LWN.net Weekly Edition for March 25, 2004

The Grumpy Editor's Guide to Image Viewers

Your editor is a firm believer in the advantages of free software. As such, he takes great pride in running a desktop system with nothing but free applications on it. Thanks to countless developers who have released their work under a free license, there is no need to run non-free software, and that fact makes a grumpy editor a little less so.

Too bad it's not true.

LWN is a relatively text-heavy site, but an LWN editor's job still requires spending a fair amount of time working with image files. This article, for example, involved grabbing several screenshots, cropping them, generating smaller versions to run inline with the article, etc. There is a simple, unpleasant fact that many Linux users sweep under the rug: the best tool for this sort of light image editing work is xv. A user with a minimal familiarity with xv can plow through a directory full of images, choose one, crop, resize, and save it (possibly in a different format) in less than a minute.

Unfortunately, xv is not free software. It is a "source available" product, and may be freely used "for your own amusement." Any sort of commercial use, however, requires the purchase of a $25 license. Web servers are standing by to take your credit card number. Since xv is not free, it is packaged by few distributors. It remains highly used, however, and packages for most distributions are a quick Google search away.

One would hope that the commercial nature of xv would, at least, encourage its further development. That turns out not to be true either, however; the last entry in the changelog was made at the end of 1994. The current release has been 3.10a since the beginning of 1995. The restrictive license of xv has clearly killed any chance of significant outside contributions, which is unfortunate; xv could use a makeover. In the late 1980's rolling your own widgets for a graphical application was almost mandatory, but there is really no excuse for that now.

Your editor has long wondered why, over all these years and with all the work that has gone into desktop development, nobody has ever come up with a tool for image viewing and simple editing which is anywhere near as quick and easy to use as xv. A proper editor, even a grumpy one, should make an effort to be on top of the state of the art, however, before making such a claim in public. So, what follows is a quick survey of the current image viewer offerings, with a focus on quick editing work.

In particular, here's what your editor wants:

• The ability to quickly step through a set of images, preferably with an easy keystroke (such as the space bar).
• Display of images in their natural resolution whenever possible.
• Fast operations for cropping and resizing images, and for saving the result.
• The ability to take a screenshot of another application is a nice bonus.
• Also nice, but less important, is the sort of quick color table tweaking that xv supports. One occasionally has to adjust the colors and contrast of a digital photograph, and it can be useful to have quick operations for that sort of task. One reaches a point where it is better to simply fire up the Gimp, however.

What your editor is not looking for is a full digital camera suite, with camera drivers, photo albums, etc. Your editor is also not looking to replace the Gimp, which is an indispensable tool in its own right, but is rather heavy for quick tasks. Finally, your editor will respond grumpily to mail suggesting packages like netpbm or ImageMagick. Those tools are invaluable for scripted applications, and no doubt some clever netpbm hacker could devise a six-stage pipeline involving two separate invocations of the ppmfrobnicate filter to perform all of the tasks above. That is not interesting, however; image viewing and editing is are jobs best done in a graphical mode.

That said, here is a quick overview of several image viewer/editor applications.

Electric Eyes

A number of distributors throw in the "Electric Eyes" application with their GNOME packages. This tool, usually called ee or eeyes, has come a long way over the years; it has most of the capabilities your editor has been looking for. Finding them can be a bit of a challenge, though. The middle mouse button is used for selecting an area to crop, but it simultaneously pops up an "edit controls" window (pictured on the left). That window allows for simple color table tweaking; it also offers a set of inscrutable icons for resizing and rotating the image. A resized image will be saved in its original size, however, unless you click the "apply" icon first; this operation has no visible effect, however. xv, in contrast, has an "original size" checkbox on the save dialog which makes things explicit. The crop operation is not to be found in the controls window; you must select it from a menu attached to the right mouse button.

Unlike most of the applications your editor tried out, Electric Eyes offers a "grab" function for creating screenshots. The process is a little cumbersome, and it employs a truly disturbing strobe effect which is meant to show you which window you had selected. But it works; it was used to generate the ee screenshot.

Electric Eyes appears to have almost nothing in the way of keyboard shortcuts, which slows things down significantly. This editor also has a significant flaw in that the image quality suffers when an image is resized; compare the image to the right (generated with ee) with that just above (generated with xv). The final conclusion is ee, while having a lot of the right features, is not yet ready to replace xv.

gthumb

In many ways, gthumb is the most capable of the tools tried by your editor. It can perform most of the tasks needed, though it lacks a screenshot grab function. The tools can be awkward to use, however. gthumb provides a cropping dialog (pictured on the left) which works by positioning a rectangle over a small version of the image. It has a number of nice options for controlling the aspect ratio of the resulting image. If, however, you are trying to position the crop area with any precision, working on a thumbnail is not the way to go. Selecting a crop area should be done on a full-size rendering of the image.

Speaking of full size, gthumb shares an annoying feature with a number of other image editors: it throws up a window with an arbitrary size that, doubtless, appealed to some GNOME developer; the image being viewed is then resized to fit the window. Your editor, when he wants to look at an image, wants to see the image in its natural resolution. There is a configuration option which can be used to tell gthumb not to resize the image, but it still doesn't size the initial window appropriately. It does, however, remember the way a window was resized the second time an image is viewed.

Resizing of images is done by way of a dialog where the desired size must be specified explicitly. It works, but a quick, immediately visible resize applied directly to the image is faster and better. The quality of images resized by gthumb is good.

There is a set of color tweaking operations which make it relatively easy to fix up digital photos. gthumb also has a number of features you editor wasn't looking for, including "catalogs" (photo albums, essentially) and the ability to attach comments to images. The comments, however, are hidden away in a secret gphoto directory and do not survive if the image is copied or renamed from the command line. gthumb can create index images and web albums as well.

KView and gwenview

KView is a KDE-based image viewer application. Like many KDE applications, KView looks pretty. This image viewer, however, is not up to the task.

KView resizes images on startup (though this behavior is configurable). The application offers a rather clunky zoom interface (you have to pick from a list of percentages) but it has no option to resize an image. It can crop images however (from a selection on the full-size image) and the basic rotate and flip operations are provided. There is also a small list of effects. KView can interface with SANE for easy processing of scanned images.

Another KDE-based viewer is gwenview. As an image viewer, it is nice; it provides a configurable thumbnail window, and keys like the space bar do the right thing (i.e. what an xv user would expect). The only editing operations provided by gwenview, however, are image flipping and rotation. The operations are quick - a simple control-L will rotate the image to the left - but by themselves they are inadequate.

Others

By this stage in the process, your editor was starting to run low on energy. There are, however, several other offerings out there which, perhaps, warrant a mention.

Digikam is a KDE application meant for working with digital cameras. It divides the world into "albums," and reacts badly if you try to start it with a command like "digikam my_image.png". There is a basic set of editing operations, including full-image cropping and gamma and brightness adjustments, but there is no way to resize an image.

Showimg is a KDE viewer which resembles gwenview in many ways. It adds a set of relatively useless image transformation options ("swirl," "implode"), but is unable to crop or resize images. It does have a cute pink cow splash screen, however.

GImageView is a GNOMEish viewer oriented towards working with lots of images. It has a special set of movie options on top of the usual image viewing features. GImageView has an unbelievable number of configuration options. The only editing operation, however, is image rotation - and you can't save the result. For whatever reason, the keyboard shortcut to exit the application is Control-C.

ida is a simple viewer which has obviously been inspired by xv; the right mouse button brings up a control panel, and many of the keyboard shortcuts work the same way. Selecting an area and hitting "c" will crop to that area, for example. Resizing is supported (and the image quality is good), but it requires typing the desired size into a dialog. A small set of image tweaking operations is provided as well. This application has potential, but it needs a faster interface. The Motif-based user interface could also stand an upgrade.

Eye of GNOME is a simple, GNOME-based viewer. The only supported editing operation is rotation; this application has a "save" operation which overwrites the file without question, but no "save as". It is a reasonable image viewer, but it is not useful for editing.

Conclusion

Your editor stands by his original claim: xv, even after nine years of absolutely no development, is still superior to any of the free alternatives. No other tool provides the same ease of use, speed, features, and quality of results. To a grumpy editor, it almost seems as if the developers of free image viewing and editing applications have concerned themselves mostly with quantity. The users of these applications, however, might well be happy to have fewer applications to choose from if a few of them were the same sort of focused, powerful application as xv.

That said, your editor's clear choice for a free image viewer/editor has to be gthumb. The essential set of features is there; all that's left is tuning the interface to make those features quick and easy to use. This application shows potential; your editor will be watching it.

Comments (100 posted)

The 2004 Debian Project Leader election

It's election time again. The Debian Project is holding its annual election for Debian Project Leader (DPL). This year, three candidates are running for the office: current DPL Martin Michlmayr, Gergely Nagy, and Branden Robinson. Debian Developers also have the option of voting for "none of the above" if they prefer.

We contacted each of the DPL candidates with several questions about themselves and their intentions in running for office. We also combed through the discussion on the debian-vote list, where the candidates have been participating in discussions about the Debian project, and why they are qualified to be DPL -- or why they are not. We have attempted to distill all of this information into a brief summary of the candidates' platforms and ideas, but we recommend that LWN readers interested in the DPL election also take the time to read each candidate's platform (they are all available on this page) as well as the relevant DPL threads on debian-vote.

It's typical for candidates for any office to assure their voters that they take that office seriously. Not so with Nagy, who it seems is running on a whim. Nagy is a 22-year-old student living in Hungary, who is running "for fun and profit, of course!"

He asks Debian Developers not to "even think about voting for me," and says he would resign immediately in the event he does win. Michlmayr and Robinson are a bit more serious about the election.

In addition to serving as DPL, Michlmayr notes that he is also working on a Ph.D. at the University of Cambridge. He says that he is researching quality management in free software. Michlmayr already holds Master degrees in Philosophy and Psychology from the University of Innsbruck, and a Masters in Software Engineering from the University of Melbourne. Michlmayr told LWN that he is running for a second term as DPL to continue his work:

Robinson lives in Indianapolis, Indiana and has worked for Progeny for the past three and a half years. He has been a Debian Developer since 1998, and served as Treasurer of Software in the Public Interest (SPI) from August 2001 to February 2004. Robinson points out in his platform several reasons why he is running for DPL. Robinson writes that Debian needs improved, more open, and more visible processes. Robinson also says in his platform that the Debian Project should "take our Constitution more seriously," and that the Debian project needs "a leader who will champion our cause:"

Since the DPL serves a one-year term, we asked each of the candidates to identify the biggest challenge facing Debian over the next year. We also asked candidates to rate the "health" of Debian, and whether the "market share" of Debian as a Linux distribution was a concern. Michlmayr responded:

In his platform, Michlmayr also lists several goals he has for the next year. In addition to a faster release cycle, he says that Debian needs a clear release plan for the coming release and for the release cycle for the next few years. He also cites a desire to work with external projects to help reduce duplication of effort between Debian-based distributions.

Robinson told LWN that he sees scalability as the top problem for Debian in the next year:

As for market share, Robinson said that it is something that the DPL "should be cognizant of, though his or her ability to directly affect it is almost nonexistant." Robinson also said that he is "not too worried," about the relative market share of Debian and that he "cannot help [but] be aware of the rising tide that is Debian."

Debian Developers recently rejected a proposal to remove non-free. However, each of the candidates for DPL says that they support removal of non-free from Debian. Robinson said that non-free software does not directly serve the Debian mission, and pointed out that many voters may have misconceptions about the nature of non-free:

Michlmayr also wants to get rid of non-free, and points out that as long as Debian maintains non-free that it is less likely that free software alternatives will be created to replace the non-free packages. He said that he was not surprised by the vote, because "the non-free removal was not approached properly."

Another issue that comes up from time to time is Debian's support for multiple architectures. We asked the candidates whether support for multiple hardware platforms was slowing the project, and when Debian should consider dropping a hardware platform. Nagy responded that if any architecture were dropped, "it should be x86, period...Debian being the Universal OS, should support all possible architectures, and as long as there are people who do the porting work, the support for the platform must be kept."

According to Robinson, the answer should be to improve the build infrastructure:

In his response to LWN, Robinson also said that Debian should stop supporting a platform "when our developers are no longer able to maintain it to our standards." According to Robinson:

Michlmayr also said that support for multiple hardware platforms was not the cause for slow releases:

Finally, we asked the candidates about their thoughts on projects that make use of Debian, such as Progeny's "Componentized Linux," and Bruce Perens' UserLinux, and whether companies like Lindows.com and Xandros were giving enough back to the Debian Project.

Michlmayr said that he has contacted some of the companies that make use of Debian, and that he thinks that "closer cooperation is very important." He notes in his platform that there is limited cooperation between the Debian-based distributions, and that there is development that is not being integrated back into Debian.

Robinson responded that one problem presented by the many Debian-based projects, and the "vast amounts of Free and Open Source software that we see today," is that it's hard for people to determine whether the problem they're trying to solve has been solved already.

As to the question of whether companies give enough back to Debian, Robinson says, "yes and no."

The current system, he notes, may be confusing for developers inside a company like Lindows or Xandros who wish to contribute but are unsure of the proper way to go about it. A Debian liaison to a company would serve as an interface between the Debian project and companies utilizing Debian and looking to contribute back to the project.

The DPL election will continue for a few more weeks. Debian Developers have until April 10 to cast their votes for the Debian Project Leader (DPL), give or take fifteen hours due to a snafu in sending out the call for votes. Good luck to all the candidates, and may the best developer win.

Comments (none posted)

LWN login problems with Internet Explorer

We have been getting a steady stream of mail from readers who are having a hard time logging in with Internet Explorer. If you are using IE, and you are having trouble logging in or getting your password sent to you, please have a look at this update from Microsoft; chances are it will solve your problem.

Comments (20 posted)

Page editor: Jonathan Corbet

Security

Brief items

Cleaning up your disks

Simson Garfinkel has written another story on the interesting things he has found on used disk drives; this one appears in CSO magazine. He looked at some 150 drives, and found that only 10% of them had been sanitized.

In general, one need not think to long before realizing that letting an unsanitized disk out of your possession is not a particularly good idea. One might well wonder, however, what the best method is for cleaning up a disk. There are a few different options available. Note that running fdisk or mkfs is not an option, however; those utilities leave most of the information on the disk intact.

The safest way, perhaps, is to encrypt the contents of your disks from the beginning. Such disks should be safe even if they leave your possession in an unexpected, undesired way. Most Linux distributions do not come with easy disk encryption options now, but that is likely to change within the next year or so. The inclusion of the crypto-API code in the 2.6 kernel, combined with the block encryption capabilities being patched into the device mapper code, should make this capability widely available.

The GNU shred utility is part of the "coreutils" package. It can be used to overwrite the contents of a single file or an entire device. The single file mode can be tripped up by things like journaling filesystems and should not be relied upon for too much security. When shred is applied to an entire block device, however, it should be effective.

Lacking a tool like shred, one could always overwrite a device with a command like:

    dd if=/dev/urandom of=/dev/disk-to-wipe

The truly paranoid among us will want to run that command more than once.

