LWN.net Weekly Edition for November 20, 2003

Sun's Linux rising in China

The biggest news for Linux this week, surprisingly, comes from Sun Microsystems. Sun has reached an agreement with the China Standard Software Company (CSSC) that is aimed at putting Sun's Linux solution, the Java Desktop System (JDS), on up to 200 million desktops throughout China. The agreement is set to begin towards the end of this year, with an initial goal of 500,000 to one million seats per year. There is no specific timeline for the ultimate goal of 200 million desktops, and CSSC will need to improve adoption rates significantly beyond 500,000 per year to achieve that figure in a meaningful time frame.

CSSC is made up of a group of Chinese high-tech companies, with the backing of the Chinese government and a mandate to create a standard Linux desktop system for the Chinese market. We spoke to Peder Ulander, Director of Marketing for Sun Microsystems Desktop Solutions, about the deal with CSSC and Sun's JDS in general. He tells us that CSSC's final product will be based on JDS, but customized for the Chinese market. Ulander didn't specify how CSSC's version might differ, but noted that it will be running on x86-based computers. At the moment, specific information on CSSC's deployment of a desktop Linux system is fairly sketchy. Ulander said that CSSC will be issuing announcements of its own in the near future.

Why not Solaris for x86? Sun has been touting its x86 Solaris offering pretty heavily lately, and it hasn't exactly shown enthusiasm for Linux despite the fact that the company has a number of Linux offerings. Ulander said that Sun made the decision based on time to market. Though Ulander did not say so, another way to read that would be that Solaris for x86 isn't ready for deployment on existing x86 desktop hardware, while Linux is.

Indeed, JDS has relatively minimal hardware requirements. According to Sun, a recommended minimum configuration for JDS is a Pentium II 266MHz or better, 128 MB of RAM and a 4GB hard disk. While some Linux distributions still run on 386s with 8MB of RAM (or less), the target for JDS seems to be computers originally outfitted with Windows 95 or 98. Ulander noted that Microsoft will be discontinuing support for Windows 95 and Office 95 this year, with Windows NT 4 and OS/2 also losing support in the near future. Companies looking for supported solutions now need to look to newer versions of Windows that will likely require newer hardware as well -- or a migration path to a supported Linux distribution.

Sun's distribution uses the GNOME desktop, Mozilla, StarOffice, Evolution and (not surprisingly) includes a Java Runtime Environment (JRE) for Linux. Ulander said that Sun settled on GNOME rather than KDE because of GNOME's focus on accessibility. From what Sun has revealed about JDS so far, there is little to distinguish their Linux desktop solution from other vendors' solutions. Ulander confirmed that JDS consists of the same components that make up most distributions, but said that Sun's "integration" of the software will set it apart from other distributions.

Of course, Sun's offering is different from other vendors in that it isn't branded "Linux." Ulander said that the name "Java Desktop System" was not meant to obscure the Linux underpinnings of the system, but rather to fit in with the rest of Sun's rebranded product line. According to Ulander, Sun has consolidated 248 individual products into six product lines, including the Java Enterprise System, Java Desktop System and so on.

Sun's published prices are $100 per desktop user, or $50 per employee for existing customers of Sun's Java Enterprise System, but CSSC will be paying less to license JDS. Ulander declined to specify how much less CSSC would be paying, but said that Sun was giving CSSC a deal similar to a typical OEM agreement where the company would pay less than list.

In fact, the deal brings a lot of credibility to Linux in general. But it does give bragging rights to Sun as the company to score the largest Linux desktop deal, at least to date, and may give the company leverage to sell other (more profitable) solutions to companies that make the switch. Ulander called JDS "a door-opener," but said that organizations deploying JDS were in no way dependent on Sun solutions on the server side.

Sun's JDS will be generally available in December of this year. Though Sun has secured a significant spot in the Chinese market with JDS, it will be interesting to see how well Sun fares with the rest of the Linux market.

Meanwhile, it's hard to see how adoption of Linux on such a wide scale anywhere in the world could be a bad thing for the community. Sun was not the only company having talks with CSSC, indicating that CSSC had already settled on Linux, but hadn't decided on a vendor. While Sun may tout this as a success for their business, and it is, it really emphasizes the maturity of Linux as a desktop solution.

Comments (6 posted)

SCO update

It has been a busy week or so in the SCO case. Time to catch up with all that has been happening.

The company has filed a new Form S-3 as part of the BayStar deal. That deal allows for a conversion of BayStar's preferred stock to the regular variety, so SCO had to go through the motions to register another 3.85 million shares for sale. As usual, these filings give a rare window into what is happening inside a company.

In this filing, SCO revealed (though not in so many words) that its fourth quarter results are going to be horrible. The company did (as was disclosed previously) get another $8 million from Microsoft for a "broader" Unix license. But the company will have to record a charge of $8.7 million related to the BayStar deal. The company also will take a $9 million hit to account for the $1 million in cash and 400,000 shares of stock that it has given to its lawyers. As a result, the company's income will be $17 million lower than it would otherwise have been. It does not look like a profitable quarter for The SCO Group.

SCO's law firm (Boies, Schiller & Flexner LLP) will be taking on the company's defense in the Red Hat case, and in IBM's countersuit as well. There was a great effort to put a positive spin on things at SCO's November 18 conference call (transcript available here); it is claimed that SCO will be setting Boies et al. on Linux end users within "the next 90 days." These, it is claimed, will be direct copyright suits, based on a whole new pile of "directly copied" code that has been found lurking somewhere in the Linux kernel. Of course, they can't tell us where that code would be.

The conference call hinted that, if SCO does really decide that it needs more legal battles, it is likely to go after HP customers. There was much satisfied talk of HP's indemnification offer, and speculation as to whether HP would pay license claims directly or choose, instead, to defend a lawsuit. As had been predicted months ago, HP's indemnification offer may well have just served to turn that company - and its customers - into low-hanging fruit for an SCO legal offensive.

SCO has finally spoken out on Novell's acquisition of SUSE. That deal, says SCO, would violate Novell's non-compete agreement with SCO. If the acquisition goes forward, SCO claims it plans to take action against Novell. Happily for us, the agreement in question is available on the net; the relevant text (section 1.6) reads:

If you buy SCO's argument that Linux is Unix with the serial numbers filed off, then SCO might actually have a leg to stand on here. If, instead, you believe that Linux is Linux and SCO has no right to steal it, SCO's non-compete argument makes no sense. The non-compete agreement only applies to what Novell does with Unix.

In the Red Hat case, SCO continues to try to get the suit thrown out, or, at least, to delay things. Given the "90 days" discussion in the teleconference, SCO's position that it has not threatened to sue anybody appears to be even shakier than before. This case is now waiting for a ruling from the judge on the various motions.

In the IBM case, the November 21 conference before the judge looms. If it still appears that SCO is failing to respond to IBM's discovery requests, oral arguments will happen on December 5. Sometime thereafter, SCO could find itself compelled by the judge to put forward its evidence or shut up. SCO may try to draw its own motion to compel discovery into the discussion as well.

SCO's supplemental responses to IBM's requests included some amusement in the form of a list of files that, according to SCO, contain its property. The file list looks like:

	arch.i386.kernel.i8259.c
	arch.i386.kernel.timers.timer_tsc.c
	arch.i386.mach-default.topology.c
	arch.i386.mach-pc9800.topology.c
	arch.i386.mm.discontig.c

And so on. Many people wondered why the files were listed in this sort of "flattened" form until it was pointed out that SCO's Unix offerings lack a version of "grep" which can do recursive searches. They had to have some poor intern rename all of the files into a single directory so that they could search through them.

Their searches were simplistic, to say the least. One of the files listed was (in standard Linux naming format) include/asm-m68k/spinlock.h, the entire contents of which are:

    #ifndef __M68K_SPINLOCK_H
    #define __M68K_SPINLOCK_H

    #error "m68k doesn't do SMP yet"

    #endif

One does, indeed, wonder how Linux was able to compete before IBM stole all that nice SCO technology. Seriously, though, it appears that SCO did a simple grep for "SMP" and listed every file that popped up with no regard to what was contained therein. Thus we see the quality of SCO's evidence.

Recent rhetoric from SCO has brought with it an interesting change: the company is now, repeatedly, talking about the old USL v. BSDI settlement. For those who have not yet seen it, taking some time to read the ruling which led to that settlement may be worthwhile. The introduction in the "statement of facts" is eerily familiar:

"Allegedly proprietary" is the judge's wording. This judge concluded that USL had failed to show that any copyrights or trade secrets in Unix could be enforced. The subsequent settlement freed the BSD code base for distribution. SCO is the successor to USL; why it wants to reopen this case at this time is currently a mystery. There have been occasional hints from SCO that it plans to go after BSD in the future; perhaps they are trying to tell us that this attack is getting closer. One publication quoted Darl McBride as saying that suits against BSD could happen in the first half of next year.

Where things will go from here is anybody's guess. The motions to compel in Utah and Red Hat's suit in Delaware could bring things to a head relatively quickly. Counting on the U.S. justice system to bring this situation to a quick conclusion is risky, however. We may be fighting this battle for some time yet.

Comments (14 posted)

Governmental open source directives in Italy

At the end of October, the Italian Dipartimento per l'Innovazione e le Technologie ("Department of Innovation and Technology") issued a press release (in Italian) regarding a new set of directives for the use of open source software in the public sector. The actual directives are not yet available - they will not be released until officially published by the government - but the press release gives an overview of what will be there. Italy, it seems, is trying to put itself at the forefront of governments adopting free software.

The following are the key points, painfully translated by your editor:

Comparative analysis of solutions: The "Stanca Open Source Directive" [Lucio Stanca is the minister responsible for all this] requires that public administrations must acquire software based on comparative technical and economic evaluation of the various solutions available in the market, taking into account the administration's needs, but also taking into account the possibility of developing specific programs in-house (or under contract) and the reuse of special-purpose programs developed in other agencies.

The evaluation must consider also the total cost of ownership and the cost of exit from each solution, but it must also consider the possible interests of other agencies in reusing the chosen solution. In cases where proprietary software is to be licensed, the administration must obtain a contractual guarantee that, if the vendor becomes unable to support the software, the source code and relevant documentation will be made available.

Technical criteria: public agencies, when acquiring software, must favor solutions which:

• Assure interoperability and cooperation between the various computing systems of the public administration, with the exception of situations requiring particular security or secrecy.
• Render information systems independent of a single vendor or a single proprietary technology.
• Guarantee the availability of source code for inspection and traceability by the public administration.
• Export data and documents in multiple formats, of which at least one is an open format.

Ownership of software: In the case of programs developed for a specific purpose, the commissioning agency will acquire the ownership of the software given that it has contributed out of its own resources to the identification of the requirements, the functional analysis, the control, and testing of the software implemented by the vendor.

Transferability of software licenses: Public administrations will obtain contractual assurance of their ability to transfer software licenses in case that agency replaces the program with another performing the same function.

Reuse: In order to encourage reuse of software owned by the administration, the project goals and specifications must allow for portability to other platforms. Contracts for software developed at public expense must include clauses that commit the vendor to making available services to enable the reuse of the software.

Interestingly, this "open source directive" says almost nothing about open source licensing; it is more focused on specific goals: software reuse, ability to inspect the code, ability to switch to a different solution. This is a good thing, of course; wiring specific licenses into the law is probably not the right way to go. The directive also says nothing about open source licensing for software developed for the government; as long as the software can be reused within the government, the rules will be satisfied.

There is little consensus on how strongly governmental bodies should be encouraged - or forced - to use free software. But it is hard to argue against criteria that call for interoperability, software reuse, and the ability to avoid being bound to a single vendor. It will be interesting to see what sort of software mix the Italian government ends up with after these rules have been in force for a few years.

Comments (3 posted)

On comment abuse

We resisted the idea of allowing reader comments on the site for years out of concern that some people would post things which detracted from the quality of LWN. A year and a half ago, we decided that we could trust our readers to do the right thing, and our experience since then has largely verified that decision. More recently, however, we have begun to have problems with comment spammers and trolls. The problem is small, for now, and a bit of carefully targeted firewalling appears to have slowed the latest troll down considerably. We have been on the net for long enough to know, however, that problems of this sort rarely get better by themselves. Instead, they tend to get steadily worse until the signal is drowned out by the noise. We do not intend to let that happen to LWN.

So we are going to have to do something; it's just a matter of figuring out what. There are a few options under consideration; we would appreciate feedback from our readers on which idea seems best.

• One option is manual moderation of comments by the LWN editors, perhaps augmented by a small number of trusted readers. The problem with this approach is that we really do not want to get into the business of censoring comments. It is an unpleasant occupation, and active control of comments might open us up to interesting liability issues.

• We could implement a reader moderation mechanism which would allow the trolls and spam to sift to the bottom of the pile. In the long term, this might be the best solution. It will require some significant site hacking to implement, however, and it will put strains on the database that will force a server upgrade (which is increasingly necessary anyway).

• Comment posting privileges could be restricted to subscribers. This one is trivial to implement. It would have the effect of silencing non-subscribers, however. Currently about 1/3 of the comments on the site are posted by non-subscribers, and almost none of those are abusive. Closing out non-subscribers would deprive us of a lot of good comments to get rid of a small number of bad ones.

• A preference flag could be added to allow readers to filter out comments by non-subscribers. This would be less draconian than silencing non-subscribers outright, but it still punishes a large community of readers for the behavior of a very small number of people.

The decision we make here will affect the feel of LWN.net into the future; we want to do the right thing. If you have any thoughts on the matter, we encourage you to post them as a comment to this article (no trolls or spam please).

Comments (88 posted)

Come back early next week

Next week's LWN.net Weekly Edition will be published on Wednesday, November 26 (one day earlier than usual) so that we can enjoy the Thanksgiving holiday. LWN is important, but pumpkin pie wins every time.

Comments (2 posted)

Page editor: Jonathan Corbet

Security

Brief items

Security updates for old Red Hat releases

Sites which have deployed Red Hat Linux have a difficult choice ahead of them. In the near future, Red Hat will cease providing security updates for these releases. If you have a Red Hat Linux system exposed to the net, you should be thinking about how you will keep it secure once the official updates stop coming. There are a number of choices available, none of which is perfect:

• Move over to Fedora core. Updates will be available for Fedora Core releases, but only until the next version comes out. The update policy for Fedora also differs from that of Red Hat Linux; rather than backport fixes to the version of the affected program which was originally distributed, Fedora will simply move to the current version. That change will make security updates potentially more disruptive. Updating the full system to a new Fedora Core release twice a year may not be a viable option for many applications.

