LWN.net Weekly Edition for February 5, 2004

Of Copyright Transfers, Slander of Title, and SCO

A lot of people are curious about SCO's lawsuit against Novell for "slander of title." First, most people have never heard of such a claim before and don't know what it is. Second, since the dispute surrounds a question of transfer of copyrights, how exactly are copyrights validly transfered and did there occur such a transfer between Novell and SCO? And third, why sue for slander of title instead of bringing a breach of contract claim or both together?

Taking those questions in order, first, what is "slander of title"? Normally a claim you find in real estate matters, it's defined as "false, unjustified statements regarding another person's title to property". There are elements you must prove to win:

If you own a house, and I know I don't but I claim to be the owner anyway, you can sue me for slander of title, because I have cast a cloud over your ownership claim in that house. There is such a thing as libel not only to your personal reputation but also to the reputation of property. You can read a bit more on that here if you are interested.

But if it's instead a good-faith conflict, in which each side thinks it really does own the house, well, that's a different kettle of fish. It still needs to get worked out in the courts, but it isn't slander of title, because it's not malicious to assert what you believe are your legal rights. Otherwise there could never be a contract dispute.

Malice is also a necessary element in a slander claim. The malicious claim must be intentional and without reasonable cause:

That has a bearing, obviously, on SCO's case against Novell. And it's why some are questioning their choice to use that claim. If you read Novell's letters, do you get the impression that they feel they actually do own the copyrights? Note particularly the letters dated May 28, June 6 and 26, August 4, and October 9 to follow the copyright argument. If Novell honestly believes that it owns the copyrights, there is no slander of title. The necessary element of malice would be missing. It's not slander if the party has a valid claim. Novell claims it did not transfer the copyrights to SCO. This raises the possibility that Novell could win on that basis alone.

Can SCO succeed is establishing its claims to copyright on Unix code? Some have expressed doubt. And even if SCO were to succeed in establishing that Novell has no copyrights, there is a deeper question, namely: what can and what can't you copyright when it comes to software?

Who owns the copyrights here anyway? To delve into it deeply, you would need to read the contracts involved, and after you do, I'm guessing you still won't be 100% sure, though you may well find yourself leaning toward Novell. SCO highlights, in particular, Amendment 2 to the Asset Purchase Agreement, but Novell points out that there were other documents, including Amendment 1, the Schedules, and a Technology License Agreement, although the latter does not pertain to the copyright issue. Novell isn't saying SCO has no rights. Novell is saying it retained certain rights, that SCO needed to assert a need for copyrights and that it never did that, that there were, in other words, conditions that SCO has not satisfied. Because they did not satisfy the conditions, the copyrights never transfered.

Why didn't SCO sue for breach of contract, then, if their position is correct and copyrights were supposed to transfer and Amendment 2 is the contract that was to make that happen? No one I have talked to can figure that out. At least one attorney I asked about this thinks that failure to assert a breach of contract claim will prove fatal to SCO's chances of prevailing in the slander of title claim. While SCO alleges that the copyrights were to have transferred under the Asset Purchase Agreement, clearly it didn't happen, or there would be no dispute heading to court. So why not sue for breach of contract and ask the judge to enforce the contract?

SCO has been claiming that its rights to Unix were absolute, but all the while it turns out it was in hot and heavy correspondence with Novell, so its rights were contested all along. That fact alone, the fact that Novell firmly asserted what it claims to be its rights, indicates that SCO may have great difficulty persuading a judge that malice was involved. If you have read the contract documents, you already know it is far from obvious that Novell has no legitimate claim.

SCO registered for copyrights, but so did Novell. SCO would need to show that Novell transfered those rights to SCO. And it had to have been in writing, because copyright law requires copyright transfers to be in writing and "signed by the owner of the rights conveyed or such owner's duly authorized agent." For example, a friend of mine, who just registered a copyright in some music he wrote, got a letter from the US Copyright Office that included this sentence:

Here, that would mean Novell, who would have to transfer by writing to SCO. There is no official US Copyright Office form for a copyright transfer, so normally they are effectuated by contract. Here are some examples of copyright transfer forms some have used, to give you an idea, here and here and here (PDF format) and here (also PDF).

So is the Asset Purchase Agreement plus amendments and schedules a contract? Yes. Is a contract enough to transfer a copyright? Yes. Is it clear on its face that this contract did mean to effectuate such a transfer? That is not clear to many readers, and obviously Novell doesn't think so. And intriguingly, if SCO ultimately fails to establish copyright ownership, after publicly asserting Linux is infringing its copyrights for nearly a year, and particularly if it sues end users for copyright infringement, and it turns out their claim to copyright had no reasonable basis and they knew it, is SCO opening itself up to a possible claim of slander to title itself?

Comments (7 posted)

Needed: code auditors

Free software is said to be more secure than the proprietary alternatives for a number of reasons. Near the top of most peoples' lists is the openness of the code: with all those eyeballs on the code, security problems are found and fixed quickly. Over the years, however, we have seen numerous signs that fewer people are actually looking at code than many of us would like to believe. Too many vulnerabilities remain in our programs for years for us to have any real confidence that comprehensive auditing is going on.

There have been attempts to encourage developers to audit code. Almost exactly two years ago, the announcement went out for the Sardonix project. Sardonix was started after Crispin Cowan noted that the Linux Security Audit Project appeared to have stalled. Since auditing was not happening by itself, Sardonix sought to provide some motivation in the form of infrastructure and credit for auditors. With these incentives, it was hoped, some large-scale code auditing would start to happen.

Thus, with a little help from a DARPA grant, the Sardonix portal was launched. The portal would track the audit state of various free software programs and would give credit to those who did the auditing work. Sufficiently skilled and productive auditors would be able to accumulate a large "audit karma" to show their friends - and help improve the security of free software at the same time.

Two years later, the only auditing work which has been done on Sardonix was a small set of projects assigned by a university professor to his students. The last posting to the Sardonix mailing list was sent in November, 2003. The DARPA money has run out. Sardonix, it seems, is a project which has failed.

One can attribute this failure to a number of reasons. Certainly Sardonix was never promoted very well; almost nothing was heard from the project after the initial announcement. With an effort to jump-start the process and a set of vulnerabilities found by Sardonix auditors posted on Bugtraq, the project might just have achieved critical mass. As it is, Sardonix vanished into obscurity shortly after its launch, and few people ever heard of it again.

The sad fact remains, however, that, with or without Sardonix, very little auditing is getting done. The continuing stream of vulnerability reports, many for problems which have lurked undetected for years, make this clear. Auditing code is difficult, tedious, and error-prone work. It also tends to be thankless; strangely enough, many developers do not welcome news of vulnerabilities in their work (though most do respond and fix the problems). New vulnerability information requires careful handling; a sustained effort may be required to get the developer to take the problem seriously, but widespread disclosure of the problem must be avoided until developers and distributors have had a chance to react. To top it off, those who do seek out vulnerabilities in software are often seen as promoting their own agendas and making the problem worse. It is not surprising that few people are stepping up and taking on this work.

The free software community has a lot of work to do if it wants to live up to its promise of greater security. This battle must be fought on many fronts: safer programming techniques, containment strategies, detection and response, etc. But we also, somehow, have to find a way to get more critical eyeballs looking at our code. As recent events have shown, the black hats are already doing this work for their own purposes. If free software wants to live up to its pretensions of being a more secure alternative, it needs more developers reviewing the code.

Comments (17 posted)

UserLinux Moves Forward

A lot has been happening on the UserLinux front since Bruce Perens first publicly announced the project in October. The project has moved through the early discussion and design phases and is now moving into early install testing with its own package repository. There is also a fairly comprehensive Wiki for UserLinux with everything from project policies and package framework to the marketing concept and mission statement:

Users and developers who are eager to try out UserLinux will find instructions on creating a UserLinux system by converting a Debian unstable system using the UserLinux package repository. At the moment, the UserLinux package repository only has three meta-packages, one for each UserLinux configuration: Desktop, server and server-gui. By adding the UserLinux repository to a system's /etc/apt/sources.list, users can use apt to retrieve the packages necessary to run under one of the UserLinux profiles.

KDE, however, is not in the package lists. A recent email from Bruce Perens to the UserLinux discussion list provoked Slashdot and a few other news sites to declare that UserLinux would support KDE after all. We touched base with Perens on Tuesday, and he said that this comment has been misinterpreted:

In the past, Perens has mentioned that some companies have approached him about the UserLinux concept. We asked Perens if he was now able to name any of the companies that had expressed interest in backing UserLinux. Perens declined to give the name of any companies he'd spoken with, saying that he was in contract negotiations and he could not give any names at this time. He also said that he asks people not to speculate on the companies he may be in talks with, as it might give potential backers cold feet.

We also asked if there was a lot of work needed to make Debian "enterprise-ready." Perens said that Debian is a "solid base" and that there are only a few areas where Debian really needs improvement.

He did acknowledge that there are some areas which need improvement. For example, Perens noted that some Debian packages are installed in a non-functional state by default. Perens said that all packages should be installed in a "working state" even if it's just a demo configuration for testing. He also noted that UserLinux will need to support batch or cluster installs, and that the new Debian installer will make Debian much more business-friendly.

For developers who want to contribute to the project, Perens says that he'd like to see them go through the Debian Developer process and check any packages into the Debian repository first. "I would not like to see a large repository of free software that does not live in Debian for some reason." He said that he expects that UserLinux will begin to draw new people into the project now that the project has entered the testing and development phase.

When can we expect to see an official release of UserLinux? Perens said that there is no firm date, but that the rough date for a release of UserLinux will correspond with the Debian Sarge release. He also noted that UserLinux will be providing pre-releases and CD releases before then.

Comments (18 posted)

New site feature: comment response notifications

Occasionally we get a request from readers to receive copies of responses to their posted comments via email. We have recently freed up a bit of hacking time and added that capability as a subscriber-only feature, with a bit of a twist. That twist is this: response notifications are only available to subscribers at the "professional hacker" level or above.

When we switched over to the subscription model, we implemented the "starving hacker" level as a way for people who couldn't afford the full LWN rate to subscribe anyway. The intended audience was students, people who were looking for work, and those in parts of the world where $5 was a lot of money. Over time, we have noticed a few trends:

• $5 is no longer very much money in much of the world.

• People should be having an easier time finding jobs. Our President says so, so It Must Be True.

• The percentage of our subscriber base taking the "starving hacker" option has grown significantly.

The conclusion we have come to is that, as LWN (hopefully) grows, we need a way to motivate people to select the full-rate option that goes beyond "you'll feel better because you're supporting LWN." Given a cheaper choice with the same benefits, many people will, rationally, take that route.

So limiting response emails to the higher subscription levels is a bit of an experiment. Hopefully, it is a small inducement to select a higher subscription level which does not actually deny anything truly important to the "starving hacker" subscribers. We may take a similar approach with other new features in the future, depending on how this one works out.

Getting response notifications is easy: there is a new dialog that shows up when a comment is published that enables the email feature. There is an expiration date, and the option to get notifications for responses all the way down the tree. There are a couple of things worthy of note:

• We need to have your email address to be able to send responses to you. If you have not given us a working address, the feature won't work. The My Account page can be used to set your address if need be. Also, please don't expect us to navigate through challenge-response systems to send you email.

• If you get tired of seeing notifications, the My Account page will let you turn them off.

You can also set your default response preferences in the account customization area. While adding that capability, we also, finally, added an option for the default setting of the "plain text/HTML" flag for comments.

Comments (38 posted)

Page editor: Jonathan Corbet

Security

Brief items

Fixing spam with postage

Bill Gates has recently come up with an idea for the spam problem: charge postage for email. This idea is far from new, of course, but, when Bill says it, more people listen. On its face, the idea has a certain amount of appeal. Spammers exist because the economics of the email system favor them: large amounts of mail can be sent for no money, meaning that even very small response rates can be profitable. Adding even a small per-message cost would change the situation considerably. Some variations of the scheme have email recipients pocketing the postage themselves, perhaps only if they decide the associated message was unwanted. Others have ISPs collecting that money; for some strange reason, most ISPs tend to be more interested in the latter approach.

There are, of course, a few practical problems with this idea. Large mailing lists, for example. If people sending to a list have to pay postage for every recipient, list traffic is likely to drop considerably. If, instead, a message to a list is paid as a single message, large lists will remain attractive targets for at least some spammers.

The real problem, however, is that the postage approach, in most implementations, takes a classic end-to-end Internet service and turns it into something centralized. Certainly, one can envision a nice system based on micro-payments where individual users have mail clients which deal with postage issues directly and no central authority is involved. Envisioning MSN or Yahoo choosing such a system is rather harder, however. They will, instead, create a central "post office" which enforces the postage policy and which collects some or all of the money involved. The result is unlikely to resemble the email system we have known for the past couple decades or so.

A central post office will require enforcement mechanisms, or people will quickly learn to bypass it. It is hard to imagine unstamped email being easier to stop than, say, music downloads. A postage-for-email scheme looks like a sure way to set off another Internet arms race.

Things would be worse if the imposition of a central post office were actually made to work. The temptation to start filtering mail, initially for viruses or some such, would likely prove irresistible. Beyond doubt, the types of mail requiring filtering would grow over time. A central post office would also be an ideal place for governments to apply taxes to electronic mail as their contribution to ending the spam problem. There are also obvious privacy issues to worry about in this scenario.

The "postage stamp" approach to spam thus looks problematic on many fronts. Before assuming that these problems would block the acceptance of a central post office, however, one should keep this in mind: the spam problem is getting worse quickly. A great many users will be willing to give up a fair amount of their freedom to somebody who can come up with something that looks like a working solution. This is a scary idea, but it is also a great opportunity. If the free software community can come up with a solution to the bulk of the spam problem while preserving our decentralized net and our freedom, World Domination will be that much closer.

Comments (26 posted)

Security posters from Microsoft

Microsoft has had some high-profile security problems recently. A big company like that knows what to do in this sort of situation, however: release a set of motivational posters for the work place. The three posters are downloadable in PDF format; surely our community has no end of gimp artists who can improve on them. Remember: "Protect your stuff: use up-to-date antivirus software."