Another option is the standalone disk wiper, which boots from a diskette or CD to do its cleanup work. This sort of utility is useful when an entire computer is being surplussed, and the person doing the cleanup does not, necessarily, know how to log into and clean the system. Besides, wiping the root disk on a running system can be a difficult operation to complete. A couple of offerings in this area are autoclave and Secure Harddisk Eraser. Both of these are compact Linux systems which boot in a standalone mode and trash the disk. Autoclave goes to some lengths to ensure that the user knows what is about to happen; Secure Harddisk Eraser, instead, simply waits a minute and goes to work.

The final option is the physical destruction of the disk drive. Modern drives can be surprisingly hard to destroy, however.

The one course which is not an option is getting rid of drives without cleaning them up first. It has become clear to a lot of people that used drives can be gold mines of information which should not be disclosed. If you throw away a loaded disk, chances are good that somebody else will go digging through it.

Comments (27 posted)

New vulnerabilities

ecartis: several vulnerabilities

Package(s):	ecartis	CVE #(s):	CAN-2003-0781 CAN-2003-0782
Created:	March 24, 2004	Updated:	March 24, 2004
Description:	The ecartis mailing list manager (version 1.0) suffers from an input validation vulnerability which can result in the disclosure of list passwords. Ecartis also has several buffer overflow vulnerabilities. See this advisory for more information.
Alerts:	Debian DSA-467-1 2004-03-23

Comments (none posted)

httpd - vulnerabilities fixed in Apache HTTP Server v2.0.49

Package(s):	httpd	CVE #(s):	CAN-2004-0174 CAN-2003-0020 CAN-2004-0113
Created:	March 23, 2004	Updated:	March 30, 2004
Description:	The Apache Software Foundation and the Apache HTTP Server Project have announced the release of version 2.0.49 of the Apache HTTP Server ("Apache"). More on the vulnerabilities fixed in this release can be found in this announcement.
Alerts:	Trustix TSLSA-2004-0017 2004-03-30

Comments (none posted)

Updated vulnerabilities

apache2: Denial of Service vulnerability

Package(s):	apache2	CVE #(s):
Created:	September 29, 2003	Updated:	March 25, 2004
Description:	A problem was discovered in Apache2 where CGI scripts that write more than 4k to the standard error stream will hang the script's execution. This problem can lead to a denial of service situation. See this bug report for additional details.
Alerts:	Gentoo 200403-04 2004-03-22 Netwosix NW-2004-0006 2004-03-25 Mandrake MDKSA-2003:096-1 2003-10-24 Mandrake MDKSA-2003:096 2003-09-26

Comments (none posted)

calife: buffer overflow

Package(s):	calife	CVE #(s):	CAN-2004-0188
Created:	March 17, 2004	Updated:	March 17, 2004
Description:	Calife, a program which provides super user privileges to specific users, was found to contain a buffer overflow related to the getpass(3) library function. A local attacker could potentially exploit this vulnerability, given knowledge of a local user's password and the presence of at least one entry in /etc/calife.auth, to execute arbitrary code with root privileges.
Alerts:	Debian DSA-461-1 2004-03-11

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail may crash on specially crafted message

Package(s):	fetchmail	CVE #(s):	CAN-2003-0792
Created:	October 17, 2003	Updated:	April 8, 2004
Description:	A bug was discovered in fetchmail 6.2.4 where a specially crafted email message can cause fetchmail to crash.
Alerts:	OpenPKG OpenPKG-SA-2004.012 2004-04-08 Gentoo 200403-10 2004-03-30 Netwosix NW-2004-0002 2004-02-20 SCO Group CSSA-2004-004.0 2004-02-19 Slackware SSA:2003-300-02 2003-10-22 Mandrake MDKSA-2003:101 2003-10-16

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

iproute: local denial of service

Package(s):	iproute net-tools	CVE #(s):	CAN-2003-0856
Created:	November 25, 2003	Updated:	December 14, 2004
Description:	The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible.
Alerts:	Mandrake MDKSA-2004:148 2004-12-13 Fedora FEDORA-2004-154 2004-06-03 Fedora FEDORA-2004-115 2004-05-11 Debian DSA-492-1 2004-04-18 Gentoo 200404-10 2004-04-09 Red Hat RHSA-2003:316-01 2003-11-24

Comments (none posted)

kdelibs: cookie disclosure

Package(s):	kdelibs	CVE #(s):	CAN-2003-0592
Created:	March 10, 2004	Updated:	August 24, 2004
Description:	kdelibs (and, thus, Konqueror) has a vulnerability where a hostile server can force the disclosure of cookies that should not be presented to it. KDE versions 3.1.3 and later contain a fix.
Alerts:	Gentoo 200408-23 2004-08-24 Red Hat RHSA-2004:074-01 2004-03-10 Red Hat RHSA-2004:075-01 2004-03-10 Mandrake MDKSA-2004:022 2004-03-10 Debian DSA-459-1 2004-03-10

Comments (none posted)

kdepim: VCF file information reader vulnerability

Package(s):	kdepim	CVE #(s):	CAN-2003-0988
Created:	January 15, 2004	Updated:	May 26, 2004
Description:	KDE has issued a security advisory for all versions of kdepim as distributed with KDE versions 3.1.0 through 3.1.4 inclusive. A carefully crafted .VCF file potentially enables local attackers to compromise the privacy of a victim's data or execute arbitrary commands with the victim's privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0988 to this issue.
Alerts:	Fedora FEDORA-2004-133 2004-05-19 Gentoo 200404-02 2004-04-06 Whitebox WBSA-2004:005-01 2004-02-12 Conectiva CLA-2004:810 2004-01-20 Slackware SSA:2004-014-01 2004-01-14 Mandrake MDKSA-2004:003 2004-01-14 Red Hat RHSA-2004:006-01 2004-01-07

Comments (none posted)

kernel: local root exploit in 2.4.22

Package(s):	kernel	CVE #(s):	CAN-2003-0961
Created:	December 1, 2003	Updated:	April 5, 2004
Description:	A vulnerability was discovered in the Linux kernel versions 2.4.22 and previous. A flaw in bounds checking in the do_brk() function can allow a local attacker to gain root privileges. This vulnerability is known to be exploitable. The 2.4.23 kernel contains the fix. For more details on how this vulnerability works, see this LWN article.
Alerts:	Debian DSA-475-1 2004-04-05 Debian DSA-470-1 2004-04-01 Debian DSA-442-1 2004-02-19 Debian DSA-433-1 2004-02-04 Debian DSA-423-1 2004-01-15 Red Hat RHSA-2003:368-01 2003-12-19 Conectiva CLA-2003:796 2003-12-05 Gentoo 200312-02 2003-12-04 SuSE SuSE-SA:2003:049 2003-12-04 Yellow Dog YDU-20031203-1 2003-12-03 Red Hat RHSA-2003:389-01 2003-12-01 Fedora FEDORA-2003-026 2003-12-02 Slackware SSA:2003-336-01 2003-12-01 Red Hat RHSA-2003:392-00 2003-12-01 Trustix 2003-0046 2003-12-01 Mandrake MDKSA-2003:110 2003-12-01 Debian DSA-403-1 2003-12-01

Comments (1 posted)

Linux kernel 2.2.10 failing function and TLB flush vulnerability

Package(s):	kernel-source-2.2.10	CVE #(s):	CAN-2004-0077
Created:	March 18, 2004	Updated:	June 4, 2004
Description:	A local root exploit is possible due to early flushing of the TLB.
Alerts:	Debian DSA-514-1 2004-06-04 Debian DSA-466-1 2004-03-18

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):	libxml2	CVE #(s):	CAN-2004-0110
Created:	February 26, 2004	Updated:	August 19, 2009
Description:	Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:	Fedora FEDORA-2009-8594 2009-08-15 Fedora FEDORA-2009-8582 2009-08-15 Fedora-Legacy FLSA:1324 2004-07-19 Conectiva CLA-2004:836 2004-03-31 Gentoo 200403-01 2004-03-06 Trustix TSLSA-2004-0010 2004-03-05 OpenPKG OpenPKG-SA-2004.003 2004-03-05 Netwosix NW-2004-0004 2004-03-04 Debian DSA-455-1 2004-03-03 Mandrake MDKSA-2004:018 2004-03-03 Red Hat RHSA-2004:091-02 2004-03-03 Whitebox WBSA-2004:090-01 2004-03-01 Red Hat RHSA-2004:090-01 2004-02-26 Fedora FEDORA-2004-087 2004-02-25 Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

mailman denial of service

Package(s):	mailman	CVE #(s):	CAN-2003-0991
Created:	February 9, 2004	Updated:	May 25, 2004
Description:	Matthew Galgoci of Red Hat discovered a Denial of Service (DoS) vulnerability in versions of Mailman prior to 2.1. An attacker could send a carefully-crafted message causing mailman to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0991 to this issue.
Alerts:	Conectiva CLA-2004:842 2004-05-25 Red Hat RHSA-2004:156-01 2004-04-14 Mandrake MDKSA-2004:013 2004-02-13 Red Hat RHSA-2004:019-01 2004-02-09

Comments (1 posted)

mc: arbitrary code execution

Package(s):	mc	CVE #(s):	CAN-2003-1023
Created:	January 16, 2004	Updated:	April 5, 2004
Description:	A vulnerability was discovered in Midnight Commander, a file manager, whereby a malicious archive (such as a .tar file) could cause arbitrary code to be executed if opened by Midnight Commander.
Alerts:	OpenPKG OpenPKG-SA-2004.009 2004-04-05 Gentoo 200403-09 2004-03-29 Conectiva CLA-2004:833 2004-03-31 SCO Group CSSA-2004-014.0 2004-03-25 Whitebox WBSA-2004:035-01 2004-02-12 Fedora FEDORA-2004-058 2004-02-09 Red Hat RHSA-2004:035-01 2004-01-19 Mandrake MDKSA-2004:007 2004-01-26 Red Hat RHSA-2004:034-01 2004-01-19 Debian DSA-424-1 2004-01-16

Comments (none posted)

metamail: integer and buffer overflows

Package(s):	metamail	CVE #(s):	CAN-2004-0104 CAN-2004-0105
Created:	February 18, 2004	Updated:	May 21, 2004
Description:	Versions of metamail through 2.7 contain a set of integer and buffer overflows which are remotely exploitable via a properly crafted message.
Alerts:	Gentoo 200405-17 2004-05-21 Debian DSA-449-1 2004-02-24 Mandrake MDKSA-2004:014 2004-02-18 Slackware SSA:2004-049-02 2004-02-18 Red Hat RHSA-2004:073-01 2004-02-18

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mod_python: denial of service vulnerability

Package(s):	mod_python	CVE #(s):	CAN-2003-0973
Created:	January 27, 2004	Updated:	October 4, 2004
Description:	Apache's mod_python module could crash the httpd process if a specific, malformed query string was sent. The Apache Foundation has reported that mod_python may be prone to Denial of Service attacks when handling a malformed query. Mod_python 2.7.9 was released to fix the vulnerability, however, because the vulnerability has not been fully fixed, version 2.7.10 has been released. Users of mod_python 3.0.4 are not affected by this vulnerability.
Alerts:	Fedora-Legacy FLSA:1325 2004-10-03 Conectiva CLA-2004:837 2004-04-12 Whitebox WBSA-2004:058-01 2004-03-01 Debian DSA-452-1 2004-02-29 Red Hat RHSA-2004:058-01 2004-02-26 Red Hat RHSA-2004:063-01 2004-02-26 Gentoo 200401-03 2004-01-27

Comments (none posted)

mozilla: multiple vulnerabilties

Package(s):	mozilla	CVE #(s):	CAN-2003-0594 CAN-2003-0564
Created:	March 10, 2004	Updated:	August 19, 2004
Description:	Mozilla 1.4 contains a few vulnerabilities, including disclosure of cookies to the wrong server, a scripting vulnerability which can allow an attacker to run arbitrary code, and an S/MIME vulnerability which can lead to remote denial of service or code execution attacks.
Alerts:	Whitebox WBSA-2004:421-01 2004-08-19 Whitebox WBSA-2004:110-01 2004-03-29 Red Hat RHSA-2004:112-01 2004-03-17 Mandrake MDKSA-2004:021 2004-03-10

Comments (none posted)

mpg321: format string vulnerability

Package(s):	mpg321	CVE #(s):	CAN-2003-0969
Created:	January 6, 2004	Updated:	March 28, 2005
Description:	A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
Alerts:	Gentoo 200503-34 2005-03-28 Debian DSA-411-1 2004-01-05

Comments (none posted)

mplayer: remotely exploitable buffer overflow vulnerability

Package(s):	mplayer	CVE #(s):	CAN-2003-0835
Created:	September 29, 2003	Updated:	April 6, 2004
Description:	A remotely exploitable buffer overflow vulnerability was found in MPlayer. A malicious host can craft a harmful ASX header, and trick MPlayer into executing arbitrary code upon parsing that header. Read the full advisory for details.
Alerts:	Mandrake MDKSA-2004:026 2004-04-05 Gentoo 200403-13 2004-03-31 Conectiva CLA-2003:760 2003-10-06 Mandrake MDKSA-2003:097 2003-09-30 Gentoo 200309-15 2003-09-27

Comments (none posted)

mutt: buffer overflow

Package(s):	mutt	CVE #(s):	CAN-2004-0078
Created:	February 12, 2004	Updated:	March 26, 2004
Description:	mutt suffers from a buffer overflow in its "index menu" code. This overflow can be exploited via a hostile message to crash mutt and, perhaps, execute arbitrary code. Version 1.4.2 fixes the problem; see this advisory for details.
Alerts:	SCO Group CSSA-2004-013.0 2004-03-25 OpenPKG OpenPKG-SA-2004.005 2004-03-09 Netwosix NW-2004-0001 2004-02-16 Trustix 2004-0006 2004-02-13 Whitebox WBSA-2004:050-01 2004-02-12 Mandrake MDKSA-2004:010 2004-02-11 Slackware SSA:2004-043-01 2004-02-12 Red Hat RHSA-2004:051-01 2004-02-11 Red Hat RHSA-2004:050-01 2004-02-11 Fedora FEDORA-2004-061 2004-02-11

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

netpbm: insecure temporary files

Package(s):	netpbm	CVE #(s):	CAN-2003-0924
Created:	January 19, 2004	Updated:	December 29, 2004
Description:	netpbm is graphics conversion toolkit made up of a large number of single-purpose programs. Many of these programs were found to create temporary files in an insecure manner, which could allow a local attacker to overwrite files with the privileges of the user invoking a vulnerable netpbm tool.
Alerts:	Conectiva CLA-2004:909 2004-12-29 Gentoo 200410-02 2004-10-04 Mandrake MDKSA-2004:011-1 2004-09-27 Whitebox WBSA-2004:031-01 2004-02-12 Mandrake MDKSA-2004:011 2004-02-11 Red Hat RHSA-2004:030-01 2004-02-05 Fedora FEDORA-2004-068 2004-02-06 Red Hat RHSA-2004:031-01 2004-01-22 Debian DSA-426-1 2004-01-18