• Switch to a Red Hat Enterprise Linux release. RHEL will offer long-term support and relative stability; all you have to do is pay the price. Given that (as reported on News.com) over 90% of RHEL customers are renewing their subscriptions, it would appear that Red Hat is offering services with a real value. Not everybody will be willing or able to pay that price tag, however.

• Switch to another distribution entirely. The nice thing about Linux is that you can switch to another vendor when the need arises. That still does not imply that changing distributions is a fun or easy process, however.

• Maintain security-critical packages in-house, from source. This approach would work, assuming there is somebody with enough technical expertise available who can also find the time to do that sort of maintenance.

Red Hat Linux users are lucky; users of a proprietary system would not have such a wealth of choices available to them. Even so, these users can be forgiven for occasionally wishing that a "go on as if nothing had changed" option existed as well.

That could yet happen. The Fedora Legacy Project is forming with the goal of supporting Red Hat Linux and Fedora Core releases past their official end of life. This project is still in its organizational stages (the inevitable press release is still in draft form) but its volunteers intend to start producing security updates for (at least) Red Hat Linux 7.3 by the beginning of 2004, when support for that release ends. Whether support for the 8.0 release will be offered remains unclear; it depends on whether volunteers show up to produce the updates. There are plans to support Red Hat Linux 9, however.

Continuing to use a deployed Red Hat Linux system with the expectation that the Fedora Legacy Project will supply security updates is a bit of a risky option. The project is new and still organizing; there is no way to know whether it will put together the necessary mass of sufficiently talented and motivated engineers to produce reliable security updates in a timely manner. There is no doubt that a volunteer project can perform this sort of task with high-quality results, however, and there should be enough deployed Red Hat Linux systems to motivate a large pool of potential contributors.

Comments (11 posted)

Strange web server traffic

If you run a web server, and you pay any attention at all to its logs, you may be seeing many entries that look like:

    SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02...

(Though the actual lines are very long). If you think it looks like an attack, you are correct. It is, however, an exploit for an old IIS vulnerability. Thus, most readers of this site need not be too worried about this one.

Comments (none posted)

New vulnerabilities

glibc: local DoS vulnerability

Package(s):	glibc	CVE #(s):	CAN-2003-0859
Created:	November 15, 2003	Updated:	November 19, 2003
Description:	Herbert Xu reported that various applications can accept spoofed messages sent on the kernel netlink interface by other users on the local machine. This could lead to a local denial of service attack. The glibc function getifaddrs uses netlink and could therefore be vulnerable to this issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0859 to this issue.
Alerts:	Fedora FEDORA-2003-002 2003-11-14

Comments (none posted)

minimalist: unsanitized input

Package(s):	minimalist	CVE #(s):	CAN-2003-0902
Created:	November 17, 2003	Updated:	November 19, 2003
Description:	A security-related problem has been discovered in minimalist, a mailing list manager, which allows a remote attacker to execute arbitrary commands.
Alerts:	Debian DSA-402-1 2003-11-17

Comments (none posted)

pstack: Buffer overflow

Package(s):	pstack	CVE #(s):
Created:	November 13, 2003	Updated:	November 19, 2003
Description:	pstack dumps a stack trace for a process, given the pid of that process. Versions prior to 1.2.3 contain a potential buffer overflow vulnerability.
Alerts:	Fedora FEDORA-2003-010 2003-11-12

Comments (none posted)

zebra: denial of service vulnerability

Package(s):	zebra	CVE #(s):	CAN-2003-0795 CAN-2003-0858
Created:	November 13, 2003	Updated:	January 7, 2004
Description:	Zebra an open source implementation of TCP/IP routing software. Jonny Robertson reported that Zebra can be remotely crashed if a Zebra password has been enabled and a remote attacker can connect to the Zebra telnet management port. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0795 to this issue. Herbert Xu reported that Zebra can accept spoofed messages sent on the kernel netlink interface by other users on the local machine. This could lead to a local denial of service attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0858 to this issue.
Alerts:	Debian DSA-415-1 2004-01-06 OpenPKG OpenPKG-SA-2003.049 2003-11-25 Conectiva CLA-2003:786 2003-11-20 Red Hat RHSA-2003:307-01 2003-11-13

Comments (none posted)

Updated vulnerabilities

2.4 kernel - several vulnerabilities

Package(s):	2.4 kernel	CVE #(s):	CAN-2003-0461 CAN-2003-0462 CAN-2003-0464 CAN-2003-0476 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552
Created:	July 21, 2003	Updated:	December 24, 2003
Description:	Several security issues have been discovered affecting the Linux kernel: CAN-2003-0461: /proc/tty/driver/serial reveals the exact character counts for serial links. This could be used by a local attacker to infer password lengths and inter-keystroke timings during password entry. CAN-2003-0462: Paul Starzetz discovered a file read race condition existing in the execve() system call, which could cause a local crash. CAN-2003-0464: A recent change in the RPC code set the reuse flag on newly-created sockets. Olaf Kirch noticed that his could allow normal users to bind to UDP ports used for services such as nfsd. CAN-2003-0476: The execve system call in Linux 2.4.x records the file descriptor of the executable process in the file table of the calling process, allowing local users to gain read access to restricted file descriptors. CAN-2003-0501: The /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program. This causes the program to fail to change the ownership and permissions of already opened entries. CAN-2003-0550: The STP protocol is known to have no security, which could allow attackers to alter the bridge topology. STP is now turned off by default. CAN-2003-0551: STP input processing was lax in its length checking, which could lead to a denial of service. CAN-2003-0552: Jerry Kreuscher discovered that the Forwarding table could be spoofed by sending forged packets with bogus source addresses the same as the local host.
Alerts:	Red Hat RHSA-2003:408-00 2003-12-19 Gentoo 200308-01 2003-08-14 Debian DSA-358-4 2003-08-13 SuSE SuSE-SA:2003:034 2003-08-12 Debian DSA-358-2 2003-08-05 Debian DSA-358-3 2003-08-04 Debian DSA-358-1 2003-07-31 EnGarde ESA-20032407-018 2003-07-24 Red Hat RHSA-2003:238-01 2003-07-21

Comments (none posted)

apache: buffer overflows in mod_alias, mod_rewrite

Package(s):	apache	CVE #(s):	CAN-2003-0542 CAN-2003-0789
Created:	October 28, 2003	Updated:	February 13, 2004
Description:	André Malo discovered buffer overflows in the mod_alias and mod_rewrite modules of the Apache webserver. These occurred if a regular expression with more than 9 capturing parenthesis was configured. To exploit this, an attacker would need to be able to locally create a carefully crafted configuration file (.htaccess or httpd.conf). CAN-2003-0542 Another buffer overflow in Apache 2.0.47 and earlier in mod_cgid's mishandling of CGI redirect paths could result in CGI output going to the wrong client when a threaded MPM is used. CAN-2003-0789.
Alerts:	Whitebox WBSA-2004:015-01 2004-02-12 Fedora FEDORA-2003-004 2004-01-08 Red Hat RHSA-2003:405-00 2003-12-18 Red Hat RHSA-2003:320-01 2003-12-16 Red Hat RHSA-2003:360-01 2003-12-10 Gentoo 200310-03 2003-10-28 Trustix 2003-0041 2003-11-15 Conectiva CLA-2003:775 2003-11-05 Slackware SSA:2003-308-01 2003-11-03 EnGarde ESA-20031105-030 2003-11-05 Mandrake MDKSA-2003:103 2003-11-03 Gentoo 200310-04 2003-10-31 Immunix IMNX-2003-7+-025-01 2003-10-28 OpenPKG OpenPKG-SA-2003.046 2003-10-28

Comments (none posted)

apache2: Denial of Service vulnerability

Package(s):	apache2	CVE #(s):
Created:	September 29, 2003	Updated:	March 25, 2004
Description:	A problem was discovered in Apache2 where CGI scripts that write more than 4k to the standard error stream will hang the script's execution. This problem can lead to a denial of service situation. See this bug report for additional details.
Alerts:	Gentoo 200403-04 2004-03-22 Netwosix NW-2004-0006 2004-03-25 Mandrake MDKSA-2003:096-1 2003-10-24 Mandrake MDKSA-2003:096 2003-09-26

Comments (none posted)

conquest: buffer overflow

Package(s):	conquest	CVE #(s):	CAN-2003-0933
Created:	November 10, 2003	Updated:	November 13, 2003
Description:	Steve Kemp discovered a buffer overflow in the environment variable handling of conquest, a curses based, real-time, multi-player space warfare game, which could lead a local attacker to gain unauthorized access to the group conquest.
Alerts:	Debian DSA-398-1 2003-11-10

Comments (none posted)

CUPS: denial of service

Package(s):	CUPS	CVE #(s):	CAN-2003-0788
Created:	November 3, 2003	Updated:	March 4, 2004
Description:	Paul Mitcheson reported a situation where the CUPS Internet Printing Protocol (IPP) implementation in CUPS versions prior to 1.1.19 would get into a busy loop. This could result in a denial of service. In order to exploit this bug an attacker would need to have the ability to make a TCP connection to the IPP port (by default 631).
Alerts:	SCO Group CSSA-2004-012.0 2004-03-03 Conectiva CLA-2003:779 2003-11-07 Mandrake MDKSA-2003:104 2003-11-05 Red Hat RHSA-2003:275-01 2003-11-03

Comments (none posted)

epic4: buffer overflow

Package(s):	epic4	CVE #(s):	CAN-2003-0328
Created:	November 10, 2003	Updated:	November 25, 2003
Description:	Jeremy Nelson discovered a remotely exploitable buffer overflow in EPIC4, a popular client for Internet Relay Chat (IRC). A malicious server could craft a reply which triggers the client to allocate a negative amount of memory. This could lead to a denial of service if the client only crashes, but may also lead to executing of arbitrary code under the user id of the chatting user.
Alerts:	Red Hat RHSA-2003:342-01 2003-11-17 Fedora FEDORA-2003-008 2003-11-12 Debian DSA-399-1 2003-11-10

Comments (none posted)

ethereal: multiple remote and local vulnerabilities

Package(s):	ethereal	CVE #(s):	CAN-2003-0925 CAN-2003-0926 CAN-2003-0927
Created:	November 10, 2003	Updated:	December 17, 2003
Description:	Multiple vulnerabilities have been found in ethereal versions below 0.9.16. Remote attackers can craft packets, and local users can build corrupt trace files, resulting denial of service and remote code execution.
Alerts:	Mandrake MDKSA-2003:114 2003-12-10 Fedora FEDORA-2003-022 2003-11-25 Gentoo 200311-04 2003-11-22 Red Hat RHSA-2003:323-01 2003-11-10 Conectiva CLA-2003:780 2003-11-07

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail may crash on specially crafted message

Package(s):	fetchmail	CVE #(s):	CAN-2003-0792
Created:	October 17, 2003	Updated:	April 8, 2004
Description:	A bug was discovered in fetchmail 6.2.4 where a specially crafted email message can cause fetchmail to crash.
Alerts:	OpenPKG OpenPKG-SA-2004.012 2004-04-08 Gentoo 200403-10 2004-03-30 Netwosix NW-2004-0002 2004-02-20 SCO Group CSSA-2004-004.0 2004-02-19 Slackware SSA:2003-300-02 2003-10-22 Mandrake MDKSA-2003:101 2003-10-16

Comments (none posted)

fileutils/wu-ftpd: denial of service

Package(s):	fileutils	CVE #(s):	CAN-2003-0854
Created:	October 22, 2003	Updated:	March 2, 2004
Description:	There is, it seems, an integer overflow vulnerability in "ls" which can be exploited via wu-ftpd to create a denial of service situation. See this advisory from Georgi Guninski for details.
Alerts:	SCO Group CSSA-2004-006.0 2004-03-01 Trustix 2003-0042 2003-11-15 Mandrake MDKSA-2003:106 2003-11-12 Red Hat RHSA-2003:309-01 2003-11-03 Immunix IMNX-2003-7+-026-01 2003-10-31 Conectiva CLA-2003:771 2003-10-24 Conectiva CLA-2003:768 2003-10-22

Comments (none posted)

glibc - buffer overflow

Package(s):	glibc	CVE #(s):	CAN-2003-0689
Created:	October 15, 2003	Updated:	November 25, 2003
Description:	The GNU C library contains a buffer overflow in the getgrouplist() function. If the user belongs to more groups than the calling application expects, the allocated storage will be overrun.
Alerts:	Gentoo 200311-05 2003-11-22 Mandrake MDKSA-2003:107 2003-11-18 Trustix 2003-0039 2003-11-15 Red Hat RHSA-2003:325-01 2003-11-12 Conectiva CLA-2003:762 2003-10-14

Comments (none posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

gnupg: key validation

Package(s):	gnupg	CVE #(s):	CAN-2003-0255
Created:	May 16, 2003	Updated:	November 18, 2003
Description:	A key validation bug was discovered in the GNU Privacy Guard (GPG) which would cause keys with more then one user ID to trust all user ID's with the amount of trust given to the most-valid user ID.
Alerts:	SCO Group CSSA-2003-034.0 2003-11-17 Conectiva CLA-2003:694 2003-07-11 Yellow Dog YDU-20030602-4 2003-06-02 Mandrake MDKSA-2003:061 2003-05-22 Slackware ssa:2003-141-04 2003-05-22 Red Hat RHSA-2003:175-01 2003-05-20 Gentoo 200305-04 2003-05-16 OpenPKG OpenPKG-SA-2003.029 2003-05-16 EnGarde ESA-20030515-016 2003-05-15

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

hylafax: remote code execution

Package(s):	hylafax	CVE #(s):	CAN-2003-0886
Created:	November 10, 2003	Updated:	November 20, 2003
Description:	Hylafax is an Open Source fax server which allows sharing of fax equipment among computers by offering its service to clients by a protocol similar to FTP. The SuSE Security Team found a format bug condition during a code review of the hfaxd server. It allows remote attackers to execute arbitrary code as root. However, the bug can not be triggered in hylafax's default configuration. The "capi4hylafax" packages also need to be updated as a dependency where they are available. Upgrading to version 4.1.8 fixes the problem; see this advisory for details.
Alerts:	Gentoo 200311-03 2003-11-10 Debian DSA-401-1 2003-11-17 Conectiva CLA-2003:783 2003-11-12 Mandrake MDKSA-2003:105 2003-11-11 SuSE SuSE-SA:2003:045 2003-11-10

Comments (none posted)

