access controls that prevent the enabling of the ebook's read-aloud function and that prevent the enabling of screen readers to render the text into a specialized format.

Many other proposals were turned down. As Ed Felten notes, "My own exemption request, asking for exemptions for information security researchers, was denied as expected." Blanket exemptions for (otherwise) non-infringing uses, or for fair use were turned down as not properly specifying which works should be exempted. A requested exemption for making backup copies of DVDs went down because it did not show, to the Librarian's satisfaction, that DVDs are fragile or that making a backup copy is a noninfringing use.

Static Control Components has been engaged in a DMCA fight with Lexmark over printer cartridges. SCC makes toner cartridges which work in Lexmark's printers; Lexmark has made the claim that SCC's products, by circumventing a printer "feature" that causes it to not function with cartridges manufactured by others, violate the DMCA. As part of its fight, SCC asked for an exemption specific to printers that would make its products unambiguously legal. The proposed exemption was turned down because, according to the Librarian, the existing interoperability exemption covers this case. Thus, in losing its exemption, SCC appears to have won its case with Lexmark; the company lost no time in issuing a press release to that effect.

Speaking of press releases, 321 Studios, a company which sells a DVD-copying program, has announced that it will be appealing the ruling on the making of backup copies of DVDs.

Finally, there is a growing case involving numerous people - mostly college students in the U.S. - who are fighting DMCA takedown notices from Diebold Election Systems. Diebold is a manufacturer of computerized voting machines. These students came into possession of some internal Diebold correspondence which shows a distressingly cavalier attitude toward the accuracy of election votes and the integrity of the election process in general. Diebold, rather than facing up to its problems, is simply trying to suppress the incriminating memos. For those who understand the net, the results of this effort have been entirely predictable: copies of the correspondence have now been distributed worldwide. The organizers of this effort are calling for help, however, in the form of additional mirrors and publicity. This effort deserves support; transparent and accurate management of elections is too important to be pushed aside by the DMCA.

Comments (6 posted)

A look at Fedora Core 1

With the first stable release of the Fedora Core scheduled for early next week, we thought we'd take a look at the final test release to see what users could expect from Fedora.

This release ("Severn") looks and feels like recent Red Hat releases, which is not entirely surprising. The default desktop is still GNOME with Metacity as the window manager. For the most part, if you're familiar with the Red Hat 9 release, Fedora will contain few surprises. The installation procedure is mostly the same as Red Hat 9, though users now have a few additional install options. Fedora 0.95 includes the ability to perform a graphical install via FTP, HTTP and the ability to perform an install via VNC.

We installed the Severn release on two machines to see how well it fared. On one machine we installed the "Server" package set, and performed a "Custom" install on the second machine. The entire install took less than thirty minutes on an Athlon 2600+ XP machine with 1 GB of RAM, and about forty-five minutes on an Athlon 1GHz machine with 1 GB of RAM.

The only real glitch we encountered was that Severn had a little trouble setting up the Matrox G450 dual-head video card. Though it offered the option of performing a dual-head setup that spanned both monitors, it kept producing a cloned display. A quick hand-edit of our XF86Config file solved the problem.

The firewall configuration during installation is somewhat simpler than the configuration that was present in Red Hat 9. Red Hat 9 offered "High," "Medium," and "No Firewall." The option with Fedora is to turn the firewall on or off. The user is also able to specify specific ports that should be passed through the firewall. The installer offers the options of passing through SSH, HTTP, FTP, Telnet, SMTP or specifying their own protocol that can be passed through.

Though it's a small thing, one also notices a difference in attitude during the installation. Instead of seeing Red Hat promotions during the install, the user is told that Fedora has a new graphical boot feature ("Who understood all that text scrolling by anyway?") and is encouraged to sign up for Fedora user and developer lists ("Hey! It's better than spam!").

There is a full list of packages for Severn test 3 release here. It may change slightly for the final release. Most of the packages have been updated since Red Hat 9, of course, but the package list hasn't changed that much.

One new inclusion in Fedora is Yum, an APT-like package installer/updater. Yum is not installed by default, but it is included on the Severn CDs. Yum has a command set similar to apt-get. One striking difference, however, is when using "yum check-update" to retrieve information on changed packages. The apt-get update command simply retrieves an index file for each package repository, which is fairly fast. Yum, on the other hand, retrieves RPM header information for every installed RPM, which can be very time-consuming.

Some packages have not made the cut from Red Hat 9 to Fedora. The LPRng print system is no longer supported or included with Fedora. CUPS is now the official, and only, print spooler for Red Hat/Fedora systems. According to the Fedora 0.95 release notes, LPRng will be replaced by CUPS even if the user decides to upgrade an existing Red Hat system with Fedora. Galeon is out, replaced by Epiphany. Users no longer have the option of using the LILO bootloader. Pine has been kicked due to licensing issues and "long-term maintenance concerns." Zebra has been replaced by the Quagga Routing Suite, and Tripwire has been removed as well.

Another interesting change is the inclusion of the Native POSIX Thread Library (NPTL). The Severn release ships with a 2.4.22 kernel with NPTL replacing the user-space LinuxThreads implementation. This means that some applications, notably Sun's Java Runtime Environment (JRE) prior to 1.4.1 and IBM's JRE will have issues. For applications that need the old implementation, there is a workaround described in the release notes.

The Fedora kernel also includes "exec shield," a kernel patch that we covered last May. By default exec shield is turned on for programs that are "marked" for this functionality. For the Fedora release, this pretty much means that the program needs to have been built with the Fedora toolchain.

Fedora Core 1 is still very much a Red Hat product, even if the "Red Hat Linux" name has been filed off. There has not, as yet, been time for a true development community to form; traffic on the Fedora mailing lists is tiny relative to those of, say, Debian or Mandrake's Cooker. So it is hard to guess what Fedora will look like in the future. But, if Fedora 0.95 is any indication, the first "stable" release looks to be shaping up well. If all goes as planned, Fedora Core 1.0 will be released on Monday, November 3.

Comments (17 posted)

SCO responds to IBM's counterclaims

The SCO Group has filed its response to IBM's counterclaims; the full text may be found in PDF format. Since this document is structured as a set of direct responses to the claims made by IBM, much of what's there must be read in the context of IBM's amended filing to make sense. SCO's responses come down to a relatively small set of points, however, which we will examine here.

One area of dispute has to do with exactly what rights were bought from Novell in 1995. Novell claims the right to veto some of SCO's actions, such as the yanking of IBM's AIX license. SCO disputes that claim. Without access to the actual agreement between the two companies, it is impossible to come to any conclusion here; this will be a job for the court.

IBM's claim #16 reads:

This would seem like a relatively uncontroversial thing for IBM to say. Even SCO, in the end, has embarked on all this litigation because Linux has become "the operating system of choice" for many of its former customers. Here's SCO's response, however:

This is, of course, the company that made a go at developing and selling Linux for years, even after it obtained its rights, whatever they may be to the Unix code base.

Much of SCO's response, however, is aimed in a different direction: SCO is, once again, claiming that the GPL is not an enforceable license. Thus, for example, when IBM claims:

SCO responds with:

In other words, according to SCO, those who write code are not entitled to attach a license to it, and even if they were, the GPL is not a valid license. This anti-GPL rhetoric reaches its peak in the "affirmative defenses" at the end of the filing:

The counterclaims offer no evidence for any of the above claims; they are simply put out there to stand on their own. The first claim will, eventually, depend on what a court finds, but many are confident that the GPL will hold up just fine. The second is ridiculous; whether or not the FSF is selective in its enforcement of the GPL has no relevance to how IBM enforces its own copyright rights. Bringing the Constitution and antitrust law into it (with the third claim) is new, but SCO's previous reasoning on the GPL and copyright law has been humorous at best.

In other details, SCO denies that its "letter to Linux users" threatened any sort of litigation. Strangely enough, SCO has removed that letter from its web site, making it harder for anybody who might want to check for themselves. Happily, this SCO v. IBM site has kept a copy handy.

SCO also goes to some lengths to try to fight off IBM's patent claims. The response even alleges that IBM might not own the patents at all.

Most of the defenses seem like a sideshow, however, compared to SCO's sustained attacks on the GPL. Clearly, the company sees the GPL as an obstacle that must be overcome. Just why SCO is so eager to see the GPL defeated is still not entirely clear, however. Perhaps the company simply wishes to destroy the Linux ecology outright so that there might yet be room for its outmoded, failing proprietary offerings. Or perhaps SCO is trying to find a way that it can apply a tax to all Linux shipments. Or maybe it is all a simply set of delay and FUD tactics while the real goal is pursued elsewhere. Given that we are facing a concerted attack on one of the pillars of the free software community - an attack now funded with another $50 million in investment money - it is proper to be concerned. Unless the attackers can come up with some better arguments, however, the GPL looks set to stand for a long time yet.

Comments (25 posted)

Page editor: Jonathan Corbet

Security

Brief items

Weblog Comments - A New Frontier for Spam

The war over spam has erupted recently in a new arena: weblog comments. The parallels to the battles that have been fought on the email spam front are considerable, but unlike email spam, weblog spam is targeted at Google (and other search engines that use number of links to derive page rankings) to increase the visibility of the sites that are being advertised via spam. Comment spam seems to be on the rise with weblog owners noticing a large increase in the number of incidents over the last month or two.

Weblogs are sites that allow the owner to post articles and essays of whatever happens to strike their fancy that day and most weblog software enables readers to post comments on the stories. LWN's comment system provides the same feature for this site but, unlike LWN comments, many weblogs allow (and even encourage) anonymous comments. That openness, like the lack of sender authentication for email, provides an avenue for abuse. Requiring registration before allowing comments does not eliminate the problem entirely (LWN has had a small amount of comment spam), but it does increase the amount of work the spammer must do.

The basic mode of attack uses a program to automatically post comments on multiple articles throughout the weblog. These unwanted messages include the URL of a website that will give you the opportunity to buy one or more of the usual items: diplomas, prescription drugs, porn, etc. The program then moves on to other sites using the same software, aided, no doubt, by the various directories of weblogs using a particular software package that are available. Eventually, Google and other search engines visit the weblog sites; thereafter, the spammer's site gains a high ranking due to all of the links to it that are found.

One of the more popular (though not entirely free) packages for running a weblog is Movable Type; its user community has been the most active so far in combating comment spam. For example, one set of tips (described by Yoz Grahame) attempts to thwart the way the current spam programs work by changing the default behavior of the software. Something as simple as changing the "post a comment" link can be sufficient to confuse most automated comment posting scripts. These techniques will only help until enough people implement them and it makes it worth the effort for a spammer to write more adaptable code to circumvent them.

Many of the other comment spam handling techniques will seem very familiar to anyone who has been dealing with the deluge of email spam: bayesian filtering and blacklisting based on the URLs in the comment and/or user profile are two of the more popular techniques. Bayesian filtering uses the frequency of words in a message and a database of word counts from previous messages that have been categorized as spam or non-spam (often called "ham") to determine a probability that the new message is spam. If the probability is too high, the message is rejected. The blacklisting patch collects the URLs that are advertised in the offending messages and rejects any comments that refer to any of those URLs. Both of these techniques can be worked around by a spammer with enough incentive, but it does make it much more difficult.

Another technique that is becoming more popular is email and web-based challenge-response systems which generate a blurry graphic that is (presumably) only readable by humans. Such systems require that the text in the graphic be typed into a form to ensure that a human, and not a program, is initiating the action. This technique, too, has made its way into the arsenal of webloggers via this plug-in for Movable Type. This scheme does have a number of downsides because it requires a graphical browser to post messages and may be unusable by the visually impaired.

Other weblogging software developers may have run into this problem and come up with their own sets of fixes, but the Movable Type community appears to be the at the forefront of this particular battle. Perhaps the spammers have yet to target other systems in an automated way. If (or more likely when) they do, newly targeted weblogging software can use one or more of the techniques above to combat the spam.

Both weblog comment and email spam fighters are running into the same issues and producing similar solutions in many cases and cooperation between the two groups will lead to better spam fighting. One of the future plans for Jay Allen's blacklist (above) is to create a distributed list of URLs that are being advertised via spam and with proper controls one can imagine that list being useful to the email spam fighting crowd. A filter using the rules for email message bodies in SpamAssassin might be useful for folks confronting spam in their weblog comments as well.