Comments (1 posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

OpenSSL: denial of service vulnerabilities

Package(s):	OpenSSL	CVE #(s):	CAN-2004-0081 CAN-2003-0851
Created:	March 17, 2004	Updated:	November 2, 2005
Description:	Versions 0.9.7a-c of the OpenSSL library suffer from two denial of service vulnerabilities; see the version 0.9.7d release announcement for details.
Alerts:	Red Hat RHSA-2005:830-00 2005-11-02 Red Hat RHSA-2005:829-00 2005-11-02 Fedora FEDORA-2005-1042 2005-10-31 Fedora-Legacy FLSA:1395 2004-05-08 Conectiva CLA-2004:834 2004-03-31 Whitebox WBSA-2004:084-01 2004-03-23 Red Hat RHSA-2004:084-01 2004-03-23 Fedora FEDORA-2004-095 2004-03-19 Whitebox WBSA-2004:120-01 2004-03-22 Trustix TSLSA-2004-0012 2004-03-17 Slackware SSA:2004-077-01 2004-03-17 Red Hat RHSA-2004:121-01 2004-03-17 OpenPKG OpenPKG-SA-2004.007 2004-03-18 Gentoo 200403-03 2004-03-17 Debian DSA-465-1 2004-03-17 Netwosix NW-2004-0005 2004-03-17 Mandrake MDKSA-2004:023 2004-03-17 SuSE SuSE-SA:2004:007 2004-03-17 Red Hat RHSA-2004:120-01 2004-03-17 Red Hat RHSA-2004:119-01 2004-03-17 EnGarde ESA-20040317-003 2004-03-17

Comments (1 posted)

perl information leak

Package(s):	perl	CVE #(s):	CAN-2003-0618
Created:	February 2, 2004	Updated:	April 21, 2004
Description:	Paul Szabo discovered a number of bugs in suidperl, a helper program to run perl scripts with setuid privileges. By exploiting these bugs, an attacker could abuse suidperl to discover information about files (such as testing for their existence and some of their permissions) that should not be accessible to unprivileged users.
Alerts:	Debian DSA-431-2 2004-04-16 Debian DSA-431-1 2004-02-01

Comments (none posted)

postfix: denial of service vulnerabilities

Package(s):	postfix	CVE #(s):	CAN-2003-0468 CAN-2003-0540
Created:	August 5, 2003	Updated:	May 27, 2004
Description:	The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:	Mandrake MDKA-2004:028 2004-05-26 Trustix 2003-0029 2003-08-04 Mandrake MDKSA-2003:081 2003-08-04 EnGarde ESA-20030804-019 2003-08-04 Conectiva CLA-2003:717 2003-08-04 SuSE SuSE-SA:2003:033 2003-08-04 Red Hat RHSA-2003:251-01 2003-08-04 Debian DSA-363-1 2003-08-03

Comments (none posted)

PWLib: possible Denial of Service

Package(s):	PWLib	CVE #(s):	CAN-2004-0097
Created:	February 13, 2004	Updated:	April 9, 2004
Description:	PWLib is a cross-platform class library designed to support the OpenH323 project. OpenH323 provides an implementation of the ITU H.323 teleconferencing protocol, used by packages such as Gnome Meeting. A test suite for the H.225 protocol (part of the H.323 family) provided by the NISCC uncovered bugs in PWLib prior to version 1.6.0. An attacker could trigger these bugs by sending carefully crafted messages to an application. The effects of such an attack can vary depending on the application, but would usually result in a Denial of Service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0097 to this issue.
Alerts:	Gentoo 200404-11 2004-04-09 Mandrake MDKSA-2004:017 2004-03-03 Fedora FEDORA-2004-078 2004-03-02 Debian DSA-448-1 2004-02-22 Whitebox WBSA-2004:047-01 2004-02-18 Red Hat RHSA-2004:047-01 2004-02-18 Red Hat RHSA-2004:048-01 2004-02-13

Comments (none posted)

python: buffer overflow

Package(s):	python	CVE #(s):	CAN-2004-0150
Created:	March 10, 2004	Updated:	October 11, 2004
Description:	Python (versions 2.2 and 2.2.1 only) has a buffer overflow in the getaddrinfo() function which can be exploited by a malformed IPv6 address.
Alerts:	Debian DSA-458-3 2004-10-10 Gentoo 200409-03 2004-09-02 Debian DSA-458-2 2004-08-31 Mandrake MDKSA-2004:019 2004-03-09 Debian DSA-458-1 2004-03-09

Comments (none posted)

samba privilege escalation

Package(s):	samba	CVE #(s):	CAN-2004-0186
Created:	March 15, 2004	Updated:	April 20, 2004
Description:	Samba, a LanManager-like file and printer server for Unix, was found to contain a vulnerability whereby a local user could use the "smbmnt" utility, which is setuid root, to mount a file share from a remote server which contained setuid programs under the control of the user. These programs could then be executed to gain privileges on the local system.
Alerts:	Mandrake MDKSA-2004:035 2004-04-19 Debian DSA-463-1 2004-03-12

Comments (none posted)

sysstat: temporary file vulnerability

Package(s):	sysstat	CVE #(s):	CAN-2004-0107 CAN-2004-0108
Created:	March 10, 2004	Updated:	October 4, 2004
Description:	The sysstat utility has a temporary file vulnerability which can be exploited by a local attacker to overwrite system files.
Alerts:	Fedora-Legacy FLSA:1372 2004-10-03 Gentoo 200404-04 2004-04-06 Debian DSA-460-2 2004-04-03 Trustix TSLSA-2004-0011 2004-03-16 Whitebox WBSA-2004:053-01 2004-03-10 Red Hat RHSA-2004:053-01 2004-03-10 Red Hat RHSA-2004:093-01 2004-03-10 Debian DSA-460-1 2004-03-10

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tcpdump: flaws in the ISAKMP decoding routines

Package(s):	tcpdump	CVE #(s):	CAN-2003-0989 CAN-2004-0057 CAN-2004-0055
Created:	January 15, 2004	Updated:	April 6, 2004
Description:	George Bakos discovered flaws in the ISAKMP decoding routines of tcpdump versions prior to 3.8.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0989 to this issue. Jonathan Heusser discovered two additional flaws in the ISAKMP decoding routines of tcpdump versions up to and including 3.8.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0057 to this issue. Jonathan Heusser discovered a flaw in the print_attr_string function in the RADIUS decoding routines for tcpdump 3.8.1 and earlier. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0055 to this issue. Remote attackers could potentially exploit these issues by sending carefully-crafted packets to a victim. If the victim uses tcpdump, these packets could result in a denial of service, or possibly execute arbitrary code as the 'pcap' user.
Alerts:	Gentoo 200404-03 2004-03-31 Fedora FEDORA-2004-091 2004-03-04 SCO Group CSSA-2004-008.0 2004-03-02 Fedora FEDORA-2004-092 2004-03-02 Whitebox WBSA-2004:008-01 2004-02-12 Fedora-Legacy FLSA:1222 2004-01-31 Mandrake MDKSA-2004:008 2004-01-26 EnGarde ESA-20040119-002 2004-01-19 Debian DSA-425-1 2004-01-16 OpenPKG OpenPKG-SA-2004.002 2004-01-16 Trustix 2004-0004 2004-01-05 SuSE SuSE-SA:2004:002 2004-01-14 Red Hat RHSA-2004:008-01 2004-01-15 Red Hat RHSA-2004:007-01 2004-01-14

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

util-linux: information leak in the login program

Package(s):	util-linux	CVE #(s):	CAN-2004-0080
Created:	February 3, 2004	Updated:	April 8, 2004
Description:	The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. In some situations, the login program could use a pointer that had been freed and reallocated. This could cause unintentional data leakage.
Alerts:	Netwosix NW-2004-0010 2004-04-08 Gentoo 200404-06 2004-04-07 Fedora-Legacy FLSA:1256 2004-03-04 Whitebox WBSA-2004:056-01 2004-02-12 Red Hat RHSA-2004:056-01 2004-02-02

Comments (1 posted)

uudeview temp file problem

Package(s):	uudeview	CVE #(s):
Created:	March 13, 2004	Updated:	March 29, 2004
Description:	uudeview 0.5.19 and later has problem with insecure temp file handling that can lead to failure retrieving the filename during decode.
Alerts:	Gentoo 200403-05 2004-03-26 OpenPKG OpenPKG-SA-2004.006 2004-03-12

Comments (none posted)

xitalk missing privilege release

Package(s):	xitalk	CVE #(s):
Created:	March 13, 2004	Updated:	March 17, 2004
Description:	The xitalk utility fails to drop privileges; this problem can be exploited by a local user to run commands under the "utmp" group ID.
Alerts:	Debian DSA-462-1 2004-03-12

Comments (none posted)

Resources

Rootkit Hunter 1.0.0

Rootkit Hunter 1.0.0 has been released; this package will scan a system for signs of compromise. The release contains a long list of "supported" malware that Rootkit Hunter can detect; that list does not include the Adore rootkit discussed here last week, however.

Full Story (comments: 1)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current 2.6 prepatch is 2.6.5-rc2, which was announced by Linus on March 19. This prepatch includes a USB update, some new SELinux features, a reiserfs update, an ALSA update, a set of hotplug CPU patches, and lots of fixes; see the long-format changelog for the details.

Linus's BitKeeper tree contains, as of this writing, some architecture updates, a watchdog driver update, and various fixes.

The current tree from Andrew Morton is 2.6.5-rc2-mm2. Recent additions to the -mm tree include journaling of ext3 quota files, a new fcntl() file_operations method (see below), a new non-executable stack patch, and lots of fixes.

The current 2.4 prepatch is 2.4.26-pre5, which was released on March 20. This one includes some SCSI fixes, a USB update, some ACPI work, and a small set of fixes. This is, says Marcelo, probably the last prepatch before the 2.4.26 release candidates start.

The current neolithic kernel prepatch is 2.2.27-pre1; Marc-Christian Petersen started the 2.2.27 process on March 24. This prepatch contains about a dozen important fixes.

Comments (2 posted)

Kernel development news

Reverse mapping anonymous pages - again

Two weeks ago, this page described Andrea Arcangeli's "anon_vma" work in some detail. This work, remember, is an attempt to improve memory scalability in the kernel by eliminating the reverse mapping ("rmap") chains used to find page table entries which reference a given page. The rmap chains can use significant amounts of low memory and can slow down fork() calls, so this work is of interest.

Andrea has continued pushing the anon_vma effort through a series of kernel tree releases. The latest, 2.6.5-rc2-aa2, solves some of the remaining problems and comes with this statement:

(The prio_tree reference is about Rajesh Venkatasubramanian's priority tree patch which speeds the search for interesting virtual memory areas when a page is mapped a large number of times).

Andrea's work is proceeding nicely, but it's worth noting that anon_vma is not the only approach to the implementation of an object-based reverse mapping scheme for anonymous memory. There is competition in the form of "anonmm" by Hugh Dickins. Hugh has recently reworked the patch and posted it for comments; interested parties can find this (multi-part) posting in the "patches" section below.

The anon_vma patch works by creating a linked list of virtual memory areas (VMAs) which reference a given page. The anonmm patch, instead, creates a connection between an anonymous page and the mm_struct structures which reference it. The mm_struct is the top-level structure used to manage a process's virtual address space; it contains pointers to all of the process's VMAs and page tables, along with various bits of locking and housekeeping information. If you have a pointer to a process's mm_struct and a virtual address, you can quickly walk the page tables and determine whether the given address is a reference to a specific page.

Most of the object-based reverse mapping has worked with the VMA structure. When performing reverse mapping of file-backed pages, use of the VMA structure is unavoidable; if multiple processes have mapped the file into their address spaces, each process likely has a different virtual address for the same page. The VMA structure contains the necessary information to determine which virtual address each process will have for a specific offset within a file. Once that address is found, the page of interest can be unmapped from that process's address space.

Anonymous pages are different from file-backed pages, however; they are only shared between processes when a process forks (and, even then, it's a copy-on-write sharing). That means that, with one exception that we'll get to, shared anonymous pages have the same virtual address in every process. Thus, if you can track an anonymous page's virtual address and the processes which share that page, you can quickly find all of the page table entries referencing the page.

The anonmm patch takes advantage of this fact. An anonymous page's virtual address is stored in the index field of the page structure. This field is normally used to give a page's offset within the file that backs it, but, since anonymous pages have no backing file, the field is available for this use. Hugh's patch then creates a new anonmm structure which is used to create a linked list of mm_struct structures; a pointer to this list is also stored in the page structure. The resulting data structure looks roughly like this:

With this structure in place, the kernel can follow the pointers to quickly find the page tables referencing a given anonymous page. This approach, in theory, should be a little simpler and faster than the anon_vma technique; a process may have several VMAs for anonymous memory areas, but it will never have more than one mm_struct.

There is one little problem with this whole scheme. It depends on the fact that every process has the same virtual address for a given, shared anonymous page. What happens when some wiseass process comes along and moves a chunk of anonymous memory with mremap()? At that point, the memory has a new address, and the anonmm algorithm will be unable to find it. Hugh's solution for this problem is to simply copy the pages being remapped. They are copy-on-write pages, so making copies will not create any correctness issues. The copying could be expensive - it may involve swapping in a number of pages so that they can be copied - but remapping of anonymous memory should be a sufficiently rare operation that a performance hit should not be a problem.

Which scheme is truly faster? Martin Bligh has posted a set of benchmarks showing that, while both reverse mapping approaches are significantly faster than the mainline kernel, neither is obviously faster than the other. Andrea's work is marginally ahead in more tests than Hugh's, but, overall, the two produce roughly equivalent results. So, if one of these implementations does find its way into the 2.6 kernel, it will have to be chosen for reasons other than performance. Either that, or it will be some combination of the two; Andrea and Hugh are actively discussing ideas, so that sort of combination could happen.

Comments (none posted)

A new file_operations method

The file_operations structure contains pointers to functions which implement I/O operations on files and char devices. These operations include the usual suspects, such as "open", "read", "write", "llseek", etc., along with some more esoteric ones ("sendfile", "get_unmapped_area"). The file_operations structure tends not to change very often; changes here can force updating a great many filesystems and drivers.

The NFS maintainers recently ran into a problem: it is not possible to simultaneously implement the O_DIRECT and O_APPEND modes over NFS. Rather than silently fail to implement a request to do so, the NFS developers have submitted a patch which adds an fcntl() method to the file_operations structure. Its prototype is:

    long (*fcntl)(unsigned int fd, unsigned int cmd, 
                  unsigned long arg, struct file *filp);

The fd, cmd, and arg parameters come straight from user space. A file descriptor is an unusual argument for a file_operations method, but the generic fcntl() code needs it. filp is, as usual, a pointer to the file structure for the open file.

If a module does not provide a fcntl() method, the call is handled in the usual way. Otherwise, the new fcntl() function should provide a complete implementation of that system call. Typically, the method will perform whatever device- or filesystem-specific work is needed (NFS simply checks for the O_DIRECT|O_APPEND combination and returns a failure code if it's there), then pass all four arguments to generic_file_fcnt(), which is exported to modules.