Comments (5 posted)

New vulnerabilities

crawl: buffer overflow

Package(s):	crawl	CVE #(s):	CAN-2004-0103
Created:	February 3, 2004	Updated:	February 4, 2004
Description:	Steve Kemp from the GNU/Linux audit project discovered a problem in crawl, another console based dungeon exploration game, in the vein of nethack and rogue. The program uses several environment variables as inputs but doesn't apply a size check before copying one of them into a fixed size buffer.
Alerts:	Debian DSA-432-1 2004-02-03

Comments (none posted)

perl information leak

Package(s):	perl	CVE #(s):	CAN-2003-0618
Created:	February 2, 2004	Updated:	April 21, 2004
Description:	Paul Szabo discovered a number of bugs in suidperl, a helper program to run perl scripts with setuid privileges. By exploiting these bugs, an attacker could abuse suidperl to discover information about files (such as testing for their existence and some of their permissions) that should not be accessible to unprivileged users.
Alerts:	Debian DSA-431-2 2004-04-16 Debian DSA-431-1 2004-02-01

Comments (none posted)

util-linux: information leak in the login program

Package(s):	util-linux	CVE #(s):	CAN-2004-0080
Created:	February 3, 2004	Updated:	April 8, 2004
Description:	The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. In some situations, the login program could use a pointer that had been freed and reallocated. This could cause unintentional data leakage.
Alerts:	Netwosix NW-2004-0010 2004-04-08 Gentoo 200404-06 2004-04-07 Fedora-Legacy FLSA:1256 2004-03-04 Whitebox WBSA-2004:056-01 2004-02-12 Red Hat RHSA-2004:056-01 2004-02-02

Comments (1 posted)

Updated vulnerabilities

apache: buffer overflows in mod_alias, mod_rewrite

Package(s):	apache	CVE #(s):	CAN-2003-0542 CAN-2003-0789
Created:	October 28, 2003	Updated:	February 13, 2004
Description:	André Malo discovered buffer overflows in the mod_alias and mod_rewrite modules of the Apache webserver. These occurred if a regular expression with more than 9 capturing parenthesis was configured. To exploit this, an attacker would need to be able to locally create a carefully crafted configuration file (.htaccess or httpd.conf). CAN-2003-0542 Another buffer overflow in Apache 2.0.47 and earlier in mod_cgid's mishandling of CGI redirect paths could result in CGI output going to the wrong client when a threaded MPM is used. CAN-2003-0789.
Alerts:	Whitebox WBSA-2004:015-01 2004-02-12 Fedora FEDORA-2003-004 2004-01-08 Red Hat RHSA-2003:405-00 2003-12-18 Red Hat RHSA-2003:320-01 2003-12-16 Red Hat RHSA-2003:360-01 2003-12-10 Gentoo 200310-03 2003-10-28 Trustix 2003-0041 2003-11-15 Conectiva CLA-2003:775 2003-11-05 Slackware SSA:2003-308-01 2003-11-03 EnGarde ESA-20031105-030 2003-11-05 Mandrake MDKSA-2003:103 2003-11-03 Gentoo 200310-04 2003-10-31 Immunix IMNX-2003-7+-025-01 2003-10-28 OpenPKG OpenPKG-SA-2003.046 2003-10-28

Comments (none posted)

apache2: Denial of Service vulnerability

Package(s):	apache2	CVE #(s):
Created:	September 29, 2003	Updated:	March 25, 2004
Description:	A problem was discovered in Apache2 where CGI scripts that write more than 4k to the standard error stream will hang the script's execution. This problem can lead to a denial of service situation. See this bug report for additional details.
Alerts:	Gentoo 200403-04 2004-03-22 Netwosix NW-2004-0006 2004-03-25 Mandrake MDKSA-2003:096-1 2003-10-24 Mandrake MDKSA-2003:096 2003-09-26

Comments (none posted)

bind: cache poisoning

Package(s):	bind	CVE #(s):	CAN-2003-0914
Created:	November 26, 2003	Updated:	February 19, 2004
Description:	A cache poisoning vulnerability in BIND may be exploited causing a temporary denial of service until the bad record expires from the cache.
Alerts:	SCO Group CSSA-2004-003.0 2004-02-19 Debian DSA-409-1 2004-01-05 SuSE SuSE-SA:2003:047 2003-11-28 Trustix 2003-0044 2003-11-27 Immunix IMNX-2003-7+-024-01 2003-10-27 EnGarde ESA-20031126-031 2003-11-26

Comments (none posted)

CUPS: denial of service

Package(s):	CUPS	CVE #(s):	CAN-2003-0788
Created:	November 3, 2003	Updated:	March 4, 2004
Description:	Paul Mitcheson reported a situation where the CUPS Internet Printing Protocol (IPP) implementation in CUPS versions prior to 1.1.19 would get into a busy loop. This could result in a denial of service. In order to exploit this bug an attacker would need to have the ability to make a TCP connection to the IPP port (by default 631).
Alerts:	SCO Group CSSA-2004-012.0 2004-03-03 Conectiva CLA-2003:779 2003-11-07 Mandrake MDKSA-2003:104 2003-11-05 Red Hat RHSA-2003:275-01 2003-11-03

Comments (none posted)

cvs: possible root compromise

Package(s):	cvs	CVE #(s):	CAN-2003-0977
Created:	December 29, 2003	Updated:	February 13, 2004
Description:	Stable CVS 1.11.11 has been released, adding code to the CVS server to prevent it from continuing as root after a user login, as an extra failsafe against a compromise of the CVSROOT/passwd file.
Alerts:	Whitebox WBSA-2004:004-01 2004-02-12 Fedora-Legacy FLSA:1207 2004-01-28 Conectiva CLA-2004:808 2004-01-20 Debian DSA-422-1 2004-01-13 Red Hat RHSA-2004:003-01 2004-01-09 Gentoo 200312-08 2003-12-28

Comments (none posted)

ethereal: protocol dissector and other vulnerabilities

Package(s):	ethereal	CVE #(s):	CAN-2003-0925 CAN-2003-0926 CAN-2003-0927 CAN-2003-1012 CAN-2003-1013
Created:	December 19, 2003	Updated:	February 13, 2004
Description:	Serious issues have been discovered in two ethereal protocol dissectors. Both vulnerabilities will make the Ethereal application crash. The Q.931 vulnerability also affects Tethereal. It is not known if either vulnerability can be used to make Ethereal or Tethereal run arbitrary code. (CAN-2003-1012 and CAN-2003-1013)
Alerts:	Whitebox WBSA-2004:002-01 2004-02-12 Fedora-Legacy FLSA:1193 2004-01-31 Red Hat RHSA-2004:002-01 2004-01-05 Mandrake MDKSA-2004:002 2004-01-13 Conectiva CLA-2004:801 2004-01-07 Red Hat RHSA-2004:001-01 2004-01-07 Debian DSA-407-1 2004-01-05 Fedora FEDORA-2003-040 2003-12-18

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail may crash on specially crafted message

Package(s):	fetchmail	CVE #(s):	CAN-2003-0792
Created:	October 17, 2003	Updated:	April 8, 2004
Description:	A bug was discovered in fetchmail 6.2.4 where a specially crafted email message can cause fetchmail to crash.
Alerts:	OpenPKG OpenPKG-SA-2004.012 2004-04-08 Gentoo 200403-10 2004-03-30 Netwosix NW-2004-0002 2004-02-20 SCO Group CSSA-2004-004.0 2004-02-19 Slackware SSA:2003-300-02 2003-10-22 Mandrake MDKSA-2003:101 2003-10-16

Comments (none posted)

fileutils/wu-ftpd: denial of service

Package(s):	fileutils	CVE #(s):	CAN-2003-0854
Created:	October 22, 2003	Updated:	March 2, 2004
Description:	There is, it seems, an integer overflow vulnerability in "ls" which can be exploited via wu-ftpd to create a denial of service situation. See this advisory from Georgi Guninski for details.
Alerts:	SCO Group CSSA-2004-006.0 2004-03-01 Trustix 2003-0042 2003-11-15 Mandrake MDKSA-2003:106 2003-11-12 Red Hat RHSA-2003:309-01 2003-11-03 Immunix IMNX-2003-7+-026-01 2003-10-31 Conectiva CLA-2003:771 2003-10-24 Conectiva CLA-2003:768 2003-10-22

Comments (none posted)

gaim: remote overflows

Package(s):	gaim	CVE #(s):	CAN-2004-0006 CAN-2004-0007 CAN-2004-0008
Created:	January 26, 2004	Updated:	February 17, 2004
Description:	Stefan Esser has discovered several vulnerabilities in Gaim 0.75. This advisory has details of 12 separate vulnerabilities.
Alerts:	Fedora FEDORA-2004-070 2004-02-16 Whitebox WBSA-2004:033-01 2004-02-12 Conectiva CLA-2004:813 2004-02-10 Red Hat RHSA-2004:045-01 2004-02-09 Debian DSA-434-1 2004-02-05 Mandrake MDKSA-2004:006-1 2004-01-30 SuSE SuSE-SA:2004:004 2004-01-29 Gentoo 200401-04 2004-01-27 Mandrake MDKSA-2004:006 2004-01-26 Slackware SSA:2004-026-01 2004-01-26 Red Hat RHSA-2004:033-01 2004-01-23 Red Hat RHSA-2004:032-01 2004-01-23

Comments (none posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

GnuPG: ElGamal signing keys compromised

Package(s):	gnupg	CVE #(s):	CAN-2003-0971
Created:	November 28, 2003	Updated:	March 3, 2004
Description:	A severe vulnerability was discovered in GnuPG by Phong Nguyen relating to ElGamal sign+encrypt keys. This email message from Werner Koch contains more information. "Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. Note that this is a real world vulnerability which will reveal your private key within a few seconds."
Alerts:	SCO Group CSSA-2004-009.0 2004-03-02 Debian DSA-429-2 2004-02-13 Debian DSA-429-1 2004-01-26 Gentoo 200312-05 2003-12-12 Fedora FEDORA-2003-025 2003-12-10 Red Hat RHSA-2003:395-01 2003-12-10 Red Hat RHSA-2003:390-01 2003-12-10 Conectiva CLA-2003:798 2003-12-09 SuSE SuSE-SA:2003:048 2003-12-03 Mandrake MDKSA-2003:109 2003-11-28

Comments (3 posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

iproute: local denial of service

Package(s):	iproute net-tools	CVE #(s):	CAN-2003-0856
Created:	November 25, 2003	Updated:	December 14, 2004
Description:	The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible.
Alerts:	Mandrake MDKSA-2004:148 2004-12-13 Fedora FEDORA-2004-154 2004-06-03 Fedora FEDORA-2004-115 2004-05-11 Debian DSA-492-1 2004-04-18 Gentoo 200404-10 2004-04-09 Red Hat RHSA-2003:316-01 2003-11-24

Comments (none posted)

kdepim: VCF file information reader vulnerability

Package(s):	kdepim	CVE #(s):	CAN-2003-0988
Created:	January 15, 2004	Updated:	May 26, 2004
Description:	KDE has issued a security advisory for all versions of kdepim as distributed with KDE versions 3.1.0 through 3.1.4 inclusive. A carefully crafted .VCF file potentially enables local attackers to compromise the privacy of a victim's data or execute arbitrary commands with the victim's privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0988 to this issue.
Alerts:	Fedora FEDORA-2004-133 2004-05-19 Gentoo 200404-02 2004-04-06 Whitebox WBSA-2004:005-01 2004-02-12 Conectiva CLA-2004:810 2004-01-20 Slackware SSA:2004-014-01 2004-01-14 Mandrake MDKSA-2004:003 2004-01-14 Red Hat RHSA-2004:006-01 2004-01-07

Comments (none posted)

kernel: privilege vulnerability on AMD64

Package(s):	kernel	CVE #(s):	CAN-2004-0001
Created:	January 16, 2004	Updated:	February 17, 2004
Description:	On AMD64 systems, a fix was made to the eflags checking in 32-bit ptrace emulation that could have allowed local users to elevate their privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0001 to this issue.
Alerts:	Gentoo 200402-06 2004-02-17 Red Hat RHSA-2004:017-01 2004-01-13

Comments (none posted)

kernel: local root exploit in 2.4.22

Package(s):	kernel	CVE #(s):	CAN-2003-0961
Created:	December 1, 2003	Updated:	April 5, 2004
Description:	A vulnerability was discovered in the Linux kernel versions 2.4.22 and previous. A flaw in bounds checking in the do_brk() function can allow a local attacker to gain root privileges. This vulnerability is known to be exploitable. The 2.4.23 kernel contains the fix. For more details on how this vulnerability works, see this LWN article.
Alerts:	Debian DSA-475-1 2004-04-05 Debian DSA-470-1 2004-04-01 Debian DSA-442-1 2004-02-19 Debian DSA-433-1 2004-02-04 Debian DSA-423-1 2004-01-15 Red Hat RHSA-2003:368-01 2003-12-19 Conectiva CLA-2003:796 2003-12-05 Gentoo 200312-02 2003-12-04 SuSE SuSE-SA:2003:049 2003-12-04 Yellow Dog YDU-20031203-1 2003-12-03 Red Hat RHSA-2003:389-01 2003-12-01 Fedora FEDORA-2003-026 2003-12-02 Slackware SSA:2003-336-01 2003-12-01 Red Hat RHSA-2003:392-00 2003-12-01 Trustix 2003-0046 2003-12-01 Mandrake MDKSA-2003:110 2003-12-01 Debian DSA-403-1 2003-12-01

Comments (1 posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

lftp buffer overflows

Package(s):	lftp	CVE #(s):	CAN-2003-0963
Created:	December 15, 2003	Updated:	February 13, 2004
Description:	According to this advisory versions of lftp prior to 2.6.10 are vulnerable to two exploitable buffer overflow problems. Both occur when you connect to a web server with lftp using HTTP or HTTPS, and then use lftp's "ls" or "rels" commands on specially prepared directories on the web server.
Alerts:	Whitebox WBSA-2003:404-01 2003-12-17 Conectiva CLA-2004:800 2004-01-06 Debian DSA-406-1 2004-01-05 Gentoo 200312-07 2003-12-16 OpenPKG OpenPKG-SA-2003.053 2003-12-17 Red Hat RHSA-2003:404-01 2003-12-16 Red Hat RHSA-2003:403-01 2003-12-16 Mandrake MDKSA-2003:116 2003-12-15 Fedora FEDORA-2003-034 2003-12-15 SuSE SuSE-SA:2003:051 2003-12-15 Immunix IMNX-2003-73-002-01 2003-12-09 Slackware SSA:2003-346-01 2003-12-12

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

mc: arbitrary code execution

Package(s):	mc	CVE #(s):	CAN-2003-1023
Created:	January 16, 2004	Updated:	April 5, 2004
Description:	A vulnerability was discovered in Midnight Commander, a file manager, whereby a malicious archive (such as a .tar file) could cause arbitrary code to be executed if opened by Midnight Commander.
Alerts:	OpenPKG OpenPKG-SA-2004.009 2004-04-05 Gentoo 200403-09 2004-03-29 Conectiva CLA-2004:833 2004-03-31 SCO Group CSSA-2004-014.0 2004-03-25 Whitebox WBSA-2004:035-01 2004-02-12 Fedora FEDORA-2004-058 2004-02-09 Red Hat RHSA-2004:035-01 2004-01-19 Mandrake MDKSA-2004:007 2004-01-26 Red Hat RHSA-2004:034-01 2004-01-19 Debian DSA-424-1 2004-01-16