KDE: Two issues in KDM

Package(s):	kde, xfree86	CVE #(s):	CAN-2003-0690 CAN-2003-0692
Created:	September 16, 2003	Updated:	December 19, 2003
Description:	According to this advisory two issues have been discovered in KDM: CAN-2003-0690: Privilege escalation with specific PAM modules. The XDM display manager that ships with XFree86 prior to 4.3 is also vulnerable. CAN-2003-0692: Session cookies generated by KDM are potentially insecure All versions of KDM as distributed with KDE up to and including KDE 3.1.3 are affected.
Alerts:	Mandrake MDKSA-2003:118 2003-12-19 Gentoo 200311-01 2003-11-15 Debian DSA-388-1 2003-09-19 Conectiva CLA-2003:747 2003-09-19 Mandrake MDKSA-2003:091 2003-09-16 Red Hat RHSA-2003:269-01 2003-09-16

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libnids: remotely exploitable buffer overflow

Package(s):	libnids	CVE #(s):	CAN-2003-0850
Created:	October 29, 2003	Updated:	January 6, 2004
Description:	libnids (a NIDS plugin which emulates the Linux 2.0 IP stack) contains a buffer overflow vulnerability which can be exploited remotely. Version 1.18 fixes the problem.
Alerts:	Debian DSA-410-1 2004-01-05 Gentoo 200311-07 2003-11-22 Conectiva CLA-2003:773 2003-10-29

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mpg123: heap overflow

Package(s):	mpg123	CVE #(s):	CAN-2003-0865
Created:	November 12, 2003	Updated:	February 19, 2004
Description:	Versions of mpg123 through 0.59s contain a heap overflow which may be exploited remotely (by a hostile server). See this advisory for details.
Alerts:	SCO Group CSSA-2004-002.0 2004-02-19 Debian DSA-435-1 2004-02-06 Conectiva CLA-2003:781 2003-11-12

Comments (none posted)

mplayer: remotely exploitable buffer overflow vulnerability

Package(s):	mplayer	CVE #(s):	CAN-2003-0835
Created:	September 29, 2003	Updated:	April 6, 2004
Description:	A remotely exploitable buffer overflow vulnerability was found in MPlayer. A malicious host can craft a harmful ASX header, and trick MPlayer into executing arbitrary code upon parsing that header. Read the full advisory for details.
Alerts:	Mandrake MDKSA-2004:026 2004-04-05 Gentoo 200403-13 2004-03-31 Conectiva CLA-2003:760 2003-10-06 Mandrake MDKSA-2003:097 2003-09-30 Gentoo 200309-15 2003-09-27

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

nfs-utils xlog() off-by-one bug

Package(s):	nfs-utils	CVE #(s):	CAN-2003-0252
Created:	July 14, 2003	Updated:	March 8, 2004
Description:	Linux NFS utils package contains remotely exploitable off-by-one bug. A local or remote attacker could exploit this vulnerability by sending specially crafted request to rpc.mountd daemon. See this BugTraq post for more details.
Alerts:	Trustix TSLSA-2004-0009 2004-03-05 SCO Group CSSA-2003-037.0 2003-11-17 Conectiva CLA-2003:700 2003-07-22 Mandrake MDKSA-2003:076 2003-07-21 Gentoo 200307-07 2003-07-19 Yellow Dog YDU-20030718-1 2003-07-18 Slackware SSA:2003-195-01b 2003-07-15 Immunix IMNX-2003-7+-018-01 2003-07-14 SuSE SuSE-SA:2003:031 2003-07-15 Slackware SSA:2003-195-01 2003-07-14 Debian DSA-349-1 2003-07-14 Red Hat RHSA-2003:206-01 2003-07-14

Comments (none posted)

omega-rpg: buffer overlow

Package(s):	omega-rpg	CVE #(s):	CAN-2003-0932
Created:	November 11, 2003	Updated:	November 13, 2003
Description:	Steve Kemp discovered a buffer overflow in the commandline and environment variable handling of omega-rpg, a text-based rogue-style game of dungeon exploration, which could lead a local attacker to gain unauthorized access to the group games.
Alerts:	Debian DSA-400-1 2003-11-11

Comments (none posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

postfix: denial of service vulnerabilities

Package(s):	postfix	CVE #(s):	CAN-2003-0468 CAN-2003-0540
Created:	August 5, 2003	Updated:	May 27, 2004
Description:	The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:	Mandrake MDKA-2004:028 2004-05-26 Trustix 2003-0029 2003-08-04 Mandrake MDKSA-2003:081 2003-08-04 EnGarde ESA-20030804-019 2003-08-04 Conectiva CLA-2003:717 2003-08-04 SuSE SuSE-SA:2003:033 2003-08-04 Red Hat RHSA-2003:251-01 2003-08-04 Debian DSA-363-1 2003-08-03

Comments (none posted)

postgresql: remote code execution

Package(s):	postgresql	CVE #(s):	CAN-2003-0901
Created:	October 31, 2003	Updated:	November 17, 2003
Description:	Two bugs leading to a buffer overflow in the PostgreSQL RDBMS, versions 7.2.x and 7.3.x prior to 7.3.4, were discovered. The vulnerability exists in the PostgreSQL abstract data type (ADT) to ASCII conversion functions. It has been conjectured that excessive data passed to the involved to_ascii_xxx() functions may overrun the bounds of an insufficient buffer reserved in heap memory, resulting in the corruption of heap based memory management structures that are adjacent to it. It is currently believed that under the correct circumstances an attacker may use this to execute arbitrary instructions in the context of the PostgreSQL server. The Common Vulnerabilities and Exposures (CVE) project assigned the id CAN-2003-0901 to the problem.
Alerts:	Trustix 2003-0040 2003-11-15 Conectiva CLA-2003:784 2003-11-13 Red Hat RHSA-2003:313-00 2003-11-13 OpenPKG OpenPKG-SA-2003.048 2003-11-11 Mandrake MDKSA-2003:102 2003-11-03 OpenPKG OpenPKG-SA-2003.047 2003-10-30

Comments (none posted)

proftpd: remote root shell

Package(s):	proftpd	CVE #(s):	CAN-2003-0831
Created:	September 24, 2003	Updated:	January 2, 2004
Description:	The ASCII translation mechanism in ProFTPD 1.2.8 contains a vulnerability which will provide a remote attacker with a root shell - if the attacker is able to download a specially-crafted file. See this ISS advisory for more information.
Alerts:	Mandrake MDKSA-2003:095-1 2003-12-31 Conectiva CLA-2003:750 2003-09-29 Gentoo 200309-16 2003-09-28 Trustix 2003-0037 2003-09-27 Mandrake MDKSA-2003:095 2003-09-26 OpenPKG OpenPKG-SA-2003.043 2003-09-25 Slackware SSA:2003-259-02 2003-09-23

Comments (2 posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

sane-backends: several vulnerabilities

Package(s):	sane-backends	CVE #(s):	CAN-2003-0773 CAN-2003-0774 CAN-2003-0775 CAN-2003-0776 CAN-2003-0777 CAN-2003-0778
Created:	September 11, 2003	Updated:	February 20, 2004
Description:	Alexander Hvostov, Julien Blache and Aurelien Jarno discovered several security-related problems in the sane-backends package, which contains an API library for scanners including a scanning daemon (in the package libsane) that can be remotely exploited. These problems allow a remote attacker to cause a segfault fault and/or consume arbitrary amounts of memory. The attack is successful, even if the attacker's computer isn't listed in saned.conf. You are only vulnerable if you actually run saned e.g. in xinetd or inetd. If the entries in the configuration file of xinetd or inetd respectively are commented out or do not exist, you are safe. Try "telnet localhost 6566" on the server that may run saned. If you get "connection refused" saned is not running and you are safe. The Common Vulnerabilities and Exposures project identifies the following problems: CAN-2003-0773: saned checks the identity (IP address) of the remote host only after the first communication took place (SANE_NET_INIT). So everyone can send that RPC, even if the remote host is not allowed to scan (not listed in saned.conf). CAN-2003-0774: saned lacks error checking nearly everywhere in the code. So connection drops are detected very late. If the drop of the connection isn't detected, the access to the internal wire buffer leaves the limits of the allocated memory. So random memory "after" the wire buffer is read which will be followed by a segmentation fault. CAN-2003-0775: If saned expects strings, it mallocs the memory necessary to store the complete string after it receives the size of the string. If the connection was dropped before transmitting the size, malloc will reserve an arbitrary size of memory. Depending on that size and the amount of memory available either malloc fails (->saned quits nicely) or a huge amount of memory is allocated. Swapping and OOM measures may occur depending on the kernel. CAN-2003-0776: saned doesn't check the validity of the RPC numbers it gets before getting the parameters. CAN-2003-0777: If debug messages are enabled and a connection is dropped, non-null-terminated strings may be printed and segmentation faults may occur. CAN-2003-0778: It's possible to allocate an arbitrary amount of memory on the server running saned even if the connection isn't dropped. At the moment this can not easily be fixed according to the author. Better limit the total amount of memory saned may use (ulimit).
Alerts:	SCO Group CSSA-2004-005.0 2004-02-19 SuSE SuSE-SA:2003:046 2003-11-18 Conectiva CLA-2003:769 2003-10-22 Mandrake MDKSA-2003:099 2003-10-09 Red Hat RHSA-2003:278-01 2003-10-07 Debian DSA-379-1 2003-09-11

Comments (none posted)

sendmail: remotely exploitable buffer overflow

Package(s):	sendmail	CVE #(s):	CAN-2003-0694 CAN-2003-0681
Created:	September 17, 2003	Updated:	November 18, 2003
Description:	Michal Zalewski has reported a buffer overflow in sendmail. This overflow, apparently, may be exploited remotely, but only in certain (non-default) configurations. Sendmail 8.12.10 has the fix.
Alerts:	SCO Group CSSA-2003-036.0 2003-11-17 SuSE SuSE-SA:2003:040 2003-09-20 OpenPKG OpenPKG-SA-2003.041 2003-09-19 Conectiva CLA-2003:742 2003-09-18 Yellow Dog YDU-20030917-2 2003-09-17 Immunix IMNX-2003-7+-021-01 2003-09-17 Mandrake MDKSA-2003:092 2003-09-17 Debian DSA-384-1 2003-09-17 Red Hat RHSA-2003:283-01 2003-09-17 Slackware SSA:2003-260-02 2003-09-17 Gentoo 200309-13 2003-09-17

Comments (none posted)

stunnel: signal handler reentrancy DoS

Package(s):	stunnel	CVE #(s):	CAN-2002-1563
Created:	July 25, 2003	Updated:	November 25, 2003
Description:	Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over a secure connection (encrypted using SSL or TLS) or to provide a secure means of connecting to services that do not natively support encryption. When configured to listen for incoming connections (instead of being invoked by xinetd), stunnel can be configured to either start a thread or a child process to handle each new connection. If Stunnel is configured to start a new child process to handle each connection, it will receive a SIGCHLD signal when that child exits. Stunnel versions prior to 4.04 would perform tasks in the SIGCHLD signal handler which, if interrupted by another SIGCHLD signal, could be unsafe. This could lead to a denial of service.
Alerts:	Red Hat RHSA-2003:296-01 2003-11-24 SCO Group CSSA-2003-026.0 2003-10-03 Conectiva CLA-2003:736 2003-09-05 Trustix 2003-0030 2003-08-07 EnGarde ESA-20030806-020 2003-08-06 Red Hat RHSA-2003:221-01 2003-07-25

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

unzip: directory traversal vulnerability

Package(s):	unzip	CVE #(s):	CAN-2003-0282
Created:	July 1, 2003	Updated:	November 13, 2003
Description:	A vulnerabilitiy in unzip version 5.50 and earlier allows attackers to overwrite arbitrary files during archive extraction by placing invalid (non-printable) characters between two "." characters. These non-printable characters are filtered, resulting in a ".." sequence. See the full advisory for further information.
Alerts:	SCO Group CSSA-2003-031.0 2003-11-07 Debian DSA-344-2 2003-08-26 Slackware SSA:2003-237-01 2003-08-25 Mandrake MDKSA-2003:073-1 2003-08-19 Conectiva CLA-2003:724 2003-08-18 Red Hat RHSA-2003:199-02 2003-08-15 Yellow Dog YDU-20030710-1 2003-07-10 Gentoo 200307-02 2003-07-11 OpenPKG OpenPKG-SA-2003.033 2003-07-10 Debian DSA-344-1 2003-07-08 Mandrake MDKSA-2003:073 2003-07-07 Conectiva CLA-2003:672 2003-07-02 Immunix IMNX-2003-7+-017-01 2003-07-02 Red Hat RHSA-2003:199-01 2003-07-01

Comments (none posted)

vim - modeline vulnerability

Package(s):	vim	CVE #(s):	CAN-2002-1377
Created:	January 16, 2003	Updated:	February 10, 2004
Description:	VIM allows a user to set the modeline differently for each edited text file by placing special comments in the files. Georgi Guninski found that these comments can be carefully crafted in order to call external programs. This could allow an attacker to create a text file such that when it is opened arbitrary commands are executed.
Alerts:	Conectiva CLA-2004:812 2004-02-10 Mandrake MDKSA-2003:012 2003-02-03 Yellow Dog YDU-20030127-3 2003-01-27 Gentoo 200301-13 2003-01-22 OpenPKG OpenPKG-SA-2003.003 2003-01-21 Red Hat RHSA-2002:297-17 2003-01-15

Comments (4 posted)

webmin: session ID spoofing

Package(s):	webmin	CVE #(s):	CAN-2003-0101
Created:	June 13, 2003	Updated:	November 18, 2003
Description:	miniserv.pl in the webmin package does not properly handle metacharacters, such as line feeds and carriage returns, in Base64-encoded strings used in Basic authentication. This vulnerability allows remote attackers to spoof a session ID, and thereby gain root privileges.
Alerts:	SCO Group CSSA-2003-035.0 2003-11-17 Debian DSA-319-1 2003-06-12

Comments (none posted)

wget: buffer overflow

Package(s):	wget	CVE #(s):	CAN-2003-1565
Created:	August 5, 2003	Updated:	December 10, 2003
Description:	The wget utility contains a buffer overflow which, when exploited with an over-long URL, can enable arbitrary code execution.
Alerts:	Red Hat RHSA-2003:372-01 2003-12-10 SCO Group CSSA-2003-025.0 2003-10-03 Conectiva CLA-2003:716 2003-08-04

Comments (1 posted)

XFree86 4.3.0 integer overflows in font libraries

Package(s):	XFree86	CVE #(s):	CAN-2003-0730
Created:	September 12, 2003	Updated:	November 25, 2003
Description:	Several vulnerabilities were discovered by blexim(at)hush.com in the font libraries of XFree86 version 4.3.0 and earlier. These bugs could potentially lead to execution of arbitrary code or a DoS by a remote user in any way that calls these functions, which are related to the transfer and enumeration of fonts from font servers to clients. See the advisory for additional details.
Alerts:	Red Hat RHSA-2003:286-01 2003-11-25 Red Hat RHSA-2003:287-01 2003-11-25 Red Hat RHSA-2003:288-01 2003-11-17 Debian DSA-380-1 2003-09-12 Mandrake MDKSA-2003:089 2003-09-11

Comments (none posted)

xinetd: Memory leak in xinetd 2.3.10

Package(s):	xinetd	CVE #(s):	CAN-2003-0211
Created:	May 13, 2003	Updated:	November 13, 2003
Description:	Xinetd is a 'master server' that is used to to accept service connection requests and start the appropriate servers. Because of a programming error, memory was allocated and never freed if a connection was refused for any reason. An attacker could exploit this flaw to crash the xinetd server, rendering all services it controls unavailable. In addition, other flaws in xinetd could cause incorrect operation in certain unusual server configurations. All users of xinetd are advised to update to xinetd-2.3.11 which is not vulnerable to these issues.
Alerts:	Conectiva CLA-2003:782 2003-11-12 Yellow Dog YDU-20030602-1 2003-06-02 Gentoo 200305-08 2003-05-19 Mandrake MDKSA-2003:056 2003-05-14 Red Hat RHSA-2003:160-01 2003-05-13

Comments (none posted)

Resources

November CRYPTO-GRAM newsletter

Bruce Schneier's CRYPTO-GRAM newsletter for November is out, with a look at airline security and the "trojan defense." "Some believe that the 'Trojan defense' sets a dangerous precedent, and that computer criminals will claim it every time. I believe that it sets a very good precedent, and will force prosecutors to do more than show that a particular computer was involved in a crime."