This patch is currently in the -mm tree; it will likely find its way into the mainline sometime after 2.6.5 comes out.

Comments (3 posted)

The return of write barriers

One of the tasks on the 2.5 "to do" list was the implementation of proper write barriers in the block I/O subsystem. Any code which attempts to implement true transactional behavior on disk-based files needs this capability. Without it, systems like journaling filesystems and database managers lack the control they need over the order in which data is written to disk. Mis-ordered writes can lead to data corruption and other unfortunate things.

The 2.6 block I/O subsystem was designed with barrier support as a core feature. But, at this point, most low-level block drivers do not actually implement barriers, and the filesystems do not use them. Patches to fill in some of the gaps have been around for a while (LWN looked at barriers last October), but have not yet been merged.

There has been a new surge of interest in proper barrier support, perhaps as a result of applications vendors starting to take a hard look at the 2.6 kernel. Now Jens Axboe and Chris Mason have put together a new barrier support patch which gets Linux closer to being able to provide real disk I/O guarantees. With this patch, write barriers work, but only on IDE drives (not SCSI or serial ATA), and only with the reiserfs and ext3 filesystems. Even then, things are qualified: "ext3 works but only if things don't go wrong."

In other words, barrier support will be staying on the "to do" list for a little while longer yet. But the work is being done, and 2.6 should be able to implement real barriers before it is all over.

Comments (5 posted)

Patches and updates

Kernel trees

• Linus Torvalds: Linux 2.6.5-rc2. (March 20, 2004)

• Andrew Morton: 2.6.5-rc2-mm1. (March 22, 2004)

• Andrew Morton: 2.6.5-rc2-mm2. (March 24, 2004)

• Andrea Arcangeli: 2.6.5-rc2-aa1. (March 22, 2004)

• Andrea Arcangeli: 2.6.5-rc2-aa2. (March 24, 2004)

• Andrew Morton: 2.6.5-rc1-mm2. (March 18, 2004)

• Andrea Arcangeli: 2.6.5-rc1-aa1. "This implements anon_vma for the anonymous memory unmapping and objrmap for the file mappings, effectively removing rmap completely and replacing it with more efficient algorithms..." (March 18, 2004)

• Andrea Arcangeli: 2.6.5-rc1-aa2. (March 19, 2004)

• Andrea Arcangeli: 2.6.5-rc1-aa3. (March 22, 2004)

• Randy.Dunlap: 2.6.5-rc1-kj1 patchset. (March 18, 2004)

• Marcelo Tosatti: Linux 2.4.26-pre5. (March 22, 2004)

Core kernel code

• John Lee: O(1) Entitlement Based Scheduler v1.1. (March 22, 2004)

• Dipankar Sarma: RCU for low latency (experimental). (March 23, 2004)

Device drivers

• Stephen Rothwell: PPC64 iSeries virtual tape driver. (March 18, 2004)

• Jaroslav Kysela: ALSA 2.6 update. (March 18, 2004)

• Jeff Garzik: latest libata (includes Silicon Image work). (March 18, 2004)

• Jeff Garzik: libata update. (March 24, 2004)

• Hanna Linder: add class support to floppy tape driver zftape-init.c. (March 22, 2004)

• Wim Van Sebroeck: v2.6.5-rc2 watchdog patches. (March 22, 2004)

• Bagalkote, Sreenivas: megaraid 2.10.2 Driver. (March 23, 2004)

• Len Brown: ACPI for 2.6. (March 23, 2004)

• Moore, Eric Dean: MPT Fusion driver 3.01.03 update. (March 24, 2004)

Documentation

• uaca@alumni.uv.es: RFC/Doc/BUGs: CONFIG_PACKET_MMAP. (March 22, 2004)

Filesystems and block I/O

• Jens Axboe: barrier patch set. (March 22, 2004)

• Jorn Engel: cowlinks v2. (March 22, 2004)

• =?ISO-8859-1?Q?R=FCdiger_Klaehn?=: File change notification (enhanced dnotify). (March 22, 2004)

• Nigel Kukard: DVD+-RW for 2.6.4. (March 23, 2004)

• Jan Kara: Journalled quota patch. (March 23, 2004)

Memory management

• Hugh Dickins: anobjrmap 1/6 objrmap. (March 19, 2004)

• Hugh Dickins: anobjrmap 2/6 linux/rmap.h. (March 19, 2004)

• Hugh Dickins: anobjrmap 3/6 page->mapping. (March 19, 2004)

• Hugh Dickins: anobjrmap 4/6 no pte_chains. (March 19, 2004)

• Hugh Dickins: anobjrmap 5/6 anonmm. (March 19, 2004)

• Hugh Dickins: anobjrmap 6/6 cleanup. (March 19, 2004)

• Hugh Dickins: anobjrmap 7/6 mremap moves. (March 22, 2004)

• Rajesh Venkatasubramanian: [RFC][PATCH 1/3] radix priority search tree - objrmap complexity fix. (March 22, 2004)

Architecture-specific

• Rusty Russell: Hotplug CPU toy for i386. (March 22, 2004)

Security-related

• Kurt Garloff: Non-Exec stack patches. (March 24, 2004)

• Serge Hallyn: New BSD Jail patch. (March 24, 2004)

Page editor: Jonathan Corbet

Distributions

News and Editorials

Novell and SUSE Unveil New Linux Products

There is a feeling among Linux solution providers that the next few months will be critical in terms of gaining new customers. This is when opportunities are going to be won and lost, and this is why decisive action has to be taken now. It will no longer be just a battle between Microsoft and Linux; it will also be a battle between various Linux entities to attract those businesses and enterprises which have made the decision to deploy Linux as part of their overall IT strategies.

SUSE LINUX, together with its powerful parent Novell, is well positioned for a dramatic increase in market share, especially on the North American market, where it has traditionally lagged behind the region's undisputed leader - Red Hat, Inc. Novell is well aware of the opportunity - its recent high-profile marketing campaign and a constant stream of press releases, product announcements, and even some radical ideas, have succeeded in catching the attention of the media. This is a very effective way of getting into the spotlight, especially while Red Hat seems somewhat less proactive.

Is Novell truly committed to Linux? "This year BrainShare don't do no stinking Windows", shouted Novell's chief executive and chairman Jack Messman during the opening speech of the company's annual BrainShare user conference. He also disclosed that Novell has committed itself to moving 100 percent of staff from Microsoft Office to OpenOffice.org by the middle of this year, and to Linux by the end of this year. It was vital, explained Messman, that his company is seen to be "eating our own dog food or drinking our own champagne" from a customer's perspective.

These ambitious declarations were soon followed by announcements about concrete products designed to make migration to Linux easier. Novell Open Enterprise Server is a new product combining Novell's NetWare, SUSE LINUX and Ntprise Linux Services into one complete networking solution. Novell GroupWise, a collaboration suite for handling e-mail, calendaring, instant messaging, contact, document and workflow management, will for the first time be available on Linux in its upcoming version 6.5 (a beta release can be downloaded for free, after registration). Besides heralding these commercial products, Novell also succeeded in pleasing the Free Software community by announcing that SUSE's system administration utility YaST will from now on be licensed under the GPL, and by introducing a new open source project called iFolder. iFolder is an easy-to-use file sharing solution for workgroup environments consisting of an integrated file sharing utility, address book, and a general purpose object repository.

As if all of the media coverage wasn't enough, Novell also announced the release of SUSE LINUX 9.1. This was a somewhat more predictable press release and it is nice to see that SUSE continues the twice per year release cycle of its distribution even after becoming part of Novell. SUSE LINUX 9.1, available in late April in Europe and early May in the rest of the world, will include kernel 2.6, KDE 3.2.1 and GNOME 2.4, among the usual array of great software packages. As with version 9.0, an AMD64 edition of the product will be released for the 64-bit Athlon and Opteron processors.

But doesn't SUSE's traditional preference for KDE conflict with Novell's goals, especially after Novell's purchase of Ximian, and with Ximian's bias towards GNOME-specific development programs? A partial answer to this question can be found in the two SUSE LINUX 9.1 press releases: while the English announcement is interspersed with references to GNOME, including a full paragraph about GNOME features, the German press release devotes exactly one sentence to the KDE alternative. This would seem to indicate that SUSE will continue to promote a KDE-centric desktop on the well-established domestic market, while accommodating Novell's intention to integrate Ximian into the product for the North American market. This speculation was given a new perspective earlier this week: according to an interview with Jack Messman at eWEEK, Novell is planning to combine the best features of Ximian and KDE to create a unified desktop environment. If the plan goes ahead, the new desktop should make an appearance in the next version of SUSE LINUX, scheduled for release towards the end of this year.

Besides the new kernel and KDE, SUSE LINUX 9.1 provides a number of other interesting features, as well as several new software packages. YaST now includes a new module for ACPI with graphical configuration of individual ACPI power management settings. The Professional edition comes with new software exclusive to SUSE, such as Textmaker and Planmaker (two Word and Excel-compatible word processing and spreadsheet applications by Softmaker), Moneyplex (a home banking software by Matrica), and Rekall (an MS Access-like database application from theKompany). A demo version of MainActor 5.2 for digital video and audio editing is also included. We will take a closer look at SUSE LINUX 9.1 after its release.

As many predicted, Novell's purchase of SUSE LINUX late last year has given Linux a considerable boost. If all of the plans by the networking giant end up being implemented, we can look forward to an exciting era of new Linux deployments, together with aggressive development initiatives. In the meantime, we can also look forward to many more press releases by Novell on its mission to move everybody to Linux.

Comments (3 posted)

Distribution News

Conectiva Linux 10 Beta 2 is now available

A new beta release of Conectiva Linux 10 is now available. This version uses the 2.6.4 kernel and contains many other changes since the first beta. Click below to find out more.

Full Story (comments: none)

Astaro Security Linux

Astaro Corp. has announced Version 5 of its Astaro Security Linux. This release adds intrusion protection and HTTP virus scanning. Click below for details.

Full Story (comments: 1)

Linux Netwosix

Linux Netwosix version 1.1 (Solstizio) has been released. The distribution has been completely rebuilt, with an emphasis on security. This version includes Linux kernel 2.6.4 and system binaries are linked with the GNU C Library version 2.3.2, among other upgrades and bug fixes. Click below for more information.

Full Story (comments: none)

SUSE 9.1 announced

SUSE has announced the forthcoming (May 6) availability of SUSE 9.1 Personal and 9.1 Professional. It has become another distribution claiming to be the first with the 2.6 kernel; it also features GNOME 2.4.2, KDE 3.2.1, and many other new packages.

Full Story (comments: 5)

Trustix Secure Linux

Trustix has announced a re-release of version 2.1, splitting the product into Trustix Secure Enterprise Linux (which will be available soon) and a free version of TSL.

The re-released TSL 2.1 contains many bug fixes to anaconda, bind, cyrus-imap, gcc, iptables, mod_php4, module-init-tools, modutils, openssh, postgresql, python, rpm, samba, swup and util-linux.

Comments (none posted)

Debian GNU/Linux

The Debian Weekly News for March 23, 2004 is out. This week you'll find a pointer to an article from Novell on how to switch from Debian to SUSE; reports from FOSDEM; an update on MPlayer licensing problems; and much more.

The results of the Debian Project vote on the future of the non-free part of the distribution are in: non-free will continue to exist. At least until the issue comes up yet again in a couple of years...

A Bug Squashing Party will be happening this weekend, March 26 - 28. This is a good chance to get involved with Debian and to help the sarge release, so join in and squish a bug or two..

Now that the non-free issue is out of the way, it's to move on to the next general resolution, proposed amendments to the Debian Social Contract. The discussion period is scheduled to begin on March 28.

Comments (none posted)

Gentoo Weekly Newsletter - Volume 3, Issue 12

The Gentoo Weekly Newsletter for the week of March 22, 2004 looks at two new features in Gentoo, security-only updates and stackable profiles; and other topics.

Full Story (comments: none)

Fedora Core

The Fedora News Updates for the week of March 18, 2004 contains information on Fedora Core 1 for AMD64 and IA64, the SELinux mailing list, and more.

FedoraForum.org has merged with the Artoo Fedora FAQ Forums. Now you can find all the Artoo forums on FedoraForum.org.

Fedora Core 1 updates:

• this xcin update has merged UTF-8 support from upstream
• xmms now upgrade to upstream xmms-1.2.10
• ghostscript adds new Canon printer drivers
• fixes broken dependencies in the x86-64 packages of openssl, pam, krb5-libs and e2fsprogs

Comments (none posted)

Mandrakelinux

Mandrakelinux has released an updated drakxtools package that fixes problems with drakbackup.

Full Story (comments: none)

Slackware Linux

The slackware-current changelog has a long list of changes this week, with lots of bug fixes and upgrades. You'll find GIMP 2.0.0, gtk+ 2.4.0, XFree86 4.4.0, and lots more. The OpenSSL security fixes are also available for slackware-stable, of course.

Comments (1 posted)

New Distributions

X Windows On A Floppy (Xwoaf)

X Windows On A Floppy (Xwoaf) is a complete standalone bootable Linux floppy that runs from a RAM disk. It provides the basic functionality required to turn any computer into a modern communication node. It features X applications that are primarily converted (n)curses-based programs with a custom Xlib-only xcurses module. These include an rxvt terminal, txplor (file manager), retawq (Web browser), popselectx (email reader), edx (text editor), calendar, bcalc (calculator), and HexView. Xwoaf was made available at version 0.1.0, released March 18, 2004.

Comments (3 posted)

Minor distribution updates

BasicLinux

BasicLinux has released v3.02 with major feature enhancements. "Changes: The BasicLinux footprint has been reduced. It now runs on a 386 with 3mb RAM. A comm program and a Web server have been added. The Web browser and email client have been significantly improved. A slim X server has been added with swm, rxvt, xli, and calctool."

Comments (none posted)

Damn Small Linux

Damn Small Linux has released v0.6.2 with minor feature enhancements. "Changes: A new GTK application theme was added, which is a little darker and easier on the eyes than the default. rdesktop was updated. New additions include documentation on TCC, an intelligent man script which knows the difference between a regular app and a busybox app, a net dictionary, and SQLite Book (a Perl/SQLite record keeper). ogg123 and mpg123 were fixed. The install script was enhanced, and can now restore most of the regular applications and libraries which BusyBox has replaced on the live CD. Text links were added to the menu."

Comments (none posted)

Devil-Linux v1.0.5a released

Last week's release of Devil-Linux 1.0.5 was followed by the release of v1.0.5a this week. V1.0.5a includes an update to OpenSSL v0.9.7d to close the latest vulnerability.

Full Story (comments: none)

dyne:bolic GNU/Linux

dyne:bolic GNU/Linux has released v1.2 with major feature enhancements. "Changes: This release fixes many bugs and implements a new docking system to let you boot from CD and run from the hard disk with much more speed, especially on XBOX. New features include a multiple interoperable audio software rack for audio synthesis and music composition, news and updates to video manipulation, recording, and streaming software, a new audio/video multicast conferencing suite, and even more multimedia juice. The device support has been widened and startup scripts rewritten for flexibility. There are also two new games. All users are encouraged to upgrade."