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mod_python: denial of service vulnerability

Package(s):	mod_python	CVE #(s):	CAN-2003-0973
Created:	January 27, 2004	Updated:	October 4, 2004
Description:	Apache's mod_python module could crash the httpd process if a specific, malformed query string was sent. The Apache Foundation has reported that mod_python may be prone to Denial of Service attacks when handling a malformed query. Mod_python 2.7.9 was released to fix the vulnerability, however, because the vulnerability has not been fully fixed, version 2.7.10 has been released. Users of mod_python 3.0.4 are not affected by this vulnerability.
Alerts:	Fedora-Legacy FLSA:1325 2004-10-03 Conectiva CLA-2004:837 2004-04-12 Whitebox WBSA-2004:058-01 2004-03-01 Debian DSA-452-1 2004-02-29 Red Hat RHSA-2004:058-01 2004-02-26 Red Hat RHSA-2004:063-01 2004-02-26 Gentoo 200401-03 2004-01-27

Comments (none posted)

mpg123: heap overflow

Package(s):	mpg123	CVE #(s):	CAN-2003-0865
Created:	November 12, 2003	Updated:	February 19, 2004
Description:	Versions of mpg123 through 0.59s contain a heap overflow which may be exploited remotely (by a hostile server). See this advisory for details.
Alerts:	SCO Group CSSA-2004-002.0 2004-02-19 Debian DSA-435-1 2004-02-06 Conectiva CLA-2003:781 2003-11-12

Comments (none posted)

mpg321: format string vulnerability

Package(s):	mpg321	CVE #(s):	CAN-2003-0969
Created:	January 6, 2004	Updated:	March 28, 2005
Description:	A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
Alerts:	Gentoo 200503-34 2005-03-28 Debian DSA-411-1 2004-01-05

Comments (none posted)

mplayer: remotely exploitable buffer overflow vulnerability

Package(s):	mplayer	CVE #(s):	CAN-2003-0835
Created:	September 29, 2003	Updated:	April 6, 2004
Description:	A remotely exploitable buffer overflow vulnerability was found in MPlayer. A malicious host can craft a harmful ASX header, and trick MPlayer into executing arbitrary code upon parsing that header. Read the full advisory for details.
Alerts:	Mandrake MDKSA-2004:026 2004-04-05 Gentoo 200403-13 2004-03-31 Conectiva CLA-2003:760 2003-10-06 Mandrake MDKSA-2003:097 2003-09-30 Gentoo 200309-15 2003-09-27

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

netpbm: insecure temporary files

Package(s):	netpbm	CVE #(s):	CAN-2003-0924
Created:	January 19, 2004	Updated:	December 29, 2004
Description:	netpbm is graphics conversion toolkit made up of a large number of single-purpose programs. Many of these programs were found to create temporary files in an insecure manner, which could allow a local attacker to overwrite files with the privileges of the user invoking a vulnerable netpbm tool.
Alerts:	Conectiva CLA-2004:909 2004-12-29 Gentoo 200410-02 2004-10-04 Mandrake MDKSA-2004:011-1 2004-09-27 Whitebox WBSA-2004:031-01 2004-02-12 Mandrake MDKSA-2004:011 2004-02-11 Red Hat RHSA-2004:030-01 2004-02-05 Fedora FEDORA-2004-068 2004-02-06 Red Hat RHSA-2004:031-01 2004-01-22 Debian DSA-426-1 2004-01-18

Comments (1 posted)

Net-SNMP: security bugs in versions before 5.0.9

Package(s):	Net-SNMP	CVE #(s):	CAN-2003-0935
Created:	December 2, 2003	Updated:	February 13, 2004
Description:	The Net-SNMP project includes various Simple Network Management Protocol (SNMP) tools. A security issue in Net-SNMP versions before 5.0.9 could allow an existing user/community to gain access to data in MIB objects that were explicitly excluded from their view. Version 5.0.9 of Net-SNMP is not vulnerable to this issue. In addition, Net-SNMP 5.0.9 fixes a number of other minor bugs.
Alerts:	Whitebox WBSA-2004:023-01 2004-02-12 Red Hat RHSA-2004:023-01 2004-01-15 Mandrake MDKSA-2003:115 2003-12-11 Red Hat RHSA-2003:335-01 2003-12-02

Comments (none posted)

nfs-utils xlog() off-by-one bug

Package(s):	nfs-utils	CVE #(s):	CAN-2003-0252
Created:	July 14, 2003	Updated:	March 8, 2004
Description:	Linux NFS utils package contains remotely exploitable off-by-one bug. A local or remote attacker could exploit this vulnerability by sending specially crafted request to rpc.mountd daemon. See this BugTraq post for more details.
Alerts:	Trustix TSLSA-2004-0009 2004-03-05 SCO Group CSSA-2003-037.0 2003-11-17 Conectiva CLA-2003:700 2003-07-22 Mandrake MDKSA-2003:076 2003-07-21 Gentoo 200307-07 2003-07-19 Yellow Dog YDU-20030718-1 2003-07-18 Slackware SSA:2003-195-01b 2003-07-15 Immunix IMNX-2003-7+-018-01 2003-07-14 SuSE SuSE-SA:2003:031 2003-07-15 Slackware SSA:2003-195-01 2003-07-14 Debian DSA-349-1 2003-07-14 Red Hat RHSA-2003:206-01 2003-07-14

Comments (none posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

postfix: denial of service vulnerabilities

Package(s):	postfix	CVE #(s):	CAN-2003-0468 CAN-2003-0540
Created:	August 5, 2003	Updated:	May 27, 2004
Description:	The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:	Mandrake MDKA-2004:028 2004-05-26 Trustix 2003-0029 2003-08-04 Mandrake MDKSA-2003:081 2003-08-04 EnGarde ESA-20030804-019 2003-08-04 Conectiva CLA-2003:717 2003-08-04 SuSE SuSE-SA:2003:033 2003-08-04 Red Hat RHSA-2003:251-01 2003-08-04 Debian DSA-363-1 2003-08-03

Comments (none posted)

rsync - remotely exploitable heap overflow

Package(s):	rsync	CVE #(s):	CAN-2003-0962
Created:	December 4, 2003	Updated:	March 3, 2004
Description:	An advisory has gone out warning of a remotely exploitable heap overflow vulnerability in rsync versions 2.5.6 and prior. If you are running an rsync server, you will want to apply a distributor patch or upgrade to 2.5.7 in the near future.
Alerts:	SCO Group CSSA-2004-010.0 2004-03-02 Immunix IMNX-2003-73-001-01 2003-12-05 Mandrake MDKSA-2003:111 2003-12-04 Red Hat RHSA-2003:399-01 2003-12-04 Red Hat RHSA-2003:398-01 2003-12-04 Fedora FEDORA-2003-030 2003-12-04 Conectiva CLA-2003:794 2003-12-04 Gentoo 200312-03 2003-12-04 EnGarde ESA-20031204-032 2003-12-04 Debian DSA-404-1 2003-12-04 OpenPKG OpenPKG-SA-2003.051 2003-12-04 SuSE SuSE-SA:2003:050 2003-12-04 Trustix 2003-0048 2003-12-04 Slackware SSA:2003-337-01 2003-12-03

Comments (none posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

sane-backends: several vulnerabilities

Package(s):	sane-backends	CVE #(s):	CAN-2003-0773 CAN-2003-0774 CAN-2003-0775 CAN-2003-0776 CAN-2003-0777 CAN-2003-0778
Created:	September 11, 2003	Updated:	February 20, 2004
Description:	Alexander Hvostov, Julien Blache and Aurelien Jarno discovered several security-related problems in the sane-backends package, which contains an API library for scanners including a scanning daemon (in the package libsane) that can be remotely exploited. These problems allow a remote attacker to cause a segfault fault and/or consume arbitrary amounts of memory. The attack is successful, even if the attacker's computer isn't listed in saned.conf. You are only vulnerable if you actually run saned e.g. in xinetd or inetd. If the entries in the configuration file of xinetd or inetd respectively are commented out or do not exist, you are safe. Try "telnet localhost 6566" on the server that may run saned. If you get "connection refused" saned is not running and you are safe. The Common Vulnerabilities and Exposures project identifies the following problems: CAN-2003-0773: saned checks the identity (IP address) of the remote host only after the first communication took place (SANE_NET_INIT). So everyone can send that RPC, even if the remote host is not allowed to scan (not listed in saned.conf). CAN-2003-0774: saned lacks error checking nearly everywhere in the code. So connection drops are detected very late. If the drop of the connection isn't detected, the access to the internal wire buffer leaves the limits of the allocated memory. So random memory "after" the wire buffer is read which will be followed by a segmentation fault. CAN-2003-0775: If saned expects strings, it mallocs the memory necessary to store the complete string after it receives the size of the string. If the connection was dropped before transmitting the size, malloc will reserve an arbitrary size of memory. Depending on that size and the amount of memory available either malloc fails (->saned quits nicely) or a huge amount of memory is allocated. Swapping and OOM measures may occur depending on the kernel. CAN-2003-0776: saned doesn't check the validity of the RPC numbers it gets before getting the parameters. CAN-2003-0777: If debug messages are enabled and a connection is dropped, non-null-terminated strings may be printed and segmentation faults may occur. CAN-2003-0778: It's possible to allocate an arbitrary amount of memory on the server running saned even if the connection isn't dropped. At the moment this can not easily be fixed according to the author. Better limit the total amount of memory saned may use (ulimit).
Alerts:	SCO Group CSSA-2004-005.0 2004-02-19 SuSE SuSE-SA:2003:046 2003-11-18 Conectiva CLA-2003:769 2003-10-22 Mandrake MDKSA-2003:099 2003-10-09 Red Hat RHSA-2003:278-01 2003-10-07 Debian DSA-379-1 2003-09-11

Comments (none posted)

screen: privilege escalation

Package(s):	screen	CVE #(s):	CAN-2003-0972
Created:	November 28, 2003	Updated:	March 3, 2004
Description:	According to this advisory a buffer overflow in GNU screen allows privilege escalation for local users. Usually screen is installed either setgid-utmp or setuid-root. It also has some potential for remote attacks or getting control of another user's screen. The problem is that you have to transfer around 2-3 gigabytes of data to user's screen to exploit this vulnerability. 4.0.1, 3.9.15 and older versions are vulnerable.
Alerts:	SCO Group CSSA-2004-011.0 2004-03-02 Fedora-Legacy FLSA:1187 2004-01-26 Conectiva CLA-2004:809 2004-01-20 Debian DSA-408-1 2004-01-05 Mandrake MDKSA-2003:113 2003-12-08 OpenPKG OpenPKG-SA-2003.050 2003-11-28

Comments (none posted)

slocate: buffer overflow

Package(s):	slocate	CVE #(s):	CAN-2003-0848
Created:	January 20, 2004	Updated:	February 16, 2004
Description:	A vulnerability was discovered in slocate, a program to index and search for files, whereby a specially crafted database could overflow a heap-based buffer. This vulnerability could be exploited by a local attacker to gain the privileges of the "slocate" group, which can access the global database containing a list of pathnames of all files on the system, including those which should only be visible to privileged users. This problem, and a category of potential similar problems, can be fixed by modifying slocate to drop privileges before reading a user-supplied database.
Alerts:	Fedora-Legacy FLSA:1232 2004-02-11 Whitebox WBSA-2004:041-01 2004-02-12 SCO Group CSSA-2004-001.0 2004-02-10 Fedora FEDORA-2004-059 2004-01-26 Red Hat RHSA-2004:041-01 2004-01-22 Mandrake MDKSA-2004:004 2004-01-23 Trustix 2004-0005 2004-01-21 Debian DSA-428-1 2004-01-20

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tcpdump: flaws in the ISAKMP decoding routines

Package(s):	tcpdump	CVE #(s):	CAN-2003-0989 CAN-2004-0057 CAN-2004-0055
Created:	January 15, 2004	Updated:	April 6, 2004
Description:	George Bakos discovered flaws in the ISAKMP decoding routines of tcpdump versions prior to 3.8.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0989 to this issue. Jonathan Heusser discovered two additional flaws in the ISAKMP decoding routines of tcpdump versions up to and including 3.8.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0057 to this issue. Jonathan Heusser discovered a flaw in the print_attr_string function in the RADIUS decoding routines for tcpdump 3.8.1 and earlier. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0055 to this issue. Remote attackers could potentially exploit these issues by sending carefully-crafted packets to a victim. If the victim uses tcpdump, these packets could result in a denial of service, or possibly execute arbitrary code as the 'pcap' user.
Alerts:	Gentoo 200404-03 2004-03-31 Fedora FEDORA-2004-091 2004-03-04 SCO Group CSSA-2004-008.0 2004-03-02 Fedora FEDORA-2004-092 2004-03-02 Whitebox WBSA-2004:008-01 2004-02-12 Fedora-Legacy FLSA:1222 2004-01-31 Mandrake MDKSA-2004:008 2004-01-26 EnGarde ESA-20040119-002 2004-01-19 Debian DSA-425-1 2004-01-16 OpenPKG OpenPKG-SA-2004.002 2004-01-16 Trustix 2004-0004 2004-01-05 SuSE SuSE-SA:2004:002 2004-01-14 Red Hat RHSA-2004:008-01 2004-01-15 Red Hat RHSA-2004:007-01 2004-01-14

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

trr19 - privilege leakage

Package(s):	trr19	CVE #(s):	CAN-2004-0047
Created:	January 28, 2004	Updated:	January 28, 2004
Description:	The trr19 utility fails to drop group privileges, thus giving group access to a local attacker.
Alerts:	Debian DSA-430-1 2004-01-28

Comments (none posted)

vim - modeline vulnerability

Package(s):	vim	CVE #(s):	CAN-2002-1377
Created:	January 16, 2003	Updated:	February 10, 2004
Description:	VIM allows a user to set the modeline differently for each edited text file by placing special comments in the files. Georgi Guninski found that these comments can be carefully crafted in order to call external programs. This could allow an attacker to create a text file such that when it is opened arbitrary commands are executed.
Alerts:	Conectiva CLA-2004:812 2004-02-10 Mandrake MDKSA-2003:012 2003-02-03 Yellow Dog YDU-20030127-3 2003-01-27 Gentoo 200301-13 2003-01-22 OpenPKG OpenPKG-SA-2003.003 2003-01-21 Red Hat RHSA-2002:297-17 2003-01-15

Comments (4 posted)

Resources

Countering buffer overflows (developerWorks)

David A. Wheeler talks about preventing buffer overflow vulnerabilities on the developerWorks site. "This article first explains what buffer overflows are and why they're both so common and so dangerous. It then discusses the new Linux and UNIX methods for broadly countering them -- and why these methods are not enough. It then shows various ways to counter buffer overflows in C/C++ programs, both statically-sized approaches (such as the standard C library and OpenBSD/strlcpy solution) and dynamically-sized solutions, as well as some tools to help you. Finally, the article closes with some predictions on the future of buffer overflow vulnerabilities."