Comments (12 posted)

New vulnerabilities

apache: buffer overflows in mod_alias, mod_rewrite

Package(s):	apache	CVE #(s):	CAN-2003-0542 CAN-2003-0789
Created:	October 28, 2003	Updated:	February 13, 2004
Description:	André Malo discovered buffer overflows in the mod_alias and mod_rewrite modules of the Apache webserver. These occurred if a regular expression with more than 9 capturing parenthesis was configured. To exploit this, an attacker would need to be able to locally create a carefully crafted configuration file (.htaccess or httpd.conf). CAN-2003-0542 Another buffer overflow in Apache 2.0.47 and earlier in mod_cgid's mishandling of CGI redirect paths could result in CGI output going to the wrong client when a threaded MPM is used. CAN-2003-0789.
Alerts:	Whitebox WBSA-2004:015-01 2004-02-12 Fedora FEDORA-2003-004 2004-01-08 Red Hat RHSA-2003:405-00 2003-12-18 Red Hat RHSA-2003:320-01 2003-12-16 Red Hat RHSA-2003:360-01 2003-12-10 Gentoo 200310-03 2003-10-28 Trustix 2003-0041 2003-11-15 Conectiva CLA-2003:775 2003-11-05 Slackware SSA:2003-308-01 2003-11-03 EnGarde ESA-20031105-030 2003-11-05 Mandrake MDKSA-2003:103 2003-11-03 Gentoo 200310-04 2003-10-31 Immunix IMNX-2003-7+-025-01 2003-10-28 OpenPKG OpenPKG-SA-2003.046 2003-10-28

Comments (none posted)

libnids: remotely exploitable buffer overflow

Package(s):	libnids	CVE #(s):	CAN-2003-0850
Created:	October 29, 2003	Updated:	January 6, 2004
Description:	libnids (a NIDS plugin which emulates the Linux 2.0 IP stack) contains a buffer overflow vulnerability which can be exploited remotely. Version 1.18 fixes the problem.
Alerts:	Debian DSA-410-1 2004-01-05 Gentoo 200311-07 2003-11-22 Conectiva CLA-2003:773 2003-10-29

Comments (none posted)

thttpd: multiple vulnerabilities

Package(s):	thttpd	CVE #(s):	CAN-2002-1562 CAN-2003-0899
Created:	October 29, 2003	Updated:	November 6, 2003
Description:	The thttpd web server has a pair of vulnerabilities which can lead to information disclosure and arbitrary code execution; both are remotely exploitable.
Alerts:	Conectiva CLA-2003:777 2003-11-06 SuSE SuSE-SA:2003:044 2003-10-31 Debian DSA-396-1 2003-10-29

Comments (none posted)

Updated vulnerabilities

2.4 kernel - several vulnerabilities

Package(s):	2.4 kernel	CVE #(s):	CAN-2003-0461 CAN-2003-0462 CAN-2003-0464 CAN-2003-0476 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552
Created:	July 21, 2003	Updated:	December 24, 2003
Description:	Several security issues have been discovered affecting the Linux kernel: CAN-2003-0461: /proc/tty/driver/serial reveals the exact character counts for serial links. This could be used by a local attacker to infer password lengths and inter-keystroke timings during password entry. CAN-2003-0462: Paul Starzetz discovered a file read race condition existing in the execve() system call, which could cause a local crash. CAN-2003-0464: A recent change in the RPC code set the reuse flag on newly-created sockets. Olaf Kirch noticed that his could allow normal users to bind to UDP ports used for services such as nfsd. CAN-2003-0476: The execve system call in Linux 2.4.x records the file descriptor of the executable process in the file table of the calling process, allowing local users to gain read access to restricted file descriptors. CAN-2003-0501: The /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program. This causes the program to fail to change the ownership and permissions of already opened entries. CAN-2003-0550: The STP protocol is known to have no security, which could allow attackers to alter the bridge topology. STP is now turned off by default. CAN-2003-0551: STP input processing was lax in its length checking, which could lead to a denial of service. CAN-2003-0552: Jerry Kreuscher discovered that the Forwarding table could be spoofed by sending forged packets with bogus source addresses the same as the local host.
Alerts:	Red Hat RHSA-2003:408-00 2003-12-19 Gentoo 200308-01 2003-08-14 Debian DSA-358-4 2003-08-13 SuSE SuSE-SA:2003:034 2003-08-12 Debian DSA-358-2 2003-08-05 Debian DSA-358-3 2003-08-04 Debian DSA-358-1 2003-07-31 EnGarde ESA-20032407-018 2003-07-24 Red Hat RHSA-2003:238-01 2003-07-21

Comments (none posted)

apache2: Denial of Service vulnerability

Package(s):	apache2	CVE #(s):
Created:	September 29, 2003	Updated:	March 25, 2004
Description:	A problem was discovered in Apache2 where CGI scripts that write more than 4k to the standard error stream will hang the script's execution. This problem can lead to a denial of service situation. See this bug report for additional details.
Alerts:	Gentoo 200403-04 2004-03-22 Netwosix NW-2004-0006 2004-03-25 Mandrake MDKSA-2003:096-1 2003-10-24 Mandrake MDKSA-2003:096 2003-09-26

Comments (none posted)

ethereal: security problems in Ethereal 0.9.12

Package(s):	ethereal	CVE #(s):	CAN-2003-0428 CAN-2003-0429 CAN-2003-0431 CAN-2003-0432
Created:	June 23, 2003	Updated:	November 10, 2003
Description:	Several security problems have been found in Ethereal 0.9.12. "It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire, or by convincing someone to read a malformed packet trace file."
Alerts:	SCO Group CSSA-2003-030.0 2003-11-07 Yellow Dog YDU-20030718-2 2003-07-18 Red Hat RHSA-2003:203-01 2003-07-03 Gentoo 200306-13 2003-06-25 Conectiva CLA-2003:662 2003-06-25 Mandrake MDKSA-2003:070 2003-06-23

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail may crash on specially crafted message

Package(s):	fetchmail	CVE #(s):	CAN-2003-0792
Created:	October 17, 2003	Updated:	April 8, 2004
Description:	A bug was discovered in fetchmail 6.2.4 where a specially crafted email message can cause fetchmail to crash.
Alerts:	OpenPKG OpenPKG-SA-2004.012 2004-04-08 Gentoo 200403-10 2004-03-30 Netwosix NW-2004-0002 2004-02-20 SCO Group CSSA-2004-004.0 2004-02-19 Slackware SSA:2003-300-02 2003-10-22 Mandrake MDKSA-2003:101 2003-10-16

Comments (none posted)

fileutils/wu-ftpd: denial of service

Package(s):	fileutils	CVE #(s):	CAN-2003-0854
Created:	October 22, 2003	Updated:	March 2, 2004
Description:	There is, it seems, an integer overflow vulnerability in "ls" which can be exploited via wu-ftpd to create a denial of service situation. See this advisory from Georgi Guninski for details.
Alerts:	SCO Group CSSA-2004-006.0 2004-03-01 Trustix 2003-0042 2003-11-15 Mandrake MDKSA-2003:106 2003-11-12 Red Hat RHSA-2003:309-01 2003-11-03 Immunix IMNX-2003-7+-026-01 2003-10-31 Conectiva CLA-2003:771 2003-10-24 Conectiva CLA-2003:768 2003-10-22

Comments (none posted)

gdm: local attacker may crash or freeze gdm

Package(s):	gdm	CVE #(s):	CAN-2003-0793 CAN-2003-0794
Created:	October 17, 2003	Updated:	October 27, 2003
Description:	Two vulnerabilities were discovered in gdm by Jarno Gassenbauer that would allow a local attacker to cause gdm to crash or freeze. CAN-2003-0793 CAN-2003-0794
Alerts:	Slackware SSA:2003-300-01 2003-10-22 Conectiva CLA-2003:766 2003-10-17 Mandrake MDKSA-2003:100 2003-10-16

Comments (none posted)

glibc - buffer overflow

Package(s):	glibc	CVE #(s):	CAN-2003-0689
Created:	October 15, 2003	Updated:	November 25, 2003
Description:	The GNU C library contains a buffer overflow in the getgrouplist() function. If the user belongs to more groups than the calling application expects, the allocated storage will be overrun.
Alerts:	Gentoo 200311-05 2003-11-22 Mandrake MDKSA-2003:107 2003-11-18 Trustix 2003-0039 2003-11-15 Red Hat RHSA-2003:325-01 2003-11-12 Conectiva CLA-2003:762 2003-10-14

Comments (none posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

gnupg: key validation

Package(s):	gnupg	CVE #(s):	CAN-2003-0255
Created:	May 16, 2003	Updated:	November 18, 2003
Description:	A key validation bug was discovered in the GNU Privacy Guard (GPG) which would cause keys with more then one user ID to trust all user ID's with the amount of trust given to the most-valid user ID.
Alerts:	SCO Group CSSA-2003-034.0 2003-11-17 Conectiva CLA-2003:694 2003-07-11 Yellow Dog YDU-20030602-4 2003-06-02 Mandrake MDKSA-2003:061 2003-05-22 Slackware ssa:2003-141-04 2003-05-22 Red Hat RHSA-2003:175-01 2003-05-20 Gentoo 200305-04 2003-05-16 OpenPKG OpenPKG-SA-2003.029 2003-05-16 EnGarde ESA-20030515-016 2003-05-15

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

ircd: denial of service vulnerability

Package(s):	ircd	CVE #(s):	CAN-2003-0864
Created:	October 17, 2003	Updated:	October 22, 2003
Description:	Piotr Kucharski reported a buffer overflow vulnerability that may allow an attacker to crash the ircd server, thus causing a denial of service condition. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0864 to this issue.
Alerts:	OpenPKG OpenPKG-SA-2003.045 2003-10-19 Conectiva CLA-2003:765 2003-10-17

Comments (none posted)

KDE: Two issues in KDM

Package(s):	kde, xfree86	CVE #(s):	CAN-2003-0690 CAN-2003-0692
Created:	September 16, 2003	Updated:	December 19, 2003
Description:	According to this advisory two issues have been discovered in KDM: CAN-2003-0690: Privilege escalation with specific PAM modules. The XDM display manager that ships with XFree86 prior to 4.3 is also vulnerable. CAN-2003-0692: Session cookies generated by KDM are potentially insecure All versions of KDM as distributed with KDE up to and including KDE 3.1.3 are affected.
Alerts:	Mandrake MDKSA-2003:118 2003-12-19 Gentoo 200311-01 2003-11-15 Debian DSA-388-1 2003-09-19 Conectiva CLA-2003:747 2003-09-19 Mandrake MDKSA-2003:091 2003-09-16 Red Hat RHSA-2003:269-01 2003-09-16

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mplayer: remotely exploitable buffer overflow vulnerability

Package(s):	mplayer	CVE #(s):	CAN-2003-0835
Created:	September 29, 2003	Updated:	April 6, 2004
Description:	A remotely exploitable buffer overflow vulnerability was found in MPlayer. A malicious host can craft a harmful ASX header, and trick MPlayer into executing arbitrary code upon parsing that header. Read the full advisory for details.
Alerts:	Mandrake MDKSA-2004:026 2004-04-05 Gentoo 200403-13 2004-03-31 Conectiva CLA-2003:760 2003-10-06 Mandrake MDKSA-2003:097 2003-09-30 Gentoo 200309-15 2003-09-27

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

net-snmp: denial of service vulnerability

Package(s):	net-snmp	CVE #(s):	CAN-2002-1170
Created:	December 17, 2002	Updated:	November 7, 2003
Description:	The SNMP daemon included in the Net-SNMP package versions 5.0.1 through 5.0.4 can be caused to crash if it is sent a specially crafted packet.
Alerts:	Conectiva CLA-2003:778 2003-11-07 Red Hat RHSA-2002:228-11 2002-12-17

Comments (none posted)

nfs-utils xlog() off-by-one bug

Package(s):	nfs-utils	CVE #(s):	CAN-2003-0252
Created:	July 14, 2003	Updated:	March 8, 2004
Description:	Linux NFS utils package contains remotely exploitable off-by-one bug. A local or remote attacker could exploit this vulnerability by sending specially crafted request to rpc.mountd daemon. See this BugTraq post for more details.
Alerts:	Trustix TSLSA-2004-0009 2004-03-05 SCO Group CSSA-2003-037.0 2003-11-17 Conectiva CLA-2003:700 2003-07-22 Mandrake MDKSA-2003:076 2003-07-21 Gentoo 200307-07 2003-07-19 Yellow Dog YDU-20030718-1 2003-07-18 Slackware SSA:2003-195-01b 2003-07-15 Immunix IMNX-2003-7+-018-01 2003-07-14 SuSE SuSE-SA:2003:031 2003-07-15 Slackware SSA:2003-195-01 2003-07-14 Debian DSA-349-1 2003-07-14 Red Hat RHSA-2003:206-01 2003-07-14

Comments (none posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

openssl: vulnerabilities in ASN.1 code

Package(s):	openssl	CVE #(s):	CAN-2003-0543 CAN-2003-0544 CAN-2003-0545
Created:	September 30, 2003	Updated:	November 4, 2003
Description:	Vulnerabilities have been found in OpenSSL ASN.1 code. This advisory contains details of 4 separate problems in versions of OpenSSL up to and including 0.9.6j and 0.9.7b and all versions of SSLeay. An attack against other applications that use OpenSSL could result in a Denial of Service. See CAN-2003-0543 and CAN-2003-0544. It may be possible for an attacker to exploit this issue to execute arbitrary code. See CAN-2003-0545. CERT has an updated OpenSSL advisory identifying additional OpenSSL vulnerabilities.
Alerts:	EnGarde ESA-20031104-029 2003-11-04 Debian DSA-394-1 2003-10-11 Conectiva CLA-2003:759 2003-10-03 EnGarde ESA-20031003-028 2003-10-03 Tawie 2003-0001 2003-10-02 SuSE SuSE-SA:2003:043 2003-10-01 Slackware SSA:2003-273-01 2003-09-30 Mandrake MDKSA-2003:098 2003-09-30 Gentoo 200309-19 2003-10-01 Debian DSA-393-1 2003-10-01 Conectiva CLA-2003:751 2003-09-30 EnGarde ESA-20030930-027 2003-09-30 Immunix IMNX-2003-7+-022-01 2003-09-29 OpenPKG OpenPKG-SA-2003.044 2003-09-30 Red Hat RHSA-2003:292-01 2003-09-30 Red Hat RHSA-2003:291-01 2003-09-30