Comments (none posted)

Feather Linux

Feather Linux has released v0.3.8 with major feature enhancements. "Changes: This version fixes the Sylpheed size, adds MPlayer config files, adds Arno's iptables script and fwb-run, fixes xterm menu colours, adds online manpages and HOWTOs links on the Fluxbox menu, adds wman, an online manpage viewer script, adds a Getting Started HOWTO, changes the Opera script to work properly from HD, makes small changes to the HD install script, adds Mutella, fbset, and Chipmunk Basic, now runs as user knoppix, includes a new restoration system, and adds a script to install the GIMP."

Comments (none posted)

Gnoppix 0.6.0-RC2 with X.org Xserver

Gnoppix has released 0.6.0-RC2. This version includes the XOrg Server instead of X11, and has many bug fixes. Click below for details.

Full Story (comments: 1)

INSERT

INSERT has released v1.2.6. "Changes: Boot time configuration for more keyboard layouts has been added (ch, dk, and es). The famous Midnight Commander (mc) was added. A few minor bugfixes and improvements to the UI were made. As usual, the virus databse for clamav was updated to the latest version."

Comments (none posted)

Linux LiveCD Router

Linux LiveCD Router has released v1.9.1 with major bugfixes. "Changes: This release fixes a bug when mounting a floppy drive. There is a new version of linux-wlan-ng, 0.2.1-pre20."

Comments (none posted)

MoviX

MoviX has released v0.8.2rc1 with minor feature enhancements. "Changes: Non-Latin true-type font characters can now be displayed in the MPlayer menu. Full translations to Chinese, Spanish, and Turkish have been added, and other translations have been improved."

Comments (none posted)

Recovery Is Possible!

RIP has released v7.8 with minor feature enhancements. "Changes: The kernel and some of the software were updated."

Comments (none posted)

Sentry Firewall

Sentry Firewall has released v1.5.0-rc11 with major feature enhancements. "Changes: The root filesystem has been changed to a tmpfs(shm fs)-based filesystem. The "root_size" and "add_swap" configuration directives have been added to the sentry.conf file to facilitate adding swap space and resizing root at boot time. The MySQL, dnsmasq, glibc, Snort, and Shorewall packages have been updated. The mppe-mppc patch has been added to the kernel and pppd to support PPTP clients using MPPE+MS-CHAP. There have also been multiple updates and bugfixes to rc.inet1.conf (the interface configuration init file), mkconfig (the sentry.conf configuration manager), and the documentation."

Comments (none posted)

TrinityOS

TrinityOS has released v03/21/04 with major feature enhancements. "Changes: The sendlogs section was updated to include selected syslog entry reduction. A backup-to-disk script was added to support both local and remote NFS or SAMBA backups to hard drives. A wget command was added to download a local IANA list. All URLs that pointed to kernelnotes.org were updated or deleted."

Comments (none posted)

ttylinux

ttylinux has released v3.4 with minor feature enhancements. "Changes: This release updates e2fsprogs, modutils, and thttpd to their latest versions."

Comments (none posted)

Distribution reviews

Arch Linux version 0.6 (Widget) Review (LinuxLookup)

Here's a review of Arch Linux on LinuxLookup.com. "It was time to work a little more with pacman, the big selling point with Arch. It is a ports based system, similar to Gentoo's emerge. It handles dependencies and makes it very simple to keep your system up to date. You start by running the command "pacman -Sy", which stands for "Sync" and "Refresh". This gives you a fresh master package list."

Comments (2 posted)

Dispelling the myths of Gentoo Linux, an honest review (LXer)

A long-time Red Hat Linux user takes Gentoo for a test drive. "The customization and optimization does make a difference and gives you fine-tuned control over the final product. If you rely on a lot of third-party applications, however, you may be best served sticking with Red Hat Enterprise Linux or Fedora, but if all you want is a solid Linux system to operate your standard internet enabled services like LAMP, you can't do better than Gentoo Linux. I have not yet tried Gentoo out as a desktop, so currently I am only recommending it for server use. I hope in the next few weeks (or months) I will try X and see how I like it. I expect to be pleased."

Comments (25 posted)

PCQuest Linux: A Fedora-based distro for India (linux.com)

Linux.com takes a look at PCQLinux 2004, a Fedora based distribution that comes with PCQuest (a computer magazine published in India). "The new release includes a lot of the latest software, such as kernel 2.6.2, KDE 3.2, JDK 1.4.2, and Gnome 2.4.2. PCQuest does a decent job of bundling new apps, especially some multimedia apps, and generally customizing the base Fedora software for Indian users. For example, they bundle a popular cable modem authentication application, which makes it easier to set up PCQuest than a standard Fedora install."

Comments (none posted)

Page editor: Rebecca Sobol

Development

GNOME Platform Stormclouds

Some tensions that have been building in the GNOME community for a while came out this week. Havoc Pennington wrote about the language and platform options available to open source development generally, and GNOME in particular. This sparked a large debate on PlanetGnome, among other places.

Currently the GNOME platform, meaning primarily the libraries available to GNOME developers, is written in C. There are a number of historical reasons for this: C was considered to be the most portable language around, and it allowed for very easy bindings to be written for other languages. The only real alternative when GNOME was formed was C++, which, at the time, scored lower on both of the previous measures. Also, some members of the community generally didn't like C++ as a language.

Times have changed. The Mono project was launched in August 2001 after the folks at Ximian had decided that, having gone through the pain of developing a large, multi-component application, enough was enough:

The obvious candidate for an object oriented, statically typed, garbage collected language is Java. Unfortunately, the most widely used, certified Java Virtual Machines (JVMs) are not free software. Sun Microsystems still maintains tight control over them, and even limits the ability to freely redistribute the free-as-in-beer JVM, even without modification. Currently, to the author's knowledge, the only Linux distributions that ship with either the Sun or IBM JVMs are a few commercial enterprise distributions. While there are some free software JVMs available, their performance is generally well below that offered by the proprietary ones.

You may be wondering why languages such as Python, Perl or Ruby aren't in consideration here. Havoc's paper doesn't do much to explain why languages such as these won't be used for writing system components, because the audience that he wrote it for probably take that as a given. Dave Camp's one-liner in this blog post probably explains the thoughs of most developers on this issue: I have a soft spot in my heart for Python (although I have a softer spot for static type checking).

In short:

• The platforms currently associated with these languages are specific to the language, the sharing of components would be difficult. Parrot, at some point in the future, may unify these languages.
• These languages are not statically type checked by a compiler. To developers who have been writing primarily in C, this seems dangerously like leaving certain types of error to happen at runtime, to be discovered by users. Automated testing can address some of these issues, but a certain type of C programmer might have trouble sleeping at night after shipping a large Python application, with the expectation of receiving bug reports containing NameErrors.
• At least partially due to the dynamic nature of these languages, there are limits to some of the optimizations that can be done, either at compile time or by a Just-In-Time compiler at runtime, as used by the Java and .NET platforms. Thus performance, particularly in platform libraries which need to be fast, is a concern.

Ximian saw the standardized C# language, and the standardized Common Language Infrastructure (CLI) from Microsoft as the way out: they could write a GNOME platform with all to goodies of an object oriented, statically typed, garbage collected language using and extending the existing GNOME APIs. Since the language was standardized, there were seemingly no trademark issues, and the parts of the platform that were Windows specific would be replaced with GNOME components anyway.

So Ximian founded the Mono project, and things have continued with the GNOME platform itself continuing to be coded in C, with the Mono team progressing its C# compiler, CLI runtime and class libraries at a tremendous rate.

Two things have happened recently to make some in the community start to think about the strategic direction that GNOME should take. The first is that Mono is actually approaching a 1.0 release sometime this year. The second is that the Java compiler and class library that are part of the GNU Compiler Collection (GCC), GCJ, is now considered to be fairly mature.

GCJ treats Java essentially as a subset of C++ with garbage collection and a large class library. Java source code is compiled to native code and then linked against a modified Boehm garbage collection library. Most of the standard class libraries have been implemented, with the notable exception being the windowing packages AWT and SWING. The GCJ was able to natively compile Eclipse last year, and it is considered mature enough for Red Hat to ship a GCJ compiled Tomcat Java Servlet Container in their Application Server enterprise distribution.

All of these environments will work quite well together, until GNOME makes a decision to start writing platform libraries in a managed language, for a managed platform. Whichever platform is not chosen might have a much more difficult time integrating such components. Many feel that GNOME needs to make some decision about which platform to support officially, otherwise the community will continue to be tied to C for the platform libraries indefinitely, or worse, risk forking.

There are a number of reasons given (by Havoc and others) as to why some in the GNOME community are unhappy with using Mono as the platform of choice, including:

• Patent concerns over parts of .NET
• General distrust of Microsoft, or strategic reluctance to adopt a Microsoft technology
• Not wanting to play "catch-up", since Mono will always be behind Microsoft's implementation
• Not wanting to upset IBM or particularly Sun, who have contributed a lot to GNOME over the past few years

These complaints don't necessarily impress Mono advocates, however. Software patents, some say, may well be inside Java too, either by some third party, like in the Eolas case, or by Sun itself. Sun, it is claimed, has never released a general royalty free patent license in relation to its Java technologies.

While Havoc argued that using a C#/CLR combo might "speed up" the adoption of Microsoft's technology, proponents of Mono point out that it allows a migration path away from Windows in the future, something that won't be there if the Windows world is using CLR technologies, and the free software world has no CLR.

The catching-up-with-Microsoft argument is persuasive, but Java hardly presents a better alternative. Java, under the tight control of Sun, has moved much slower than the corresponding pace of many free software projects such as GNOME, Python, or indeed, Mono. The language has evolved very slowly, with features that developers have wanted for years, such as enums and generics (templates for C++ people), only just now being added to the language, after they came out as part of C# from Microsoft, a much younger piece of software.

Sun's reluctance to support a native widget based GUI toolkit, sticking with the sometimes sluggish, alien looking SWING, left developers with no real option for developing desktop applications. There's a reason why Java is used heavily on the server, with a devoted following, but very sparingly on the desktop. To use a contrasting example, Python has evolved as a language at a much faster rate, with incremental rather than groundbreaking speed improvements over time as well. The Benevolent Dictator model is used in Python as it is in Linux, with great effect.

Keeping Sun happy seems like a very valuable goal for some in the community in light of the major contributions that Sun has made to GNOME. It's ironic, however, that the community seemingly is in this position at least partly because of Sun's refusal to let go of Java, and more ironic that one proposed solution to keep Sun happy is to use a non-Sun-licensed, non-Sun-certified Java platform which doesn't support Sun's preferred GUI APIs. While it might keep Sun happier than if GNOME adopted Mono, it would seem unlikely that that's where they'd like to be. Even if Sun were to make an open source version of their JVM and class libraries available, as advocated by IBM and others, the interaction between two competing platforms may still be awkward. It would be a great step, in any case.

Meanwhile, discussions continue, and there have been some constructive suggestions as to how to interoperate and leave the community's options as open as possible. The debate is currently civil, intelligent and constructive. There are a number of parties with big stakes involved, however, so things may yet get heated. A fragmented platform helps nobody, so there's a big incentive to work out the most inclusive solution constructively. It's a debate which will be watched closely by many.

Comments (47 posted)

System Applications

Audio Projects

FishSound 0.6.0 Released

Version 0.6.0 of FishSound is out: "libfishsound provides a simple programming interface for decoding and encoding audio data using Xiph.Org codecs (Vorbis and Speex)."

Full Story (comments: none)

vsti 0.0.3 announced

Version 0.0.3 of vsti, which allows a Windows vsti plugin to be used with JACK and alsa-seq, is out.

Full Story (comments: none)

CORBA

openMDX v1.1.0 (stable, production quality) released (SourceForge)

Version 1.1.0 of openMDX, an open source MDA (Model Driven Architecture) platform, is out. "openMDX enables software architects and developers to build and integrate software applications in a highly automated and industrialized way. openMDX supports J2SE, J2EE, and .NET."

Comments (none posted)

Database Software

Database Templates with MySQL (O'Reilly)

Russell Dyer writes about Database Templates on O'Reilly. "Once you've built several MySQL databases, you'll learn some shortcuts to database design. Many databases are very similar. When creating new databases, developers often build the same basic tables with only slightly different names and some adjustments to columns. Rather than starting from scratch when putting together a new database, developers will sometimes copy tables from an existing database, give them new names, and then make modifications. This can be a big timesaver."

Comments (1 posted)

PostgreSQL Weekly News

The March 22, 2004 edition of the PostgreSQL Weekly News is out with the latest PostgreSQL database news.

Full Story (comments: none)

Networking Tools

Announcing Click 1.4pre1

Version 1.4pre1 of Click is out. "Click 1.4pre1 is the current (almost) stable release of Click - a modular software router that can be run in userspace OR be loaded into the kernel."

Full Story (comments: none)

jpcap - v0.01.15 released (SourceForge)

Version 0.01.15 of jpcap, a Java-based network packet capture facility, is available. "The major feature of this new release is support for multiple [s]imultaneous instances of the packet capture engine within a single Java VM."

Comments (none posted)

Net-SNMP 5.1.1 released (SourceForge)

Following last week's pre-release, version 5.1.1 of Net-SNMP is out. "Net-snmp provides tools and libraries relating to the Simple Network Management Protocol including: An extensible agent, An SNMP library, tools to request or set information from SNMP agents, tools to generate and handle SNMP traps, etc."

Comments (none posted)

Zabbix 1.0 released (SourceForge)

Version 1.0 of Zabbix is available. "Zabbix is software for monitoring of your servers and applications. Polling and trapping are supported. Zabbix works with both native and SNMP agents. It has simple, yet very flexible notification mechanism. Web interface allows easy administration."

Comments (none posted)

Peer to Peer

XNap 2.5r2 released (SourceForge)

Version 2.5r2 of XNap is available. "XNap is a Java plugin-based peer-to-peer (P2P) framework and client including an OpenNap plugin with multiple server support, as well as Gnutella, giFT (OpenFT), IRC, ICQ and an OverNet plugin. XNap provides resuming, chat, hotlist and a media library. This release fixes a rather critical bug that caused large amounts of tcp sockets remaining in CLOSE_WAIT state forever."

Comments (none posted)

Printing

CUPS Driver Development Kit 1.0rc1

Version 1.0rc1 of the CUPS Driver Development Kit has been announced. "The CUPS Driver Development Kit (DDK) provides a suite of standard drivers, a PPD file compiler, and other utilities that can be used to develop printer drivers for CUPS and other printing environments."

Comments (none posted)

PyKota 1.18 released

Version 1.18 of PyKota, a print quota management system, is out. "Many bugs were fixed, especially wrt users and printers groups which can now be nested to an arbitrary depth. Some new command line utilities and configuration directives were added. Speed was improved at different places, especially when managing several thousands of users on many printers. An Italian translation was added. Pluggable hooks at job start/end are now entirely configurable. Sample print quota reports made from within OpenOffice.org are now included, as well as some preliminary Debian packaging specific files."