Full Story (comments: 4)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current development kernel is 2.6.0-test9, which was released almost a full month ago now. Fixes continue to trickle slowly into Linus's BitKeeper tree, however.

The current stable kernel is 2.4.22, but not for much longer. Marcelo has turned loose the second 2.4.23 release candidate which, he hopes, will be the final one.

Comments (none posted)

Kernel development news

2.6 patch policy

Anybody who has been following Linus's BitKeeper tree knows that very few patches have gone in recently. Linus is doing his best to restrict things to only the most important fixes. As a result, one might get the impression that 2.6 development has stalled. Development continues, of course, and bug fixes are being produced, but most of that work is not getting into the tree in the interests of getting a highly stable 2.6.0 release out.

Linus explains his policy this way:

This policy makes some sense; it should quiet the waters enough to help the developers find most of the final serious problems in 2.6.0. The only problem, though, is that there is an increasingly large pile of patches which will have to go in after 2.6.0. As a way of thinking about what happens then, consider what Linus said almost three years ago, when 2.4.0 came out:

To an extent, things have to be opened up a bit after the 2.6.0 release. The wider testing that the "dot-zero" release gets is certain to turn up new bugs that will need fixing. And a number of the fixes out there do need to go in before 2.6 can be deployed in a lot of production situations. So chances are good that the usual pattern will be followed; things will destabilize a little before 2.6 is truly ready for wider use. That, perhaps, is simply the way kernels have to be made.

Comments (11 posted)

What remains to be done

The "must fix" and "should fix" lists which were frequently posted some months ago have been keeping a low profile recently. They do still exist, however, and some effort has gone into keeping them up to date. The latest version is bundled with Andrew Morton's -mm patches. For the curious, here are the must-fix and should-fix lists from 2.6.0-test9-mm4.

The must-fix remains surprisingly long, given that 2.6.0 is considered to be right around the corner. It includes (among many other items):

• A lot of locking problems in the tty, parport, PCMCIA, SCSI, and input drivers.

• Expanding dev_t to 64 bits is there, though the list acknowledges that the current 32-bit size will be enough for 2.6.0. Reaching 64 bits will require additional work with certain filesystems (such as older NFS protocols) which are not prepared for it.

• The char device rework remains incomplete, though it is in a functioning state now. It would not be surprising to see some changes in the char device API early in 2.6.x. Such things cause endless annoyance to people trying to write driver books.

• There are still fixes from the 2.4 tree - including security fixes - which must be ported to 2.6. Alan Cox surfaced from his studies long enough to note that this work is currently being done.

• The "misc device" interface is marked for removal, since the new char device interface does all the same stuff. That change seems unlikely for 2.6.x, however.

• Asynchronous I/O remains a work in progress. It has a number of potentially lethal race conditions, and fairly straightforward things (regular file I/O, for example) are not fully implemented. The -mm tree contains a lot of AIO patches which should move over at some point, but they clearly not the "one line fixes" that Linus is looking for currently.

• Scheduler interactivity remains on the list, though the level of complaining is lower than it used to be.

The "should-fix" list is even longer. It includes more IDE driver work, various device mapper cleanups, the incorporation of a number of wireless driver patches, the kexec patch (booting one kernel directly from another), merging klibc (for initramfs images), MPLS support for IPSec, sorting out the three-way software suspend disagreement, a kernel interface for reporting errors to user space, improving the external module build process, and numerous other things.

This list also still includes fixing module initialization races by not enabling calls into the module until initialization is complete. With the new module loading infrastructure, this change is an easy one to make. The only problem is that it breaks certain things (like disk drivers, where the kernel attempts to read the partition table when a disk is registered with the system). These problems can be worked around, but there appears to be little will to do so at this time.

No kernel will ever be perfect when it is released - making one perfect would take so long that the kernel would no longer be relevant. Even so, these lists are still long. Expect a bit of churn in the early 2.6.x releases as the developers work at shortening them.

Comments (2 posted)

Driver porting

News from the Driver Porting series

The updating of the Driver Porting Series is almost complete; as of this writing, only the device model articles need to be done (they will take a bit of work). The following article is another rerun, but it has seen enough changes to be worth another pass. The "simple block driver" is even simpler now; it is significantly shorter (less than 200 lines), but it implements a fully functional, partitionable block device.

Comments (none posted)

A simple block driver

This article is part of the LWN Porting Drivers to 2.6 series.

Given the large number of changes to the 2.6 block layer, it is hard to know where to start describing them. We'll begin by examining the simplest possible block driver. The sbd ("simple block device") driver simulates a block device with a region of kernel memory; it is, essentially, a naive ramdisk driver implemented in less than 200 lines of code. It will allow the demonstration of some changes in how block drivers work with the rest of the system without the need for all the complexity required when one is dealing with real hardware. Code fragments will be shown below; the full driver source can be found on this page.

If you have not read the block layer overview, you might want to head over there for a moment; this article will still be here when you get back.

Initialization

In our simple driver, the module initialization function is called sbd_init(). Its job, of course, is to get set up for block operations and to make its disk available to the system. The first step is to set up our internal data structure; within the driver a disk (the disk, in this case) is represented by:

	static struct sbd_device {
	    unsigned long size;
	    spinlock_t lock;
	    u8 *data;
	    struct gendisk *gd;
	} Device;

Here size is the size of the device (in bytes), data is the array where the "disk" stores its data, lock is a spinlock for mutual exclusion, and gd is the kernel representation of our device.

The device initialization is pretty straightforward; it is just a matter of allocating the memory to actually store the data and initializing the spinlock:

    Device.size = nsectors*hardsect_size;
    spin_lock_init(&Device.lock);
    Device.data = vmalloc(Device.size);
    if (Device.data == NULL)
	return -ENOMEM;

(nsectors and hardsect_size are load-time parameters that control how big the device should be).

About now is where block drivers traditionally register themselves with the kernel, and sbd does that too:

    major_num = register_blkdev(major_num, "sbd");
    if (major_num <= 0) {
	printk(KERN_WARNING "sbd: unable to get major number\n");
	goto out;
    }

Note that, in 2.6, no device operations structure is passed to register_blkdev(). As it turns out, a block driver can happily get by without calling register_blkdev() at all. That function does little work, at this point, and will likely be removed sooner or later. About the only remaining tasks performed by register_blkdev() are the assignment of a dynamic major number (if requested), and causing the block driver to show up in /proc/devices.

Generic disks

If register_blkdev() no longer does anything, where does the real work get done? The answer lies in the much improved 2.6 "generic disk" (or "gendisk") code. The gendisk interface is covered in a separate article, so we'll look only quickly at how sbd does its gendisk setup.

The first step is to get a gendisk structure to represent the sbd device:

    Device.gd = alloc_disk(16);
    if (! Device.gd)
	goto out_unregister;

Note that a memory allocation is involved, so the return value should be checked. The parameter to alloc_disk() indicates the number of minor numbers that should be dedicated to this device. We have requested 16 minor numbers, meaning that the device will support 15 partitions.

The gendisk must be initialized; the sbd driver starts that task as follows:

    Device.gd->major = major_num;
    Device.gd->first_minor = 0;
    Device.gd->fops = &sbd_ops;
    Device.gd->private_data = &Device;
    strcpy (Device.gd->disk_name, "sbd0");
    set_capacity(Device.gd, nsectors*(hardsect_size/KERNEL_SECTOR_SIZE));

Most of the above should be relatively self-explanatory. The fops field is a pointer to the block_device_operations structure for this device; we'll get to that shortly. The private_data field can be used by the driver, so we stick a pointer to our sbd_device structure there. The set_capacity() call tells the kernel how large the device is. Note that the kernel can handle block devices which have sectors greater than 512 bytes, but it always deals with 512-byte sectors internally. So we need to normalize the sector count before passing it to the kernel.

Another thing that (usually) goes into the gendisk is the request queue to use. The BLK_DEFAULT_QUEUE macro from 2.4 is no more; a block driver must explicitly create and set up the request queue(s) it will use. Furthermore, request queues must be allocated dynamicly, at run time. The sbd driver sets up its request queue as follows:

    static struct request_queue *Queue;
    /* ... */
    Queue = blk_init_queue(sbd_request, &Device.lock);
    if (Queue == NULL)
	    goto out;
    blk_queue_hardsect_size(Queue, hardsect_size);
    Device.gd->queue = Queue;

Here, sbd_request is the request function, which we will get to soon. Note that a spinlock must be passed into blk_init_queue(). The global io_request_lock is gone forevermore, and each block driver must manage its own locking. Typically, the lock used by the driver to serialize access to internal resources is the best choice for controlling access to the request queue as well. For that reason, the block layer expects the driver to provide a lock of its own for the queue. If a nonstandard hard sector size (i.e. not 512 bytes) is in use, the sector size should be stored into the request queue with blk_queue_hardsect_size(). Finally, a pointer to the queue must be stored in the gendisk structure.

At this point, the gendisk setup is complete. All that remains is to add the disk to the system:

    add_disk(Device.gd);

Note that add_disk() may well generate I/O to the device before it returns - the driver must be in a state where it can handle requests before adding disks. The driver also should not fail initialization after it has successfully added a disk.

What you don't have to do

That is the end of the initialization process for the sbd driver. What you don't have to do is as notable as what does need to be done. For example, there are no assignments to global arrays; the whole set of global variables that used to describe block devices is gone. There is also nothing here for dealing with partition setup. Partition handling is now done in the generic block layer, and there is almost nothing that individual drivers must do at this point. "Almost" because the driver must handle one ioctl() call, as described below.

Open and release

The open and release methods (which are kept in the block_device_operations structure) actually have not changed since 2.4. The sbd driver has nothing to do at open or release time, so it doesn't even bother to define these methods. Drivers for real hardware may need to lock and unlock doors, check for media, etc. in these methods.

The request method

The core of a block driver, of course, is its request method. The sbd driver has the simplest possible request function; it does not concern itself with things like request clustering, barriers, etc. It does not understand the new bio structure used to represent requests at all. But it works. Real drivers will almost certainly require a more serious request method; see the other Driver Porting Series articles for the gory details on how to do that.

Here is the whole thing:

    static void sbd_request(request_queue_t *q)
    {
        struct request *req;
    
        while ((req = elv_next_request(q)) != NULL) {
            if (! blk_fs_request(req)) {
                end_request(req, 0);
                continue;
            }
            sbd_transfer(&Device, req->sector, req->current_nr_sectors,
                            req->buffer, rq_data_dir(req));
            end_request(req, 1);
        }
    }

The first thing to notice is that all of the old <linux/blk.h> cruft has been removed. Macros like INIT_REQUEST (with its hidden return statement), CURRENT, and QUEUE_EMPTY are gone. It is now necessary to deal with the request queue functions directly, but, as can be seen, that is not particularly hard.

Note that the Device.lock will be held on entry to the request function, much like io_request_lock is in 2.4.

The function for getting the first request in the queue is now elv_next_request(). A NULL return means that there are no more requests on the queue that are ready to process. A simple request loop like this one can simply run until the request queue is empty; drivers for real hardware will also have to take into account how many operations the device can handle, of course. Note that this function does not actually remove the request from the queue; it just returns a properly adjusted view of the top request.

Note also that, in 2.6, there can be multiple types of requests. Thus the test:

	if (! blk_fs_request(req)) {
	    end_request(req, 0);
	    continue;
	}

A nonzero return value from the blk_fs_request() macro says "this is a normal filesystem request." Other types of requests (i.e. packet-mode or device-specific diagnostic operations) are not something that sbd supports, so it simply fails any such requests.

The function sbd_transfer() is really just a memcpy() with some checking; see the full source if you are interested. The key is in the parameters: the various fields of the request structure (sector, current_nr_sectors, and buffer) look just like they did in 2.4. They also have the same meaning: they are a window looking at the first part of a (possibly larger) request. If you deal with block requests at this level, you need know nothing of the bio structures underlying the request. This approach only works for the simplest of drivers, however.

Note that the direction of the request is now found in the flags field, and can be tested with rq_data_dir(). A nonzero value (WRITE) indicates that this is a write request. Note also the absence of any code adding partition offsets; all of that is handled in the higher layers.

Finally, end_request() is called to finish processing of this request. This function has picked up a new parameter in 2.6, being the pointer to the request structure.

Other block operations

The two other block_device_operations methods from 2.4 - check_media_change() and revalidate() - have seen prototype changes in 2.5. They are now called media_changed() and revalidate_disk(), and both take a gendisk structure as their only argument. The basic task performed by these methods remains unchanged, however.