Comments (none posted)

postfix: denial of service vulnerabilities

Package(s):	postfix	CVE #(s):	CAN-2003-0468 CAN-2003-0540
Created:	August 5, 2003	Updated:	May 27, 2004
Description:	The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:	Mandrake MDKA-2004:028 2004-05-26 Trustix 2003-0029 2003-08-04 Mandrake MDKSA-2003:081 2003-08-04 EnGarde ESA-20030804-019 2003-08-04 Conectiva CLA-2003:717 2003-08-04 SuSE SuSE-SA:2003:033 2003-08-04 Red Hat RHSA-2003:251-01 2003-08-04 Debian DSA-363-1 2003-08-03

Comments (none posted)

PostgreSQL - more buffer overflows

Package(s):	postgresql	CVE #(s):
Created:	February 12, 2003	Updated:	November 7, 2003
Description:	A new set of buffer overflows has been discovered in PostgreSQL 7.2.2; they affect the circle_poly(), path_encode(), and path_addr() functions. Exploiting these overflows requires that the attacker first obtain a connection to the PostgreSQL server.
Alerts:	Debian DSA-397-1 2003-11-07 Immunix IMNX-2003-7+-005-01 2003-04-08 Trustix 2003-0004 2003-02-20 Mandrake MDKSA-2002:062-1 2003-02-11

Comments (1 posted)

proftpd: remote root shell

Package(s):	proftpd	CVE #(s):	CAN-2003-0831
Created:	September 24, 2003	Updated:	January 2, 2004
Description:	The ASCII translation mechanism in ProFTPD 1.2.8 contains a vulnerability which will provide a remote attacker with a root shell - if the attacker is able to download a specially-crafted file. See this ISS advisory for more information.
Alerts:	Mandrake MDKSA-2003:095-1 2003-12-31 Conectiva CLA-2003:750 2003-09-29 Gentoo 200309-16 2003-09-28 Trustix 2003-0037 2003-09-27 Mandrake MDKSA-2003:095 2003-09-26 OpenPKG OpenPKG-SA-2003.043 2003-09-25 Slackware SSA:2003-259-02 2003-09-23

Comments (2 posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

sane-backends: several vulnerabilities

Package(s):	sane-backends	CVE #(s):	CAN-2003-0773 CAN-2003-0774 CAN-2003-0775 CAN-2003-0776 CAN-2003-0777 CAN-2003-0778
Created:	September 11, 2003	Updated:	February 20, 2004
Description:	Alexander Hvostov, Julien Blache and Aurelien Jarno discovered several security-related problems in the sane-backends package, which contains an API library for scanners including a scanning daemon (in the package libsane) that can be remotely exploited. These problems allow a remote attacker to cause a segfault fault and/or consume arbitrary amounts of memory. The attack is successful, even if the attacker's computer isn't listed in saned.conf. You are only vulnerable if you actually run saned e.g. in xinetd or inetd. If the entries in the configuration file of xinetd or inetd respectively are commented out or do not exist, you are safe. Try "telnet localhost 6566" on the server that may run saned. If you get "connection refused" saned is not running and you are safe. The Common Vulnerabilities and Exposures project identifies the following problems: CAN-2003-0773: saned checks the identity (IP address) of the remote host only after the first communication took place (SANE_NET_INIT). So everyone can send that RPC, even if the remote host is not allowed to scan (not listed in saned.conf). CAN-2003-0774: saned lacks error checking nearly everywhere in the code. So connection drops are detected very late. If the drop of the connection isn't detected, the access to the internal wire buffer leaves the limits of the allocated memory. So random memory "after" the wire buffer is read which will be followed by a segmentation fault. CAN-2003-0775: If saned expects strings, it mallocs the memory necessary to store the complete string after it receives the size of the string. If the connection was dropped before transmitting the size, malloc will reserve an arbitrary size of memory. Depending on that size and the amount of memory available either malloc fails (->saned quits nicely) or a huge amount of memory is allocated. Swapping and OOM measures may occur depending on the kernel. CAN-2003-0776: saned doesn't check the validity of the RPC numbers it gets before getting the parameters. CAN-2003-0777: If debug messages are enabled and a connection is dropped, non-null-terminated strings may be printed and segmentation faults may occur. CAN-2003-0778: It's possible to allocate an arbitrary amount of memory on the server running saned even if the connection isn't dropped. At the moment this can not easily be fixed according to the author. Better limit the total amount of memory saned may use (ulimit).
Alerts:	SCO Group CSSA-2004-005.0 2004-02-19 SuSE SuSE-SA:2003:046 2003-11-18 Conectiva CLA-2003:769 2003-10-22 Mandrake MDKSA-2003:099 2003-10-09 Red Hat RHSA-2003:278-01 2003-10-07 Debian DSA-379-1 2003-09-11

Comments (none posted)

sendmail: remotely exploitable buffer overflow

Package(s):	sendmail	CVE #(s):	CAN-2003-0694 CAN-2003-0681
Created:	September 17, 2003	Updated:	November 18, 2003
Description:	Michal Zalewski has reported a buffer overflow in sendmail. This overflow, apparently, may be exploited remotely, but only in certain (non-default) configurations. Sendmail 8.12.10 has the fix.
Alerts:	SCO Group CSSA-2003-036.0 2003-11-17 SuSE SuSE-SA:2003:040 2003-09-20 OpenPKG OpenPKG-SA-2003.041 2003-09-19 Conectiva CLA-2003:742 2003-09-18 Yellow Dog YDU-20030917-2 2003-09-17 Immunix IMNX-2003-7+-021-01 2003-09-17 Mandrake MDKSA-2003:092 2003-09-17 Debian DSA-384-1 2003-09-17 Red Hat RHSA-2003:283-01 2003-09-17 Slackware SSA:2003-260-02 2003-09-17 Gentoo 200309-13 2003-09-17

Comments (none posted)

stunnel: signal handler reentrancy DoS

Package(s):	stunnel	CVE #(s):	CAN-2002-1563
Created:	July 25, 2003	Updated:	November 25, 2003
Description:	Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over a secure connection (encrypted using SSL or TLS) or to provide a secure means of connecting to services that do not natively support encryption. When configured to listen for incoming connections (instead of being invoked by xinetd), stunnel can be configured to either start a thread or a child process to handle each new connection. If Stunnel is configured to start a new child process to handle each connection, it will receive a SIGCHLD signal when that child exits. Stunnel versions prior to 4.04 would perform tasks in the SIGCHLD signal handler which, if interrupted by another SIGCHLD signal, could be unsafe. This could lead to a denial of service.
Alerts:	Red Hat RHSA-2003:296-01 2003-11-24 SCO Group CSSA-2003-026.0 2003-10-03 Conectiva CLA-2003:736 2003-09-05 Trustix 2003-0030 2003-08-07 EnGarde ESA-20030806-020 2003-08-06 Red Hat RHSA-2003:221-01 2003-07-25

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

unzip: directory traversal vulnerability

Package(s):	unzip	CVE #(s):	CAN-2003-0282
Created:	July 1, 2003	Updated:	November 13, 2003
Description:	A vulnerabilitiy in unzip version 5.50 and earlier allows attackers to overwrite arbitrary files during archive extraction by placing invalid (non-printable) characters between two "." characters. These non-printable characters are filtered, resulting in a ".." sequence. See the full advisory for further information.
Alerts:	SCO Group CSSA-2003-031.0 2003-11-07 Debian DSA-344-2 2003-08-26 Slackware SSA:2003-237-01 2003-08-25 Mandrake MDKSA-2003:073-1 2003-08-19 Conectiva CLA-2003:724 2003-08-18 Red Hat RHSA-2003:199-02 2003-08-15 Yellow Dog YDU-20030710-1 2003-07-10 Gentoo 200307-02 2003-07-11 OpenPKG OpenPKG-SA-2003.033 2003-07-10 Debian DSA-344-1 2003-07-08 Mandrake MDKSA-2003:073 2003-07-07 Conectiva CLA-2003:672 2003-07-02 Immunix IMNX-2003-7+-017-01 2003-07-02 Red Hat RHSA-2003:199-01 2003-07-01

Comments (none posted)

vim - modeline vulnerability

Package(s):	vim	CVE #(s):	CAN-2002-1377
Created:	January 16, 2003	Updated:	February 10, 2004
Description:	VIM allows a user to set the modeline differently for each edited text file by placing special comments in the files. Georgi Guninski found that these comments can be carefully crafted in order to call external programs. This could allow an attacker to create a text file such that when it is opened arbitrary commands are executed.
Alerts:	Conectiva CLA-2004:812 2004-02-10 Mandrake MDKSA-2003:012 2003-02-03 Yellow Dog YDU-20030127-3 2003-01-27 Gentoo 200301-13 2003-01-22 OpenPKG OpenPKG-SA-2003.003 2003-01-21 Red Hat RHSA-2002:297-17 2003-01-15

Comments (4 posted)

webmin: session ID spoofing

Package(s):	webmin	CVE #(s):	CAN-2003-0101
Created:	June 13, 2003	Updated:	November 18, 2003
Description:	miniserv.pl in the webmin package does not properly handle metacharacters, such as line feeds and carriage returns, in Base64-encoded strings used in Basic authentication. This vulnerability allows remote attackers to spoof a session ID, and thereby gain root privileges.
Alerts:	SCO Group CSSA-2003-035.0 2003-11-17 Debian DSA-319-1 2003-06-12

Comments (none posted)

wget: buffer overflow

Package(s):	wget	CVE #(s):	CAN-2003-1565
Created:	August 5, 2003	Updated:	December 10, 2003
Description:	The wget utility contains a buffer overflow which, when exploited with an over-long URL, can enable arbitrary code execution.
Alerts:	Red Hat RHSA-2003:372-01 2003-12-10 SCO Group CSSA-2003-025.0 2003-10-03 Conectiva CLA-2003:716 2003-08-04

Comments (1 posted)

XFree86 4.3.0 integer overflows in font libraries

Package(s):	XFree86	CVE #(s):	CAN-2003-0730
Created:	September 12, 2003	Updated:	November 25, 2003
Description:	Several vulnerabilities were discovered by blexim(at)hush.com in the font libraries of XFree86 version 4.3.0 and earlier. These bugs could potentially lead to execution of arbitrary code or a DoS by a remote user in any way that calls these functions, which are related to the transfer and enumeration of fonts from font servers to clients. See the advisory for additional details.
Alerts:	Red Hat RHSA-2003:286-01 2003-11-25 Red Hat RHSA-2003:287-01 2003-11-25 Red Hat RHSA-2003:288-01 2003-11-17 Debian DSA-380-1 2003-09-12 Mandrake MDKSA-2003:089 2003-09-11

Comments (none posted)

xinetd: Memory leak in xinetd 2.3.10

Package(s):	xinetd	CVE #(s):	CAN-2003-0211
Created:	May 13, 2003	Updated:	November 13, 2003
Description:	Xinetd is a 'master server' that is used to to accept service connection requests and start the appropriate servers. Because of a programming error, memory was allocated and never freed if a connection was refused for any reason. An attacker could exploit this flaw to crash the xinetd server, rendering all services it controls unavailable. In addition, other flaws in xinetd could cause incorrect operation in certain unusual server configurations. All users of xinetd are advised to update to xinetd-2.3.11 which is not vulnerable to these issues.
Alerts:	Conectiva CLA-2003:782 2003-11-12 Yellow Dog YDU-20030602-1 2003-06-02 Gentoo 200305-08 2003-05-19 Mandrake MDKSA-2003:056 2003-05-14 Red Hat RHSA-2003:160-01 2003-05-13

Comments (none posted)

Resources

Interview: Brian Hatch (LinuxQuestions)

LinuxQuestions.org interviews Brian Hatch, author of Hacking Linux Exposed. "So true, not everyone can read and understand the code that they end up running, and not anyone can read all of the code that they end up running. There's a level of trust, and that's no different than when you run proprietary software. The big difference is the number of individuals who do view that code."

Comments (4 posted)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current development kernel is 2.6.0-test9, released by Linus on October 25. It consists almost entirely of important fixes, of course, but Linus also threw in Jeff Garzik's "libata" driver. As always, the long-format changlog has the details.

It seems a real 2.6.0 release could be getting close:

Linus's approach of restricting patches to the most important fixes should help to stabilize the kernel. It also is likely to mean, however, that there will be a substantial pile of patches waiting to go in after the 2.6.0 release.

2.6.0-test9 is, perhaps, unique in having its own press release, something that is not normally done for development kernels. OSDL, it seems, wants to be sure that the world knows where Linus and Andrew work these days.

Linus's BitKeeper tree, as of this writing, contains a relatively small number of fixes.

The current stable kernel is 2.4.22; Marcelo released 2.4.23-pre8 on October 22. Along with the usual fixes, this patch also includes an ACPI update, some driver updates, and a set of tmpfs fixes.

Comments (none posted)

The Wonderful World of Linux 2.6

Joe Pranevich has updated the Wonderful World of Linux 2.6 to cover the -test9 release. This is likely to be the last update until the official 2.6 release. A rough list of changes to the document is also available.