Comments (none posted)

Events

DIMVA 2004

The Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA) conference will be held July 6 and 7 in Dortmund, Germany. The call for papers is out, with a submission deadline of February 29.

Full Story (comments: none)

ESORICS and RAID 2004

The 9th European Symposium on Research in Computer Security will be held in Sophia Antipolis, on the French Riviera, on September 13 to 15. The call for papers is out; the submission deadline is March 26.

This conference will be immediately followed by RAID 2004, the Seventh International Symposium on Recent Advances in Intrusion Detection. This conference, too, is looking for submissions; deadline is March 31.

Comments (none posted)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current 2.6 kernel is 2.6.2, which was announced by Linus on February 3. Very few changes have been made since the last release candidate. For those of you just tuning in, the major changes since 2.6.1 include a bunch of block device hotplug work, many big driver updates, sysfs support for many new types of devices, a big XFS update, some sleep_on() removal work, and lots of fixes; see the long-format changelog for the details.

Linus's BitKeeper tree contains, as of this writing, a fair number of patches. One of them, is a VFS fix by Stephen Tweedie which addresses a problem (triggered, but not caused, by SELinux) that delayed the first Fedora Core 2 test release. Other patches which have been merged include some architecture updates, some dead code removal, a RAID update, the deprecation of the raw block device driver, the readX_relaxed() functions for reading from PCI space without ordering requirements, a large set of gcc-3.5 fixes, some network driver updates, and various other fixes.

The current patch set from Andrew Morton is 2.6.2-rc3-mm1. Recent additions to the -mm tree include the CPU hotplug patch, the "large number of groups" patch, a new variant on snprintf() (see below), and lots of fixes. Note that the large groups patch breaks the intermezzo filesystem, which appears to be unmaintained under 2.6 for now.

The current 2.4 kernel is 2.4.24. Marcelo released 2.4.25-pre8 on January 29; it contains a fair amount of new stuff: a big USB update (including the new gadget code), CIFS work from 2.6, some SCSI driver updates, various architecture updates, and more. This is, says Marcelo, probably the last prepatch (before the release candidates start).

Comments (1 posted)

Kernel development news

Software Suspend 2.0

The better part of a year ago, your editor replaced his ancient Sony Vaio laptop with a new Vaio laptop. The new machine is quite nice in many ways, but it came with an interesting surprise: the old BIOS-based suspend-to-disk functionality was no more. In the modern world, suspending the system is supposed to be done by the operating system, not by the hardware; that's what we call "progress."

Ever since getting the new laptop, your editor has been interested in the software suspend patch, which promises to restore that missing functionality. Versions of that patch have been working reasonably well for a while, but software suspend work has not stood still. The announcement of the software suspend 2.0 patch was thus of interest.

The new patch brings with it a number of new improvements. Software suspend now works on systems with high memory (up to 4GB, which will be sufficient for most laptops for a little while yet), SMP systems (2.4 only), and preemptive kernels. Suspend-to-disk will now work with swap files, not just dedicated partitions. Compression of the saved image is supported, which can lead to faster suspends and resumes on some systems. And, of course, there is a nicer, splash-screen enabled user interface.

The fact remains, however, that software suspend is a hard problem, and the Linux version still has some ground to cover before it is truly ready for general use. Your editor had no end of trouble getting the 2.0 patch to work until the software suspend hackers pointed out the USB code which had been built into the kernel. USB and power management do not yet play very well together, it seems. The only way to make the 2.0 patch work reliably on systems with USB is to compile all of the USB code in modular form so that it may be removed from the kernel prior to suspending. There are also issues with AGP video, SMP under 2.6, and various other parts of the system. Software suspend can be made to work well, but you have to be prepared to dig into the kernel a bit to get there.

It is encouraging to see how quickly this work is proceeding, however. A stable, safe, reliable software suspend functionality later in the 2.6 series could well come about. (If you are interested in how software suspend works, see the May 1, 2003 LWN Kernel Page).

Comments (1 posted)

Generic DMA pools

Device driver authors sometimes find that they have to perform DMA operations on very small pieces of memory. It is tempting to just perform this sort of DMA (often just a few bytes) directly into or out of a kernel data structure. The problem with this approach is that caching issues can arise; memory adjacent to the region being read or written by the device can end up with the wrong values. Needless to say, this sort of memory corruption is not good for long-term system stability.

This problem can be avoided through the use of "PCI pools." A PCI pool is simply a source of small pieces of memory which are suitable for DMA operations. A driver which makes use of a PCI pool for its small DMA needs will not have memory corruption issues.

There is only one problem with PCI pools: not all devices are attached to a PCI bus. With the intent of making the PCI pool functionality available to a wider class of devices, Deepak Saxena has posted a set of patches implementing a new "DMA pool" abstraction. The new interface is strikingly similar to the old one - to the point that the old pci_pool_ functions can be emulated with simple macros. As a result, drivers using the old PCI functions will continue to work without changes.

In the new scheme, DMA pools are allocated and destroyed with:

    struct dma_pool *dma_pool_create(const char *name, struct device *dev,
                                     size_t size, size_t align,
				     size_t allocation);
    void dma_pool_destroy(struct dma_pool *pool);

Parameters for the creation of the pool include its name, the device which will be using the pool, the size of blocks to be allocated from the pool, and the required alignment. Optionally, the allocation parameter can be used to keep pool memory from crossing a specific memory size barrier; if allocation is 4096, for example, no pool allocation will cross a 4K page boundary. The main difference from the old pci_pool_create() function is the use of a device structure rather than a pci_dev structure.

The allocation and deallocation functions are:

    void *dma_pool_alloc(struct dma_pool *pool, int mem_flags,
                         dma_addr_t *handle);
    void dma_pool_free(struct dma_pool *pool, void *vaddr, 
                       dma_addr_t handle);

Internally, the new pool functions bear a strong resemblance to the old ones - with the obvious exception that the memory for the pools is now allocated using the generic DMA functions.

This patch has been received well; chances are it will appear in a kernel sometime after 2.6.2 comes out.

Comments (none posted)

snprintf() confusion

Any C coder worth his or her salt knows that encoding text into a string with sprintf() invites buffer overflows, and is thus dangerous. The proper way of doing things is with snprintf(), which takes the length of the destination string as a parameter, and will not overrun it. Callers to snprintf() generally assume that the return value is the length of what was actually encoded into the destination array. That turns out, however, to not be the case. As per the C99 standard, snprintf() returns the length the resulting string would be, assuming it all fit into the destination array. As a result of this misunderstanding, the kernel is full of snprintf() calls which use the return value incorrectly.

This mistake is rarely a problem; snprintf() almost never has to truncate its output, so the return value is what the programmer is expecting. Every miscoded use is an invitation for trouble, however, and really should be fixed. To that end, the 2.6.2-rc3-mm1 tree contains a patch by Juergen Quade which adds a couple of new functions:

    int scnprintf(char *buf, size_t size, const char *format, ...);
    int vscnprintf(char *buf, size_t size, const char *format, va_list args);

The new functions work the way many programmers expected the old ones to: they return the length of the string actually created in buf. The plan is to migrate the kernel over to the new functions; the patch fixes well over 200 snprintf() and vsnprint() calls. Unless the old functions are eventually removed, however, they are likely to be a source of programming errors well into the future.

Comments (13 posted)

Trimming down sysfs

The sysfs virtual filesystem is one of the many additions to the 2.6 kernel. sysfs is the user-space presentation of the kernel's device model; it is used by the udev utility to create device nodes for hardware and, eventually, numerous other purposes. There is a lot of information about the system available under sysfs; it may, eventually, replace many of the files currently found under /proc.

There is one little problem with sysfs, however. It is built as a simple kernel filesystem using the VFS cache as its backing store. This is an easy way to build a kernel filesystem, since the generic VFS code does most of the hard work for you. It does, however, require the kernel to maintain a directory entry ("dentry") cache entry and an inode in memory for every file and directory in the filesystem. As sysfs has grown, the amount of memory it dedicates to dentries and inodes has grown as well. Even a small system can have several hundred files in /sys; that number can grow impressively for larger systems. The memory that all those sysfs nodes occupy can be painful for very small systems (which do not have much memory to spare) and for very large systems (because sysfs lives in low memory, which is at a premium).

In order to deal with this problem, Maneesh Soni has been working on a set of patches which provides a true backing store for sysfs. These patches (the full set can be found in the "patches and updates" section, below) retain the current VFS-level cache for directories; doing otherwise turns out to open a fairly large can of worms in how the device model and the VFS interact. All of the attribute files (which make up 70% or so of sysfs entries), however, can be more compactly represented by the sysfs code itself. All that is really needed for an attribute, after all, is its name and pointers to the "show" and "store" functions.

To this end, the patches create a new sysfs_dirent structure which describes a node in the sysfs hierarchy. These structures implement an in-core representation of the sysfs tree that takes up far less space than the full VFS-cached version. When user space accesses a specific attribute node, it is a fairly straightforward matter to create the inode and dentry structures on the spot. Neither structure need be pinned into memory, so they can be aged out with the rest of the VFS cache.

The result of all this work, Maneesh claims, is a savings of 145MB of low memory on his (massive) test system. The number of active dentries in this system drops from over 60,000 to under 9,000. Unlike early versions of this patch, the current effort also avoids making changes to the kobject structure, so no penalty is paid for structures using kobjects which do not appear in sysfs. As the patch has evolved, the number of criticisms has gone down; sysfs backing store appears to be getting closer to ready for inclusion.

Comments (none posted)

Patches and updates

Kernel trees

• Linus Torvalds: Linux 2.6.2 aka "Feisty Dunnart". (February 4, 2004)

• Linus Torvalds: Linux 2.6.2-rc3. (January 31, 2004)

• Andrew Morton: 2.6.2-rc3-mm1. (February 3, 2004)

• Matt Mackall: 2.6.2-rc3-tiny1 for small systems. (February 2, 2004)

• Andrew Morton: 2.6.2-rc2-mm2. (January 30, 2004)

• Con Kolivas: 2.6.1-ck3. (February 3, 2004)

• Marcelo Tosatti: Linux 2.4.25-pre8. (January 29, 2004)

Core kernel code

• Nigel Cunningham: Software Suspend 2.0. (January 30, 2004)

• Shailabh Nagar: Revised CKRM API. (January 31, 2004)

• Rusty Russell: 2.6.2-rc2-mm2 CPU Hotplug: cpu_active_map. (January 31, 2004)

• Rusty Russell: 2.6.2-rc2-mm2 CPU Hotplug. (January 31, 2004)

• Rusty Russell: 2.6.2-rc2-mm2 CPU Hotplug: The Core. (January 31, 2004)

• Rusty Russell: 2.6.2-rc2-mm2 CPU Hotplug: i386 support. (January 31, 2004)

• Rusty Russell: New v. v. experimental HOTPLUG CPU megapatch.. (February 3, 2004)

Device drivers

• Max Asbock: Driver for IBM RSA service processor (1/2). (February 2, 2004)

• Max Asbock: Driver for IBM RSA service processor (2/2). (February 2, 2004)

• Deepak Saxena: Replace pci_pool with generic dma_pool. (February 3, 2004)

• Deepak Saxena: Replace pci_pool with generic dma_pool (1/3). (February 3, 2004)

• Deepak Saxena: Replace pci_pool with generic dma_pool (2/3). (February 3, 2004)

• Deepak Saxena: Replace pci_pool with generic dma_pool (3/3). (February 3, 2004)

• James Bottomley: SCSI updates for 2.6.2. (February 4, 2004)

Documentation

• Vojtech Pavlik: 2.6 input drivers FAQ. (February 2, 2004)

Filesystems and block I/O

• Maneesh Soni: RFC/T 0/6 sysfs backing store (with symlink). (February 4, 2004)

• Maneesh Soni: RFC/T 1/6 sysfs backing store (with symlink). (February 4, 2004)

• Maneesh Soni: RFC/T 2/6 sysfs backing store (with symlink). (February 4, 2004)

• Maneesh Soni: RFC/T 3/6 sysfs backing store (with symlink). (February 4, 2004)

• Maneesh Soni: RFC/T 4/6 sysfs backing store (with symlink). (February 4, 2004)

• Maneesh Soni: RFC/T 5/6 sysfs backing store (with symlink). (February 4, 2004)

• Maneesh Soni: RFC/T 6/6 sysfs backing store (with symlink). (February 4, 2004)

Janitorial

• Randy.Dunlap: add syscalls.h (v2). (February 3, 2004)

• Randy.Dunlap: add syscalls.h (ver. ~4). (February 4, 2004)

Kernel building

• Andreas Gruenbacher: External kernel modules. (February 2, 2004)

Memory management

• Nick Piggin: mm swapping improvements. (January 30, 2004)

• Alok Mooley: Active Memory Defragmentation: Our implementation & problems. (February 3, 2004)

• Nick Piggin: mm improvements 0/5. (February 4, 2004)

• Nick Piggin: mm improvements 1/5. (February 4, 2004)

• Nick Piggin: mm improvements 2/5. (February 4, 2004)

• Nick Piggin: mm improvements 3/5. (February 4, 2004)

• Nick Piggin: mm improvements 4/5. (February 4, 2004)

• Nick Piggin: mm improvements 5/5. (February 4, 2004)

Networking

• Patrick McHardy: : HFSC packet scheduler. (February 3, 2004)

Security-related

• James Morris: (1/3) SELinux context mount support - LSM/FS. (February 4, 2004)

• James Morris: (2/3) SELinux context mount support - NFS. (February 4, 2004)

• James Morris: (3/3) SELinux context mount support - SELinux changes.. (February 4, 2004)

Miscellaneous

• Greg KH: udev 016 release. (February 3, 2004)

• Mariusz Mazur: glibc-kernel-headers 2.6.1.2 released. (February 4, 2004)

Page editor: Jonathan Corbet

Distributions

News and Editorials

Substituting RHEL with Free Alternatives

Ever since last year's announcement by Red Hat that it would discontinue its free Red Hat Linux, concentrating instead on the Red Hat Enterprise Linux (RHEL) product line, a new breed of Linux distributions began to emerge. Since source RPM packages of all RHEL products are freely available on the company's FTP servers and mirrors, why not use them to build a complete RHEL clone? All that had to be done was remove trademarked logos and other references to Red Hat from the original source RPMs, then compile them into binary ones, and voilà - a new distribution is born. And because all Red Hat erratas and updates are also released in the form of source RPMs, keeping this new distribution up-to-date with security patches would be a simple matter of compiling the updated source RPMs and releasing them for download.