Comments (none posted)

Web Site Development

The CI-Link language and web development IDE

Version 4.3.0.3 of CI-Link, a cross-platform language and IDE that is aimed at web site development, was recently announced on the project's Source Forge page. "CI-Link is an object-oriented language, easy to handle and dedicated to Web applications, like PHP or JAVA. Gateways are available to enable CI-link to interact with JAVA, .NET, COM or XML applications."

Comments (none posted)

Plone 2.0 released (SourceForge)

Version 2.0 of Plone, a web Content Management and Publishing system that is based on Zope, has been announced. "Over a year in development, the Plone Team released the 30+ languages strong Plone 2.0 today." See the announcement for a long list of changes.

Comments (none posted)

Samizdat 0.5.1 released

Version 0.5.1 of Samizdat, and RDF-based engine for building collaboration and open publishing web sites, is out. "Main feature of this version is i18n support, with Russian translation already in place. Other improvements include ability to work as plain CGI without mod_ruby, support for Windows/Cygwin, massive speed increase, and a long list of bugfixes. Database schema is changed again, but this time it is trivial to migrate from the previous version."

Full Story (comments: none)

Desktop Applications

Data Visualization

JGraph 3.2 released (SourceForge)

Version 2.3 of JGraph, a Java-based graph component, is available. This version: "can draw labels along edges, uses double precision coordinates, fixes handling of negative coordinates and in-place editing, adds map to default graph model."

Comments (none posted)

Desktop Environments

GNOME 2.6 Desktop & Developer Platform RC 1 (GnomeDesktop)

Version 2.6 RC 1 of GNOME has been announced. "That's right - it's almost here, and this is your last chance to have a sneak preview, and hopefully beat out some of the last remaining bugs before our final release."

Comments (none posted)

GNOME servers compromised, 2.6 release delayed

The GNOME system administration team has sent out a notice that some GNOME web servers have been compromised. The cleanup is now in progress. The project has determined that the GNOME 2.6 sources (which were due to be released today) have not been tampered with, but the release has been delayed one week (to the 31st) anyway. (Thanks to Jonathan Lucas).

Comments (1 posted)

SVG and its Path into the Linux Desktop (OS News)

Christian Schaller writes about Scalable Vector Graphics (SVG) on the GNOME platform in an OS News article. "Computer graphics have long been dominated by bitmapped images. However, the free software community has taken an innovative lead by adopting scalable graphic formats on its desktops. In this article I cover the history and rise of scalable graphics on the desktop from my viewpoint - a proponent of its use in the GNOME platform."

Comments (1 posted)

KDE-CVS-Digest (KDE.News)

The March 19, 2004 edition of the KDE-CVS-Digest has been published. Here's the summary: "KDE integrates Mono with C# bindings. A PHP debugger integrated into Quanta. Work continues on eGroupware / Kontact integration. Kopete rewrites the Jabber plugin. Plus, a new tool for monitoring application usage."

Comments (none posted)

KDE Developer's Corner: Common Programming Mistakes (KDE.News)

Zack Rusin has announced a new KDE document. "I'm very happy to announce a new document for inspiring KDE hackers, entitled "Common Programming Mistakes". The document aims to combine the experience of many of the top KDE developers about the Qt and KDE frameworks dos and don'ts. The way they were usually passed on to the next generation was by letting the youngsters make the mistakes and then yell at them in public."

Comments (none posted)

Electronics

New OpenCollector releases

New software from the OpenCollector site includes version 0.1.0 of the Eclipse Verilog Editor, and version 0.9 of Confluence. "Confluence is a declarative functional programming language for the design and verification of synchronous reactive systems including digital logic, hard-real-time software, and hardware-software co-design."

Comments (1 posted)

Financial Applications

The Open Business Account accounting system

The Open Business Account accounting system is a new project which was forked from Sql-Ledger version 1.8.7. "OBA Accounting System is an Accounting, Inventory and Invoicing system best for small to middle organisation. This is a double entry accounting system and the data is stored in a SQL-Server."

Full Story (comments: none)

Games

WorldForge Weekly News

The March 19, 2004 edition of the WorldForge Weekly News is out with the latest news from the WorldForge game project.

Comments (none posted)

GUI Packages

FLU 2.9.2 Maintenance Release

Maintenance Release 2.9.2 of FLU, a collection of FLTK Widgets, has been announced.

Comments (none posted)

Glade 2.5.0 released (GnomeDesktop)

Version 2.5.0 of Glade, a User Interface Builder for GTK+ and GNOME, is out "This is the first beta release on the way towards 2.6.0. NOTE - you need GTK+ 2.4, and GNOME 2.5.x if you want GNOME support."

Comments (none posted)

Imaging Applications

Release 2.0 rc1 of the GIMP

Version 2.0 rc1 of the GIMP is available. "Today the last bugs on the 2.0 milestone have been fixed and the GIMP team is preparing the GIMP 2.0 release." See the changes document for details.

Comments (1 posted)

GIMP 2.0 released

Gimp.org has the news that the GIMP 2.0 release has happened. "This release is a major event, marking the end of a three year development cycle by a group of volunteers and enthusiasts who have made this the most professional release of the GIMP ever." A list of new features is available in PDF format; it includes a great deal of internal restructuring, a reorganized toolbox, an improved text tool, various path tool improvements, a full-screen editing mode, and much more.

Comments (2 posted)

gThumb 2.3.2 released (GnomeDesktop)

Development version 2.3.2 of gThumb, an image viewer application for Gnome, is available with lots of bug fixes.

Comments (none posted)

Interoperability

Netatalk 2.0-beta1 released (SourceForge)

Version 2.0-beta1 of Netatalk has been released. "The Netatalk development team is proud to announce the second alpha release of the upcoming version 2.0 of the Netatalk File Sharing suite. Please note that this release has not yet received widespread testing due to its beta status. It should therefore *not* be used in production. Netatalk is a collection of server programs and utilities for handling various protocols employed by Apple Macintosh computers on Unix compatible systems. This allows Unix hosts to act as file, print, and time servers for Apple Macintosh (classic MacOS as well as MacOS X) computers."

Comments (none posted)

Samba 3.0.3 pre1 Available

Samba version 3.0.3 pre1 has been released. "This release is *not* intended for production servers. However, there have been several bug fixes and new features added since 3.0.2a that we feel it is important make it available to the Samba community for wider testing."

Full Story (comments: none)

Wine Traffic

Issue #215 of Wine Traffic is out with the latest Wine project news.

Comments (none posted)

Medical Applications

Oscar 2.0 Has Open Source Drug Reference (LinuxMedNews)

Version 2.0 of OSCAR, the Open Source Clinical Application Resource medical record system, is out. "David Chan is announcing the availability of OSCAR version 2.0 which features Drugref.org's Free and Open Source drug database, easy internationalization, a laboratory module, improved billing and more."

Comments (none posted)

Office Applications

Gfax version 0.6.0 (GnomeDesktop)

Version 0.6.0 of Gfax, a front-end to Hylafax, is available. "Gfax gives you the familiar "pop up" window and phone book support for sending facsimiles by printing to a fax printer. This is a GNOME-2.x port of Gfax. It is a complete re-write in C# and Gtk# using Mono."

Comments (none posted)

Office Suites

OpenOffice.org 1.1.1 RC3 released

Version 1.1.1 RC3 of the OpenOffice.org office suite is available. "It incorporates numerous bug fixes and is cleaner than RC1. However, we are asking you, the community, to make sure that there are no outstanding issues remaining."

Full Story (comments: none)

Science

CDAT 4.0Beta 2 available (SourceForge)

Version 4.0Beta 2 of CDAT, the Climate Data Analysis Tools, is out. "CDAT (Climate Data Analysis Tools) is an open-source, Python-based environment for scientific calculations and graphics with focus on the needs of climate modelers. This release includes Full Mac OS-X support, thermodynamic diagrams contrib package, and averager/time tools bug fixes (bounds related issues)."

Comments (none posted)

Web Browsers

Galeon 1.3.14 Released (GnomeDesktop)

Version 1.3.14 of the Galeon web browser, has been announced. "Mostly a bugfix release, it adds support for Mozilla 1.7b, and the developers are saying it will be the last gtk-2.2 release."

Galeon version 1.3.14a was also released this week to fix an automake problem.

Comments (none posted)

Mozilla 1.7 Beta Released (MozillaZine)

Version 1.7 Beta of the Mozilla browser has been announced. "The Mozilla Foundation today released Mozilla 1.7 Beta, the latest test version of the Mozilla Application Suite. 1.7b features hundreds of improvements, including a new preference to stop sites blocking the standard page context menu and a Password Manager option to show the actual saved passwords."

Comments (none posted)

w3m 0.5 released (SourceForge)

Version 0.5 of w3m, a text-based browser, has been announced. "This release is the first release with m17n features that has been provided as m17n patch by Hironori Sakamoto. w3m is a pager and/or text-based browser. It can handle table, cookies, authentication, and almost everything except JavaScript."

Comments (none posted)

Word Processors

AbiWord 2.1.1 Released (GnomeDesktop)

Version 2.1.1 of the AbiWord word processor has been announced "The AbiWord team is very proud to announce the release of AbiWord v2.1.1, the second snapshot of the development that will lead to AbiWord 2.2. This snapshot allows interested developers, testers and users a sneak preview to see how AbiWord is advancing the State-of-the-Art in Word Processing."

Comments (none posted)

Miscellaneous

FileZilla 2.2.5 final released, FZ 3 development started (SourceForge)

Version 2.2.5 final of FileZilla, an FTP client and server, is out. "With version 2.2.5, an era ends. This will be the last version based on the old source tree. Over the last three years, FileZilla has been constantly improved. However, in the past few months development has slowed significantly, mainly due to the fact that it's become quite difficult to add new features to FileZilla. The complexity of FileZilla has grown far far beyond anything then anyone could imagine when the project first started, this also reflects in the source code. That's why I've decided to leave the current source tree behind and start FZ3 from scratch."

Comments (none posted)

Languages and Tools

C++

Initializing User Defined Data Structures (Linux Journal)

William F. Simpson discusses the initialization of dynamically allocated memory in C++ in an article on LinuxJournal. "The term user friendly is not the term new programmers usually associate with C++. One of the darkest areas in the entire C++ jungle is the place where students are supposed to find out how to initialize data structures accessed by pointers."

Comments (none posted)

Caml

Caml Weekly News

The March 16-23, 2004 Caml Weekly News is available with the latest Caml language articles and news.

Full Story (comments: none)

Java

Retroweaver 1.0 RC4 released (SourceForge)

Version 1.0 RC4 is available. "Retroweaver is a Java bytecode weaver that enables you to take advantage of the new 1.5 language features in your source code, while still retaining compability with 1.4 virtual machines. New features in this release include new support for enumerations, new support for java.lang.Iterable, and more optimized autoboxing."

Comments (none posted)

Lisp

GNU CLISP 2.33 released

Version 2.33 of GNU CLISP has been released. "This version provides a more flexible APROPOS, a more efficient function for computing the composition of MOD and EXPT on integers, a function for returning the command line arguments, an extension of FILE-POSITION to Gray streams, better ANSI compliance, and more."

Full Story (comments: none)

Perl

Perl 5.9.1 released (use Perl)

Perl 5.9.1 is available. "The Perl 5 developer team is pleased to announce the release of perl 5.9.1, the second development release of perl 5.9, incorporating developments towards the next major stable version of perl, perl 5.10."

Comments (none posted)

Synopsis 3 (O'Reilly)

Luke Palmer presents Synopsis 3, which covers Perl 6 Operator Renaming.

Comments (none posted)

This Week on perl5-porters (use Perl)

The March 15-21, 2004 edition of This Week on perl5-porters has been published. "This week saw the arrival of spring in the northern hemisphere, and coincidentally the release of a new development version of bleadperl, which you can peruse for testing the new features, the new fixes, the new optimisations, and of course the new bugs. But of couse 5.9.1 is already outdated for the perl 5 porters, who like to live at the edge of the bleadperl."

Comments (none posted)

This week on Perl 6 (O'Reilly)

The March 14, 2004 edition of This week on Perl 6 is out. "Another week, another summary. It's been a pretty active week so, with a cunningly mixed metaphor, we'll dive straight into the hive of activity that is perl6-internals"

Comments (none posted)

PHP

PHP 5 Release Candidate 1 Released

Release candidate #1 of PHP 5 is out. "The first Release Candidate of PHP 5 is finally here! The move from Beta stage to RC stage means that PHP 5 is now feature complete, and is quite stable - stable enough for everyone to start playing with. Note that it is still not recommended for mission-critical use."

Also, PHP version 4.3.5 RC4 has been announced.

Comments (none posted)

PHP Weekly Summary for March 18, 2004

The PHP Weekly Summary for March 18, 2004 is out. Topics include: 64bit fixes, More PHP 5 fixes, and CVS account requests.

Comments (none posted)

PHP Weekly Summary for March 22, 2004

The PHP Weekly Summary for March 22, 2004 is out. Topics include: PHP 5.0.0RC1, PHP 4.3.5RC4, New security feature for PHP 4, and the Montreal based PHP conference.

Comments (none posted)

Using MySQL from PHP, Part 2 (O'ReillyNet)

John Coggeshall continues his series on using MySQL from PHP with part two. "Today I'll explain dealing with errors, determining the number of rows in a result set, and more."

Comments (none posted)

Python

Dr. Dobb's Python-URL!

The March 19, 2004 edition of Dr. Dobb's Python-URL! is out with the week's Python language article links.

Full Story (comments: none)

Ruby

RubyGems release (Ruby Garden)

The Ruby Garden mentions a new Ruby library collection, RubyGems. "A concept initially demonstrated by Ryan Leavengood at the first RubyConf, RubyGems has been a long time coming. It is a package manager for Ruby libraries, handling library versioning (allows co-existence of multiple versions of a single Ruby library), search, download, and installation."

Comments (none posted)

Tcl/Tk

Dr. Dobb's Tcl-URL!

Dr. Dobb's Tcl-URL! is available for March 22, 2004.

Full Story (comments: none)

XML

Microcontent Management with Syncato (O'Reilly)

Kimbro Staken talks about Syncato, an XML-based web logging system. "In the past few years there's been a surge in popularity for what has become known as blogging. The weblog (or "blog") is an online journal of links and information. It seems everyone has one now. I've written a blog for several years now using Movable Type to manage it. Unfortunately, I've always been bothered by the very rigid perspective provided by most weblog management systems. Most of these systems are based on a relational database system and have a limited number of post types that you can add. I wanted something that would be much more flexible and allow you to define an arbitrary level of structure to the content you add to your site. This lead me to the development of the system that is now known as Syncato."