Comments (1 posted)

Kernel development news

Mandrake Linux 9.2 and self-destructing CD-ROM drives

Upgrading to a new version of an operating system is always a bit of a mixed experience. The promise of new features, new applications, and better performance (one hopes) contends with the fear that the upgrade will break something that used to work. Even the most worried among us, however, do not normally worry about an upgrade causing hardware to self destruct. Those who have recent attempted to install Mandrake Linux 9.2 on a system containing an LG CD drive (shipped by Dell and numerous others) have gotten just that sort of surprise, however. An unpatched 9.2 system, it seems, can cause those drives to wipe out their firmware and cease to function.

This problem has been the centerpiece of a small flood of complaints about the stability of the 9.2 release - over 250MB of updates have already been issued by MandrakeSoft. The simple fact of the matter, however, is that it is hard to blame MandrakeSoft for this problem.

The code which toasts LG drives was added to the Mandrake Linux kernel back in August, as part of a general packet writing support patch. It issues a standard ATAPI FLUSH_CACHE command to the drive at times, in order to ensure that all outbound data reaches its intended destination. A CD-ROM is a read-only device, so the FLUSH_CACHE command does not make any particular sense in this context. But, for the purpose of the packet-writing code, it was easier to simply issue that command unconditionally.

The ATAPI specification is clear on what should happen in this situation; the drive should either simply ignore the command, or it should fail it with an error code. The designer of the LG drive firmware, however, had a different idea. Since FLUSH_CACHE is not a command that is applicable in this situation, why not reuse it to overwrite the firmware in some (undocumented) way? It must have, in some twisted way, seemed like a good idea at the time. But standard commands should never be re-purposed in this way; and they especially should not be turned into a self-destruct operation. The LG drives are non-compliant and mis-designed, and nobody can blame MandrakeSoft for having been the first distributor to get burned by this poor product.

Some people have tried to lay the blame there anyway, of course. According to the critics, if MandrakeSoft would only test its releases more thoroughly and avoid including non-standard kernel patches, this sort of episode would not occur. These charges do not hold water, however. Mandrake Linux has, arguably, the most open development process of any commercial distributor; anybody who is interested can follow the evolution of each release from one day to the next and, yes, test those releases. The code in question was included in two 9.2 release candidates, but nobody pointed out the problem. It is hard to see how much better MandrakeSoft could do on the testing front.

With regard to patches: for better or worse, shipping patched kernels is standard practice for distributors. Some distributors ship kernels which are hard to recognize as being derived from any mainline release; Red Hat's kernels are called 2.4.x, but, at the moment, are packed with 2.6 code and features. Even Debian has just been through a lengthy (and somewhat inconclusive) debate on just how heavily its kernels should be patched. For many patches, use in distributor kernels is a prerequisite to inclusion in the mainline. The use of patched kernels in distributions is not only standard practice, but it's a part of the wider development process.

New code will bring surprises, though, hopefully, not often of this magnitude. The only real way to be sure of the stability of code is to see it in wide use, in many different situations. Unfortunately, in the software world, the only way to achieve that degree of testing is to have the end users do it. This is true for both free and proprietary software. Such is life in this industry. MandrakeSoft got unlucky this time; the next such incident could just as easily happen to anybody else.

(Mandrake users may want to see the errata page for the LG drive problem).

Comments (8 posted)

User-space device enumeration

Mark Bellon recently announced the first release of a tool called "User-Space Device Enumeration," or "uSDE". uSDE maintains a directory full of device nodes based on hotplug events and information found in sysfs. It is thus intended to be a user-space replacement for the devfs filesystem.

Few doubt that the objectives for uSDE make sense. But quite a few developers have asked why the uSDE developers went off and created their own system, rather than working on udev (which recently released version 005). Given that the two projects appear to be trying to do exactly the same thing, it seems strange that the work is being done twice.

According to Mr. Bellon, uSDE was developed because udev wasn't up to the needs of Carrier Grade Linux. What needs they were trying to meet are not entirely clear; his posting is full of language like "Aggressive device enumeration. Multiple concurrent policy execution and management." In fact, the actual requirements imposed by the CGL specification are minimal; as posted by Greg Kroah-Hartman:

Meeting this requirement with existing tools is not that hard to do.

uSDE appears to be the result of a different design approach. It uses a complicated plugin architecture to implement different device naming policies. As a whole, it is rather larger and more complex than udev. It does provide some functionality that udev is still lacking, including a devfs emulation module. In general, it shows the signs of having had more developer time put into it than udev.

But, while uSDE may be a little further developed than udev, it looks set to lose the fight for developer support and mindshare. The development of udev has followed the informal rules of kernel hacking: it has been done in the open, with feedback received along the way. It also doesn't hurt that udev is the project of a core kernel developer. uSDE, instead, has been developed in isolation, in competition to an established project, and was late to enter the public arena. Whether or not uSDE is, in fact, a better solution, the way in which it has been developed has put it at a disadvantage relative to its competition.

Comments (3 posted)

Driver porting

Examining a kobject hierarchy

This article is part of the LWN Porting Drivers to 2.5 series.

The Driver Porting Series now includes several articles on how kobjects work as a way of tieing together data structures and managing reference counts. Experience shows, however, that truly envisioning how kobject-linked data structures tie together is a difficult task. In the hope of shedding a bit more light in this direction, and as a way for your editor to exercise his minimal skills with the "dia" diagram editor, this article will show how some of the crucial data structures in the block layer are connected.

The core data structure in this investigation is the kobject. In the diagrams that follow, kobjects will be represented by the small symbol you see to the right. The upper rectangle represents the kobject's parent field, while the other two are its entries in the doubly-linked list that implements a kset. Not all kobjects belong to a kset, so those links will often be empty.

At the root of the block subsystem hierarchy is a subsystem called block_subsys; it is defined in drivers/block/genhd.c. As you'll recall from The Zen of Kobjects, a subsystem is a very simple structure, consisting of a semaphore and a kset. The kset will define, in its ktype field, what type of kobjects it will contain; for block_subsys, this field is set to ktype_block. Pictorially, we can show this structure as seen on the right.

Each kset contains its own kobject, and block_subsys is no exception. In this case, the kobject's parent field is explicitly set to NULL (indicated by the ground symbol in the picture). As a result, this kobject will be represented in the top level of the sysfs hierarchy; it is the kobject which lurks behind /sys/block.

A block subsystem is not very interesting without disks. In the block hierarchy, disks are defined by a struct gendisk, which can be found in <include/linux/genhd.h>. The gendisk interface is described in this article. For our purposes, we will represent a gendisk as seen on the left; note that it has the inevitable embedded kobject inside it. A gendisk's kobject does not have an explicit type pointer; its membership in the block_subsys kset takes care of that. But its parent and kset pointers both point to the kobject within block_subsys, and the kset pointers are there too. The result, for a system with two disks, would be a structure that looks like this:

Things do not end there, however; a gendisk structure is a complicated thing. It contains, among other things, an array of partition entries (of type struct hd_struct), each of which has embedded within it, yes, a kobject. The parent of each partition is the disk which contains it. It would have been possible to implement the list of partitions as a kset, but things weren't done that way. Partitions are a relatively static item, and their ordering matters, so they were done as a simple array. We depict that array as seen on the right.

As you can see, the kobject type of a partition is ktype_part. This type implements the attributes you will see in the sysfs entries for each partition, including the starting block number and size.

Another item associated with each gendisk is its I/O request queue. The queue, too, contains a kobject (of type queue_ktype) whose parent is the associated gendisk. The I/O scheduler ("elevator") in use with an I/O request queue is also represented in the hierarchy. The scheduler's kobject's type depends on which scheduler is being used; the (default) anticipatory scheduler uses as_ktype. The resulting piece of the puzzle looks as portrayed on the left.

The request queue and I/O scheduler information in sysfs is currently read-only. There is no reason, however, why sysfs attributes could not be used to change I/O scheduling parameters on the fly. The selectable I/O scheduler patch uses sysfs attributes to change I/O schedulers completely, for example.

Putting it all together

So far, we have seen a number of disconnected pieces. The full diagram can be found on this page; it is a bit wide to be placed inline with the text (a small, illegible version appears to the right). Also on that page, you'll find a corresponding diagram showing the sysfs names the correspond to each kobject.

The data structure as described is the full implementation of the /sys/block subtree of sysfs. The full sysfs tree contains rather more than this, of course. For each gendisk which shows up under /sys/block, there will be a separate entry under /sys/devices which describes the underlying hardware. Internally, the link between the two is contained in the driverfs_dev field of the gendisk structure. In sysfs, that link is represented as a symbolic link between the two sub-trees.

Hopefully this series of pictures helps in the visualization of a portion of the sysfs tree and the device model data structure that implements it. The device model brings a great deal of apparent complexity, but, once the underlying concepts are grasped, the whole thing is approachable.

Comments (2 posted)

Patches and updates

Kernel trees

• Linus Torvalds: Linux 2.6.0-test9. (October 25, 2003)

• Martin J. Bligh: 2.6.0-test8-mjb1. (October 23, 2003)

• Marcelo Tosatti: Linux 2.4.23-pre8. (October 23, 2003)

• Bernhard Rosenkraenzer: 2.4.23-pre8-pac1. (October 27, 2003)

Core kernel code

• Nick Piggin: Nick's scheduler v17. (October 24, 2003)

• Nigel Cunningham: Announce: Swsusp-2.0-2.6-alpha1. (October 25, 2003)

• Pallipadi, Venkatesh: 0/3 A dynamic cpufreq governor. (October 27, 2003)

• Pallipadi, Venkatesh: 1/3 A dynamic cpufreq governor. (October 27, 2003)

• Pallipadi, Venkatesh: 2/3 A dynamic cpufreq governor. (October 27, 2003)

• Pallipadi, Venkatesh: 3/3 A dynamic cpufreq governor. (October 27, 2003)

Device drivers

• Jeff Garzik: 2.6.x experimental net driver queue. (October 29, 2003)

Memory management

• Con Kolivas: Autoregulate vm swappiness 2.6.0-test8. (October 23, 2003)

• Con Kolivas: Autoregulate vm swappiness cleanup. (October 25, 2003)

Networking

• Emmanuel Fleury: Announce: NetKeeper Firewall For Linux. (October 27, 2003)

• Stephen Hemminger: Updated 8139too with NAPI. (October 29, 2003)

Architecture-specific

• Dominik Brodowski: ACPI PM-Timer rev.2 [Was: Re: ACPI PM-Timer [Was: Re: [RFC][PATCH] must fix lists]]. (October 29, 2003)

Security-related

• Andreas Gruenbacher: ACL Version 0.8.64: nfsacl fix. (October 29, 2003)

Benchmarks and bugs

• Mike Benoit: File System shootout v2.1 using an AMD Opteron 240.... (October 24, 2003)

Miscellaneous

• Greg KH: udev 005 release. (October 23, 2003)

• Mark Bellon: ANNOUNCE: User-space System Device Enumeration (uSDE). (October 27, 2003)

• Neil Brown: ANNOUNCE: mdadm 1.4.0 - A tools for managing Soft RAID under Linux. (October 29, 2003)

Page editor: Jonathan Corbet

Distributions

News and Editorials

A First Look at Turbolinux 10 Desktop

Turbolinux, established in Japan in 1992 under the name of Pacific HiTech, is one of the oldest surviving Linux companies. Like many others, it started by publishing a monthly CD-ROM containing the latest Linux software, before creating its own RPM-based Linux distribution in 1996. The company moved its headquarters to the United States in 1999, but returned to Japan some two years later when it was sold to a Japanese software firm called Software Research Associates. Turbolinux is a founding member of the United Linux consortium.

Turbolinux 10 Desktop is the company's first desktop-oriented release in over a year. Although the product is currently only available in Japan, Turbolinux also plans to introduce its "Basic" edition to the English-language audience next month. Those readers familiar with the distribution might be surprised at the complete change of focus in this release - instead of continuing to develop a general purpose distribution for Linux enthusiasts, Turbolinux 10 Desktop is designed for complete novices to Linux. Its target market is the average Windows user who is interested in migrating to Linux with as little pain and learning curve as possible. It attempts to compete with products such as LindowsOS, Lycoris Desktop/LX or Xandros Desktop.

The most controversial aspect of Turbolinux 10 Desktop is the fact that it is the first Linux distribution to ship with a 2.6 kernel (2.6.0-test5 development kernel, to be precise). Some might question the wisdom of this decision, which seems to have been based on the desire to increase the product's marketability, rather than on solid technical reasons. Nevertheless, Turbolinux 10 had undergone two months of beta testing prior to its release and the company promises to supply a new stable kernel as soon as it becomes available. But while there are many nice new features in the 2.6 kernel series, not everyone will be happy using it at this time. As an example, NVIDIA has yet to produce a graphics driver that would compile cleanly under it. A wiser option would have been to give users a choice between a stable and a development kernel, rather than forcing everyone to the bleeding edge.

Installing Turbolinux is one of the more pleasant aspects of the product. The distribution's "Mongoose" installer is not only extremely functional, it is also aesthetically well-designed. It is loosely modeled on Red Hat's Anaconda, except that the choice of languages is limited to English, Japanese, simplified and traditional Chinese (Korean is gone from this release), while the selection of journaled file systems include ext3, JFS, ReiserFS and XFS. Raid arrays and logical volume management can also be set up during installation. The installer is able to configure Samba-based networks automatically, so that all networked computers are immediately browseable after first boot. This, together with flawless hardware detection and configuration contributed most to the overall positive experience with the installation program.