Indeed, several such projects have been born over the last few months. Although not all of them are completely free (beer), they all have one thing in common - they cost a lot less than the real RHEL. As such, they are more likely to attract small businesses and organizations that had standardized on Red Hat Linux before it was discontinued. What are their choices? Some of the projects that have built a complete Linux distribution from RHEL source RPM packages include CentOS, Lineox Enterprise Linux, Tao Linux and White Box Enterprise Linux.

White Box Enterprise Linux was the first officially released distribution built from RHEL's source RPMs. The project was initiated by a public library in Louisiana, USA and its motivation is best summed up by the representatives of the library itself:

White Box Enterprise Linux is completely free in both senses of the word. While the project lacks a flashy web site, all the most important pieces are present: basic documentation (including a tutorial on compiling source RPMs), highly active mailing lists, and most importantly, security updates via "yum" from several available mirrors. Version 3.0, code name "liberation", was released on December 15, 2003.

Tao Linux is another free RHEL clone. It was created for reasons not much different than those driving the White Box project - the attraction of having a well-built distribution running critical servers for years with very little maintenance beyond occasional security updates. The project also supports upgrades via "yum". The maintainer promises to provide free security and bug-fix updates for a period of at least 3 years, making them available within 72 hours after their upstream release by Red Hat. However, the author does not currently recommend Tao Linux to inexperienced users. Like White Box, the Tao Linux project provides detailed information about rebuilding Red Hat's source RPM, access to mailing lists and several download mirrors. Tao Linux Release One (code name "mooch") was released on December 16, 2003.

Lineox Enterprise Linux is a product of Lineox, Inc, a commercial company based in Finland. It was created from source RPMs used in RHEL's Advanced Server, Cluster Suite and Developer Suite. Unlike the previously mentioned offerings, Lineox goes a little further by providing upgrades with "apt" (and optionally Synaptic, a graphical user interface for "apt"), and it also offers some updated packages, such as OpenOffice 1.1 and Linux kernel 2.6. Currently all updates are available free of charge, although users will be required to pay a modest fee for the upgrade service once the introductory "free updates" period expires. The company promises to provide security and bug-fix updates within 12 hours after their official release by Red Hat.

CentOS is a product of cAos - Community Linux. CentOS-2 and CentOS-3 are what the developers call "sanitized rebuilds" of Red Hat Advanced Server 2.1 and RHEL 3.0 respectively. According to the project's FAQ, CentOS is a stepping stone towards cAos, a more distinctive Linux distribution with many package updates. All of these projects are in various development stages, with CentOS-3 now at release "build5-rc1". While the distribution is available for free download, the project maintainers are considering several revenue generating models to pay for the cost of the development.

It is clear that the Open Source Software development model has created interesting opportunities not available in the world of proprietary software and there is no reason why we shouldn't take advantage of them. Of the four Red Hat Enterprise Linux clones, White Box Enterprise Linux is looking like the most promising effort, with a public sponsor behind it and many active users on the project's mailing lists. Tao Linux is another project worth considering.

Comments (4 posted)

Five Live CDs Reviewed

This guest article by Lenish Namath takes a look at five of the leading Live Linux CD distributions; MEPIS Linux, KNOPPIX, GNOPPIX, ADIOS and MandrakeMove. "MEPIS had the best hardware detection. The others had problem identifying my laptop's refresh rates, so my screen was flickering. It also had a control center where you can configure the system. The fonts seemed a bit clunky, but it was very easy to mount partitions. It also had QTParted which can be used to resize your fat32, NTFS and GNU/Linux partitions."

Full Story (comments: 10)

Distribution News

Mandrake Linux

MandrakeSoft has announced a major evolution in the way that future Mandrake Linux distributions will be engineered and released. "The spirit of the new development road map is to keep providing a release similar to what was released in the past, which will now be called "Mandrake Linux Community." This is the regular Mandrake Linux distribution, based on Cooker, which goes through the traditional QA process. But from now on, a second 'rock-solid' version titled "Mandrake Linux Official" will be released two or three months after Mandrake Linux Community. This new version will include all Erratas applied to the initial release, and as a result will be particularly solid and problem-free. The Community release will be ideal for those who want the 'latest and greatest' features as soon as available, while the second release will be perfect for those who prefer to wait and avoid any potential glitches."

The php-ini package previously had modules located in /usr/lib/php for AMD64 when the actual modules were being installed in /usr/lib64/php. The updated packages provide a fixed php.ini file for Mandrake Linux 9.2.

Comments (1 posted)

Gentoo Weekly Newsletter - Volume 2, Issue 5

The Gentoo Weekly Newsletter for the week of February 2, 2004 is out; it contains a pointer to the summaries and logs for two of January's Gentoo Managers' Meetings and several other topics.

Full Story (comments: none)

Debian GNU/Linux

The February 3 issue of the Debian Weekly News is available; this week's topics include the new XFree86 license, various conference reports, the Debian Extra CD Project, and several others.

Look for the Debian Project at several Conferences in Europe, including Solution Linux, Paris - Linux Expo Ulm, Germany - and Free and Open Source Software Developers' Meeting, Brussels.

The debian-boot team is looking for some help on the next-generation installer they are building for sarge.

Pablo Lorenzzoni presents a DebConf4 status report.

Comments (none posted)

Fedora Core

The Fedora News Updates for February 4 is out; it looks at a new multimedia HOWTO, the new Fedora Core 2 test schedule, and several other topics.

MozillaZine looks at a How-to on installing and configuring plug-ins for Mozilla Firebird using the Fedora Core Linux distribution.

Here are the latest Fedora Core 1 updates:

• Upgrade rdesktop to 1.3.0
• Bug fixes are available for privoxy 3.0.3-1

Comments (none posted)

Trustix Secure Linux 2.1 Technology Preview 2.

The second "technology preview" prerelease of Trustix Secure Linux 2.1 is available. A number of packages have been upgraded and improved; see the announcement for details.

Full Story (comments: none)

Party Updates

Just in case you still haven't found the right option for your Red Hat refugee systems, consider "Party Updates". Party Updates are rebuilt from Progeny source RPMs. Updates for Red Hat Linux 7.2, 7.3 and 8.0 are available, and 9 will be added when Progeny begins 9 support later this year.

Comments (2 posted)

Lindows offers software for free over P2P (News.com)

News.com covers an announcement by Lindows.com that LindowsLive will be available for download from P2P networks.

Comments (none posted)

Slackware Linux

Slackware has several updates, as seen the slackware-current changelog, including xscreensaver-4.14, xmms-1.2.9, xlockmore-5.11.1, xfce-4.0.3, slackpkg-1.02-noarch-6, perl-5.8.3, kdevelop-3.0.0r1, and the bootdisks to Linux 2.4.24, plus a few more upgrades.

Comments (none posted)

New Distributions

Compact Flash Linux Project

The Compact Flash Linux Project is making Linux run on a compact flash. It is developed on a 16MB CF, and still there is free space. It uses the Linux kernel. The main library is uClibc and the main commands are provided by Busybox. The initial release, v0.1.1, is dated January 8, 2004. Version 0.1.2 was released January 25, 2004.

Comments (none posted)

Lineox Releases Lineox Enterprise Linux 3.0

Lineox Enterprise Linux is built from modified Red Hat Enterprise Linux 3.0 sources. It offers customers an enterprise level Linux operating system without bundled support options. Lineox Enterprise Linux 3.0 is available from the website and also from resellers. Lineox Enterprise Linux 3.0 was released January 29, 2004.

Full Story (comments: none)

Linux Netwosix

Linux Netwosix aims to be a small, powerful and highly configurable Linux distribution for servers and network security related jobs. Version 1.0, with Linux Kernel 2.6.1, GCC 3.3.2 and GLIBC 2.3.2, was released January 31, 2004.

Full Story (comments: none)

Minor distribution updates

Buffalo Linux

Buffalo Linux has released v1.1.2 with minor feature enhancements. "Changes: Six kernel options are now available at install time. The 2.6.1 kernel has been integrated as an install-time option. The "newkernel" build now includes an option to create a Slackware package for the newly built kernel and modules. There were many minor bugfixes. Some new packages were added: python-2.3.3-i486-1, python-tools-2.3.3-noarch-1, and qt-3.2.2-i486-2. Upgraded packages include sendmail-8.12.11-i486-1, sendmail-cf-8.12.11-noarch-1, alsa-lib-1.0.1-i486-1, lvm-1.0.7-i486-1, and xchat-2.0.6-i486-2."

Comments (none posted)

Crash Recovery Kit

Crash Recovery Kit has released v2.4.24. "Changes: This version is based upon the Mandrake 9.2 i586 Linux distribution. The Logical Volume Manager (LVM) administration tools and the NTFS driver v2.1.6a and ntfsprogs-1.8.4-1 have been added. A small utility to select a foreign keyboard keymap is included."

Comments (none posted)

Gentoo For Zaurus

Gentoo For Zaurus has released v0.2.2 with code cleanup. "Changes: Kernel sources were added, which will allow some more base packages to be emerged. The base layout has been reordered to be more like standard gentoo. tbz2ipk.nodev was added, which removes the development libraries from the resulting ipk, making it smaller."

Comments (none posted)

INSERT

INSERT (INside SEcurity Rescue Toolkit) has released v1.2.1 with major feature enhancements. "Changes: This version is based on the latest KNOPPX V3.3-031119, booting Linux 2.4.22-xfs and offering the ability to run from RAM or the hard drive. It provides full read-write support on NTFS partitions, which is being achieved with captive. The latest version of nmap, man pages, and the missing floppy disk boot image have been added. A lot of minor bugs have been fixed."

Comments (none posted)

KnoppiXMAME

KnoppiXMAME has released v1.2 with major feature enhancements. "Changes: This release has an "addroms" boot option to create a custom CD with ROMs added from a running CD. This is done with a new graphical addroms utility. X-MAME has been updated to 0.78.1, GXMame to 0.34b, and the Linux kernel to 2.6.1. Dynamic path configuration for GXMame is now generated at boot time to find /roms and /samples folders on all hard drives or extra CD-ROMs."

Comments (none posted)

Linux From Scratch

Linux From Scratch has released development version 5.1-pre1 with minor bugfixes.

Comments (none posted)

Linux Live

Linux Live has released v3.0.28 with major feature enhancements. "Changes: A script to copy and install LiveCD to a USB mass storage device (such as a flashdisk) was added. It is in ./bootfiles/create_bootflashdisk.sh, and it is untested. Some minor fixes were made. Floppy automounting is now disabled. USB modules for linuxrc are loaded only with the "usbdisk" boot parameter."

Comments (none posted)

Phrealon Linux

Phrealon Linux has released v0.96 with major bugfixes. "Changes: The ability for the sending machine to act as a DHCP server was added. However, there are still some rough edges with this feature."

Comments (none posted)

RUNT

RUNT (ResNet USB Network Tester) has released v3.2 with minor security fixes. "Changes: This release upgrades the kernel to 2.4.24, lftp to 2.6.10, and rsync to 2.5.7."

Comments (none posted)

slimlinux

slimlinux has released v0.5.0 with major feature enhancements. "Changes: This release includes kernel 2.4.18, PCMCIA support, and USB support for mass storage devices. Other new features are udhcpc 0.9.8, fetchpop 1.9, and smtpclient 1.0 and ssmtp 2.48 for receiving and sending email. The very small but efficient e3 text editor is included in this release."

Comments (none posted)

Source Mage GNU/Linux

Source Mage GNU/Linux has released v0.9, code named "Virtue". The announcement (click below) also contains a call for developers, testers and maintainers.

Full Story (comments: none)

ThePacketMaster

ThePacketMaster has released v1.2.1 with major feature enhancements. "Changes: This release adds 70 more security packages, bring the grand total to 200+. The system will not proceed with the bootup until a root password has been created. Some initialization scripts that were included in 1.2.0 have been tweaked."

Comments (none posted)

Page editor: Rebecca Sobol

Development

The Sussen Security Scanner

The Sussen security scanner project is designed to assist in scanning for security vulnerabilities on remote hosts.

"Sussen is a security scanner which remotely tests computers or other devices and provides a report on their vulnerabilities."

A brief summary of Sussen features includes:

• Support for the GNOME desktop environment.
• Works with a number of free and commercial databases.
• Includes Python-language security testing software.
• Produces a variety of customizable reports.
• Has built-in druid windows for common tasks.
• Includes policy and plugin editors.
• Configuration is XML-based.
• Includes language translations.
• Has a built-in help system.

Sussen consists of three components, Sussen, Sussen-sensor, and Sussen-plugins.

• Sussen is the user interface for the GNOME environment.
• Sussen-sensor is the server component that carries out the security scans.
• Sussen-plugins are Python based security tests that are used by Sussen and Sussen-sensor.

Recently, new versions of the project have been coming out at a rate of one per month. This week, version 0.9 was announced. The release includes bug fixes and quite a long list of new features to the three components. The release came out with this caveat: "Sussen is not currently suited for production use. Many features are incomplete or not working at all." Nonetheless, Sussen could still prove to be useful to the system administrator who is looking to find and plug security holes on their network.

A brief attempt at installation of the three RPMs for the latest version of Sussen resulted in a long list (16 items) of failed dependencies. Those wishing to install Sussen on Red Hat 9 may end up spending some time hunting for extra RPMs.

Comments (none posted)

System Applications

Audio Projects

ALSA 1.0.2a released

Version 1.0.2a of the ALSA sound driver has been released. "It should fix most of 2.6 kernel compilation problems and adds RME HDSP MADI (hdspm) driver."

Comments (none posted)

Planet CCRMA Changes

The latest changes from the Planet CCRMA audio utility packaging project include new versions of Audacity, terminatorX, Hydrogen, and the TAP Plugins.

Comments (none posted)

Database Software

PostgreSQL Weekly News

The PostgreSQL Weekly News for February 2, 2004 is available, with a look at new features, bug squashing, and more.