In 2.4, a block driver's ioctl() method would handle any commands it understood, and pass the rest on to blk_ioctl() for generic processing. In 2.6, the generic code gets the first crack at any ioctl() calls, and only invokes the driver for those it can't implement itself. As a result, ioctl() methods in drivers can often be pretty small. The sbd driver includes an ioctl method which handles a single command:

    int sbd_ioctl (struct inode *inode, struct file *filp,
                   unsigned int cmd, unsigned long arg)
    {
	long size;
	struct hd_geometry geo;

	switch(cmd) {
	/*
	 * The only command we need to interpret is HDIO_GETGEO, since
	 * we can't partition the drive otherwise.  We have no real
	 * geometry, of course, so make something up.
	 */
	    case HDIO_GETGEO:
		size = Device.size*(hardsect_size/KERNEL_SECTOR_SIZE);
		geo.cylinders = (size & ~0x3f) >> 6;
		geo.heads = 4;
		geo.sectors = 16;
		geo.start = 4;
		if (copy_to_user((void *) arg, &geo, sizeof(geo)))
			return -EFAULT;
		return 0;
        }
        return -ENOTTY; /* unknown command */
    }

The notion of a regular geometry has been fiction for most devices for some years now. Tools like fdisk still work with cylinders, however, so a driver must make up some sort of convincing geometry story. The sbd implementation claims four heads and 16 sectors per cylinder, but anything else reasonable would have worked as well.

Shutting down

The last thing to look at is what happens when the module is unloaded. We must, of course, clean up our various data structures and free memory - the usual stuff. The sbd cleanup function looks like this:

    static void __exit sbd_exit(void)
    {
        del_gendisk(Device.gd);
        put_disk(Device.gd);
        unregister_blkdev(major_num, "sbd");
        blk_cleanup_queue(Queue);
        vfree(Device.data);
    }

del_gendisk() cleans up any partitioning information, and generally makes the system forget about the gendisk passed to it. The call to put_disk() then releases our reference to the gendisk structure (obtained when we first called alloc_disk()) so that it can be freed. Then, of course, we must free the memory used for the device itself (only after the gendisk has been cleaned up, so we know no more operations can be requested), release the request queue, and unregister the block device.

Conclusion

That is about as simple as it gets; the above implements a true virtual block device that can support a filesystem. Real drivers, of course, will tend to be more complicated. For details on how to make them more complicated, continue with the Driver Porting Series; the next block driver article is The Gendisk Interface.

Comments (8 posted)

Patches and updates

Kernel trees

• Andrew Morton: 2.6.0-test9-mm3. (November 13, 2003)

• Andrew Morton: 2.6.0-test9-mm4. (November 19, 2003)

• Marcelo Tosatti: Linux 2.4.23-rc2. (November 19, 2003)

Core kernel code

• Nick Piggin: Nick's scheduler v19. (November 17, 2003)

• Nick Piggin: Nick's scheduler v19a. (November 17, 2003)

• Con Kolivas: Hyper-thread aware batch scheduling 2.6.0-test9. (November 17, 2003)

• Jonathan Corbet: seq_file version of /proc/interrupts. (November 13, 2003)

• Krzysztof Benedyczak: POSIX message queues - syscalls & SIGEV_THREAD. (November 17, 2003)

• Frederic Rossi: AEM [Asynchronous Event Mechanism] v0.5, linux-2.6.0-test1 and linux-2.6.0-test9. (November 19, 2003)

Development tools

• sugita: LKST v2.0.0 is released (Kernel v2.6.0-test9). (November 14, 2003)

• Alex Tomas: use-after-free hunter. (November 19, 2003)

Device drivers

• Bartlomiej Zolnierkiewicz: ide-tape update for 2.6 (Was: PATCH: gets ide-tape working on 2.6). (November 13, 2003)

• Jeff Garzik: 2.5.x experimental net driver patches. (November 14, 2003)

• Jeff Garzik: (updated] 2.6.x experimental net driver queue. (November 17, 2003)

• Carl-Daniel Hailfinger: forcedeth: version 0.17 available. (November 17, 2003)

• Pontus Fuchs: Announce: ndiswrapper. (November 18, 2003)

• James Bottomley: Updated state model for SCSI devices. (November 19, 2003)

• Stephen Hemminger: 8139too NAPI for net-drivers-2.5-exp. (November 19, 2003)

• Takashi Iwai: [ANN] ALSA 1.0.0pre1 is released. (November 19, 2003)

Documentation

• Andries.Brouwer@cwi.nl: man-pages-1.61. (November 13, 2003)

• Xose Vazquez Perez: state of scsi drivers. (November 17, 2003)

• Will Dyson: Add lib/parser.c kernel-doc. (November 19, 2003)

Filesystems and block I/O

• Alex Zarochentsev: new reiser4 snapshot is available. (November 14, 2003)

Networking

• Martijn van Oosterhout: First release of kernel L2TP support. (November 19, 2003)

Miscellaneous

• Greg KH: udev 006 release. (November 19, 2003)

Page editor: Jonathan Corbet

Distributions

News and Editorials

The Success of Gentoo

Gentoo Linux is one of the most remarkable success stories of this year. At the time when more and more new Linux distribution are clamoring for our attention, it is very hard for most of them to attract new users, let alone break into the top league. Yet, Gentoo has done it. It has become one of the most widely used distributions in a very short time.

But don't take our word for it, let some of these figures illustrate the success. Gentoo has one of the most active user forums with over 34,000 registered users who have posted close to 650,000 messages over the last 19 months. On average, nearly 60 new users join the forums every day. Besides forums, Gentoo also provides 36 mailing lists, 10 of which are for non-English speakers. The sizable Gentoo Weekly Newsletter is now translated into 12 languages, including Japanese, Russian and Turkish. Many Gentoo-oriented community web sites sprouted around the globe - from China to Sweden. And the number of Gentoo packages (or ebuilds) in the stable repository has now risen to over 4,700.

What has Gentoo done right to become such a runaway success? Let's look at some of the factors.

Originality. There is no denying that Gentoo has come up with an interesting idea. At the time of increasing availability of fast Internet connections and more powerful CPUs, downloading source codes and compiling them locally is no longer as painful as it once was. Although the concept wasn't new, there is no denying that many Linux users found Gentoo refreshingly different from the mainstream Linux distributions, especially in terms of user control over most aspects of the operating system as well as software optimization.

Persistence. While Gentoo is often seen as a new distribution, its actual development began in early 1999 under the name of Enoch Linux. In "Making the distribution" (part 1, part 2, part 3), Gentoo's creator Daniel Robbins reveals how he started with Linux, how he became a Stampede Linux developer and how he eventually left to start his own distribution. He also mentions his brief encounter with FreeBSD (and its "ports", which later formed the basis of "Portage") and reasons for his return to Linux: "FreeBSD was a peaceful home, but a little too boring, too staid. Linux is where the action was, where major progress was being made. There's no doubt that if you're looking for excitement and innovation, Linux is the place to be." But the fact that Gentoo Linux will soon be 5 years old serves as a reminder that its current fame was preceded by many years of hard, persistent and often thankless work.

Packages. For many users, one of the main attractions of Gentoo is the almost instantaneous availability of new package versions as they are released by their upstream developers. "I just love Portage" is a phrase often heard on public forums. Portage, written in Python, is the Gentoo package management system with many convenient features. The most essential among its commands is "emerge", which has the ability to download, unpack, configure, compile and install a given package in one swoop. Portage also supports OpenBSD-style "fake" installs, safe removal, system profiles, package masking, it has an elaborate dependency system and many other features.

Documentation. Gentoo has some of the best documentation of any Linux distribution. It is written in a style that is easily understandable by all users, irrespective of their skill levels, with detailed, step-by-step instructions and explanations. Color highlighting and additional notes help to keep the text from becoming too tedious and dull. It is fair to say that installing Gentoo is one of the best and most effective ways to learn about Linux internals and system administration, hands-on.

Community. Interacting with the user community is a critical factor contributing to a success or a failure of a Linux distribution, yet sadly, many tend to underestimate it. Not Gentoo. They provide both mailing lists and user forums, as well as a regular weekly newsletter full of useful information about the latest happenings in the development of Gentoo, developer profiles, wealth of practical tips and tricks and other topics of interest. Contrast that to newsletters published by some of the commercial Linux distributions offering little valuable information beyond urging subscribers to join the club, visit the online store or enroll for a certification program.

Although other factors, such as availability of Gentoo for many different platforms or surprise releases of live game CDs have also contributed to a certain degree, the above points illustrate why Gentoo has become one of the most popular and fastest growing Linux distributions ever. An amazing achievement by any standard, but even more so in case of a non-commercial project relying mostly on volunteer effort. No, this success did not come without a considerable amount of hard work, but in the end it was certainly worth it.

Comments (23 posted)

Distribution News

Debian GNU/Linux

The November 18 issue of the Debian Weekly News is out; this one looks Bruce Perens's desktop Debian proposal, package caching, Impi Linux, progress toward the 3.1 release, and several other topics.

Martin Schulze provides an update on the progress of Debian GNU/Linux 3.0r2.

Debian Planet points to a step by step walkthrough of the new Debian installer (on LinMagAU).

Also found on Debian Planet, this woody backports collection where you can find newer software for your stable system.

Comments (none posted)

Gentoo Weekly Newsletter - Volume 2, Issue 46

The Gentoo Weekly Newsletter for the week of November 17, 2003 is out. This week Gentoo announces the new packages.gentoo.org; Gentoo-BSD looks for someone to port Portage's sandbox code to the *BSDs; and more.

Full Story (comments: none)

Mandrake Linux

Mandrake Linux 9.2 ISO images are available for download at a mirror near you. Visit this link to find out more.

Here are this week's bug fix advisories for Mandrake Linux 9.2:

• OpenDX: dx does not start properly
• totem: may crash when attempting to retrieve CDDB information while playing an audio CD
• SnortSnarf: this update fixes dependency problems.
• drakxtools: multiple bugs squashed
• gawk: segfault when character class and locale is not "C".
• nss_ldap: package improperly built against db1 rather than db4.
• rpm: database locking bug may cause menu loss.

Comments (none posted)

Fedora Core

Here are some updates for Fedora Core 1:

• strace 4.5.1: revert bogus s390 fix & rebuilt for 2.1AS erratum.
• vnc 4.0: a problem in the VNC server causes VNC clients to stop displaying updates.
• mozilla 1.4.1: may crash on sites with Japanese text.

Comments (none posted)

Slackware Linux

This week at slackware-current you will find Python 2.3.2, some fixes to Brazilian timezones in glibc, Koffice 1.2.94, gcc-3.3.2 now in slackware/d/, and more.

Comments (none posted)

Linux use in Norwegian schools

Here is an article about Skolelinux for Scandinavian language readers. English readers can click below to get a summary translation. (Thanks to Morten Sickel)

Full Story (comments: 1)

Correction: Xandros Announces Desktop 2.0 Linux

Xandros has corrected last week's press release. "Correction: Xandros is based on the "Sarge" version of Debian GNU/Linux and not on Debian Linux 4.0 as said in the original announcement." Most of us already knew that.

Full Story (comments: 1)

New Distributions

White Box Linux

White Box Linux is an effort to rebuild Red Hat's Enterprise product from source, including only Free/Open source software. The first set of Release Candidate ISO images are available for download now.

Full Story (comments: none)

Minor distribution updates

2-Disk Xwindow embedded Linux

2-Disk Xwindow embedded Linux has released 1disk v1.2.3 with major feature enhancements. "This release adds RTF 12312 compliance, menu system enhancements, and desktop wallpaper. Many browser bugs have been fixed. The graphical login system has been updated. There is LSB subset compliance and speed improvements in boot time."

Comments (none posted)

ADIOS

The ADIOS project has released v2.00. "This version updates Linux and adds more boot and run options."

Comments (none posted)

Damn Small Linux

Damn Small Linux has released v0.5 with minor feature enhancements. "A local .xinitrc, a save/restore user settings menu option, a boot time "restore" option (type "knoppix restore" at boot), and the mount.app program now recognizes the USB drive. Firebird now runs as the user damnsmall. sqlite has been added. ispell and flwriter have been replaced with Ted-gtk with US English spell check. The removed option to set the frequency didn't work quite right and has been removed. An option to set the DPI has been added."

Comments (none posted)

Familiar

Familiar version 0.7.2 has been released. This release includes 'pypak' which allows programmers to write Python GUI applications on their handheld. Click below for more information.

Full Story (comments: none)

GNOPPIX

GNOPPIX has released v0.6.0-beta3 with major feature enhancements. "This version comes with woody backports of GNOME 2.4, updates, and a number of improvements."

Comments (none posted)

KNOPPIX

KNOPPIX has released v3.3-2003-11-14 with minor feature enhancements. "The Euro symbol works again in konsole, but font scanning at startup is slow (fontconfig?). This release adds a bittorrent ncurses client and an ALSA package update. The "knoppix testcd" option is now more verbose. The default timings in monitor detection have changed. This may give better results with DDC-capable monitors, but you will probably have to use "knoppix vsync=60" for non-DDC-capable TFT displays. There have been the usual bunch of Debian package updates."

Comments (2 posted)

PXES Linux Thin Client

PXES Linux Thin Client has released v0.7-1 with major feature enhancements. "This release tries to solve two of the most recurring problems. It has access to a monitors database for autodection. In the case of errors in connecting to the server, also known as the Gray Xcreen of Death, this release tries to identify the problem and inform the user. rdesktop 1.3.0 is included with support for 24-bit color when connected to a W2K3 server and sound redirection. Local sessions have been improved. There is a configuration program and much more."

Comments (none posted)

Rock Linux

Rock Linux has released v2.0.0-rc2 with major feature enhancements. "This release includes an improved package selection (including a minimal+Xfree86 template), improved kernel config generation, other build system improvements, various gcc 3 fixes, many non-x86 (e.g. PowerPC, Alpha, and SPARC) fixes, installer RAM filesystem cleanup, and space optimizations. Many package updates including various KDE and GNOME packages, linux-drm, dietlibc (and all the package conformance patches needed), and Samba 3.0 have been performed, and many new packages have been added, including more fonts."

Comments (none posted)

RUNT

RUNT has released v3.0 with major feature enhancements. "This release is based on Slackware 9.1, and includes kernel 2.4.22. It includes iptraf (for network monitoring), iptables, and CD/DVD writing tools. SCSI controllers are now supported through hotplug. memtest was removed due to increased kernel size, but can still be run if booting directly off the USB drive."

Comments (none posted)

Trustix Secure Linux

Tawie Server Linux and the old Trustix Secure Linux have now been merged into a new distribution called Trustix Secure Linux. TSL Bugfix Advisory #2003-0043 (click below) shows the last packages have been updated to reflect the return of the original name.

Full Story (comments: none)

Distribution reviews

Review: SuSE Linux 9 (NewsForge)

NewsForge reviews SuSE Linux 9 Professional edition. "SuSE 9 is basically a big update to all the software packages that it comes with. This release adds a few new features to the OS, such as auto login, NTFS resizing, system recovery, and more documentation. But it also fails to solve some problems that were in 8.2, such as a conflict between Glib 2 and GTK 2, which meant I couldn't compile Gaim and some other programs. I would have liked to have seen such more support for DivX and Xvid codecs, so that I could play more videos without having to download codecs from the Internet. However, all in all, SuSE 9 is a nice improvement on what we have come to expect from SuSE."