Turbolinux 10 comes with KDE 3.1.3 (default), GNOME 2.4.0 and XFce 3.8.18 as choices of desktop environments. The menus are greatly simplified and made to resemble Windows menus wherever possible, while hiding more advanced options and more obscure packages deeply inside menu structures. Some other aspects designed to make Windows converts feel right at home include the "My Documents" folder and the My Networks-style "Windows Network" icon on the desktop. The distribution also comes with CD and floppy automount support, as well as Turbolinux-specific "Dynaplug" tool for accessing USB flash memory and IEEE-1394 removable devices. 802.11b wireless network cards and advanced power management for notebooks are also supported.

What does Turbolinux supply in terms of configuration tools? A new "Turbo Update" is a graphical utility for security, bug fix and product updates directly from a remote FTP server or local file system. Other tools include package administration, language selection, daemon configuration, window manager selection and some Turbolinux-specific hardware configuration utilities. All of them are integrated into the KDE control panel, although they can also be launched independently.

It is important to note the differences between the Turbolinux 10 Desktop edition ($143) and Desktop Basic edition ($29). In terms of value, there is little comparison as the Basic edition lacks some proprietary applications as well as an office suite. On the other hand, the more expensive edition includes Sun's Star Suite 7 (the Asian equivalent of Star Office) and Acronis Partition Manager, as well as printed documentation and 3 years of free Turbo Update service (1 year for the Basic edition). It also comes with a proprietary ATOK Japanese input method.

While all of the above sounds fairly impressive, no distribution is perfect and Turbolinux 10 is no exception. The Turbo Update service came with misconfigured defaults and, while entering the correct path to system updates fixed the problem, the new configuration did not stick between sessions. Worse, the program kept reporting available package updates even after they had been updated. All errata information is only given in Japanese, and don't expect perfect English in system dialogs either. But possibly the worst aspect of Turbolinux is lack of any online documentation as well as an absence of English language support services, such as community web sites, user forums or mailing lists. Unless the company makes an effort to create a solid English documentation and support infrastructure, the product will only be really useful to those users who can read Japanese and who need good Japanese functionality in a Linux distribution.

Comments (2 posted)

Distribution News

Debian GNU/Linux

The Debian Weekly News for October 28, 2003 is available. This issue looks at a discussion by the XPde team on the legal implications of emulating aspects of proprietary desktop environments; Andreas Steinel announced a set of pictures that he took at OpenSaar and Linux-Kongress; an upcoming SPI Board election coming up; and more.

A Debian bug-squashing party is planned for Sunday November 9th 2003, in Ecublens, Switzerland. The GULL (Groupe romand des Utilisateurs de Linux et de Logiciels Libres) is organizing the effort that will be open to members and non-members.

Ian Murdock has posted this note to the debian-devel mailing list, with a status report from Progeny. Among other things, Progeny has ported Red Hat's Anaconda installer to Debian. "It is our hope that a distribution-independent Anaconda and a distribution-independent APT (plus, eventually, a distribution- independent configuration framework) will, along with a stronger LSB, help unify further the various Linux distributions."

Comments (none posted)

Gentoo Linux

The Gentoo Weekly Newsletter for the week of October 27, 2003 is out. This week read about improved support for virtual hosting and web-based applications, 2.6 kernel LiveCDs available for x86 and amd64, kernel developer positions open in the Gentoo Linux Project, GWN is seeking an additional contributor, and more.

The Gentoo Linux project will be releasing updates for Apache and all web-based packages, to make it easier to use Gentoo Linux on servers that host more than one website at once.

Comments (none posted)

Mandrake Linux

The Mandrake Linux Community Newsletter for October 24, 2003 is available, with a look at the Mandrake 9.2 'FiveStar' release and more.

A number of Mandrake Linux 9.2 bug fixes are available. Issues with the default mailman install, mdkkdm problems under amd64, fixes for drakconnect, and many other bugs have been fixed in this errata.

New Mandrake Linux 9.2 kernel packages are available which address the problems with certain LG-based CD-ROM devices.

Comments (none posted)

ALT Linux Compact

A new beta of ALT Linux 2.3 is now available. Most known release bugs are fixed, and the cleanups are now rather cosmetic. Click below for more.

Full Story (comments: none)

Slackware Linux

Slackware Linux has a few items in the slackware-current changelog since last week. Check the log for details on tweaks to glibc, and upgrades to automake, gdb, gst and swaret, a new version gcc in testing, and more.

Comments (none posted)

New Distributions

GoboLinux

GoboLinux is an alternative Linux distribution that redefines the entire filesystem hierarchy. Package management is performed through the directory layout itself by storing each program in its own /Programs/[AppName]/[Version] directory. Version 007 was released on October 25, 2003.

Comments (1 posted)

Hakin9 Live

Hakin9 Live is a bootable distribution (based on Aurox Live) which contains hacking, security, and network diagnostic tools. Hakin9 joins the list at version 0.9, released October 28, 2003.

Comments (none posted)

Minor distribution updates

Astaro Security Linux

Astaro Security Linux has released v4.016 with major feature enhancements. "Changes: This new ISO includes a new kernel for supporting new hardware, extends PCMCIA card support (Prism 2/2.5/3) for WLAN, adds more ACPI functions, and has DMA support for speeding up newer hard disks. It fixes several bugs and other issues with PPTP. ASL 4.016 includes a 30 day evaluation license with all features enabled."

Comments (none posted)

Devil-Linux

Devil-Linux has announced the Halloween release of Devil-Linux 1.0. New features include kernel 2.4.22 with FreeS/WAN and Netfilter patches applied, Kernel Security through GRSecurity, almost all software compiled with the GCC stack smashing protector, new "setup" program for basic configuration, and much more.

Comments (none posted)

dyne:bolic GNU/Linux

dyne:bolic GNU/Linux has released v1.1.1 with minor bugfixes. "Changes: This release fixed a booting problem on PCs with that Award BIOS that prevented the distribution from loading from CD. There is no need to upgrade if the the previous version is already working on a system."

Comments (none posted)

Linux From Scratch

Linux From Scratch has released v5.0-pre3. "Changes: Changes from pre2 to pre3 are strictly textual changes such as spelling fixes. Other than that, the package contents and descriptions were updated."

Comments (none posted)

MoviX

MoviX has released v0.8.1pre3 with minor feature enhancements. "Changes: The supervesafb and supermount patches have been applied to the kernel. Digital audio output are now on by default. A new "Play->Dir" menu has been introduced to automagically play every audio/video file within a selected directory. MoviX is once again able to boot from Windows partitions."

Comments (none posted)

Quantian

Quantian has released (test) 0.4.9.1. "This new version been contains an updated kernel and openMosix patch, a broadcom bcm4400 network driver (required by some newer motherboards), and updated packages throughout."

Full Story (comments: none)

SmoothWall

SmoothWall has released v2.0 beta7 with minor bugfixes. "Changes: Security fixes for OpenSSH and OpenSSL from beta6. Graphs for PNG, an .htaccess bug, Snort log rotation, a DHCP problem, and a gettime.pl bug have been fixed. This release has advanced TCP networking, IP blocking, configuration backup and restore, an updated BeWAN driver, and a better, faster squid with diskd support."

Comments (none posted)

Snootix

Snootix has released v0.4.1 with minor bugfixes. "Changes: A library needed to compile LFS (libext2.so.2) was added to disk1."

Comments (none posted)

Source Mage GNU/Linux

Source Mage GNU/Linux has released v0.7.1 with major feature enhancements. "Changes: The biggest change is that devfs is now used on /dev. All the changes necessary for using devfs have been made and tested. sorcery is upgraded to version 1.4. Mount points for CDROM and floppy drive now exist by default. Drivers for several ADSL modems have been added (in source form only)."

Comments (none posted)

ttylinux

ttylinux has released v3.3 with minor bugfixes. "Changes: This release updates LILO to its latest version and fixes a few minor bugs in the init scripts."

Comments (none posted)

Warewulf

Warewulf has released v1.16 with minor bugfixes. "Changes: A bug has been fixed in wulfd with regard to large memory and use of atol(l). A bug in the nodes with dhcpd restarting with a lost return code has been fixed. Masterconf is easier to use."

Comments (none posted)

Distribution reviews

Vector Linux 4.0 (PCBurn.com)

PCBurn.com has this review of Vector Linux 4.0. "Vector Linux (download edition) bills itself as a pre-configured Slackware derivative with updated packages and all the programs you'll need for a generic desktop or file server. Basing their OS's underpinnings off of Slackware allows Vector Linux to retain the old school Unix feel of Slack while loosing some of the non essential bits accumulated up over that venerable distribution's history. Think quick Slackware installation with only the essentials."

Comments (none posted)

Learning to Walk: A Linux User Migrates to FreeBSD (OfB.biz)

Open for Business continues a review of FreeBSD. "It's still about freedom, but it's freedom for a reason. It's no good being free to do a million things I don't want if I can't do the one thing I do want. FreeBSD 5.0 is just a test release: Don't try this at home, kids. It was broken in many places and I wasn't getting much work done. So I accepted someone's offer to provide me with 4.8."

Comments (none posted)

Libranet 2.8.1 (NeoLink)

Neolink Computers reviews Libranet 2.8.1. "One thing I noticed about Libranet is that it's not flashy at all like a SuSE or Lycoris. It's strictly a well-built Linux distro that has an extremely useful tool set at your fingertips. It's a "get down to business" distro that does exactly that -- let's the user get down to business. It eliminates all of the learning that a newbie will have to painstakingly discover through "googling", posting to and scouring message boards, and reading an endless stream of documentation."

Comments (none posted)

Enterprise Linux Server Distributions (TechNewsWorld)

TechNewsWorld compares Red Hat Enterprise Linux against several flavors of UnitedLinux. "While neither SuSE UnitedLinux nor Red Hat's distribution strayed from its Linux Standards Base (a reference platform that ensures that all applications can run across Linux distributions), hardware support favored Red Hat, if only for a larger driver base and advanced hardware detection. But we found that all hardware items were discovered and configured correctly, with few mistakes made by each distribution vendor. All UnitedLinux distributions behaved identically."

Comments (none posted)

Review: SUSE 9 Professional (UnixReview.com)

UnixReview has a review of the preview release of SUSE Linux 9 Professional. "Because SUSE 9 is a major version jump (from 8.2 to 9.0), I expected the release to be significantly different from its predecessor. It definitely has some improvements, but it seems like more of a point release than a major jump. SUSE 9.0 is a modest upgrade from SUSE 8.2. There are a number of improvements, but it's not the major leap that many Linux users may be used to. The additional YaST modules may be the best reason for upgrading."

Comments (1 posted)

Page editor: Rebecca Sobol

Development

gmodconfig 0.5 released (GnomeDesktop)

Gmodconfig is a GUI-based kernel module configuration application for the GNOME desktop. The utility is aimed at making kernel module configuration easier for inexperienced users.

The capabilities of gmodconfig include:

• Configuration of kernel module parameters.
• The display of module information.
• The ability to check on the availability of new module versions.
• The ability to Download, build, and install new modules.

The module information for gmodconfig is stored in XML files. Currently, the XML files are generated manually, with fall-back information coming from the modinfo utility. XML configuration files are generated with the companion gmodconfigedit tool. Automated XML file creation is on the list of project goals. The utility supports multiple language translations for modules with XML configuration files.

Version 0.5 of gmodconfig has been announced. "This version provides GUI improvements, and supports kernel 2.6 modules. The DKMS package installer has been improved to support both tarballs and RPMs."

The project status page details the history of gmodconfig. The software is available here. Project dependencies include the GNOME2 libraries and libxml2.

Documentation for gmodconfig includes the manual (available as a PDF document), and the FAQ. To see gmodconfig in action, see the screenshots page.

Comments (none posted)

System Applications

Audio Projects

Planet CCRMA Changes

The latest changes from the Planet CCRMA audio utility packaging project includes the latest version of Ardour, a multi-track hard disk recorder.

Comments (none posted)

Database Software

Database Programming with Perl (O'Reilly)

Simon Cozens writes about accessing databases in Perl with Perl DBI. "A long, long time ago, when I was a tiny little programmer, I worked as a trainee Perl coder and systems administrator for a large database company. Naturally, at a database company, a lot of what we had to do was talking to databases in Perl. As a fresh-faced programmer, the only way I knew to interface with databases was through a command-line SQL client."

Comments (none posted)

PostgreSQL Weekly News

The October 23, 2003 edition of the PostgreSQL Weekly News is available with another week's worth of PostgreSQL database information.

Full Story (comments: none)

psqlODBC 07.03.0200 Released

Version 07.03.0200 of psqlODBC, the PostgreSQL ODBC driver, has been released. Lots of bug fixes have been implemented.

Comments (none posted)

Proxool 0.8.1 released (SourceForge)

Version 0.8.1 of Proxool, a Java connection pool for JDBC drivers, has been released to fix some bugs that crept into the 0.8.0 release. The version 0.8.0 release notes state: "It is the first release with JDK independence. Or more precisely, Proxool now runs, out of the box, on JDK1.2 and up."

Comments (none posted)

Filesystem Utilities

ntfsprogs 1.8.0beta released (SourceForge)

Version 1.8.0 beta of ntfsprogs, a set of Linux utilities for dealing with NTFS partitions, has been released. "After a long, long wait, here is the all shiny and new first ntfsprogs-1.8.0 beta release. Several bug fixes, compatibility with newer gcc compilers, and lots of new utilities such as ntfscat, ntfsclone, ntfscluster, ntfsinfo and ntfsls are the highlights of this release."