Full Story (comments: none)

Embedded Systems

BusyBox 1.0.0-pre6 released

BusyBox, a toolkit consisting of command line utilities, is nearing version 1.0.0 with the pre-6 release. "This release adds a number of size optimizations, updates udhcp, fixes up 2.6 modutils support, updates ash and the shell command line editing, and the usual pile of bug fixes both large and small. Things appear to be settling down now, so with a bit of luck and some testing perhaps we can finish off the -pre series in February and move on to the final 1.0.0 release..."

Comments (none posted)

Printing

PyKota 1.17 released

Version 1.17 of PyKota, a print quota system, has been announced. "This new release fixes a problem when using software accounting within the new CUPS backend : users were incorrectly charged for jobs they were correctly denied to print when they were above quota."

Comments (none posted)

Security

Secure programmer: Countering buffer overflows (IBM developerWorks)

David A. Wheeler explores buffer overflow vulnerabilities in C and C++ programs. "This article discusses the top vulnerability in Linux/UNIX systems: buffer overflows. This article first explains what buffer overflows are and why they're both so common and so dangerous. It then discusses the new Linux and UNIX methods for broadly countering them -- and why these methods are not enough."

Comments (none posted)

Web Site Development

Cooking with Apache, Part 2 (O'ReillyNet)

Rich Bowen and Ken Coar go into the details of Apache configuration on O'Reilly. "Last month, we published our first batch of recipes from the recently released Apache Cookbook. This week, we've excerpted three more samples. Find out how to make part of your web site available via SSL, how to place a CGI program in a directory that contains non-CGI documents, and how to redirect a 404 ("not found") page to another page (such as the front page of the site) in these latest samplings."

Comments (none posted)

Nvu 0.1 Released (MozillaZine)

Nvu version 0.1 has been announced. "Version 0.1 of Nvu, the open-source Web development tool based on Mozilla Composer, has just been released."

Comments (none posted)

Perl port of Lucene search engine (use Perl)

Use Perl mentions Kasei, a port of the Lucene search engine from Java to Perl.

Comments (none posted)

Plone 2.0 Release Candidate 4 available. (SourceForge)

Release Candidate #4 of Plone 2.0, a content management system, has been announced. "A new Release Candidate of the highly anticipated Plone 2.0 is ready, this time with a lot of migration fixes."

Comments (none posted)

What's New in Tomcat 5 (O'ReillyNet)

Jason Brittain reviews the latest version of Apache Tomcat on O'Reilly. "On Dec. 3, 2003, the Apache Tomcat developers released their latest version of the popular open source Java servlet and JSP container, version 5.0.16, as the first stable release of Tomcat 5. If you're already running Tomcat 4, you'll be happy to know that Tomcat 5 is easy to migrate to, and has many new features that make it advantageous to upgrade. In this article, we'll take a look at the latest features in Tomcat 5."

Comments (none posted)

Documentation

The Ox Documentation Tool (O'Reilly)

Michael Fitzgerald introduces Ox on O'Reilly. "Ox is a simple documentation tool for people who regularly work at the shell or command-prompt level. It's a command-line Java program that accepts a keyword or term as input and then returns documentation for that term. It's free, open source software (BSD license), and because it uses Java properties, it's easily extensible by non-programmers."

Comments (none posted)

Standards

Filesystem Hierarchy Standard 2.3 Released

Version 2.3 of the Filesystem Hierarchy Standard was released. The new top-level directories /srv and /media have been added, among other things.

Full Story (comments: 1)

Miscellaneous

Mono 0.30 released (GnomeDesktop)

Version 0.30 of Mono, an open-source implementation of the .NET framework, has been announced. "This is mostly a fine tuning release: bug fixing and performance improvements are the major benefits, but new classes and new features are also included."

Comments (none posted)

PIKT 1.16.1 released

Version 1.16.1 of PIKT, the Problem Informant/Killer Tool, has been announced. "PIKT is a cross-categorical toolkit for monitoring and configuring systems, organizing system security, formatting documents, assisting command-line work, and performing other common systems administration tasks."

Full Story (comments: none)

Desktop Applications

Audio Applications

Gnomoradio 0.9.1 Released (GnomeDesktop)

Version 0.9.1 of Gnomoradio, a peer-to-peer music player for Gnome, is out. "This is a small bugfix release that fixes an abort on startup if the song status pixmaps are not found."

Comments (none posted)

Tkeca 4.0.2 Released!

Version 4.0.2 of Tkeca, a GUI interface to the Ecasound audio utility, is out. This release fixes a bug in the mixdown properties window.

Full Story (comments: none)

WaveSurfer 1.6.1 released

Version 1.6.1 of WaveSurfer, an audio file editing package, is out. This release fixes one bug and adds new sound information to the message bar.

Comments (none posted)

Desktop Environments

GNOME Development Release 2.5.3 (GnomeDesktop)

Development Release 2.5.3 of the GNOME desktop environment has been announced. "This release is a snapshot of development code. Although it is buildable and usable, it is primarily intended for testing and hacking purposes."

Comments (none posted)

GNOME in the Year of the Monkey (GnomeDesktop)

GnomeDesktop.org summarizes some of the GNOME developments last year. "Tim Ney, the executive director of the GNOME Foundation (and unsung hero) has written up a very informative account of foundation happenings over the last year as well as looking into the future. Highlights include an overview of various GNOME deployments over the last year, a new GNOME book in the works and outreach and advocacy efforts."

Comments (none posted)

The GNOME/Scoop sidebar proposal

Paul Hendrick has proposed a new sidebar for GNOME. "In terms of UI, it's vaguely similar, in terms of the kind of program it would be - it's nothing like dashboard. Really, scoop is just a new type of container widget, which embeds other widgets within itself."

Comments (none posted)

Gnome Summary (GnomeDesktop)

The GNOME Summary for January 25-31, 2004 is out. "This week's GNOME Summary is now available, featuring news about the GNOME booth in Solutions Linux in Paris. We are also looking for web developers to help with adding more features to the GNOME Summaries."

Comments (none posted)

KDE 3.2 released

The announcement for the KDE 3.2 release has gone out. See the announcement for a quick summary of what's new; we also ran a review of KDE 3.2 in the January 29 LWN Weekly Edition.

Comments (1 posted)

KDE-CVS-Digest (KDE.News)

The January 30, 2004 edition of the KDE-CVS-Digest is online, here's the summary: "Kttsd (text to speech) improves with gui and speaker plugins. KStars adds star motions. And many bugfixes in KDevelop and Khtml."

Comments (none posted)

A new XFree86 license

David Dawes has sent out an announcement for version 1.1 of the XFree86 license, which will take effect with the 4.4 release. Says David: "The purpose of these changes is to strengthen the 'except claim you wrote it' clause of the Project's licensing philosophy regarding binary distributions of XFree86." To achieve this goal, the license now includes something that resembles the old BSD advertising clause. (Thanks to Andres Salomon and Paul Sladen).

Comments (31 posted)

Release Notes for XFree86 4.4.0

A new version of the XFree86 4.4.0 Release Notes are available. Here is the announcement. "We have brushed upon this before but now it's here.: the 4.4.0 pre-Release Notes in DocBook format. We call it DocNotes. We hope you call it Splendid!"

Comments (none posted)

Electronics

NG-SPICE rework 15 released

A new release of NG-SPICE, an electronic circuit simulation package, is available.

Comments (none posted)

Games

New PyGame releases

New Python-based games releases from the PyGame project include Pydance 0.9 and Bluevade 2.5.

Comments (none posted)

WorldForge Weekly News

The February 2, 2004 edition of the WorldForge Weekly News is out with the latest development news from the WorldForge game project.

Comments (none posted)

Graphics

fl-inventor 1.0.0 is available

Version 1.0.0 of the Fl-Inventor Toolkit, which is used for developing 3D/VR applications, has been announced "Yes, this is the first 1.0.x major release ! The most complete & stable release to date."

Comments (none posted)

GIMP Animation Package for GIMP 2.0 (GnomeDesktop)

GnomeDesktop.org looks at GIMP-GAP, a newly released animation package for the GIMP. "GIMP-GAP is a set of plug-ins for the GIMP-2.0 that extends GIMP for creation of animations based on a series of frame images. GIMP-GAP is the next development step of the Video Menu that once was part of gimp-1.2."

Comments (none posted)

GIMP Plug-In Template for GIMP 2.0 (GnomeDesktop)

An updated version of the GIMP Plug-In Template has been announced. "The gimp-plugin-template is essentially an empty GIMP plug-in that is supposed to be useful when you are about to write a more complex GIMP plug-in from scratch. It provides a complete build environment using autoconf/automake, a framework for internationalization, the infrastructure for providing gimp-help and some example user interface code."

Comments (none posted)

GIMP FreeType Plug-In for GIMP-2.0

A new version of the GIMP FreeType Plug-In has been announced. "The text tool in GIMP 2.0 has improved a lot and in a lot of ways it is even superiour to the GIMP FreeType Plug-In. But there are still a few things that only the plug-in can do and that's why there's now a release for GIMP 2.0."

Comments (none posted)

GIMP 2.0pre3 Released (GnomeDesktop)

Version 2.0 pre 3 of the GIMP has been announced.

Comments (none posted)

PLplot version 5.3.0 released

Version 5.3.0 of PLplot, a scientific plotting package, is out. "Release 5.3.0 substantially updates the C++ and Fortran interfaces to the C PLplot library (to the level of our existing Python, Java, Tcl/Tk, Octave, and Yorick interfaces). It also makes the configuration/build system more robust allowing successful installations on platforms like Linux, Solaris, OSF1, MacOS X, Cygwin, and Windows."

Full Story (comments: none)

GUI Packages

Qt 3.3 released

Trolltech has announced the release of Qt 3.3. New features include .NET, IPv6, and 64-bit support.

Full Story (comments: 1)

The Independent Qt Tutorial

A new version of The Independent Qt Tutorial has been published, here are the changes: "Added two new chapters. Chapter eight is a complete re-write, chapter nine is completely new (credits to Michael Goettsche for proofing and feedback). Some minor updates have been made too."

Comments (none posted)

Interoperability

Samba 3.0.2rc2 Available for Download

Release Candidate #2 for Samba 3.0.2 is out. "This is mostly a cleanup of some minor issues in 3.0.2rc1."

Full Story (comments: none)

Medical Applications

Yet Another Java Based FOSS PMS application (LinuxMedNews)

LinuxMedNews looks at openPMS, a java based medical Practice Management System.

Comments (none posted)

Music Applications

galan 0.3.0 beta 3 announced

Version 0.3.0 beta 3 of galan, the graphical Audio language, is out. "This version has several fixes for loading files. so if you tried out some earlier 0.3.0 and could not load your files back in. then try again."

Full Story (comments: none)

simsam 0.1.6 released

Version 0.1.6 of simsam, a MIDI sample playback program, is out with lots of changes.

Full Story (comments: none)

Web Browsers

Epiphany 1.1.6 released

Version 1.1.6 of Epiphany, a lightweight web browser for GNOME, has been announced. Changes include interface improvements, bug fixes, new documentation, and improved translations.

Comments (none posted)

Epiphany Extensions 0.7 released (GnomeDesktop)

Version 1.1.7 of the Epiphany browser has been announced. "Not much has changed since the recent Epiphany 1.1.6 release, but this new one has typo fixes, downloader view fixes and a crash fix in the extensions manager."

Also, version 0.7 of Epiphany extensions is out. "This release of Epiphany was made especially to cope with Epiphany Extensions, which are self-contained pieces of code which alter the behavior of Epiphany. Epiphany Extensions 0.7 has been released, which now contains extensions for mouse gestures, per-site popup blocking, extra options in the Tabs menu, a Javascript and HTML page validator (local validation of HTML with the same precision as validator.w3.org), an SSL certificate viewer and a Dashboard frontend."

Comments (none posted)

Independent Status Reports (MozillaZine)

The Mozilla Independent Status Reports are out for February 2, 2004. "The latest set of status reports includes updates from Urlnav, Weather, Dictionary Search, easyGestures and QuickNote."

Comments (none posted)

Lynx 2.8.5 pre 5 released

Version 2.8.5 pre 5 of Lynx, a text-mode browser, is available for download. Change information is in the source code.

Comments (1 posted)

Mozilla Links Newsletter

Issue #12 of the Mozilla Links Newsletter is out with more Mozilla browser news.

Full Story (comments: none)

Word Processors

AbiWord Weekly News

Issue #179 of the AbiWord Weekly News is available. "As you would have noticed, 2.0.3 didn't come out, but it certainly will next week! Meantime, the Windows Installer is now available in numerous languages, instructions are included for MacOS X users who might want to try playing with AbiWord early, there's discussion about making BiDirectional text manipulation purely optional, and AbiWord's first Arabic translation just committed! Or, maybe, we're guessing; well, I'm guessing."

Comments (none posted)

Languages and Tools

Java

A Dozen Ways to Get the Testing Bug in the New Year (O'Reilly)

Mike Clark talks about Java testing on O'Reilly. "Test-driven development received a lot of attention in 2003, and the interest will grow in 2004. For good reason: everyone agrees testing is important, but now many respected programmers are claiming that by writing tests first, they see better designs emerge. These same programmers quickly point out that test-driven development makes them feel more productive and less stressed. At the end of a shorter programming day they've built a suite of passing tests and code with better designs. Sound too good to be true? Well, there's nothing to lose in giving it a whirl. In fact, there's much to be gained."

Comments (none posted)

Perl

Cultured Perl: Fun with MP3 and Perl, Part 2 (IBM developerWorks)

Teodor Zlatanov works on MP3 data with Perl on IBM's developerWorks. "Ted continues his look at manipulating and guessing MP3 tags with Perl, FreeDB, and various CPAN models via his autotag.pl application."

Comments (none posted)

This week on Perl 6 (O'Reilly)

This week on Perl 6 for January 25, 2004 is out with the latest Perl 6 news.

Comments (none posted)

PHP

PHP 4.3.5RC2 is available

Version 4.3.5RC2 of PHP has been released. "This is likely to be the last release candidate prior to the final release, so please test it as much as possible."

Comments (none posted)

PHP Weekly Summary for February 2, 2004

The PHP Weekly Summary for February 2, 2004 is out. Topics include: Remove value from PHP, Session remarks, Building multiple SAPIs at once, Remove gpc_order, Include/Require and parse errors.

Comments (none posted)

MySQL Crash Course, Part 3 (O'Reilly)

John Coggeshall continues his PHP series on O'Reilly. "I will wrap up my crash-course series on MySQL by discussing some useful functions available when using SQL and PHP, introducing a clause or two for the SELECT statement, and explaining a few of the principles behind relating one table to another (after all, it is a "relational" database system)."

Comments (none posted)

Python

Dr. Dobb's Python-URL!