Comments (33 posted)

Review: Fedora Core 1 is a Mild Disappointment (OSNews)

OSNews reviews Fedora Core 1. "Fedora Core comes with Gnome 2.4.0 (plus some 2.4.0.1 updated packages), Mozilla 1.4.1, Gaim 0.71, OOo 1.1, XMMS 1.2.8, KOffice, Gimp 1.2.x, gThumb 2.0.2 (pretty outdated version), Epiphany 1.0.4 and many hundreds of other packages. The distro includes most of what users would need for their home usage: Internet applications, office apps, games, some multimedia support, easy administration for most things via Red Hat's preference panels." (Thanks to lon jones)

Comments (2 posted)

Page editor: Rebecca Sobol

Development

The Dasher Project

The Dasher Project is working on a new type of computer interface, with the goal of replacing the traditional keyboard as a text input device. According to the project summary:

Dasher is designed for use on palmtops and wearable computers. It supports one-handed and hands-free operation. One-handed input may be performed via a conventional pointing device such as a mouse, joystick, or touch screen. Hands-free operation involves the use of a head-mouse or eye-tracker.

The Dasher documentation includes a three page explanation on the use of the software. Operation looks a bit like running a video game, a few example movies of Dasher in operation are included, they illustrate the use of Dasher nicely.

The Tips for Novices section compares the input method to driving a car:

The intended audience for Dasher is for people with disabilities, the software could also be useful to a wider audience. Decent typing speeds can apparently be achieved fairly quickly:

This looks like fun and useful software.

Version 3.2.0 of Dasher has been announced. "This version is the first release of the new stable branch, and is aimed at the GNOME 2.4 and 2.5 desktops (but will continue to work happily under 2.2). New features include integration with the GNOME accessibility framework and gnome-speech, and the ability to enter text directly into other applications."

Dasher is a cross-platform project, the code is available here.

Comments (3 posted)

System Applications

Audio Projects

Alsa 1.0.0pre1 available

Version 1.0.0pre1 of the development version of the Alsa sound driver is available. "This release is intended for wide testing."

Comments (none posted)

JACK 0.90.0 Released

Version 0.90.0 of the JACK Audio Connection Kit is out. "Buffers can resize during operation. This can be triggered by the user or by the function jack_set_buffer_size(). See the documentation for details. It is new code and still needs a shakedown."

Full Story (comments: none)

Database Software

PostgreSQL 7.4 Released

The PostgreSQL Global Development Group (PGDG) has announced the availability of version 7.4 of the PostgreSQL Object Relational Database Management System (ORDBMS). Version 7.4 includes a host of new features, including AMD Opteron optimization, improved index maintenance tools, and enhanced support of full text indexing which adds ranked result sets.

Full Story (comments: 2)

PostgreSQL Weekly News

The PostgreSQL Weekly News for November 14, 2003 is out with more PostgreSQL database news.

Full Story (comments: none)

Python Database Objects (PDO) 1.2.0 Released

Version 1.2.0 of Python Database Objects is out. "This new release adds support for the cx_Oracle, DB2 and adodbapi modules, allowing users to use PDO with a variety of database systems. 9 different DBAPI modules are now supported, allowing for PDO to be used with almost any RDBMS. Additional features, such as query parameters, have also been added in this release, as well as the usual bug-fixes."

Full Story (comments: none)

Quick and Dirty RDBMS Tuning (O'ReillyNet)

Steven Hauser writes about database tuning on O'Reilly. "You'd like to tune your database, but don't have much time. The point of this article is to find quick and effective results, not the optimum effect. Application design is not covered in detail. Here is how to tune with the least effort."

Comments (none posted)

Mail Software

milter-sender 0.43 released

Version 0.43 of milter/sender, a spam filtering application, has been announced. "This is a quick follow-up release to address some non-portable issues with the previous release that affected Solaris types. I also took the oppurtunity to fix Dns lookups to use one UDP socket for many DNS servers, which reduces the number of file descriptors required by the milter; also implement the AnyMX: access database tag, which allows for -A behaviour on selected domains without having to specify -A."

Comments (none posted)

Web Site Development

Enterprise Application Integration using Apache Cocoon 2.1 (O'Reilly)

Tony Culshaw works with Apache Cocoon on O'Reilly. "Apache Cocoon has typically been categorized as a web publishing framework, but since the release of version 2.1 is has started to look more like an XML application server. I've just completed a project with a travel company to build a web-based travel agency desktop which integrates several common backend systems. These systems are ones that a typical agent would use in day to day business and were chosen to demonstrate a variety of integration techniques. In this article I outline how Cocoon 2.1 was the key to building this product, including both advantages and disadvantages."

Comments (none posted)

QueryParser Rules (O'Reilly)

Erik Hatcher discusses search techniques and Lucene, a Java-based search engine package for Apache. "First we'll see what is involved to use QueryParser in an application. Then, Lucene's Query API is shown in relation to the corresponding QueryParser syntax. Elaboration on the details of QueryParser syntax is then followed by how QueryParser's features can be customized."

Comments (none posted)

Zope 2.7.0 beta 3 released

Version 2.7.0 beta 3 of the Zope web development platform is available. "Zope 2.7.0 represents a concentration on software configuration and installation improvement over older versions."

Full Story (comments: none)

Desktop Applications

Audio Applications

jackEQ 0.3.6 released

Version 0.3.6 of jackEQ, the audio equalizer for the Jack Audio Connection Kit, has been released. The notes say: "Added monitor buttons for aux channels. Pre gain."

Version 0.3.5 of jackEQ was also released this week with these changes: "Added 2x stereo aux send/return channels with one touch assignable inputs (like monitor but for aux send). Useful for external fx processing. Cleaned up gui a little in preparation for internally assigning jack ports."

Full Story (comments: none)

WaveSurfer 1.5.7 released

Version 1.5.7 of the WaveSurfer audio file editor is available. See the changes document for information on what's new.

Comments (none posted)

Desktop Environments

New release of YaGnoBS (GnomeDesktop)

Version 0.7 of YAGNobs (Yet Another GNome build script) has been released. "The major additions are some stripping down to remove unnecesary packages and some more flexibility in the scripts."

Comments (none posted)

KDE-CVS-Digest

The November 14, 2003 edition of the KDE-CVS-Digest is available. Here's the summary: "A deeper freeze is called for in preparation for release. Kexi, a graphical database application now has gui and non-gui parts. Many bug fixes, including searching and sorting fixes in Juk, topmenu fixes in KWin, CSS and Javascript fixes in Konqueror."

Comments (none posted)

KDE Traffic #68

Issue #68 of KDE Traffic has been published. The KDE.News summary and reader feedback page says: "KDE Traffic #68 has been released, covering topics ranging from toolbars (1, 2), KMail and Kontact fun, to a change in the KDE 3.2 release schedule. Enjoy!"

Comments (none posted)

XFce 4.0.1 is out.

Version 4.0.1 of the XFce Desktop has been released. "This is a bugfix release and all users of 4.0.0 are e[n]couraged to upgrade to this version."

Comments (none posted)

Electronics

Covered 0.2.2 released

Version 0.2.2 (stable) of Covered, a Verilog code coverage analysis tool, is available. "This release is a repackaged version of the 0.2.1 release with the 0.2.1 patches applied to it. If you are using the 0.2.1 release without the available patches, please download this version and use it instead." A new development release of Covered is also available.

Comments (none posted)

XCircuit 3.1.27 released

Version 3.1.27 of XCircuit, an electronic schematic drawing package, is available. Change information is in the source code.

Comments (none posted)

Financial Applications

Release of GnuCash stable version 1.8.8

Version 1.8.8 (stable) of GnuCash has been released. This version features new translations, bug fixes, and more.

Full Story (comments: none)

Games

Solving Puzzles with LM-Solve (O'Reilly)

O'Reilly has published an article by Shlomi Fish on puzzle solving with Perl. "Suppose you encounter a (single-player) riddle or a puzzle that you don't know how to solve. Let's also suppose that this puzzle involves moving between several states of the board with an enumerable number of moves emerging from one state. In this case, LM-Solve (or Games::LMSolve on CPAN) may be of help."

Comments (none posted)

GUI Packages

New FLTK software

New software for FLTK, the Fast Light ToolKit, includes version 181103 of the Table widget, and version 2.1 alpha 4 of SPTK, the Simply Powerful ToolKit.

Comments (none posted)

Instant Messaging

Gossip 0.6 released (GnomeDesktop)

Version 0.6 of Gossip, an instant messaging client, has been announced. See the Gossip Homepage for change information and screenshots.

Comments (none posted)

Interoperability

Samba 3.0.1 pre3 released

Version 3.0.1 pre3 of Samba is available. "This release does fix a few core dumps in the 3.0.1pre2 release and corrects point-n-print for Windows 2K/XP clients."

Full Story (comments: none)

Music Applications

pianokeys 0.3 released

Version 0.3 of pianokeys is available. "Next mockup of this kind will be about to become pretty more realistic."

Full Story (comments: none)

QSynth 0.0.1 released

The first release of QSynth, a Qt-based front-end to the fluidsynth software audio synthesizer, has been announced.

Full Story (comments: none)

Digital Photography

GNOME Photo Printer V0.6 (GnomeDesktop)

Version 0.6 of GNOME Photo Printer has been announced. "This program is intended to make printing pictures/photos easy. It does all the calculation, transformation and arrangements of your pictures on a sheet of paper. There have been lots of improvements and bug fixes because of user suggestions."

Comments (none posted)

Science

MayaVi 1.3 released

Version 1.3 of MayaVi, a scientific data visualizer, has been released.

Full Story (comments: none)

Web Browsers

Minutes of the mozdev Admin Meeting (MozillaZine)

The minutes are available for the November 17, 2003 mozdev Admin Meeting. "Issues discussed include mozdev's non-profit status, date/time standards, email aliases and the site redesign."

Comments (none posted)

Minutes of the mozilla.org Staff Meeting (MozillaZine)

The minutes from the November 10, 2003 mozilla.org staff meeting have been published. "Issues discussed include releases, how much driving time there should be for a rel[e]ase, the new Roadmap update, the new website, Netscape email addresses in important documents and Boris Zbarsky's suggestion about flag policy at release time."

Comments (none posted)

Word Processors

AbiWord Weekly News

The November 16, 2003 edition of the AbiWord Weekly News has been published. Here's the summary: "TextBoxes get richer, BeOS finally sees some action and preparations for 2.1.0 Some technical notes on how Abi renders a document, bugs on the rise, more news on Abi's Relatives OTS, libWPD, gnumeric and conglomerate. Also, lots of hinting for 2.1.0!"

Comments (none posted)

Miscellaneous

Informant 0.01 Released (GnomeDesktop)

The first release of Informant has been announced. "Informant is a set of utilities for keeping a user informed of events. It consists of an informant -- currently implemented as Gnome Panel applet or standalone Gtk program -- and a different sources that "whisper" alerts to the informant."

Comments (none posted)

Languages and Tools

Caml

Caml Weekly News

The November 11-18, 2003 edition of the Caml Weekly News is out with the latest Caml language news.

Full Story (comments: none)

Java

Java-Gnome 0.8.1 (GnomeDesktop)

Version 0.8.1 of the Java-Gnome library, which is used for creating GTK and GNOME applications in Java, has been announced. "The Java-Gnome project is proud to announce the recent releases of java-gnome 0.8 and 0.8.1 bringing full support for gtk/gnome 2, many bug fixes and performance enhancements. These latest releases represent major progress for the Java-Gnome project. Some reasonably large applications have already been developed with Java-Gnome and there has been much interest from new Java-Gnome developers."

Comments (none posted)

Inside Class Loaders (O'ReillyNet)

Andreas Schaefer looks at Java class loading details on O'Reilly. "Class loading is a topic that separates the Java Jedi from his or her apprentice. Until you start working with multiple -- and potentially incompatible -- class loaders, you don't realize the trickiness of keeping classes straight."

Comments (none posted)

Subverting Java Access Protection for Unit Testing (O'ReillyNet)

O'Reilly has published an article on Java unit testing. "Ross Burton describes how to use reflection to subvert Java class-member access protection to improve unit testing, by accessing private and protected members as required."

Comments (none posted)

Perl

Perl 5.6.2 released (use Perl)

Version 5.6.2 of Perl is available. "Perl 5.6.2 is being released to fix the build issues with the newest compilers, libraries and operating systems that have appeared since the release of perl 5.6.1 (notably gcc 3, AIX 5, Mac OS X). A few modules have been upgraded as well".

Comments (none posted)

This Week on perl5-porters (use Perl)

The November 10-16, 2003 edition of This Week on perl5-porters has been published. "For some reason, (maybe the approach of mod_perl 2), one of the main topics this week was interpreter cloning and the problems it may cause. But the release of perl 5.6.2 is an event that is not to be neglected."

Comments (none posted)

This week on Perl 6 (O'Reilly)

The November 09, 2003 edition of This week on Perl 6 is out with another week's worth of Perl 6 news.

Comments (none posted)

PHP

PHP Weekly Summary for November 17, 2003

The PHP Weekly Summary for November 17, 2003 is out. Topics include: Benchmarking PHP, PHP 5 roadmap, PHP-IDN extension, Java extension, Upload meter.

Comments (none posted)

Python

Dr. Dobb's Python-URL!

Dr. Dobb's Python-URL! for November 17, 2003 is available with the week's Python happenings.

Full Story (comments: none)

paramiko 0.1 charmander released

Version 0.1 (charmander) of paramiko, which implements a Python-based SSH2 communication channel, is available. "The module works by taking a socket-like object that you pass in, negotiating with the remote server, authenticating (using a password or a given private key), and opening flow-controled "channels" to the server, which are returned as socket-like objects."

Comments (none posted)

Ruby

Announcing Ruby-GNOME2-0.8.0 (GnomeDesktop)

Version 0.8.0 of Ruby-GNOME2, the Ruby language binding to GNOME, has been announced. "One step closer the 1.0.0 release (and hopefully only two steps left) of the Ruby bindings of the GNOME2 libraries, 0.8.0 brings you libgda bindings, more classes and methods, and the ability to create GObjects from Ruby."

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The November 17, 2003 edition of Dr. Dobb's Tcl-URL! is out with a new collection of Tcl/Tk article links.