Comments (none posted)

Mail Software

Sendmail 8.13.0.PreAlpha4

Sendmail 8.13.0.PreAlpha4 has been announced. "Sendmail 8.13.0.PreAlpha4 is available for testing. It should give you an idea of some of the new features that will be part of 8.13 such as connection rate control and a new "socket" map to query maps via TCP/IP sockets. 8.13 also enables many FFRs from 8.12 (and adds the required documentation) like quarantining and even more LDAP support. For a full list of currently available features see below. Note: this release is called "PreAlpha" because the set of features is not (yet) fixed, i.e., there might be (substantial) changes between this version and 8.13.0 when it is released, e.g., more features are likely to be added, existing features may be changed, and in some cases features may even be removed."

Comments (none posted)

Building an Advanced Mail Server, Part 3 (O'ReillyNet)

Joe Stump continues his O'Reilly series on setting up an email server with part three. "While it'd be nice to pretend you never receive spam or viruses, server-side filters are a necessary evil. In the final installment of Building an Advanced Mail Server, Joe Stump demonstrates how to install and configure SpamAssassin and ClamAV."

Comments (none posted)

Networking Tools

Big Sister 0.98c8 released (SourceForge)

Version 0.98c8 of Big Sister, an SNMP aware network and system monitoring application, is available. "Release 0.98c8 is a production/stable release mainly fixing a few portability issues and other bugs discovered since 0.98c7 release."

Comments (none posted)

Printing

CUPS 1.1.20rc5 released

Version 1.1.20rc5 of CUPS, the Common UNIX Printing System, has been released. See the version announcement for the list of fixed bugs.

Comments (none posted)

LinuxPrinting.org changes

The latest changes section on the LinuxPrinting.org site says: "Added Epson Stylus C63, C64, CX6400, CX8400, PX V500, AcuLaser C900, C1900. The Epson EPL-2750 works with the Epson Kowa laser printer driver now. Fix: Epson AcuLaser C4000 understands also PCL 5e. Update: Epson AcuLaser C1000 perhaps works with Epson's non-free driver for the AcuLaser C900."

Comments (none posted)

Web Site Development

Bricolage Devel 1.7.0 available

Development version 1.7.0 of Bricolage, a web-based content management and publishing system, is out. "In addition to all of the bug fixes included in the 1.6.x series, this version of the open-source content management system adds a number of significant new features."

Full Story (comments: none)

mod_caml 1.0.0 released

Version 1.0.0 of mod_caml, the OCaml language binding for Apache, has been released. Change information is in the source code.

Comments (none posted)

mod_python 3.1.2 beta released

Version 3.1.2 beta of mod_python, the Python extension to the Apache web server, is available. Downloads are available here. "This is a Beta release, therefore it is likely to contain bugs and is not of production quality. We strongly recommend that you try out your application in a test environment with this release and report any incompatibilities or problems you may encounter."

Comments (none posted)

Miscellaneous

Twisted 1.1.0 released

Version 1.1.0 of Twisted, an event driven networking framework, is available. This release features an updated deployment and configuration library, better documentation, bug fixes, and more.

Full Story (comments: none)

Desktop Applications

Audio Applications

Ardour 0.9beta7 released

Version 0.9 beta 7 of Ardour, a multi-track audio hard disk recorder, has been announced. Lots of new features and bug fixes are included.

Comments (none posted)

WaveSurfer 1.5.5 available

Version 1.5.5 of WaveSurfer, an audio file editor, is available. The changes include several new informational display windows, bug fixes, and more.

Comments (none posted)

Desktop Environments

GTK+ 2.3.0, Pango 1.3, Glib 2.3 released (GnomeDesktop)

GnomeDesktop.org has a multiple announcement for GTK+ 2.3.0, Pango 1.3, and Glib 2.3. "This is the first development release loading up to GTK+-2.4. This release contains a number of major new widgets and capabilities including: an action based menu system, a replacement for GtkFileSelector, and a new unified GtkComboBox widget that replaces both GtkOptionMenu and GtkCombo."

Comments (none posted)

KDE-CVS-Digest

The October 25, 2003 edition of the KDE-CVS-Digest has been published, here's the summary: "KHotkeys now has a gui. KOrganizer now supports todo attachments. Kexi has a postgresql driver. Bug fixes in Khtml layer support and rendering engine. Many bugfixes in KMail, Kopete, Korganizer. We are very close to feature and string freeze in the 3.2 release cycle. After Sunday the 26th, only urgent fixes will be accepted, and Beta 1 will be packaged and released."

Comments (none posted)

Help KDE: Clean Up bugs.kde.org

The KDE development team has announced a bug cleaning effort that is underway. "As KDE 3.2 is approaching and the first Beta version is near, more and more people are testing it. Therefore, a lot of new bugs are appearing in KDE's bugtracking system. While this is of course a good thing, it is much easier for the developers if all the reported bugs are (still) valid and precise enough. Everyone with a current version of KDE is able to do this cleanup-work, coding-knowledge is not needed."

Comments (none posted)

Graphics

Animation in SDL: OpenGL (O'ReillyNet)

Bob Pendleton writes about the OpenGL API on O'Reilly. "SDL, the cross-platform multimedia toolkit, is powerful enough to have brought over 40 commercial games to Linux. While it has its own graphics primitives, it also supports the popular and powerful OpenGL API. In the third of a series of articles, Bob Pendleton introduces OpenGL and demonstrates how to use it in your SDL programs."

Comments (none posted)

Gnuplot.py 1.7 released

Version 1.7 of Gnuplot.py, a Python language interface to the Gnuplot graphing utility, is available. "This version includes a change of license from GPL to LGPL, support for sending data to Gnuplot via FIFOs (named pipes) under unix, and preliminary support for running Gnuplot.py under Jython. For more information, read the NEWS.txt file in the distribution."

Comments (none posted)

JSynoptic v0.3 released (SourceForge)

Version 0.3 of JSynoptic is available. "JSynoptic is dedicated to rendering information graphically. It can be used as a simple graph plotter, or as a complex run-time monitoring environment. The user sets up and edits shapes (ex: plots) on a synoptic (graphical page). Data sources (ex: ASCII file) are then applied on the shapes to render the information. Version 0.3 introduces new shapes: Polygon, Ellipse, Lines, and Text shapes (inc. array and history)."

Comments (none posted)

Matplotlib 0.31 released

Version 0.31 of Matplotlib is available. "matplotlib is a pure python plotting library designed to bring publication quality plotting to python with a syntax familiar to matlab users. A lot progress towards this goal has been made since the first release of matplotlib, the library does produce high quality 2D plots."

Comments (none posted)

Instant Messaging

ChatZilla 0.9.44 Available in French (MozillaZine)

MozillaZine has an announcement for a French version of ChatZilla 0.9.44. A Spanish version is also available.

Comments (none posted)

Interoperability

wine20031016 released

Wine version 20031016 has been announced. "New features include support for the Xrandr extension, completion of the Dll separation of kernel and ntdll, metafile improvements and bug fixes."

Comments (none posted)

Wine Traffic

Issue #193 of Wine Traffic has been published. Topics include: News: Press Coverage, WineSetupTk Resurrected, RedHat 7.3 Packages, and User Forums (Maybe) Resurrected.

Comments (none posted)

Multimedia

Beep the player formerly known as the XMMS GTK2 port (GnomeDesktop)

GnomeDesktop has an announcement for a fork of XMMS that's known as Beep. "I renamed the project to 'beep' since 4Front had asked me to do so (which is of course 100% ok), a new version is uploaded too, 1.0.0-pre2 (1.0.0 because of the fork), featuring Pango font rendering in the playlist widget and main window (try dropping fonts from Fontilus/Nautilus onto the main window :) and other nice stuff, many bugs since the short-lived -pre1 got fixed (the crashing skin browser and the drop hint etc)."

Comments (none posted)

GStreamer 0.7.1 released

Version 0.7.1 of the GStreamer multimedia framework is available. "The goal of this release series is to stabilize it towards a 0.8 release which will be part of the GNOME 2.6 release. This development series and the ABI/API stable 0.8 release series that is to follow it also hoped to increase our chances of KDE choosing GStreamer as their multimedia framework for KDE 4.0."

Full Story (comments: none)

mp3db2-2.8 final has been released.

Version 2.8 of mp3db2, a collection of bash scripts for keeping track of MP3 audio file collections, has been released. "The 2.8 development cycle has focused primarily on making the scripts easier to install. There is now an interactive configuration script that can be run at install time to generate the configuration file and make sure all of the path names are valid."

Full Story (comments: none)

Music Applications

BEAST/BSE 0.5.5 released (GnomeDesktop)

Version 0.5.5 of BEAST/BSE, the Bedevilled Audio SysTem/Bedevilled Sound Engine, has been announced. "This new development series of BEAST comes with a lot of the internals redone, many new GUI features and a sound generation back-end separated from all GUI activities. The most outstanding new features are the demo song, the effect and instrument management abilities, the track editor which allows for easy selection of synthesizers or samples as track sources, loop support in songs and unlimited Undo/Redo capabilities."

Comments (none posted)

Office Suites

KOffice 1.3rc1 available

The first release candidate for KOffice 1.3 has been announced. The changelog details what has gone into the rc1 release, but those who have not been following KOffice development closely may want to look at the beta1 changelog instead, as it covers the changes since 1.2.

Comments (8 posted)

Web Browsers

Adblock 0.5 Development Build 1 Released (MozillaZine)

A new development build of Adblock, a content filtering plug-in for Mozilla and Firebird, has been announced. "This is an incredibly awesome upgrade, not only fixing a few bugs with Firebird integration, but also making it even easier to block any object on a page, including images, Flash, etc. with incredible regular expression matching."

Comments (none posted)

Epiphany 1.1.0 released (GnomeDesktop)

Version 1.1.0 of the Epiphany browser has been announced with a long list of changes.

Comments (none posted)

Galeon 1.3.10 Released

Version 1.3.10 of Galeon, a minimalist browser, has been released. This release works with Mozilla 1.4, 1.4.1, 1.5, 1.6a, and trunk, and features better error reporting, bug fixes, and more.

Comments (none posted)

Mozilla Links Newsletter

The October 28, 2003 edition of the Mozilla Links Newsletter is out with lots of news about the Mozilla family of browsers.

Full Story (comments: none)

Independent Status Reports (MozillaZine)

The October 26th, 2003 edition of the Mozilla Independent Status Reports are out. Here's the content summary: "The first set of third-party project status reports from Brian King includes updates from easyGestures, MozillaBook, QuickManager, Mozile, StumbleUpon, mozdev, Link Visitor and Optimoz."

Comments (none posted)

Minutes of the mozilla.org Staff Meeting (MozillaZine)

The minutes from the October 13, 2003 Mozilla.org staff meeting are available. "Issues discussed include Mozilla 1.5 final, Mozilla Firebird 0.7, Mozilla Thunderbird 0.3, CDs, the Roadmap update, Asa Dotzler's absence and the FTP mirror network."

Comments (none posted)

Minutes of the mozdev Admin Meeting (MozillaZine)

The minutes from the October 27, 2003 mozdev admin meeting are available. "Issues discussed include site performance, non-profit status, the website and user notes."

Comments (none posted)

Miscellaneous

OSAF Status Update #10

Status Update number 10 is out from the Open Source Application Foundation (OSAF). Take a look to see the latest news on the Chandler Personal Information Manager (PIM), and related activity.

Full Story (comments: none)

GNOME Network version 1.99.2 Released (GnomeDesktop)

GNOME Network version 1.99.2 has been announced. "GNOME Network is a set of client network-oriented tools, which currently contains a network information tool, a remote shell and desktop clients, and a personal web server."

Comments (none posted)

Languages and Tools

Caml

Caml Weekly News

The Caml Weekly News for October 21-28, 2003 is out with a report on the week's Caml language activity.

Full Story (comments: none)

Java

Developing With Maven (O'ReillyNet)

O'Reilly has published an article about Maven, a Java project management and comprehension tool. "By knowing what developers want in a build tool, Maven hopes to unseat Ant as the favorite build tool of Java developers. Rob Herbst looks at Maven's most compelling features."

Comments (none posted)

Analyze Your Classes (O'ReillyNet)

Vikram Goyal introduces the Byte Code Engineering Library on O'Reilly. "Most of us never need to go beyond the basics of coding and compiling our classes. The Java Virtual Machine (JVM) is a highly efficient engine that executes our classes and for the most part, we are happy with the way it runs. However, to extend and enhance the JVM to improve runtime performance, among other things, we need to take a deeper look inside this engine and the structure of the class files that it loads and executes. The Byte Code Engineering Library (BCEL) from the Apache-Jakarta stable helps the average developers by analyzing and manipulating the structure of class files."

Comments (none posted)

Eye on performance: A load of stress (IBM developerWorks)

Jack Shirazi and Kirk Pepperdine write about Java performance on IBM's developerWorks. "TheServerSide.com discussion boards are usually quite active, so we stopped there this month to see what was happening in the world of performance. Given its name, it should come as no surprise that performance discussions at TheServerSide tend to focus on J2EE systems. Of course, that's a pretty wide-ranging subject, as it encompasses almost everything in the Java platform -- even J2ME systems are often clients to J2EE systems, so you can even get an occasional question about optimizing J2ME systems."