The Dr. Dobb's Python-URL for February 3, 2004 is available, with weekly news and links for the Python community.

Full Story (comments: none)

PEP 237 - Decimal Data Type

PEP 237 for the Python language, a proposal for a Decimal Data Type, has been announced by Facundo Batista. "The idea is to have a Decimal data type, for every use where decimals are needed but binary floating point is too inexact."

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The February 2, 2004 edition of Dr. Dobb's Tcl-URL is out with links to more Tcl/Tk articles.

Full Story (comments: none)

XML

A survey of XML standards: Part 2 (IBM developerWorks)

Uche Ogbuji continues his IBM developerWorks series on XML standards with part 2. "The world of XML is vast and growing, with a huge variety of standards and technologies that interact in complex ways. It can be difficult for beginners to navigate the most important aspects of XML, and for users to keep track of new entries and changes in the space. Uche Ogbuji continues this series on XML standards by focusing on XML processing technologies."

Comments (none posted)

Build Tools

Ximian Build Buddy released as GPL (GnomeDesktop)

The Ximian Build System has been released under the GNU GPL license. "The Ximian Build System, Build Buddy, is now available to the community, in GPL form. This is a very exciting moment, and one that many of us at Ximian have been hoping would come.Build Buddy is a cross-platform packaging system designed with flexibility, reproducibility, and automation in mind."

Comments (none posted)

IDEs

Anjuta 1.2.1 released (GnomeDesktop)

Version 1.2.1 of Anjuta is available. "Anjuta is a versatile IDE for C and C++, written for GTK/GNOME. Features include project management, application wizards, an onboard interactive debugger, and a powerful source editor with browsing and syntax highlighting. This is a bugfix release but also includes some new features."

Comments (none posted)

Version Control

The New Breed of Version Control Systems (O'ReillyNet)

Shlomi Fish investigates several alternatives to CVS on O'Reilly. "CVS, part of the glue that holds open source development together, is showing its age. Many competitors have emerged recently, fixing misfeatures and adding new ideas. Shlomi Fish explores several current open source version control systems that may be better than CVS for your needs."

Comments (none posted)

Miscellaneous

CORBA, Part I (Linux Journal)

Gerry Pocock introduces CORBA on Linux Journal. "CORBA (Common Object Request Broker Architecture) is a specification for an architecture that provides support for invoking methods in objects that may exist in a different process. The CORBA architecture is based on the concept of a common object."

Comments (none posted)

Basic use of pthreads (IBM developerWorks)

Peter Seebach introduces POSIX threads on IBM's developerWorks. "Threads strike fear into the hearts of many programmers. UNIX's process model is simple and well understood, but it is sometimes inefficient. Threading can often allow for substantial improvements in performance, at the cost of a little confusion. This article demystifies the POSIX thread interface, providing practical examples of threaded code for consideration."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

U.N. report says open source produces better software (OpenSector)

The United Nations has concluded that better software comes from the open-source development model. "The report says that OSS software is better for four primary reasons: More people looking for defects means more defects are found and fixed. Free from marketing considerations, developers release more fixes and improvements, more often. Proprietary software does not guarantee quality, in order to avoid legal liability. Source code availability allows users to fix, customize or improve on their own."

Comments (10 posted)

Why Run Free Software on a PDA? (O'ReillyNet)

Guylhem Aznar investigates the use of Linux on PDA platforms. "Now that more and more people are familiar with the idea of a GNU/Linux PDA, you may wonder why free software on a PDA may be important to you as a consumer or a manufacturer, and why the choice of a full, free software solution is progressing on the end-user devices market."

Comments (1 posted)

Groklaw Takes A Closer Look at the ABI Files

Worth a read: this lengthy investigation on Groklaw into the provenance of the Linux kernel ABI. "This indicates that representatives of SCO/Caldera were the ones who collected, developed, tested, and maintained the source code to implement the ABI functionality, then placed the GPL notice on it, packaged it, and provided it to the entire Linux community. Given that SCO themselves did so much of the work to provide this functionality, and placed the GPL notice on it themselves, judging from these files, it seems hard to avoid concluding that SCO explicitly released the System V ABI under the GPL and that they did so knowingly and because they wanted to."

Comments (12 posted)

Trade Shows and Conferences

Report: KDE at LWE NY, 2004 (KDE.News)

KDE.News has published a write-up from the Linux World Expo. "For three days, 10 KDE developers and a few others helped deal with a huge amount of interest from the crowd, showing off the latest and greatest in KDE 3.2. This year's show was thought to be at least twice as good as last year's, and a great time was had by all."

Comments (none posted)

EclipseCon from 30,000 feet (NewsForge)

Joe Barr jets to EclipseCon. "What interests me most about Eclipse.org is that it is a consortium of proprietary software and hardware firms who are developing a world-class, cross-platform, open source development environment. It's a bizarre twist to the Guess Who's Coming to Dinner story line."

Comments (none posted)

EclipseCon on the ground (NewsForge)

Joe Barr continues coverage from EclipseCon. "Eclipse went open source in 2001 and today has more than 50 member companies. The goal of Eclipse today -- since IBM has made it a completely separate and independent organization -- remains the same as it has always been, [IBM's John] Wiegand said: to make a fun and profitable framework for developing software that can be used by anyone."

Comments (1 posted)

Eclipse State of the Union

Coverage of the first day of EclipseCon is available. "Today marked the major kickoff of EclipseCon 2004, the first Eclipse Conference, at the Disneyland Hotel in Anaheim. The keynote speech was delivered by John Wiegand (IBM) and Erich Gamma. There were over 600 attendees at the conference and people were lined up around the walls to listen to the opening speech. There are over 50 companies who belong to Eclipse and the session opened with Eclipse company and board members filling the entire stage."

Comments (none posted)

The SCO Problem

Decatur Jones' Dion Cornett on SCO (Groklaw)

Groklaw now has the full Decatur Jones report on SCO. Any corporate manager who is considering paying off SCO should definitely be given a copy. "Now with the potential for legal costs to be borne by OSDL, whose defense fund contributors include heavyweight Intel, we now believe it may be difficult for SCO to win any settlement. Furthermore the 'safe' action appears to have switched sides. Before, many organizations may have been willing to write a five-figure check to avoid legal risks and move on with business. We suspect anyone currently considering such an expenditure may now worry that they will be taken to task for wasting corporate funds. As a consequence, we have reduced our expectation for FY04 SCOSource revenue by 90%."

Comments (2 posted)

Interview With Darl McBride (CNN.com)

CNN.com interviews Darl McBride, president and CEO of the SCO Group. "This is a new digital frontier. We came out, we found that key parts of our code -- we owned the Unix operating system -- was showing up in this new upstart program called Linux. These new programmers working with IBM. We found that things were violated against our copyrights. And so we filed a $3 billion lawsuit against IBM. We've been working through a judicial system here. But now you have people going outside the system, trying to attack us, to try and shut us down before we have a court verdict." Thanks to Murry.

Comments (24 posted)

Australian firm again asks SCO to show proof of IP violations (SMH)

The Sydney Morning Herald follows up with Leon Brooks's continuing effort to get SCO to back up its claims in Australia. "Brooks said SCO had not responded to his last communication. He said this was odd, given that The SCO Group's lawyers rushed to include accusations of attack from the MyDoom virus in their most recent 10K filing with the Securities and Exchange Commission."

Comments (6 posted)

SCO Sets Up Alternative Address - Finally (Groklaw)

Groklaw notes that SCO has set up a new web address, and wonders why they waited for the Mydoom DDoS attack to bring down the old one first. "It will be interesting to find out if there are some disappearing documents as a result of this whole incident. Bob Mims has some interesting details. Stowell says they have a number of backup tricks they can try: "We have had a good four to five days' notice of this," Stowell said, noting Mydoom's Jan. 26 launch. "We have a lot of backup plans in place.""

Comments (none posted)

Darl Goes to Harvard - My First Quick Impressions (Groklaw)

Groklaw reports on Darl McBride's talk at Harvard. "The big news is that they say they will start to sue copyright end users by February 18. The other news is that he asked the audience if they had gotten infected by MyDoom, and he pointed to one guy who beautifully answered, 'No, I use Linux, so I wasn't affected,' and the room laughed. Darl wasn't happy about that and it was clear he didn't like the questions about the ABI files." There are also some pictures available.

Comments (9 posted)

Companies

Microsoft Offers Bounty For Mydoom Author (TechWeb)

TechWeb reports that Microsoft is offering a $250,000 reward for the arrest of the Mydoom author. The negative Linux press is included, of course. "While not proven, SCO may be the target of such attacks because of its legal challenge of the open-source operating system Linux, which the company claims contains its copyrighted code. SCO's lawsuits have angered the Linux community and its supporters."

SCO has also put a bounty of the same amount on the virus writer's head.

Comments (8 posted)

An open letter to Eclipse membership from Sun (NewsForge)

NewsForge covers the independence of the Eclipse organization. "Sun would like to congratulate the Eclipse organization on the eve of the transition to independence. This move proves again that the Java technology ecosystem is capable of spawning new value and continued technical diversity. Given this noteworthy accomplishment, and the recent creation of javatools.org, Sun would like to reflect on what we hope the future has in store for Java technology-based tools and the enduring Java platform."

Comments (none posted)

Legal

Europe's tug of war over software patents (Herald Tribune)

The International Herald Tribune reports on the European software patent issue. "A European Parliament bill that would have made all software subject to patenting is the focal point of the outrage among technology activists. Opponents of the bill succeeded in adding amendments in September that would essentially prevent patents from being issued for most types of software. The proposal is due back in Parliament in the next few months, and the outcome is far from certain."

Comments (5 posted)

Interviews

Conversation with the Linux kernel keeper (InfoWorld)

Here's an InfoWorld interview with Andrew Morton. "AM: 2.6 will scale significantly further than 2.4 on large machines. More CPUs, more memory, more disks, larger disks, more threads, etc. Also, it is smoother and more responsive on the desktop. The merge of uCLinux is nice for very small embedded systems."

Comments (none posted)

KDE integrates OpenOffice.org (KDE.News)

KDE.News interviews Jan Holesovsky, author and leader of the KDE.OpenOffice.org project. "The search for work resulted in a contract with SUSE. I became their employee the last week, and now I am paid to continue the KDE OpenOffice.org integration. Here I want to thank Holger Schroeder once more. He donated the money that covered the first part of my Native Widget Framework development. All the work on cuckooo and KDE vclplug (OOo Qt port) I did as a volunteer."

Comments (none posted)

Reviews

Sharp Zaurus SL-5600 Personal Mobile Tool (Linux Journal)

Linux Journal reviews the Sharp Zaurus SL-5600 PDA, a cool new tech-toy. "The Zaurus is not like any other PDA on the market. What really differentiates it from other PDAs is what's inside: Linux. This OS choice allows development on many different platforms. Libraries are available for Python, PyQt and Java. There also is version of Xfree86 for the Zaurus."

Comments (12 posted)

The Neuros MP3 Digital Audio Computer (Linux Journal)

Linux Journal reviews the Neuros MP3 Digital Audio Computer. "The Neuros MP3 Digital Audio Computer is a portable digital music player that includes an FM tuner. For penguin users, however, the most interesting capabilities probably are its support for music encoded in the Ogg Vorbis format and its compatibility with Linux computers."

Comments (none posted)

Easy personal video recording for Linux? It's a myth (NewsForge)

Lee Schlesinger writes about the trials and tribulations of getting video recording running on a Linux box. "I just spent several weeks installing and configuring MythTV, an open source application that gives a computer TiVo-like personal video recorder capabilities. I learned a lot of lessons along the way that I'll share here. The biggest one is... Don't do it! Unless you can view the process as an intellectual challenge, spending the money for an actual TiVo will save you dozens of hours you could spend on more pleasurable activities."

Comments (none posted)

The Role of Linux in Grid Computing (Linux Journal)

Linux Journal looks at Linux and grid computing. "Linux has gained a reputation for being a highly efficient operating system in simpler application environments running on smaller hardware configurations, the type that will be enabled by the grid architecture. In such experimentation-based systems, the free nature of Linux will play a crucial important role due to lower investments."

Comments (1 posted)

Building A Better Browser (Forbes)

Forbes tries out Mozilla Firebird. "If, in its unfinished state, Firebird is this good, perhaps Microsoft should be worried." (Thanks to Bernard Bencic).

Comments (26 posted)

Miscellaneous

DARPA-funded Linux security hub withers (Security Focus)

Security Focus covers the demise of the Sardonix project. "Initially funded by a research grant from the Pentagon's Defense Advanced Research Projects Agency (DARPA), the Sardonix project aspired to replace the loosely-structured Linux security review process with a public website that meticulously tracks which code has been audited for security holes, and by whom."

Comments (3 posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

Eclipse Forms Independent Organization

The Eclipse Board of Stewards has announced Eclipse's reorganization into a not-for-profit corporation. Originally a consortium that formed when IBM released the Eclipse Platform into Open Source, Eclipse is now an independent body. All technology and source code provided to this fast-growing ecosystem will remain openly available and royalty-free.

MontaVista has announced they are a founding member of the new Eclipse.

Comments (none posted)

Eclipse Plugin Central Alliance Formed

The Eclipse Plugin Central Alliance has been formed. "At the Eclipse Conference in Anaheim, Innoopract, Instantiations, and Genuitec announced that they had formed an alliance to create Eclipse Plugin Central. According to Mark Johnson, VP Marketing and Business Development at Instantiations, "The mission of our alliance in forming Eclipse Plugin Central is to support the growth of the Eclipse community by helping developers locate, evaluate, and acquire plugins that can help them deliver their projects faster, better, and cheaper."

Full Story (comments: none)

GRAMPS Bounty: GNOME-Print integration (GnomeDesktop)

GnomeDesktop.org mentions the need for somebody to help integrating gnome-print into the GRAMPS genealogy system. "We are looking for a person to step forward to claim the gnome-print integration into GRAMPS. This will use the GNOME print infrastructure to allow print preview and direct printing of reports, in addition to PostScript and PDF file generation." A $100 bounty has been offered for the task.

Comments (none posted)

OSDL Announces First Chinese Member

The Beijing Co-Create Open Source Software Company, Ltd. has joined the Open Source Development Labs (OSDL).

Comments (none posted)

NTT joins OSDL

The Open Source Development Labs has sent out a press release announcing its newest member, Nippon Telegraph and Telephone Corporation (NTT). "NTT, a telecommunications giant that oversees a group of more than 430 companies with 200,000 employees in Japan and around the world, is joining OSDL to accelerate the development of Linux for enterprise computing. NTT's research and development arm, NTT research laboratories, will take the lead for the firm on open source software development to strengthen Linux for use as a major platform for enterprise computing."