Comments (none posted)

Describe open source projects with XML, Part 2 (IBM developerWorks)

Edd Dumbill continues his series with part two on describing open-source projects with XML. "This time, I will distill a set of terms that are candidates for inclusion in this vocabulary and talk about some of the difficulties inherent in specifying it. I will show you that the admirable aim of being able to share DOAP descriptions globally has some consequences for the design of this vocabulary."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Wal-Mart and Sun share Linux desktop lust (Register)

The Register has stumbled into a marketing deal between Sun and Wal-Mart. "Sun appears to have convinced Wal-Mart to go along with the Java naming scheme. Sun likes to call its package of StarOffice, GAIM, Mozilla, Evolution and SuSE the Java Desktop System. And Wal-Mart has obliged Sun by creating a new OS category - the 'Java operating system' - instead of placing the OS with the herd in the Linux operating system category."

Comments (23 posted)

Novell management tool going open source (News.com)

News.com reports that Novell will be open-sourcing the SUSE YAST administrative tool. "By putting YAST under the same open-source license that governs Linux itself, Novell hopes the program will gain widespread acceptance as a module used by management software powerhouses such as Computer Associates International, Hewlett-Packard and IBM, sources said." That may or may not happen, but this move will address a longstanding complaint against SUSE from parts of the community.

Comments (11 posted)

Trade Shows and Conferences

Lessig: IP protection a business, not cultural, battleground (IT Manager's Journal)

IT Manager's Journal covers Lawrence Lessig's Open Source Business Conference keynote. "Stanford University law professor, author, and Creative Commons chairman Lawrence Lessig Tuesday sharpened the definition of the ongoing legal struggle to satisfy both proprietary and open source advocates through equitable intellectual property regulations. "Contrary to what many people see as a cultural war between conservative business types and liberal independents, this is not a 'commerce versus anything' conflict. It's about powerful (business) interests and if they can stop new innovators," Lessig said." Thanks to Don Waugaman.

Comments (none posted)

Letter from CeBIT - the world's largest IT trade show (NewsForge)

Here's a NewsForge report from CeBIT. "The CeBIT Linux area is crowded with little booths run by many companies. Most of them provide software and solutions. While in previous years CeBIT had two major Linux centers, this year there is only one, with other Linux solution providers scattered through the rest of the show, but the Linux area has a nice big stage and many events are taking place there. Each weekday has its own topic, for instance "Desktop Day.""

Comments (none posted)

More inside information from CeBIT 2004 (NewsForge)

NewsForge continues its CeBIT coverage. "Saturday was consumer day at CeBIT 2004, where more than 220,000 people visited in the first three days. Most visitors come with empty bags and go home with filled ones. After an interesting dinner with Evan Leibovich and the German LPI guys -- and too little sleep -- we were back in the booth with minutes to spare before the gates opened."

Comments (none posted)

LinuxUser & Developer Expo awards open source excellence (Register)

The LinuxUser & Developer Expo is coming in April. The Register reports that nominations for the LinuxUser & Developer Awards is open until March 26.

Comments (none posted)

Novell loves Linux (true) (Register)

The Register reports from Novell's "BrainShare" conference. "Both its SuSE Linux systems management tool, YaST, and Novell's iFolder, personal storage and filing technology, are to be released to the open source community. Novell also flagged up plans for a company-wide shift to Linux on the desktop. As if this wasn't enough, Novell surprised delegates with the surprise of Linux founder Linus Torvalds. He didn't say much - beyond criticising software patents and praising Novell's development efforts - but who cares, it's Linus Torvalds! In Utah!"

Comments (none posted)

The SCO Problem

Inside the Linux arcana (ZDNet)

ZDNet is running a lengthy column full of speculation on Sun's agreements with SCO (and its predecessors) and the implications on SCO's lawsuits. "Of course, a bigger question underlying my hypothesis is why hasn't Sun publicised more of the details from the 1994 agreement. If Sun really has a smoking gun, it would clearly have an adverse impact on SCO's legal manoeuvres. It could be said that, like Microsoft, Sun has an interest in seeing SCO win. After all, Windows isn't the only operating system that has suffered at the hand of Linux."

Comments (7 posted)

Companies

IBM: Open Java Process isn't same as open code (IT Manager's Journal)

IT Manager's Journal looks at efforts by IBM to get Sun to open up Java. " "The JCP is inching toward something, little by little, by little by little," Dr. Bob Sutor, IBM's director of Websphere infrastructure told Open Enterprise Trends. "What we're trying to do is talk about the real fundamental end point here. Java is 8 or 9 years old now; it's mature. Now, we want to discuss with Sun about how we can move to a point where there is an official Open Source Java implementation [of Java]. IBM sent Sun a letter last month asking for a 1-on-1 meeting to discuss a roadmap for opening up Java code."

Comments (none posted)

Novell Updates GroupWise for Linux, Zenworks and Partner Program (eWeek)

eWeek covers several recent Novell announcements. "Novell announced an enhanced partner program as well. The first addition to the company's PartnerNet program will be 560 SuSE Linux partners. The partners will retain their current benefits and will be eligible to enroll in PartnerNet at no additional charge. Novell also is launching several initiatives to encourage its other partners to support SuSE Linux, including a software development kit, a program to ease hardware-certification requirements and the publishing of a SuSE Linux solution directory."

Comments (none posted)

Linux Adoption

Dell-Oracle alliance pushes Linux in China (News.com)

Dell and Oracle are working together to promote Linux-based database systems in China. "Dell and Oracle executives said the tie-up, which tacks Linux-based Oracle software onto Dell computer servers, would edge out competing platforms, but they declined to say how it would help them expand market share. Nonetheless, the alliance could threaten Microsoft and its Windows dominance because the Chinese government has been pushing for a national standard on open-source software to counter the reign of Windows in recent years."

Comments (5 posted)

The Microsoft killers (Prospect Magazine)

This article on Prospect Magazine looks at the origins of open source and at Linux adoption around the world. "The recipe for Coca-Cola is one of the most closely guarded secrets in the world. Yet a small Canadian software firm has sold 150,000 cans of a rival fizzy cola, which tastes very like Coke, and has made the recipe public. The firm behind the drink, Opencola, makes software, not drinks. It used the drink (and its open recipe) as a metaphor for the most important trend in software today." (Thanks to Stuart Ritchie)

Comments (5 posted)

Linux at Work

Driving to Laptopia (Linux Journal)

Doc Searls looks at Linux laptops in this Linux Journal article. "From the laptop perspective, however, I'm an Xtreme road warrior as well as a sub-technical Linux user, which makes me an ideal torture tester for Linux on the laptop (LOTL). Because I don't use a desktop most of the time (I don't want to switch boxes when I come home), LOTL is a better match for me than LOTD (Linux on the desktop). Which is why Don Marti, our Editor-in-Chief here at Linux Journal, wants me to torture-test the best LOTD we can put in my dangerous hands."

Comments (12 posted)

Interviews

The People Behind KDE: Fabrice Mous (KDE.News)

The People Behind KDE series heads to the Netherlands for a talk with Fabrice Mous. "I'm a sort of PR guy for the Dutch KDE group who is visiting events together with those strange KDE devs :) I also help to (re)write some howtos for www.kde.nl and lately I also write some articles/interviews for the newssite dot.kde.org." (Found on KDE.News)

Comments (none posted)

An Interview with OpenBSD's Marc Espie (O'ReillyNet)

O'ReillyNet talks with Marc Espie, an OpenBSD hacker. "Marc Espie: Like most OpenBSD developers, I am very interested in the stability and robustness and security of the whole system. Which means that I do a lot of development outside of my own area: see bug, fix bug. It's as simple as that."

Comments (none posted)

KDE 3.2 Full sKale Release (linmagau.org)

The Australian Linux/Open Source Magazine, linmagau.org, has an interview with George Staikos on the KDE 3.2 release. "I think Konqueror is already a 'killer-app'. The difference is that our HTML rendering capabilities are improving at a faster rate now. This doesn't just apply to Konqueror, but any application that uses KHTML or KPart embedding. Remember that Konqueror is a generic browsing application for the web, the local filesystem, and anything else that you might want to browse." (Found on KDE.News)

Comments (1 posted)

Tom Chance: C.T. Leung on LTSP and KDE at Sisler High School

Tom Chance talks with C.T. Leung on the ups and downs of the deployment of LTSP and KDE in a Manitoba high school. "C.T. Leung: I am a full time high school teacher and a part time instructor for Universities. At Sisler High School, I teach many different computer courses from Programming in Java, Troubleshooting personal computers, networking, operating systems, and some physics including AP Physics. At the University of Winnipeg, I teach one evening per week on Telecommunications, Intro to Linux (System Admin and Networking)." (Found on KDE.News)

Comments (none posted)

Reviews

Can a Red Hat Guru Survive on a Lindows Laptop? (Linux Journal)

Linux Journal reviews the process of installing Lindows on a laptop. "Booting into the installed Lindows Laptop Edition for the first time is very clean, but it might be somewhat frustrating for expert Linux users. None of the boot time messages we are used to fly by, but considering the target audience, this is probably a good thing. I know too many people who would panic over all those messages."

Comments (none posted)

Application of the Month: Konsole (KDE.News)

KDE.News points to the "Application of the month" series on KDE.de which includes an interview for Konsole author Lars Doele. The above link also points to the Dutch KDE website which is offering an English translation of the interview and an overview of this issue.

Comments (1 posted)

CBTracker: a checkbook manager for the rest of us (NewsForge)

NewsForge takes a look at CBTracker. " Do you want to balance your checking account on your Linux desktop, but don't want to have to learn double-entry accounting in order to do it? Join the crowd. GnuCash is the best known personal finance manager for Linux. It's a dandy, but many shy away from it because they can't (or won't) cope with the complexity of real accounting just to balance their checkbook. If that's you, check out Tony Maro's GPL'd CheckBook Tracker. It might just be the answer to your reconciliation blues."

Comments (3 posted)

Sneak Preview: Multitasking Talin Laptop Is Linux-Ready (TechWeb)

TechWeb looks at Tadpole Computer's Talin laptop. "Installing Linux on the desktop can be frustrating, especially if you have a wireless setup: Newer chipsets and standards for wireless networking often aren't included in the latest distribution, and using the open-source drivers available is no stroll in the park. But Tadpole Computer's Talin line of corporate laptops should get you whistling a happier tune. The notebooks come preinstalled with the Linux OS--a customized SuSE Desktop 1.0 distribution--and Sun Microsystems' Java Desktop System, which includes the latest version of Sun's StarOffice 7 productivity software. And they are ready for wireless."

Comments (1 posted)

Switching from PHP to Zope/Python

Kuro5hin is carrying a lengthy article about one developer's switch from PHP to Zope for web application development. "Zope is a beautifully integrated set of solutions to common web development problems. It works in a substantially different way to traditionally scripted web-applications. Think of it as a collection of objects help with web publishing rather than a set of scripts to do a job."

Comments (6 posted)

Miscellaneous

Analysts cheer AMD, Dell and Microsoft as x86-64-bit winners (Register)

The Register looks at competing developments in the 64 bit processor field. "However, IBM is also starting to push its own POWER processor family for 64-bit Linux," Haff wrote. "The upcoming broad-based shift to 64-bits will be a disruptive event that - in the absence of a single dominant architecture as x86 became for 32-bit computing - creates a breakout opportunity for POWER. But x86 extensions provide an alternative path-of-least-resistance for potential Linux-on-POWER buyers, just as they do for Itanium customers. That makes Linux-on-POWER as a mainstream option - never an easy strategy to realize - even more challenging."

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

Chinese government science and technology group joins OSDL

China's Beijing Software Testing Center (BSTC) has joined the Open Source Development Labs (OSDL).

Full Story (comments: none)

Commercial announcements

Absoft Announces New Fortran Compiler for AMD 64-bit Opteron/Athlon Processors

Absoft Corporation has announced the release of a new High Performance Fortran Compiler for AMD 64-bit Opteron/Athlon Processors running Linux.

Comments (none posted)

BitKeeper claims doubling of kernel development pace

BitMover has sent out a press release claiming that the adoption of BitKeeper has doubled the pace of kernel development over the past two years. Quoting Linus: "BitKeeper is different. It's made me more than twice as productive, and its fundamentally distributed nature allows me to work the way I prefer to work -- with many different groups working independently, yet allowing for easy merging between them."

Comments (2 posted)

GFI Announces Its Linux Development Plans

GFI has announced that it is releasing a Linux version of its anti-spam software. "GFI, leading developer of content security, anti-spam, messaging and network security and monitoring software, has announced at CeBIT 2004 that it will soon release a Linux version of GFI MailSecurity. GFI is also developing increased Linux support in all its products."

Comments (none posted)

IBM Announces University Grid Computing Projects

IBM has announced that it will be working with two universities to build grid computing systems for working on geophysical data and medical problems.

Comments (none posted)

Installed Base of Linux POS Terminals Grows 35% in 2003

The use of Linux for Point Of Sale (POS) terminals grew 35% in 2003, according to this press release from the IHL Consulting Group. ""We expect to see strong growth of Linux for several years to come but this is not necessarily good news for POS vendors," said Greg Buzek, president of IHL Consulting Group, an analyst firm and consultancy that serves retailers and retail technology vendors. "The retailers most likely to use Linux for the future are those retailers that currently run DOS on their POS systems and want to continue to keep their same hardware going forward.""

Comments (2 posted)

New version of Opera Embeds ViaVoice from IBM

The Opera browser now has speech recognition capabilities. "Today at AVIOS, SpeechTEK 2004, Opera Software announced the upcoming release of a multimodal desktop browser that incorporates IBM's Embedded ViaVoice speech technology. By leveraging IBM's voice libraries in this version of Opera, users can navigate, request information and even fill in Web forms using speech and other forms of input in the same interaction."

Full Story (comments: none)

Red Hat reports another good quarter

Red Hat has announced its fourth quarter/year end results. Revenue was $37 million in the quarter, resulting in net income of $5 million. Over the last year, the company's bank balance has gone from $292 million to $941 million; $500 million of that will be from bond sales (though the PR does not mention that); the rest is from cash flow.

Comments (4 posted)

New Books

"Hardcore Java" Released by O'Reilly

O'Reilly has published the book Hardcore Java by Robert Simmons, Jr.

Full Story (comments: none)

No Starch Press Releases "Linux for Non-Geeks"

The book Linux for Non-Geeks by Rickford Grant is available from No Starch Press.

Full Story (comments: none)

Resources

The LDP Weekly News

The March 24, 2004 edition of the Linux Documentation Project Weekly News is out with the latest new documentation. A new version of the Linux IPv6 HOWTO is available, among other things.

Full Story (comments: none)

Surveys

ONJava Reader Survey (O'ReillyNet)

O'Reilly's OnJava site is conducting a survey. "This year's ONJava survey asks you which technologies you use, and where and how you use them. Help us shape the site and enter for your chance to receive three O'Reilly books of your choosing."

Comments (none posted)

Event Reports

Novell BrainShare announcements

Novell's BrainShare 2004 conference started today, spawning a host of press releases. Here is a sample:

• Novell Launches Open Source Systems Management Project
• Open Enterprise Server bridges Netware and SUSE Linux
• Novell Makes iFolder Open Source

Comments (6 posted)

Python Sprints coverage

Jeremy Hylton and Ted Leung cover the Python Sprints event. See what went on during day 1, more from day 1, day 2, more from day 2, day 2's dinner, and day 3. (Found on the Daily Python-URL.)