Full Story (comments: none)

XML

An Introduction to Schematron (O'Reilly)

Eddie Robertsson introduces Schematron on O'Reilly. "The Schematron schema language differs from most other XML schema languages in that it is a rule-based language that uses path expressions instead of grammars. This means that instead of creating a grammar for an XML document, a Schematron schema makes assertions applied to a specific context within the document. If the assertion fails, a diagnostic message that is supplied by the author of the schema can be displayed."

Comments (none posted)

SVG and XForms: A primer (O'Reilly)

Antoine Quint writes about SVG and XForms on IBM's developerWorks. "Scalable Vector Graphics (SVG) and XForms are two blossoming technologies that handle what may appear to be two different facets of electronic document publishing. This primer provides an overview of the two technologies and highlights the potential synergies between them."

Comments (none posted)

More Gems From the Mines (O'Reilly)

Uche Ogbuji covers the use of more Python-based XML tools on O'Reilly. "In a recent article I started mining the riches of the XML-SIG mailing list, prospecting for some of its choicest bits of code. I found a couple of nice bits from 1998 and 1999. This time I cover 2000 and 2001, an exciting period where preparations for Python 2.0 meant that XML tools were finally gaining some long-desired capabilities in the core language. As in the last article, where necessary, I have updated code to use current APIs, style, and conventions in order to make it more immediately useful to readers."

Comments (none posted)

Debuggers

DDD 3.3.8 is now available

Version 3.3.8 of the DDD Debugger is available. "DDD 3.3.8 contains some important memory corruption fixes, and better interoperation with gdb-5.x, gdb-6.0, and the Perl debugger. In addition, Arnaud Desitter has made literally hundreds of micro-optimisations throughout the codebase. Builds on HPUX-10.20 and NetBSD are improved too. The manual is now distributed in PS, PDF, and texinfo sources in the main distribution tarball (previously, it was a separate bundle). DDD 3.3.8 is the fastest and most stable DDD yet -- I strongly recommend upgrading if you are using an earlier version."

Comments (none posted)

Editors

First release of Inkscape (GnomeDesktop)

Version 0.35 of Inkscape, a full featured open source SVG editor, has been announced. "This is the first release of Inkscape, and it's a great start for the project. Recent additions include new keyboard shortcuts, alternate node joining method, ability to apply text to multiple text objects, an Open Recent menu item, and more."

Comments (none posted)

Profilers

OProfile 0.7.1 is released

Version 0.7.1 of OProfile is available. "opcontrol now has an "--image" option which takes a comma-separated list of binary images to profile. All others are ignored. This is most useful for reducing the number of profiles generated when using --separate=thread."

Full Story (comments: none)

Miscellaneous

Thomas Bushnell is no longer Hurd maintainer

The GNU Hurd page lists Thomas Bushnell as "the primary architect" for the project. No more. Mr. Bushnell has posted a message to the gnu-prog-discuss mailing list saying: "RMS has now 'dismissed' me as Hurd maintainer because I have publicly spoken against the GFDL, saying that a GNU maintainer must support and speak in favor of GNU policies." (Thanks to David Martínez Moreno)

Comments (90 posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Sun's Linux desktop off to flying start (Register)

The Register looks forward to Sun's Linux desktop offering. "Sun is batting around the idea of teaming with service providers to rent out applications such as StarOffice and also hardware such as online storage. The service provider could theoretically ship a thin client or white box to a consumer and then charge for various products. Do you want browsing, StarOffice and storage? Well, that's x dollars per month."

Comments (19 posted)

Interview: SCO's Darl McBride and Chris Sontag (CRN)

CRN has posted a lengthy interview with Darl McBride and Chris Sontag. Reading it is a trying experience, to say the least, but it gives an insight into the thought processes of SCO's management. "Our belief is that SCO has great opportunity in the future to let Linux keep going, not to put it on its back but for us to get a transaction fee every time it's sold. That's really our goal. To the extent that we have to take it down and put it on its back, we're fully prepared and willing to do that." Or... "The interesting scenario is, do you go after an HP customer or an IBM customer? That's what David [Boies] is the master of. That's his final decision.'

Comments (33 posted)

Trade Shows and Conferences

On the Scene at the Boston Desktop Linux Consortium (Linux Journal)

Here's a Linux Journal report from the Desktop Linux Consortium conference. ""The Open Desktop: Freedesktop.org", a presentation given by Havoc Pennington (from Red Hat, but he was presenting as a member of freedesktop.org) was most interesting. This site is hosting some intriguing technology specifically geared toward solving basic issues, including integrating applications with differing toolkits and developing specs and recommendations for common technology. The idea is all of this can be shared by GNOME, KDE, other window managers and toolkits. Freedesktop.org has become the host for many stable projects, including fontconfig. Keith Packard's fontconfig has done wonders to bring badly needed sanity to font management in XFree86. Freedesktop.org also is hosting other, more experimental software."

Comments (none posted)

IBM keynote presentation from Desktop Linux Conference (DesktopLinux.com)

DesktopLinux.com has announced the availability of the slides from the IBM keynote presentation at the Desktop Linux Conference. "The first presentation in our series is from IBM's Sam Docknevich, Linux and Grid Services Executive for IBM Global Services. His presentation discusses IBM's push into the Linux desktop market, an initiative from inside "Big Blue.""

Comments (1 posted)

Linux Lunacy 2003: Cruising the Big Picture, Part I (Linux Journal)

Doc Searls presents part 1 of his Geek Cruise trip report, on Linux Journal. "The Linux Lunacy III curriculum stretched across the greater Linux platform--LAMP for short. (That's Linux, Apache, MySQL, PHP, Perl, Python and everything else that fits in the suite.) Ted T'so gave a whole day (two long sessions) to the Linux kernel and added another lecture on filesystems. David Axmark gave sessions on MySQL. Randall Schwartz did Perl. Guido van Rossum did Python. Karen and Steven Pritchard gave LPI certification courses and tests. Bruce Perens covered Linux in tiny embedded applications, plus international wireless connectivity. Mick Bauer taught classes on Linux security. David Fetter taught Linux databases. Greg Haerr taught programming, and Keith Packard taught about graphics in X and fonts in Linux."

Comments (none posted)

Linux Lunacy 2003: Cruising the Big Picture, Part II (Linux Journal)

The Linux Journal has posted the second part of Doc Searls' "Linux Lunacy" travelogue. "Although Linux and LAMP are handy as can be, they have not established themselves fully in the habitats left bare by the retreating glaciers. Watching the rocky shore go by in Glacier Bay, I decided that we are somewhere between the horsetail and alder stages of plant succession in the marketplace. We will know the marketplace has reached maturity when everybody once again feels free to ply and sell their talents and crafts, with or without the assistance of large industrial manufacturers, distributors and retailers."

Comments (none posted)

The Path to Ruby2 (a.k.a. "Rite")

The Ruby Garden has coverage of Rubyconf 2003. A report on Ruby 2.0 (a.k.a. "Rite"), and presentation slides are available.

Comments (none posted)

The SCO Problem

SCO Targets Torvalds, Stallman (Forbes)

Here is a Forbes article on the SCO Group's latest round of subpoenas. There's not much that's new here, but it is amusing to see reporter Daniel Lyons, who has bought almost everything SCO has said without question, begin to notice that the company is not being entirely straightforward with him. "Oddly enough, on Nov. 11, SCO Executive Vice President Christopher Sontag complained to Forbes about IBM's decision to send subpoenas to investors and analysts who supported SCO.... So why didn't Sontag mention that, uh, SCO itself was about to target Torvalds and Stallman with subpoenas? SCO's spokesman says Sontag and Darl McBride, SCO's chief executive, did not know that SCO's lawyers were planning the move. But the 'Who's on first?' act is tough to swallow since it turns out SCO notified IBM of its plans to seek discovery from these parties more than a month ago, on Oct. 5."

Comments (15 posted)

Two analysts on SCO (Groklaw)

Groklaw has taken a look at two analyst reports on SCO's stock. Deutsche Bank's Brian Skiba is making a truly impressive attempt to hype that stock ("We believe that a number of high-profile legal moves could bring to the forefront the IP issue around UNIX and Linux which would likely result in some monetization on the part of SCO in the form of IP licenses. We believe these events, should they occur, will be a positive for the stock, which has otherwise been in a relative dearth of news flow over the past several months.") while Dion Cornett of Decatur Jones Equity Partners disagrees.

Comments (9 posted)

SCO CEO: Novell-SuSE breaks SCO contract (InfoWorld)

According to InfoWorld, SCO is now threatening to sue Novell. "The non-compete agreement was only one of several legal avenues that SCO is considering, should the SuSE acquisition be competed. according to McBride. SCO also believes that Novell does not have the right to distribute Linux, which SCO alleges to contain intellectual property that has been derived and copied directly from its Unix System V code, he said. Novell greatly enhanced its legal risks 'by getting into this Linux game,' McBride said.

Comments (38 posted)

Innovation Loses If Open Source Wins (LinuxInsider)

In the interest of knowing what the other side is saying: here is an impressive Enderle column on LinuxInsider. He says that open software will destroy innovation, and that SCO will win. "Why this is interesting is that SCO appears to be attempting to prepare for trial, while IBM appears to be trying to destroy SCO's ability to sustain the fight. With SCO's legal team still on contingency, it still looks to me like SCO is more confident of winning in court than IBM is." Of course, SCO's legal team has worked a deal where it wins whether SCO does or not.

Comments (64 posted)

Companies

IBM sees growing Linux programmer community (ADTMag)

ADTMag.com looks at how IBM helps developers create applications for Linux. "The new wave of Linux development includes applications that "span all major industries, including government, finance, retail, automotive and manufacturing," according to a Big Blue spokesperson. Specifically, IBM claims its Linux developer community is working in all sizes of businesses building applications for e-commerce, payroll, inventory tracking, CRM, small business accounting, financial analysis software and even "pattern discovery in genome sequences.""

Comments (none posted)

Red Hat subscriptions beat expectations (News.com)

News.com reports that the renewal rate for Red Hat Enterprise Linux subscriptions is over 90% - significantly higher than had been expected. "Red Hat's challenge now is to put its new revenue to judicious use, such as investing in a new call center in Australia to support Asian customers. The company can't simultaneously tackle major new initiatives such as pushes into China, the embedded computing market or desktop computer software..."

Comments (none posted)

SGI Japan wins order for Linux supercomputer (Asia Times Online)

Asia Times Online reports that SGI Japan has received an order from the government-affiliated Institute of Statistical Mathematics for a high-end Linux supercomputer. "The Altix 3700 supercluster will boast a numbers-crunching capability of 1.3 teraflops, and will use shared memory helps to save time by eliminating the need to write programs that tell the microprocessors how to apportion computational tasks."

Comments (none posted)

Sun Strikes Huge Linux Desktop Deal With China (TechWeb)

TechWeb reports on Sun's deal with the China Standard Software Company (CSSC) which, it seems, will lead to the deployment of its Linux-based "Java Desktop System" on a million systems. "The licensing agreement, which will start at the end of this year, allows the CSSC to deliver its own branded products using the Java Desktop System as the foundation for a nation-wide standard."

Comments (7 posted)

Linux Adoption

Formula 1 racer's secret: 1,000 horsepower and a Linux cluster (NewsForge)

NewsForge looks at the role supercompters play in Formula 1 racing. "Aerodynamics are as important to modern Formula 1 race cars as they are to jet fighters. That's why the BMW Williams F1 team turn to a Linux cluster when they need to get a bit more out of their 3-litre, 1,000-horsepower, 1,320-lb. FW25 car."

Comments (3 posted)

Legal

Judge shuts garage opener copyright suit (News.com)

News.com reports that the Chamberlain v. Skylink DMCA case (having to do with the making of garage door openers that "circumvent" Chamberlain's encoding scheme) has been dismissed. "The judge's reliance in her decision on Chamberlain's lack of notice to consumers left that core issue untouched, however. Lawyers said that the ruling would allow Chamberlain to create a new variety of garage door opener, include a label that says it can't be used with other products--just as a DVD says it can't be copied--and then try to block a company such as Skylink again."

Comments (none posted)

Interviews

Jan Varga's Root Interview in English (MozillaZine)

MozillaZine has posted an english translation of an interview with Mozilla developer Jan Varga. "Since you mentioned Firebird, how do you see the new concept of Mozilla. What does it take from you and bring to you as a programmer?"

"I must confess that I did not like it very much at the beginning. I later realized that it was good idea (except for the controversial name :)). There is no doubt that it will bring a faster development because the individual products are developed independently. Furthermore I would like to mention the stability of the product. If the browser crashes accidentally, this will not affect your e-mail client and so forth."

Comments (none posted)

Interview with LimeWire COO Greg Bildson (O'Reilly)

O'Reilly's OpenP2P site features an interview with Greg Bildson. "Greg Bildson is the COO of LimeWire and president of P2P United, a consortium of P2P software companies created to help educate Congress and the public about peer-to-peer software, technology, and culture. P2P United is the organization that paid 12-year-old Brianna LaHara's $2,000 RIAA settlement after the RIAA served her with a Digital Millennium Copyright Act subpoena."

Comments (none posted)

Resources

Make your own brushes with The GIMP (LinuxFocus)

LinuxFocus presents the various brushes found in GIMP, and how to create your own. "A pipe - or animated brush - is a brush which contains several images. The image of the brush varies at the same time as one draws: it is the experiment we did with the brush "Vine" in the first part. In GIMP, the creation of a brush of this type is an image with several layers." (Found on Footnotes)

Comments (none posted)

The State of Home-Brew PVRs on Linux (O'ReillyNet)

O'ReillyNet looks at how to build a Personal Video Recorder. "If you wish to record a show and watch a live TV show at the same time, you will need two TV cards: one for recording and one for watching TV. I would highly recommend using one of the many cards supported by the bttv Linux drivers. If you wish to listen to FM radio, you can pick up one of the WinTV cards that include an FM tuner as well."

Comments (2 posted)

Reviews

Linux on Pocket PCs (O'ReillyNet)

Here's an O'ReillyNet article looking at various handheld computers. "An iPAQ running Familiar will have a selection of apps and the X Window System. If you add Intimate, you will have a full Debian setup, again running X (or just a console, if you wish). Another option is to take advantage of all of the writing and porting that's been going on for the Zaurus."

Comments (none posted)

Introduction to Mozilla Firebird (Nidelven-IT)

Nidelven-IT has published two more articles in Kay Frode's series on the Mozilla Firebird browser. The articles look at the download manager and printing.

Comments (none posted)

Miscellaneous

Many Organisations Employing Mozilla Contributors (MozillaZine)

MozillaZine reports on Mozilla developers who are employed by outside companies. "For many years, Netscape provided several full-time employees to work on Mozilla. Since AOL pulled the plug on Netscape's contributions to the project in July, many have assumed that all the work is now done by volunteers. However, that is not the case and a variety of organisations have either expanded their Mozilla workforce or started hiring lizard-friendly employees for the first time."