Comments (none posted)

The easy way to non-blocked sockets (IBM developerWorks)

Kenneth Ballard covers the issue of SSL blocking in Java on IBM's developerWorks. "Although SSL blocking operations -- in which the socket is blocked from access while data is being read from or written to -- provide better I/O-error notification than the non-blocking counterpart, non-blocking operations allow the calling thread to continue. In this article, the author will cover both the client and server side as he describes how to create non-blocking secure connections using the Java Secure Socket Extensions (JSSE) and the Java NIO (new I/O) library, and he will explain the traditional approach to creating a non-blocking socket, as well as an alternative (and necessary) method if you want to use JSSE with NIO."

Comments (none posted)

Lisp

SBCL 0.8.5 released

Version 0.8.5 of SBCL (Steel Bank Common Lisp) is available. "This version includes the new module sb-introspect, cleans up the behavior of REQUIRE/PROVIDE, provides compiler enhancements and threading fixes, and more."

Full Story (comments: none)

CL-PDF 2.0.3 released

Version 2.0.3 of CL-PDF, a Common Lisp library for generating PDF formatted files, is available. "This version changes the way AFM files are loaded."

Full Story (comments: none)

The CL-INTERPOL string interpolation library

A new Lisp library called CL-INTERPOL is available. "CL-INTERPOL is a library for Common Lisp which modifies the reader so that you can have interpolation within strings similar to Perl or Unix Shell scripts. It also provides various ways to insert arbitrary characters into literal strings even if your editor/IDE doesn't support them." Thanks to Paolo Amoroso.

Comments (none posted)

Albert 0.4.9 released

Version 0.4.9 of Albert, a Common Lisp documentation generation tool that is similar to JavaDoc and Doxygen, is available.

Full Story (comments: none)

Perl

Perl 5.8.2 RC1 is out (use Perl)

Version 5.8.2 RC 1 of Perl has been announced on the use Perl site. "5.8.2 is being released to fix minor binary incompatibilities discovered between 5.8.1 and 5.8.0 in the hashing code. 5.8.2 should be binary compatible with both, so if you have modules already installed with 5.8.0 or 5.8.1 please check that they work with 5.8.2."

Comments (none posted)

This Week on perl5-porters (use Perl)

The October 20-26, 2003 edition of This Week on perl5-porters is online. The summary says: "This week, several threads raised concerns with tainting. Plan C for randomized hashes was successful. The language issues with constant subroutines were discussed. Bugs were found, some of which were fixed ; some others were dismissed as features. Quite an usual week for the Perl 5 porters."

Comments (none posted)

This week on Perl 6 (O'Reilly)

The October 19, 2003 edition of This week on Perl 6 is out with another wrap-up of Perl 6 development news.

Comments (none posted)

Cultured Perl: Inversion lists with Perl (IBM developerWorks)

Teodor Zlatanov explains inversion lists as applied to Unicode, on IBM's developerWorks. "So what are inversion lists? Inversion lists are best described as a condensed summary of a bit string. They are similar to a simple run-length encoding of data, though there are some differences. Let's look at an illustrative example. Suppose you want to encode the bit string "1110011." An inversion list would store a list of three numbers: 0, 3, 5. All we store is the start position of the 1s, then the start position of the 0s, then the position of 1s again, and so on until the bit string is over."

Comments (none posted)

Gtk2-Perl supports Gtk+ 2.3.0 (GnomeDesktop)

GnomeDesktop.org mentions the recent efforts of the Gtk2-Perl project team. "Only a few hours after Gtk+ 2.3.0 was released, the Gtk2-Perl team has added support for the new version to the existing Gtk2-Perl libraries."

Comments (none posted)

PAR 0.76 released! (use Perl)

Version 0.76 of Par, a cross between Java's JAR and Perl2exe/PerlApp, is out. "This version offers bytecode-compiling and bleaching filters, bringing Perl on par with Java's obscurability. There is also a new GUI frontend for pp, among other improvements."

Comments (none posted)

PHP

PHP Weekly Summary for October 27, 2003

The PHP Weekly Summary for October 27, 2003 is out. Topics include: PHP 5 Beta 2, RC 1, PHP 5, XML, PHP 4.3.4, RC 2, OpenGroupware PHP, TLK: Dangling Comma, No more rows, ext/java in PHP 5.

Comments (none posted)

Python

Dr. Dobb's Python-URL!

The Dr. Dobb's Python-URL for October 27, 2003 is out, with weekly news and links for the Python community.

Full Story (comments: none)

Scheme

Scheme Weekly News

The October 27, 2003 edition of the Scheme Weekly News has been published. Take a look to see what's been happening in the world of the Scheme programming language.

Full Story (comments: none)

Shells

Developer's notebook (IBM developerWorks)

John Papageorge looks at some shell programming tricks from Spence Murray. "For a Linux developer, Murray believes the shell is a powerful software development tool whose utility is hard to overestimate. 'Shell scripting is an integral part of just about everything I do, whether quickly perusing and editing plain text or writing code," he says. "It's small and quick, and its short commands make moving code around a quick and painless process. As an editor, it quickly becomes second nature.'"

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The Dr. Dobb's Tcl-URL for October 27, 2003 is out, with weekly news and links of interest to Tcl programmers.

Full Story (comments: none)

XML

Using Embedded XML Databases to Process Large Documents (O'Reilly)

Mark Wilcox covers embedded XML databases on O'Reilly. "However, when you are processing a large XML document (for example one that is several megabytes in size), you often have to drop out of DOM due to memory constraints, in which you probably use a SAX processor which allows you greater control over memory consumption. But you pay a price for this control. SAX programming can be quite a bit more complex if you need to do a lot of processing based on parent-children element relations. I propose as an alternative the use of an embedded XML database so that you can continue to utilize DOM for processing but without eating all of your memory."

Comments (none posted)

Profilers

OProfile 0.7 released

Version 0.7 of OProfile, a code profiler, is available. "OProfile is still in alpha, but has been proven stable for many users."

Full Story (comments: none)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Call for Open Source Voting Hardware/Software (OpenSector)

OpenSector has published a call for open source voting machines. "I am currently seeking funding to start up a non-profit 501 c3 charitable organization to provide unique hardware and software solutions for the public good. Specifically, I would like to start by building free software and open source backed voting machines with specialized authentication and verification that would allow for ease in auditing and verifying the usage of such machines by the public. I believe it is a social imperative that we provide trustworthy and open systems that are not proprietary, nor so obscure that they cannot be widely adopted."

Comments (31 posted)

SCO: IBM cannot enforce GPL (InfoWorld)

InfoWorld reports on SCO's response to IBM's counterclaims in Utah District Court. "'The Free Software Foundation is the only entity that can enforce the GPL so, in effect, IBM is barred from trying to enforce the GPL with SCO,' wrote Blake Stowell, a SCO spokesman, in an e-mail response to questions. SCO's filings also assert that 'the GPL violates the U.S. Constitution, together with copyright, antitrust and export control laws.'"

Comments (30 posted)

Suing Your Customers: A Winning Business Strategy? (Wharton)

This Wharton "Strategic Management" article requires registration, but it is a worthwhile read on the pitfalls of the "sue your customers" business strategy, as seen 100 years ago when auto manufacturers tried to use patents to keep cheap cars out of the market. The article is mostly concerned with attacks on music traders, but it could be seen as equally applicable to the SCO case. "The litigation lasted from 1903 until 1911 and along the way, the association launched hundreds of lawsuits against Ford's customers to scare them away from his showrooms for buying 'unlicensed vehicles.' Most ordinary people of Ford's era had been content to stand by and watch the automobile makers slug it out over the Selden Patent. It was just an industry cat fight. But when the big 'money men' started suing ordinary people who were just trying to buy a cheap car, public sympathy shifted against the incumbents."

Comments (5 posted)

Trade Shows and Conferences

Red Hat CTO says Fedora lets company 'Concentrate on the enterprise' (NewsForge)

NewsForge covers a keynote speech by Red Hat CTO Michael Tiemann at the Enterprise Linux Forum. "Fedora, said Tiemann, will provide "the stimulus and the R&D" behind many future Red Hat innovations. And while Fedora explores the leading edge of Linux, Red Hat will concentrate on producing stable, mature enterprise products -- and, obviously, on marketing those products."

Comments (21 posted)

Kapor: Why the old development model is history (IT Manager's Journal)

IT Manager's Journal covers Mitch Kapor's talk at the Software Development Forum. ""Open source software, like flowing water, will go everywhere it can go," said Kapor. And that's not a bad thing; it may be harder to get ultra-rich developing software, he said, but it's easier to start a software company, thanks to the rich base of existing open source projects."

Comments (2 posted)

Enterprise Linux Forum: Small but important event (NewsForge)

Here's a NewsForge report from Enterprise Linux Forum. " Sometimes it's not the size of the audience that matters, but the quality. It may seem wasteful to have a high-end speaker such as Ximian's Nat Friedman talking about desktop Linux advances to a room with only 30 or 40 people in it, but when half of those people are highly-placed IT executives or government agency CIOs, and many of them are taking notes and asking cogent questions, Nat is probably doing more good in a "Let's spread the Linux word" sense than he'd do in front of 200 LUG members who already run Linux all day."

Comments (none posted)

The SCO Problem

SCO attacks open-source foundation (News.com)

News.com reports on SCO's attacks on the GPL - and the fact that SCO continues to ship GPL-licensed software. "SCO spokesman Blake Stowell said SCO doesn't offer indemnification, or legal protection, for use of Samba. As a hypothetical example, if Microsoft were to decide Samba violated its file system intellectual property and start suing companies that use the software, SCO would stop including Samba but wouldn't offer customers using the software legal protection, Stowell said."

Comments (23 posted)

Linux Adoption

Linux Is the Enterprise Operating System (eWeek)

eWeek has decided that Linux will succeed. "Amazon.com runs its shopping carts off Oracle on Linux. You want to talk mission-critical? What could be more business mission-critical? If Amazon's shopping carts stop working, not only are thousands of customers inconvenienced but the entire world knows that the biggest Internet retailer of all has had a major foul-up."

Comments (7 posted)

South Africa launches OSS center (OpenSector)

OpenSector reports that South Africa has launched a government-backed Open Source Centre "to foster industrial and scientific development, either by itself, or in partnership with public and private sectors to contribute to the improvement of the quality of life of the people of South Africa."

Comments (1 posted)

Legal

Senate Votes for Tough Limits on Spam (eWeek)

eWeek reports that the US Senate has approved the "Can Spam" bill, by a 97-0 vote. ""The odds of us defeating spam by legislation alone are extremely low, but that does not mean we should stand idly by and do nothing about it," said Sen. John McCain, R-Ariz., chairman of the Senate Commerce, Science and Transportation Committee."

Comments (4 posted)

Interviews

The C++ Style Sweet Spot (artima.com)

Artima.com is running part 1 of an interview with C++ creator Bjarne Stroustrup. "A lot of people see C++ as C with a few bits and pieces added. They write code with a lot of arrays and pointers. They tend to use new the way they used malloc. Basically, the abstraction level is low. Writing C-style code is one way to get into C++, but it's not using C++ really well. I think a better way of approaching C++ is to use some of the standard library facilities. For example, use a vector rather than an array."

Comments (1 posted)

Resources

Using the Hammerfall HDSP on Linux (Linux Journal)

Here is HOWTO article on Linux Journal about using RME's Hammerfall HDSP sound card on Linux. "This article focuses on using the Multiface module with the PCI host card. If you have different hardware, most of this article still should be applicable, and wherever possible, I've included information on the differences."

Comments (2 posted)

Reviews

System recovery with Knoppix (IBM developerWorks)

IBM developerWorks looks at Knoppix as a system recovery tool. "This is the most common scenario. Something goes haywire, and boom, no boot. No problem: boot up Knoppix and find all your local partitions nicely iconicized on the KDE desktop. (Or cruise the file tree to /mnt.) Click on the correct icon, and there are all your files. But they are wisely mounted read-only. Again, no problem: right-click the desktop icon to bring up a nice menu with a "Change read/write mode" option. This mounts the filesystem on the partition as read/write. Now you can edit any file."

Comments (5 posted)

A Comparison of Snort Books (Linux Journal)

Linux Journal compares Intrusion Detection with Snort: Advanced IDS Techniques with Snort, Apache, MySQL, PHP, and ACID by Rafeed Ur Rehman and Intrusion Detection with Snort by Jack Koziol. "One indication that an idea's time has come is when two publications on the topic arrive at the same time. Based on the two titles reviewed here, it's apparent that Snort is going mainstream. These two books plus Snort 2.0 Intrusion Detection and Snort: The Complete Guide to Intrusion Detection all have been released this year."

Comments (none posted)

Looking into Zend Studio 3.0 (O'ReillyNet)

John Coggeshall reviews Zend Studio 3.0 on O'ReillyNet. "I've been a PHP developer for a long time, using many different development environments in my PHP projects. When I was asked to do a review of the new Zend Studio, I decided that the best way to really judge it was to actually use it in my day-to-day development. So for a week, I set aside my trusted ActiveState Komodo 2.5 and sat down with Zend Studio 3.0. Here is what I found, what I liked, and how it compared to what I was expecting."