Comments (none posted)

Upcoming Events

Ohio LinuxFest 2004 CFP

A Call for Presentations has gone out for the Ohio LinuxFest 2004. The event will take place on October 2, 2004 at Ohio State University in Columbus, Ohio.

Full Story (comments: none)

YAPC::Australia::2004 (use Perl)

The YAPC::Australia::2004 will be held in Melbourne, Australia on December 1-3, 2004.

Comments (none posted)

EuroPython Call for Participation

A call for participation has gone out for EuroPython 2004. The event will take place in Göteborg, Sweden on June 7-9, 2004.

Full Story (comments: none)

Japanese mozilla.party.jp 5.0 Conference Announced (MozillaZine)

The annual Japanese Mozilla users' group conference has been announced. The event will take place on April 18, 2004.

Comments (none posted)

Exhibitors Queue Up For This Year's LinuxUser & Developer Expo

The LinuxUser & Developer Expo has sent out a press release. "LinuxUser & Developer Expo 2004, the UK’s premier Linux event, has today announced that it has filled 90 per cent of its exhibitor space a month before the show is planned to take place. Exhibitors attending the event in Olympia London from 20th – 21st April 2004 include IBM, LDRA, Rackspace Managed Hosting, Red Hat, SuSE Linux and Sybase."

Full Story (comments: none)

Events: March 25 - May 20, 2004

Date	Event	Location
March 25 - 26, 2004	PyCon DC 2004	Washington, D.C.
March 25 - 26, 2004	Novell BrainShare 2004	Salt Lake City, Utah
March 25 - 26, 2004	Open Source Forum 2004	(The Sydney Marriott Hotel)Sydney, Australia
March 27 - 28, 2004	Nordic Perl Workshop 2004	(Symbion Science Park)Copenhagen, Denmark
March 27 - 28, 2004	YAPC::Taipei::2004	Taipei, Taiwan
March 29 - April 1, 2004	Embedded Systems Conference	(Moscone Center)San Francisco, CA
March 31 - April 2, 2004	USENIX Conference on File and Storage Technologies(FAST '04)	(Grand Hyatt Hotel)San Francisco, CA
April 5 - 7, 2004	Samba eXPerience 2004	(Hotel Freizeit In)Göttingen, Germany
April 5 - 8, 2004	ClusterWorld Conference & Expo	(San Jose Convention Center)San Jose, California
April 13 - 15, 2004	Real World Linux 2004 Conference & Expo	(Metro Toronto Convention Centre)Toronto, Ontario, Canada
April 14 - 16, 2004	MySQL Users Conference and Expo 2004	(Peabody Hotel Orlando)Orlando, FL
April 14 - 17, 2004	ACCU Spring Conference 2004	(Randolph Hotel)Oxford, England
April 16 - 18, 2004	Penguicon 2.0	(Detroit Sheraton Novi Hotel)Novi, MI
April 20 - 21, 2004	LinuxUser & Developer Expo	(Olympia)London, England
April 22 - 23, 2004	2004 Desktop Linux Summit	(Del Mar Fairgrounds)San Diego, California
April 26 - 27, 2004	Digital Media Project Traditional Rights and Usages Workshop	Los Angeles, CA
April 29 - May 2, 2004	2nd Linux Audio Developers Conference	(Institute for Music and Acoustics)Karlsruhe, Germany
May 3 - 5, 2004	International PHP Conference 2004 Spring Edition	Amsterdam, Netherlands
May 6 - 8, 2004	TheServerSide Java Symposium	(The Venetian)Las Vegas, NV
May 16 - 18, 2004	European Firebird Conference 2004	Fulda, Germany
May 17 - 20, 2004	Fifth LCI International Conference on Linux Clusters	(University of Texas)Austin, TX
May 17 - 19, 2004	Enterprise Software Summit	(The Palace Hotel)San Francisco, CA
May 17 - 20, 2004	Black Hat Briefings Europe 2004	(Grand Hotel Krasnapolsky)Amsterdam, the Netherlands
May 17 - 21, 2004	Apache Boot Camp	Atlanta, GA
May 20 - 22, 2004	Austrian Perl Workshop	Vienna, Austria

Comments (none posted)

Web sites

IMIA/OS-NI Has a New Website (LinuxMedNews)

LinuxMedNews has an announcement for the new IMIA-NI (Nursing Informatics) web site. "The Open Source Nursing Informatics (OSNI) Working Group of IMIA-NI was established in June 2003. It aims to bring together an international collaboration of nurses and nurse informaticians interested in exploring the potential for open source and free software in nursing, and more widely in health."

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook

Letters to the editor

Letter to the Editor

From:		"Andrew Stuart" <astuart-AT-mira.net>
To:		<lwn-AT-lwn.net>
Subject:		Letter to the Editor
Date:		Sun, 21 Mar 2004 02:21:18 +1100

To the Editor,
 
I have started a grass-roots campaign aimed at convincing IBM to open up and
free the programming documentation for its STB (Set Top Box) series chips
http://www-306.ibm.com/chips/products/digitalvideo/products/settopbox.html .
You can find the campaign home page at
www.users.bigpond.net.au/mysite/freestb.htm
 
My personal outlook is that the documentation and drivers need to be freely
downloadable to encourage people to develop. Developers have to be pretty
motivated to embark on a quest to engage with an IBM reseller to sign an NDA
and eventually get access to the documentation. IBM, Microsoft, Sun and all
other software companies are very open with their software documentation and
programming documentation for software API's, but why not hardware?
 
I'm not sure what the origin is of the practice of hiding chip documentation
behind an NDA. Surely companies like IBM don't think that an NDA would in
some way keep them one step ahead of the other chip manufacturers?
 
I think such information hiding is a relic of the days of proprietary
computing and chips haven;t felt the wind of open source, so to speak.
 
This is a sub $100 TV connected Linux machine which uses an STBx25xx chip
http://www.hauppauge.com/html/mediamvp_datasheet.htm
Here are the hardware specs of the Mediamvp machine.
http://www.shspvr.com/forum/viewtopic.php?p=19411
 
Also http://www.netgem.com/ has an STB chip.
 
This forum shows people who are trying to build their own version of linux
to run on the MediaMVP http://www.shspvr.com/forum/viewforum.php?f=38 I
think life would be much easier for these people with full documentation and
drivers available.
 
Projects like this would benefit from public and free access to the
documentation and drivers.
http://sourceforge.net/projects/mvpmc/
 
I'm hoping to spread the word and build public pressure on IBM to address
the issue. Any help that you might be able to give would be appreciated.
 
Regards
 
Andrew Stuart
astuart@bigpond.net.au

Comments (2 posted)

Release Early, Release Often

From:		Jonathan Day <imipak-AT-yahoo.com>
To:		letters-AT-lwn.net
Subject:		Release Early, Release Often
Date:		Fri, 19 Mar 2004 06:01:00 -0800 (PST)

Dear editors,
 
The one thing most software developers forget is that
if the project is dead to the world, it will often
become simply dead.
 
At the moment, I'm looking at software routers - an
area notorious for slow to non-existant releases.
Zebra, for example, has a commercial offshoot, and the
Open Source version has since come to a halt. Who,
though, is going to buy the commercial product, if
they perceive the project as dead?
 
Click, a router from MIT, is better in that they have
just made a release. A very large, bulky, and no doubt
bug-ridden release. That's the reason for releasing
often - bugs breed in the dark, and die off in the
light.
 
Mind you, if you are after a software router, Click is
the only one out there with any decent releases at
all. It's also very fast and does support a lot more
than the others ever did. All the others are sleeping,
comatose or dead.
 
If you want to encourage Open Source - and I think we
all do - then release early and release often. LWN
does, with its headline news items, though you could
argue it's not really software. The point is, though,
the model works and the alternative doesn't.
 
Jonathan Day

Comments (4 posted)

XNotesplus - calendar support (and comments on Grumpy Editor column)

From:		"Michael J. Hammel" <mjhammel-AT-graphics-muse.org>
To:		lwn-AT-lwn.net
Subject:		XNotesplus - calendar support (and comments on Grumpy Editor column)
Date:		19 Mar 2004 16:57:54 -0600

 
Anyway, there were some comments made about XNotesPlus that I need to
add some clarification to.
 
1. XNotesPlus is shareware. There have been 1000's of downloads of it.
To date, I think I've had 5 people pay for it. Anyone complaining about
it not being free ought to see it from my end. It'd be nice if people
paid for it, but I'm not tracking anyone down who doesn't. I just ask
that they do. I just didn't want it being added to GNOME or any
distribution without my getting something for it. I designed it
specifically for end users, not for distributions. It doesn't even
install in system directories, it installs in the users HOME directory
(something I may change in the future, however, so it can be used on
university systems).
 
2. The post from "utidjian" was just plain silly. XNotesPlus builds on
just about any Unix platform if you have the proper prerequisites (and
what desktop application doesn't have prerequisites?). The "pspell"
issue is configurable in the config.h (it doesn't use autoconf cuz I
just haven't gotten around to learning that yet - I still use imake) and
is not required but is turned on by default. The RH7.3 binaries are
available for purchase on CD but then so is the source and so are - now
- the RH 9 binaries. I use RH 9 at home and have built XNotesPlus on
probably 20 different platforms. And the RH9 binary version is even on
the web site, available for download *WITHOUT PAYMENT*. So this guy is
just whining without really doing his homework (and I certainly have not
received any email from him asking about these issues).
 
The calendar feature of XNotesPlus was just added to the 3.6 release and
may be buggy. I found a crash today that I need to fix. But I use the
calendar at work and at home and, from the KISS perspective, it works
fine. Its not full featured - it doesn't do group scheduling or the
like. But its not meant to. Its meant to be the home users calendar.
Eventually I may add groupwise support (its on the grand plan) but I'm
not anywhere near adding it yet. It also doesn't allow breaking an
appointment (ie the "exceptions" that the PalmOS allows) yet. I'm
considering how to add that feature. The hooks are there, but the UI is
not implemented.
 
Anyway, I wish people would spend a little time sending *me* the
feedback on problems with XNotesPlus instead of whining in public. I
have answered *every* email with request for help in getting it running
and, to my knowledge, have only failed to get it working once (with
someone who was new to programmning). Just cuz its shareware doesn't
mean the author isn't willing to help. I'm just asking you to offer an
honest dollar for an honest days work.
 
Feel free to post this as a reply if you want, or anywhere else. Like I
said, I tried to reply but couldn't for some reason.
 
--
Michael J. Hammel The Graphics Muse
mjhammel@graphics-muse.org http://www.graphics-muse.com
------------------------------------------------------------------------------
Bumper Sticker: Some people just don't know how to drive... I call these people
"Everybody But Me."

Comments (3 posted)

It's a step in the right direction, but only a step

From:		Leon Brooks <leon-olc-AT-cyberknights.com.au>
To:		Anthony_Doesburg <Anthony_Doesburg-AT-idg.co.nz>, Peter Moore <petemoor-AT-microsoft.com>
Subject:		It's a step in the right direction, but only a step
Date:		Tue, 23 Mar 2004 09:36:10 +0800
Cc:		LWN Letters <letters-AT-lwn.net>, linux-aus-AT-lists.linux.org.au

 
    http://computerworld.co.nz/news.nsf/NL/6671974C513F31E8CC256E5B00723C21
 
> And in what might be a first for a senior Microsoft executive, [Peter]
> acknowledged that Linux is not going to be a passing fad.
 
> "Linux is going to be part of the future. It's going to be like Unix was."
 
While I appreciate the message in there that Linux is going to rule the server
landscape, and am frankly flabbergasted that a Microsoft exec would openly
confess as much (bonus points for so doing, Peter), I don't appreciate the
innuendo that Unix is in some way a "has been" or that Linux is going to join
it in has-been land.
 
I can plug a Linux CD into one machine, and a minute later have a fully
functional Linux workstation and server going there, with extensive office,
networking and diagnostic capabilities - all without disturbing what's on the
hard disk. I do so regularly while repairing virus-savaged MS-Windows LANs.
The staff can be editing up documents and getting on with their lives while
I'm still repairing their system.
 
I can issue one command and reboot the rest of the office into the same
software within a very few minutes, without any extra CDs (hurrah for PXE and
caching). I can batch-process information supercomputer-style on this
network. I can permanently install the software onto the machines' hard disks
while they're running and being used for day-to-day work. This is not the
substance of a has-been, and I CAN'T DO ANY OF IT without a great deal of
effort in MS Windows, and a great deal of licence-counting.
 
> For each of Red Hat, Mandrake and Debian, their websites reported more
> than double the number of security advisories of Windows 2000 and XP,
> Moore said, and while the Linux security advisory rate was rising, that for
> Windows was falling.
  
I can speak to this with authority on Mandrake. First, account for the
*nature* of the patches. Very few of them are for show-stopper issues. Think
CodeRed. If what Peter infers from this were true, there should be twice as
many attacks through Apache as through MS IIS, but day after day my Apache
web logs show stuff like this MS IIS probe and no Apache probes:
 
    GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir
 
Next, account for what's being patched. Mandrake 10.0 ships with over 1800
packages including three different equivalents to MS Office, three different
equivalents to MS Exchange, two different equivalents to MS SQL Server, three
different equivalents to MS Outlook, three different equivalents to MS
Internet Explorer and so on ad infinitum. One would expect to see roughly
three times as many updates based on this factor (more choice) alone.
 
Microsoft supports an organisation trading as "Software Choice". I hope you're
not going to turn around and claim that more choice is now a Bad Thing. The
workstation I'm typing on has 1458 packages installed; some for me, some for
my wife, and some for my children.
 
Even allowing for the observation that those packages are generally more
granular (call it the equivalent of roughly 500 MS Windows software
packages), just getting all of that software installed together on MS Windows
at one time without having it "tread on each other's toes" would be a minor
miracle. When even such basic issues haven't been completely solved, security
must by definition take a back seat to not rocking the boat.
 
>"Security is an industry issue," Moore said, "and we're getting better."
  
Security is a multifaceted thing, and blaming it principally on "the industry"
denies that you're (Microsoft) putting sufficient weight on more important
issues such as basic software architecture.
 
Fixing security aspects such as this would require Microsoft to bite the
bullet and make statements along the lines of "OK, so the MIME handling in
Windows is broken, and that Outlook application is a house of cards from keel
to crowsnest. We're going to re-engineer those, *without* building in more
DRM hooks and other junk and lock-ins designed to help us and our market
image at the expense of customer utility."
 
The people best placed to help you face that are your MVPs, who are as close
to a genuine Open Source community as Microsoft (so far) gets.
 
If Microsoft doesn't do something radical along those lines, and very soon,
Linus Torvalds' flippant quip, "Really, I'm not out to destroy Microsoft.
That will just be a completely unintentional side effect." will come to pass.
Really. And then what of the customers stranded by Microsoft lock-ins, but
without any source of security updates?
 
Meanwhile, there is no such single point of failure in the Open Source world.
 
Cheers; Leon

Comments (none posted)

Page editor: Jonathan Corbet