Full Story (comments: 2)

Open Hardware ARM SBC - 'Balloon' available

The Balloon is a new open-hardware ARM-based single board computer. "Aleph One announces the availability of the Balloon board, a small light low-power computer with a high-performance ARM processor and lots of memory. The complete design is available to all, free of charge."

Full Story (comments: none)

Commercial announcements

Lindows loses in the Netherlands

Lindows.com has lost yet another court battle over the "Lindows" name; this time a preliminary injunction was given to Microsoft in the Netherlands. Lindows has responded with a typical press release: "The ruling will deny the Netherlands the cost-savings that desktop Linux currently offers to approximately 18 million people worldwide, leaving vulnerable and expensive Microsoft software as the only option for computer consumers in the Netherlands." Regardless of the justice of Microsoft's trademark claims, this attempt to portray Lindows as the only possible source of desktop Linux seems misplaced.

Comments (11 posted)

Lineox Enterprise Linux Support Partner Program

Lineox is assembling a list of Linux consultants who are able to support their product. "Lineox Enterprise Linux is sold without bundled support. This creates a business opportunity for companies and consultants who can offer support for Lineox Enterprise Linux. Lineox believes that free market will provide the best support network for our products."

Full Story (comments: none)

Linux/QNX news

QNX Software Systems now supports Linux as a development platform. "QNX Software Systems today announced it is adding support for Linux development hosts to the QNX Momentics embedded development suite."

Full Story (comments: none)

MySQL AB and Pearson Education Launch MySQL Press

The new MySQL Press collaboration has been announced. "MySQL Press, a collaboration between MySQL and Pearson Education, publishes and globally distributes books about the MySQL® database and related technologies. MySQL Press books have been extensively reviewed by MySQL AB, the company that develops and markets the MySQL database."

Comments (none posted)

Novell/SUSE management changes

Novell has announced that Gerard Van Kemmel, president Novell-EMEA, will assume the role of chairman, Novell, EMEA. Also Richard Seibt, formerly chief executive officer, SUSE LINUX and president of Novell's SUSE LINUX business unit, will assume operating responsibility for Novell-EMEA and as such will be responsible for all day-to-day operations.

SUSE R&D Vice President Markus Rex was named General Manager of Novell's SUSE LINUX Business Unit, in a separate announcement.

Comments (1 posted)

PJ gets a day job

Open Source Risk Management LLC has sent out a press release stating that it has hired Pamela Jones ("PJ"), the editor of Groklaw, as its Director of Research. OSRM sells products like indemnification insurance for users of open source software. Groklaw will continue as before. (PJ also occasionally writes for LWN; this week's Edition will include one of her articles).

Comments (13 posted)

A new SCO 10-K

The SCO Group has filed its annual report with the SEC. There is a wealth of information about the company there for those with the time to dig. For example, one of the new risk factors reads: "Also, some of the more significant participants in the Linux industry have made efforts to ease Linux end users' concerns that their use of Linux may subject them to potential copyright infringement claims from us. For example, Hewlett-Packard and Novell have each established indemnification programs for qualified customers purchasing Linux-based products and services that may potentially become subject to a copyright infringement claims from us." Interestingly, in SCO's press releases, these offers were described as validating SCO's case...

There is a large set of other documents submitted as attachments to the 10-K; they include agreements with Morgan Keegan (which also gets a chunk of SCO's license revenue, acquisitions, etc.), Sun's stock options, etc.

Comments (10 posted)

SourceForge add subscription services

OSDN has announced the addition of a set of subscription services for SourceForge. The current SourceForge services will remain free; for $7/month or $39/year users can also get better searching, easier downloads, project monitoring, and some tech support.

Comments (none posted)

New Books

"Hardware Hacking: Have Fun While Voiding Your Warranty" published

The book "Hardware Hacking: Have Fun While Voiding Your Warranty" has been published by Syngress Publishing.

Full Story (comments: none)

Resources

LSB 2.0 available for Public Review

the Free Standards Group has announced the availability of version 2.0 of the Linux Standard Base. LSB 2.0 is up for public review for 30 days. "LSB 2.0 features the revision of the core specification to support modules that are built on the foundation of the core LSB. This will accommodate future growth, as Linux standards for different vertical markets, for example, are developed as extensions to the core LSB. LSB 2.0 also introduces an ABI for C++ -- a long-awaited feature. Further, LSB 2.0 incorporates updates to many of the specifications and implementations underlying the LSB, such as the Single Unix Specification."

Comments (4 posted)

Austin Group Status Report

The Austin Common Standards Revision Group (CSRG) has published their status report for January 31, 2004. "The Austin Common Standards Revision Group (CSRG) is a joint technical working group established to consider the matter of a common revision of ISO/IEC 9945-1, ISO/IEC 9945-2, IEEE Std 1003.1, IEEE Std 1003.2 and the appropriate parts of the Single UNIX Specification. Having completed the initial deliverable in late 2001, the group is presently working on maintenance activities."

Full Story (comments: none)

POSIX manpages incorporated to Linux

The Linux Manual Pages Project now has access to new manual pages. "The IEEE and The Open Group have granted permission to the Linux Manual Pages Project to incorporate material from the joint IEEE 1003.1 POSIX standard and The Open Group Base Specifications Issue 6."

Full Story (comments: none)

What Should Governments Examine in Acquiring COTS Open Source Software?

David A. Wheeler has posted a presentation on governments and open source software. It's a short presentation, available in PDF format from the link given above.

Comments (none posted)

Contests and Awards

Etnus TotalView Honored with LinuxWorld Magazine's Readers' Choice Award

Etnus has announced that its TotalView debugger has been honored with a LinuxWorld Magazine Readers' Choice Award.

Full Story (comments: none)

2004 World Record Attempt

The 2004 Chess World Record Attempt was held. "On January 30th 2004, ChessBrain became the first distributed network to play a game against a single human opponent." The game resulted in a tie. Thanks to Kim 'The Pirate' Christensen.

Comments (none posted)

Upcoming Events

CMMR 2004 CFP

A call for papers has gone out for the 2nd International Symposium on Computer Music Modeling and Retrieval. The event will be held in Esbjerg, Denmark on May 26-29, 2004.

Full Story (comments: none)

Schedule for Mozilla Developers Meeting in Europe 4.0 Published (MozillaZine)

The European Mozilla Developers Meeting will be held in Brussels, Belgium on February 21 and 22, 2004.

Comments (none posted)

Linux-Day at Chemnitz

Linux-Day Chemnitz 2004 will be held on March 6 and 7, 2004 in Chemnitz, Germany (Saxony).

Full Story (comments: none)

AGNULA at FOSDEM 2004

Members of the AGNULA-IST (A GNU/Linux Audio distribution) project will be at FOSDEM in Brussels, Belgium on February 21 and 22, 2004.

Full Story (comments: none)

Sponsors announced for Desktop Linux Summit 2004

Red Hat, Seagate, Sun and Lindows have signed on as sponsors of the second annual Desktop Linux Summit 2004, to be held in April in San Diego, California.

Comments (5 posted)

YAPC::Taipei::2004 - Call For Registration (use Perl)

Use Perl has announced that registration is open for the YAPC::Taipei conference.

Comments (none posted)

YAPC::Europe 2004

The YAPC::Europe 2004 Perl conference has been announced. The event will take place on September 15-17, 2004 in Belfast, Northern Ireland.

Comments (none posted)

PyCon DC 2004 Sprints CFP

A Call for Participation has gone out for the PyCon DC 2004 Sprints sessions. The Sprints will be held from March 20-23, 2004 in Washington, DC. "The Python Software Foundation is sponsoring four days of sprints before PyCon -- Saturday through Tuesday. We invite developers to attend the sprints. We will provide space and network connectivity for developers who want to work on open source projects."

Comments (none posted)

Events: February 5 - April 1, 2004

Date	Event	Location
February 5, 2004	Linux Solutions 2004	Paris, France
February 5 - 6, 2004	EclipseCon 2004	(Disneyland Hotel)Anaheim, CA
February 9 - 12, 2004	O'Reilly Emerging Technology Conference(ETech)	(The Westin Horton Plaza)San Diego, CA
February 20 - 22, 2004	CodeCon 2004	(Club NV)San Francisco, CA
February 20 - 24, 2004	PaWS PHP and Web Standards UK 2004	Manchester, UK
February 21 - 22, 2004	Mozilla Developers Meeting in Europe 4.0	Brussels, Belgium
February 21 - 22, 2004	FOSDEM 2004	(SOLBOSCH)Brussels, Belgium
February 23 - 27, 2004	PostgreSQL Bootcamp	(Big Nerd Ranch, Inc.)Atlanta, GA
February 25 - 26, 2004	UKUUG LISA/Winter Conference and Tutorial	(Lansdowne Campus, Bournemouth Univ.)Bournemouth, UK
February 27, 2004	Mozilla Developer Day	Mountain View, CA
March 1 - 5, 2004	PHP|Cruise	The Caribbean
March 5, 2004	Perl Workshop 2004	Amsterdam, the Netherlands
March 6 - 7, 2004	Linux-Day Chemnitz	Chemnitz, Germany
March 15 - 17, 2004	Open Source in Government Conference	(George Washington University)Washington, DC
March 16 - 17, 2004	Open Source Business Conference 2004	(The Westin St. Francis)San Francisco, CA
March 18 - 24, 2004	CeBIT	(Hannover Exhibition Center)Hannover, Germany
March 21 - 26, 2004	Novell BrainShare 2004	Salt Lake City, Utah
March 24 - 26, 2004	PyCon DC 2004	Washington, D.C.
March 27 - 28, 2004	Nordic Perl Workshop 2004	(Symbion Science Park)Copenhagen, Denmark
March 27 - 28, 2004	YAPC::Taipei::2004	Taipei, Taiwan

Comments (none posted)

Web sites

Welcome to Gna!

Gna.org is a new code-hosting site that is similar to SourceForge and Savannah. "Gna! provides CVS Repositories, Download Area, Web Pages, Mailing-Lists and Trackers (Bugs, Task, Support Requests, Patches)."

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Miscellaneous

News from India

Linux World Magazine has ranked India's Rahul Chopra, Editor of 'Linux For You', as one of the world's top twenty Linux luminaries. He has been highlighted for his contribution to the area of Linux and open source software.

Richard M Stallman met with the President of India to discuss the ethical issues related to the use of proprietary software.

Comments (2 posted)

Netcraft Starts www.sco.com Death Watch

Netcraft graphs the SCO web site's uptime to see if it will collapse under the impending DDoS attack. (Thanks to Don Marti)

Also, many alert readers have pointed out this site in which Netcraft explains how SCO could defend against the DDoS.

Comments (12 posted)

Page editor: Forrest Cook

Letters to the editor

What? No evidence?

From:		Leon Brooks <leon-AT-cyberknights.com.au>
To:		"Kieran O'Shaughnessy" <anz_info-AT-sco.com>
Subject:		What? No evidence?
Date:		Mon, 2 Feb 2004 09:35:16 +0800
Cc:		Linux Australia list <linux-aus-AT-linux.org.au>, SLPWA members <members-AT-slpwa.asn.au>, letters-AT-lwn.net, Kate Mackenzie <mackenziek-AT-theaustralian.com.au>, Sam Varghese <svarghese-AT-theage.com.au>, infocentre-AT-accc.gov.au

Good morning, SCO ANZ!

Today dawns fine and clear, and I see no invoice from you, and no 
evidence for any of The SCO Group's code being in Linux.

In my office, I constantly run a uniprocessor server on Linux 2.6.1, a 
UP server on 2.4.23, a dual-processor server on 2.4.22, two UP 
workstations on 2.6.1 and a UP laptop on 2.4.22. In addition, I 
regularly run up other Linux-based machines as they are prepared for 
installation on client premises.

If you know that in doing so I'm using any of your code, copyrighted 
material, patented processes or anything of the kinds, please send me 
an invoice for those but only if you can accompany the invoice with 
precise specification of the rights you can prove are being used.

By "precise" I really do mean precise: vague references like "the RCU 
code" will not do because they are not sufficient to make an 
independent determination of the veracity of your claims. The SCO Group 
must surely have at least some of this evidence available already, as 
it is being required to collate it for presentation to a US Court in a 
week or so.

If you have any trouble identifying the kernels I'm using, just pull the 
latest Mandrake Cooker kernels from a file mirror like the one below, 
and supply the version number of that along with a list of file names 
and line number ranges referring to that which you claim as your 
property:

http://public.planetmirror.com/pub/mandrake/devel/cooker/SRPMS/

Do take care when nominating "your" code, because if you claim as your 
property any code written by non-SCO developers, you can be sure that 
at least some of them (incensed by The SCO Group's recent high-handed 
tactics) will certainly take the opportunity to sue you for copyright 
infringement.

I haven't seen any response to my previous communication, which is odd 
given that The SCO Group's lawyers rushed to include accusations of 
attack from the MyDoom virus in their most recent 10K filing:
 
http://www.sec.gov/Archives/edgar/data/...

This is significant because The SCO Group has essentially accused the 
Linux community (and I am unequivocally a part of the Linux community) 
of writing MyDoom, specifically "We've been working through a judicial 
system here. But now you have people going outside the system, trying 
to attack us, to try and shut us down before we have a court verdict" 
although Darl later backwaters this to "We don't know for sure if this 
attack is coming from Linux<1>, but we have very strong suspicions that 
is the case":

http://www.cnn.com/TRANSCRIPTS/0401/30/lol.01.html

This is even more significant because MyDoom has been traced to 
commercial spammers in Russia<2>:

http://www.themoscowtimes.com/stories/2004/01/30/002.html

I'm wondering if this demand for licence fees might be more of the same? 
If it is, do bear in mind that Australian law is a lot less inclined to 
let freedom of speech trump fraud than US law.

Either way, today is your final chance to either prove your claims 
against my company for our use of Linux, or to publicly retract them. 
If you need more time to prove your claims, please contact me promptly 
with the details to negotiate a deferment of action.

Cheers; Leon


<1> Doubly ironic because the MyDoom attack is coming only from
    Microsoft Windows-equipped machines.

<2> At the time MyDoom had not yet been formally activated against
    www.sco.com (they'd be getting the odd angry shot from machines
    with incorrect clocks, that's all) so Darl seems a little
    confused on this point.

-- 
http://cyberknights.com.au/     Modern tools; traditional dedication
http://plug.linux.org.au/       Committee Member, Perth Linux User Group
http://slpwa.asn.au/            Committee Member, Linux Professionals WA
http://linux.org.au/            Past Committee Member, Linux Australia

Comments (1 posted)

Page editor: Jonathan Corbet