Comments (none posted)

Miscellaneous

IBM should take care of software risks (ZDNet)

ZDNet is running an impressive piece of indemnification FUD from Forrester Research. "IBM is giving its customers the blues by asking them to assume financial and legal risk with its open-source software--that's after those same customers have already shelled out hundreds of thousands of dollars for the code."

Comments (13 posted)

A Web of Rules (O'Reilly)

Kendall Grant Clark predicts the development process of the Semantic Web on O'Reilly. "My view, sustained by an admittedly simplistic analogy to the way the Web itself developed, is that if the Semantic Web is to happen, it will be because of a loosely coupled collaboration between three communities: the academics, the industrialists, and the hackers. This view gives me some pain, however, since the hacker community (by which I mean people who develop open source software for fun and for profit) is perhaps the one least engaged in the Semantic Web effort."

Comments (none posted)

If I could re-write Linux (NewsForge)

In this NewsForge article the author speculates on building a next-generation operating system aimed at 64-bit hardware. "Linux is a pure 32-bit operating system written from scratch for 32-bit processors. It doesn't suffer from any 16-bit baggage code. Now Linux is being ported to various 64-bit processors. It will be a while before all the code is compiled and optimised to take advantage of 64-bit platforms."

Comments (22 posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

Potential for major public savings in open source software

The Danish board of technology has released a report on switching from proprietary software to open source software in Danish public administration. "The report shows that there are potential for major savings for the public administration in the use of open source software. The report has now been translated for download." The full report, in English, can be found here (PDF format).

Comments (3 posted)

Show us your flag! (GnomeDesktop)

GnomeDesktop.org mentions a an effort that is underway to build a collection of free flag images. "After the recent release of GSwitchit featured on this site there has been some talk about the need to have a complete free set of international flags available in SVG format for many different uses, both inside and outside GNOME. We want this set of flags to be as free as possible, available in the public domain."

Comments (none posted)

Korean Version of MozillaZine Available (MozillaZine)

A Korean translation of MozillaZine has been announced. "With this latest international version, MozillaZine can now be read in six languages. The Mozilla Korean Project makes Korean language packs for Mozilla and recently began maintaining a Korean translation of Mozilla Firebird Help."

Comments (none posted)

Commercial announcements

Alias-i Goes Open Source with LingPipe Natural Language Processing Tools

Alias-i, Inc. has announced the release of LingPipe 1.0, its suite of linguistic tools, for research and commercial use. "LingPipe is offered under an open source release or a commercial license. The open source release is for researchers, experimenters and companies comfortable with the requirements of open source licensing. For others, LingPipe is available under commercial licenses that entirely support proprietary use."

Comments (9 posted)

Announcing CrossOver Office, Version 2.1

Version 2.1 of CrossOver Office, a commercial application that allows Windows applications to be run under Linux, is available.

Full Story (comments: none)

DriverLoader 1.2

Version 1.2 of DriverLoader is available. Linuxant inc. "is announcing the immediate availability of DriverLoader 1.2, a revolutionary compatibility-wrapper allowing standard Windows NDIS (Network Driver Interface Specification) drivers shipped by hardware vendors to be used as-is on Linux x86 systems. The main highlight of this new release is significant compatibility improvements with simultaneous support for multiple Windows drivers."

Full Story (comments: none)

NEC Global Navigator 5.0

NEC America has announced the availability of Global Navigator 5.0, a call center management system. This is a proprietary system that might not normally be of interest, but it does highlight the reason for a lot of the legal activity which is going on: "The new solution has been ported from SCO UNIX to the Linux operating system, offering more flexibility, lower-cost and a simpler installation. Similarly, Global Navigator replaced all proprietary databases with MySQL."

Comments (none posted)

Red Hat Enterprise Linux 3 released

Here is Red Hat's press release on the availability of Red Hat Enterprise Linux 3. This release includes the Native POSIX Threading Library, greater scalability, and a wider range of supported architectures. Dell, perhaps, is the first vendor to send out a press release announcing the availability of systems with the new release installed.

Comments (3 posted)

Oracle and Red Hat Collaborate

Here's a press release from Oracle and Red Hat, announcing new features and improvements in Red Hat Enterprise Linux 3 designed by and for Oracle.

Comments (3 posted)

Veritas and SUSE LINUX Team Up

Veritas and SUSE LINUX have announced a partnership that will put VERITAS storage management and high availability software on the SUSE LINUX Enterprise Server platform.

Full Story (comments: none)

SUSE LINUX Joins ObjectWeb

SUSE LINUX has joined the ObjectWeb consortium, bringing open-source middleware to SUSE Enterprise Linux.

Full Story (comments: none)

Open Source Storage Management Software

Xinit Systems Limited has announced a storage management platform called Openfiler for building NAS (Network Attached Storage) appliances. They plan to release the guts of Openfiler under the GPL later this week.

Full Story (comments: none)

Andreas Typaldos Named Xandros CEO

The board of directors of Xandros, Inc. has announced the appointment of Andreas Typaldos as CEO. Mr. Typaldos is a 30-year technology veteran and entrepreneur with science and computer science degrees.

Full Story (comments: none)

New Books

"Hacking: The Art of Exploitation" from No Starch Press

No Starch Press has published the book Hacking: The Art of Exploitation by Jon Erickson.

Full Story (comments: 2)

Resources

Benchmarks of scalable network programming research

Felix von Leitner has made available the results of some benchmarks he did while preparing for a talk about scalable network programming given at Linux Kongress 2003. Linux kernels 2.4 to 2.6-test7 were compared to OpenBSD, NetBSD and FreeBSD. Slides can be found here (PDF format). This was posted on Slashdot where you can find lots of comments. (Thanks to Maximilian Attems)

Comments (none posted)

LDP Weekly News

The October 22, 2003 edition of the The Linux Documentation Project Weekly News is available with the week's documentation changes.

Full Story (comments: none)

LDP weekly news

The Linux Documentation Project Weekly News for October 29, 2003 is out with a look at what's happening in Linux documentation.

Full Story (comments: none)

New Introduction to Mozilla Firebird Articles (MozillaZine)

MozillaZine mentions the availability of two more articles on the Firebird browser by Kay Frode. "Kay Frode has create two new articles on Firebird, covering installation of extensions and use of the browsing history."

Comments (none posted)

Contests and Awards

UKUUG Open Source Award 2004

The UK UNIX User Group will be presenting an Open Source Award of £500 in 2004. "The judging panel, made up from representatives from UKUUG, UK computer science departments and the wider community, will consider submissions which might be articles or papers, software products, or other contributions."

Full Story (comments: none)

Upcoming Events

Asian Enterprise Open Source Conference

The Asian Enterprise Open Source Conference will be held on October 30 and 31, 2003 in Singapore.

Full Story (comments: none)

COMDEX Las Vegas 2003, ApacheCon 2003 Offering Reciprocal Invitations to Open-Source Attendees

It seems that ApacheCon and COMDEX are running concurrently this year, both in Las Vegas. MediaLive International, Inc. and the Apache Software Foundation have announced a partnership to extend complimentary admissions to attendees of both events. "Through the partnership, those registered for ApacheCon 2003 will receive a free pass to the COMDEX Las Vegas 2003 exhibit floor, the open source and Linux Power Panel, keynote addresses and the Innovation Centers. Similarly, all COMDEX Las Vegas 2003 registered attendees can access the ApacheCon 2003 exhibits, Vendor Showcase and birds-of-a-feather sessions at no additional fee."

Comments (none posted)

Registration Opens for O'Reilly ETech Conference

O'Reilly has sent out an announcement for the 2004 O'Reilly Emerging Technology Conference. The event will be held in San Diego, CA on February 9-12, 2004.

Full Story (comments: none)

chi.pm: Field Guide to Perl Command Line Switches (use Perl)

The Chicago, IL Perl Mongers group has announced their first Tech Meeting, to be held on November 4, 2003. "Andy Lester will be presenting 'A Field Guide To Perl Command Line Switches' on the nice 25-foot screen at WDI. Learn tricks of Perl data wizardry that you can do without even opening your text editor."

Comments (none posted)

IDG World Expo Unveils Keynote Line-up for LinuxWorld

IDG World Expo has announced the keynote line-up for LinuxWorld Conference & Expo in New York City, taking place January 20-23, 2004 at the Javits Center.

Comments (none posted)

Mednet programme is out (LinuxMedNews)

LinuxMedNews has an announcement for the upcoming Mednet conference, to be held in Geneva, Switzerland on December 4-7, 2003. "There are 3 workshops with Open Source Software: Workshop and Tutorial on the Use of Open-Source Software in HealthCare Applications Elsner C., Heart Center Leipzig, Leipzig Germany Open Source E-learning Software for Medical Education Dorup J., Section for Health Informatics, University of Aarhus, Aarhus Denmark Care2x an OPEN SOURCE hospital information system Godert W., CARE2X.DE, Mainz Germany".

Comments (none posted)

Last CFP: LCA2004 audio miniconf

The final call for papers has gone out for the Linux Audio mini-conference at Linux.Conf.Au, to be held on Jan 12, 2004 in Adelaide, South Australia.

Full Story (comments: none)

Events: October 30 - December 25, 2003

October 30 - 31, 2003	Large Installation Systems Administration Conference(LISA)	(Town & Country Resort Hotel)San Diego, CA
October 30 - 31, 2003	Asian Enterprise Open Source Conference(AEOSC)	(Suntec International Convention and Exhibition Centre)Singapore
October 30 - 31, 2003	4to Encuentro Linux	Valparaiso, Chile
November 2 - 3, 2003	International PHP Conference 2003	(Astron Hotel Frankfurt-Mörfelden)Frankfurt, Germany
November 6 - 7, 2003	HiverCon 2003	(Davenport Hotel)Dublin, Ireland
November 6, 2003	Netherlands Unix Users group fall conference	(Conference Center De Reehorst)Ede, the Netherands
November 6 - 7, 2003	PacSec.jp 2003	(Hotel East 21 Tokyo)Tokyo, Japan
November 8, 2003	Lightweight Languages 2003(LL3)	(MIT)Cambridge MA
November 10, 2003	Desktop Linux Conference	(Boston University Corporate Education Center)Tyngsboro, Massachusetts
November 10 - 11, 2003	Congreso Nacional de Software Libre(CONASOL)	(Universidad de Talca)Talca, Chile
November 14 - 16, 2003	Third International Ruby Conference	(Red Lion Hotel)Austin, Texas
November 15 - 21, 2003	Supercomputing Conference(SC2003)	(Phoenix Civic Plaza Convention Center)Phoenix, AZ
November 16 - 19, 2003	ApacheCon 2003	Las Vegas, Nevada
November 16 - 20, 2003	COMDEX 2003	(Las Vegas Convention Center)Las Vegas, Nevada
November 20 - 21, 2003	ObjectWeb Conferenc3	(INRIA Rocquencourt)Rocquencourt, France
November 22, 2003	Southern California Linux Expo(SCALE)	(Los Angeles Convention Center)Los Angeles, CA
November 22 - 24, 2003	New York GNOME Summit	(Brooklyn College)New York, NY
November 24 - 26, 2003	Open Standards and Libre Software in Government Conference(EGOVOS 3)	Paris, France
November 26 - 27, 2003	Forum PHP Paris 2003	(Club Confair)Paris, France
December 2 - 4, 2003	Linux Bangalore/2003	Bangalore, India
December 9 - 13, 2003	International Conference on Logic Programming(ICLP'03)	Mumbai (Bombay), India

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook

Letters to the editor

Stop making products for Linux

From:		bryanh-AT-giraffe-data.com (Bryan Henderson)
To:		letters-AT-lwn.net
Subject:		Stop making products for Linux
Date:		Sat, 25 Oct 2003 20:19:45 +0000

I've just been through the exercise of buying hardware, trying to be
sure I will be able to use whatever I select with my Linux system.
And I have a message for the computer industry.

I'm tired of companies making products for Linux.  I don't want to see
hardware that comes with a Linux device driver.  I don't want to see a
Linux version of a software package.  I don't want technical support
for Linux users.  All this makes sense for Windows, but is contrary to
the concept of Linux.

What we Linux users want is products with robust and published
interfaces, preferably conforming to some public standard.  We want
technical support at the level of those interfaces (so I can call and
say, "I issued a F2 command and got back D1 status, and the spec says
it should be D3").  We appreciate sample driver code, but that's just
gravy.  

If we had that, we'd write our own drivers, test our own
configurations, and package our own software.  We'd even provide
technical support among ourselves for the higher-level Linux users.

I bought a UPS that advertised "works with Linux."  Turns out that
means you can download a binary RPM for Red Hat Linux 6.0 and control
the product with a Windows-style GUI interface.  I don't have Red Hat
6.0 or anything like it, and if I wanted to control the UPS
windows-style, I'd hook it up to my Windows system.

Sometimes, "works with Linux" means that the product was tested and
found to work on some Linux system.  But unlike Windows systems, Linux
systems are, by design, not all alike.  I believe the only way to
truthfully claim "works with Linux" is to provide and support an
OS-agnostic interface.

I understand the kind of product I'm talking about is not
cost-effective.  That's why Windows is what it is.  I'm just saying
that when a product "supports" Linux in the same way it "supports"
Windows, the company is just wasting its time and insulting the Linux
community.


-- 
Bryan Henderson                                    Phone 408-621-2000
San Jose, California

Comments (7 posted)

Page editor: Jonathan Corbet