Comments (none posted)

Mono project announces new roadmap to completion (NewsForge)

NewsForge covers a new roadmap for the Mono project. "The new roadmap calls for Mono 1.0 to be completed in Q2 of 2004, and Mono 1.2 to follow by the end of the year. Mono 1.4 is scheduled for the middle of 2005 and Mono 2.0 early in 2006."

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

OSDL pays Linus's legal bills

The Open Source Development Lab has sent out a press release stating that it will be picking up the tab for Linus Torvalds' legal representation in the SCO case. OSDL will also pay for representation for any other employees who get caught up in SCO's lawsuits.

Full Story (comments: 11)

The Public Sector Open Source Project

The Public Sector Open Source Project is a cooperative effort between Massachusetts and MIT; its purpose is to encourage the use and creation of free software for governmental use. The project is launching with a meeting in Cambridge, Mass. on December 9; the organizers are looking for state and local government representatives who are interested in attending.

Comments (1 posted)

theKompany.com: Rekall Now Available Under GPL

KDE.News has an announcement concerning a license change on the Rekall project. "theKompany.com has just announced that Rekall, the rapid application development database tool for Linux, similar in concept to MS Access, has been released under the GPL. Rekall can be built with KDE3 support as well as Qt-only."

Comments (none posted)

Commercial announcements

CyberGuard Acquires SnapGear

CyberGuard Corporation has announced that the company has signed an agreement to acquire the embedded Linux company SnapGear. SnapGear's engineering team might be best known to LWN readers for their role in developing uClinux.

Full Story (comments: none)

Gateway selling SUSE-installed servers

Here, finally, is Gateway's press release regarding its deal with SUSE. "The new alliance with SUSE, a leading provider of Linux software and services, further strengthens Gateway's commitment to enterprise customers, creating a single point of purchase, support and maintenance for SUSE LINUX Standard Server 8 and SUSE LINUX Enterprise Server 8 operating systems."

Comments (none posted)

JBoss Group goes for indemnification

The JBoss Group has announced that it will be offering indemnification against patent and copyright suits (relating to the JBoss Application Server) to its customers. "Among the challenges for companies moving to open source technologies, such as the JBoss application server, are concerns regarding intellectual property rights. By offering industry standard indemnification for the JBoss application server, JBoss Group is taking another vital step in its efforts to promote Professional Open Source for the enterprise market. The company is committed to making it easier and safer than ever for customers to develop and deploy open source technologies." There is no mention of what sort of insurance coverage the JBoss Group may have put into place to enable it to back up its promise if need be.

Comments (8 posted)

J2EE 1.4 Specification Wins Unanimous Vote of Approval From the Java Community Process

The Java Community Process has approved the Java 2 Platform, Enterprise Edition [J2EE(TM)] version 1.4 specification in a unanimous vote. Sun Microsystems has offered the new specification and its Compatibility Test Suite (CTS) under new license terms friendly to non-profit and open source projects. Apache Software Foundation and JBoss Group are among the first open source organizations to license J2EE 1.4 specification and CTS. JBoss has issued its own press release.

Comments (3 posted)

MaxDB by MySQL Now Available

MySQL AB has announced that MaxDB by MySQL has been released. MaxDB is a heavy-duty, SAP-certified open source database that claims to offer high availability, scalability and a comprehensive feature set.

Comments (7 posted)

Enrico Pesatori To Take The Helm of Linux Leader Penguin Computing

Penguin Computing has named Enrico Pesatori as its president and chief executive officer. ""Enrico has a tremendous track record building and managing successful enterprise organizations and we are confident he will take Penguin Computing into its next phase of growth," said Sam Ockman, founder and chairman of the board of Penguin Computing."

Comments (none posted)

Federal judiciary to move to Linux

While federal judges are considering the future of Linux in Delaware and Utah courts, the judiciary's administrative offices are switching to Linux. A company called PEC Solutions has sent out a press release stating that it has won the contract to do the conversion. "PEC will support the transition of the Judiciary's mission-sensitive applications, including case management, finance and accounting, probation and pretrial services, and case-tracking management systems to the Linux standard."

Comments (18 posted)

Resources

Tutorial: Potential of FOSS in Medicine (LinuxMedNews)

LinuxMedNews mentions the availability of a tutorial on the use of Free and Open Source Software (FOSS) in medicine.

Comments (none posted)

First release of Sodipodi flag collection (GnomeDesktop)

GnomeDesktop.org has an announcement for the first release of the Sodipodi SVG flag collection. "After our very successful call for contributions to our collection of flags we are now proud to announce the first release of the Sodipodi SVG flag collection. Currently the collection contains 215 different flags and we are just around 30 flags away from having all UN recognized international flags in our collection."

Comments (none posted)

Linux Soundapps Site Updated

Dave Phillips has updated his list of Linux sound applications on his Sound & MIDI Software For Linux page.

Full Story (comments: none)

LDP Weekly News

The Linux Documentation Project Weekly News for November 18, 2003 is out. Click below to see what's new at LDP.

Full Story (comments: 1)

Availability of COE Linux Platform review materials

The Open Group has announced the addition of a new certification program: "The Open Group is adding the Linux Platform to its COE Platform Certification program for DISA's Common Operating Environment and announces a formal review of the draft materials."

Full Story (comments: none)

OpenI18N 1.3 added to LSB Certification program

The OpenI18N Globalization Specification 1.3 has been added to the LSB Certification program. "The new certification product standard is called the LSB Internationalized Runtime Environment 1.3 and is for platforms providing a common internationalized environment that conform to both the Free Standards Group LSB and OpenI18N specifications."

Full Story (comments: none)

Windows-to-Linux roadmap: Part 1. Thinking in Linux (IBM developerWorks)

IBM has published a guide to help transition users from Windows to Linux. "If you have been using Windows for a long time, you are accustomed to rebooting the system for many reasons, from software installation to correcting problems with a service. This is a habit you will need to change to start thinking in Linux. Linux tends to be rather Newtonian in nature. Once set in motion, it will tend to stay in motion until it is acted upon by an outside force, such as a hardware failure."

Comments (none posted)

Contests and Awards

2003 LinuxQuestions.org Members Choice Awards

LinuxQuestions.org has announced that voting is open in the 2003 LinuxQuestions.org Members Choice Awards. There are lots of categories, including favorite Distribution, Browser, Multimedia application, Desktop and more.

Comments (11 posted)

Event Reports

Supercomputing announcements from SC2003

The Supercomputing Conference 2003 is in full swing in Phoenix, Arizona. Here are some of the Linux related press releases:

• SGI displays a Linux powered Altix 3000 supercomputer with 128 Intel Itanium 2 processors.

• Intel, California Digital and the University of California at Lawrence Livermore National Laboratory are building a nearly 4,000 processor Linux supercomputer, codenamed "Thunder".

• IBM claims 55% of the top 100 and introduces Blue Gene/L.

• Linux Networx clusters account for two of the top 10 fastest supercomputers.

• Dell claims 18 Linux clusters on the Top 500 list, including the #4 entry - a cluster at the University of Illinois' National Center for Supercomputing Applications.

Comments (none posted)

Announcements from SC2003

Announcements from the second day of SC2003:

• SGI announced they are building a 512 processor system for NASA Ames Research Center.

• Paracel announced the Paracel Cyclone, a turnkey Linux cluster system.

• PathScale announced a suite of compilers for the AMD Opteron processor. They claim the PathScale Compiler Suite is the highest performance 64-bit compiler for AMD Opteron-based Linux servers.

• Mountain View Data announced that its PowerCockpit Linux Management Framework now supports 64-bit AMD Opteron Processor-based Linux clusters.

Comments (none posted)

Upcoming Events

YAPC::Israel::2004 - Call for Proposals (use Perl)

A Call for Proposals has gone out for the YAPC::Israel::2004 Perl conference, which will be held on February 26, 2004.

Comments (none posted)

EuroPython, June 2004

The third Europython Conference will be held in Göteborg, Sweden on June 7-9, 2004.

Full Story (comments: none)

First Linux Bangalore/2003 shortlist

The initial list of talks for the Linux Bangalore 2003 conference, which will be held in Bangalore, India on December 2-4, is available.

Full Story (comments: none)

Cluster2003, Hong Kong

The 2003 IEEE International Conference on Cluster Computing will be held on December 1-4, 2003 in Kowloon, Hong Kong.

Full Story (comments: none)

Eclipse Expands Conference Program for EclipseCon 2004

The EclipseCon 2004 will be held on February 2-5, 2004 in Anaheim, CA. "Eclipse announces the expansion of the conference program for EclipseCon 2004, which will feature the latest integrated software development technology for the Eclipse universal tools platform."

Comments (none posted)

Events: November 20, 2003 - January 15, 2004

Date	Event	Location
November 20 - 21, 2003	Supercomputing Conference(SC2003)	(Phoenix Civic Plaza Convention Center)Phoenix, AZ
November 20 - 21, 2003	ObjectWeb Conferenc3	(INRIA Rocquencourt)Rocquencourt, France
November 20, 2003	COMDEX 2003	(Las Vegas Convention Center)Las Vegas, Nevada
November 22, 2003	Southern California Linux Expo(SCALE)	(Los Angeles Convention Center)Los Angeles, CA
November 22 - 24, 2003	New York GNOME Summit	(Brooklyn College)New York, NY
November 24 - 26, 2003	Open Standards and Libre Software in Government Conference (CANCELLED)(EGOVOS 3)	Paris, France
November 26 - 27, 2003	Forum PHP Paris 2003	(Club Confair)Paris, France
December 1 - 4, 2003	IEEE International Conference on Cluster Computing(Cluster2003)	(Sheraton Hong Kong Hotel & Towers)Kowloon, Hong Kong
December 2 - 4, 2003	Linux Bangalore/2003	Bangalore, India
December 9 - 13, 2003	International Conference on Logic Programming(ICLP'03)	Mumbai (Bombay), India
January 12 - 13, 2004	Linux.Conf.au Miniconfs	Adelaide, Australia
January 12 - 13, 2004	EducationaLinux 2004	Adelaide, Australia
January 14 - 17, 2004	Linux.conf.au	Adelaide, Australia

Comments (none posted)

Web sites

New mozilla.org Site Launches (MozillaZine)

MozillaZine has an announcement for the new Mozilla web site. "This new site caters more to the end user, with better product information, clearer download links and more details about help resources. New Mozilla initiatives, such as telephone support, CD sales and donations are now promoted throughout the site. Navigation has also been improved and a friendlier layout and colour scheme have been created. This is the first significant redesign of mozilla.org since its launch in 1998."

Comments (2 posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook

Letters to the editor

selinux

From:		Mike Duvall <starsfancyfarm-AT-comcast.net>
To:		lwn-AT-lwn.net
Subject:		selinux
Date:		12 Nov 2003 21:33:26 -0500

Has anyone followed the line of thinking that since the US government
released a linux version, selinux, that SCO would have to sue the US
government also?
 
Or that by providing a million pages to IBM, that SCO implies it has
copyrights to items which we already know belong to open source, there
fore they have "lied" in court by claiming copyrights that they don't
own....
Put "MR. SCO" on the stand....and have IBM ask...
 
IBM: Page 1. ...SCO is this yours? MR. SCO:.....err....uh....no
 
IBM: Page 2. ...SCO is this yours? MR. SCO:......err....uh....no
 
IBM: Page 3. ...SCO is this yours? MR. SCO:......err....uh....no
 
IBM: Page 4. ...SCO is this yours? MR. SCO:......err....uh....no
 
IBM: Page 5. ...SCO is this yours? MR. SCO:......err....uh....no
...
 
until the judge just dismisses the case, or orders
SCO to provide the exact pages/lines.
-
Mike
 
 

Comments (2 posted)

Time to laugh at SCO once again

From:		Anonymous <anonymous-AT-anonymous.net>
To:		osi-AT-opensource.org, gnu-AT-gnu.org, web_inquiries-AT-osdl.org, legal-AT-ibm.com, webmaster-AT-cravath.com, legal-AT-redhat.com, legal-AT-suse.com, pj-AT-groklaw.com, kmself-AT-ix.netcom.com, robin-AT-roblimo.com, joe-AT-pjprimer.com, nicholas-AT-petreley.com, lwn-AT-lwn.net
Subject:		Time to laugh at SCO once again
Date:		Thu, 13 Nov 2003 23:08:51 -0600

This light-hearted moment of unbridled sarcasm is licensed under
Creative Commons. Please feel free to publish this and contribute
additions or corrections.
 
 
SCO rules of the game.
 
1. Only SCO is allowed to bully and intimidate. No one may bully or
intimidate SCO or its partners.
 
2. If anyone claims SCO has broken any laws, those laws are
automatically one or more of the following: invalid, unenforcible,
unconstitutional, violate export laws. If SCO claims IBM, Linux users
or anyone else has broken any laws, they are automatically guilty and no
evidence is necessary. Only unsubstantiated claims are necessary to
prove guilt of others.
 
3. SCO is free to change its story as many times and as frequently as
it deems necessary. There is no such thing as lying, inconsistency,
hypocrisy or self-contradiction.
 
4. The most effective legal strategy is to mimic our opponent's every
move. Taking the initiative is not necessary.
 
5. Hype and sensationalism in the media are all that is necessary to
prove that many people owe us money. Waiting quietly for our day in
court is not acceptable.
 
6. SCO will easily survive for the next 2 years waiting for the IBM and
Red Hat trials to begin and then more years for the appeals process.
SCO is a highly respected member of the Unix and Linux community and
sells many high quality products and services and has a profitable,
growing business.
 
7. SCO has the moral high ground.
 
8. SCO has the silent majority supporting its claims.
 
9. SCO executives are entitled to make enough money to own a second
house.
 
10. Only SCO is allowed to have a "don't ask, don't tell" policy.
 
11. Novell, Red Hat, Eric Raymond, Bruce Perens and the entire open
source community are illegally conspiring against SCO because IBM is
paying them to do it.
 
12. SCO is free to use the terms "IP" and "intellectual property," even
in court, even though they are vage, nebulous terma. SCO does not ever
need to specifically state what type of rights, such as copyrights,
trade secrets, patents or trademarks.
 
13. The claims against Linux are part of a wider debate about
intellectual property rights in a digital age. We are not aggrandizing
the issues or trying to use smoke and mirrors to prevent you from
discovering the emperor has no clothes. SCO and/or its executives are
not trying to make themselves look and feel more important than they
really are.
 

Comments (2 posted)

Page editor: Jonathan Corbet