LWN.net Weekly Edition for April 1, 2004

A look at GNOME 2.6

With the GNOME 2.6 release pushed back a week due to GNOME Web Server intrusion, we decided to take an early look at 2.6 with the 2.5.92 test release. For this preview, GNOME 2.5.92 was built using GARNOME on a system running SUSE Linux 9. The GARNOME GNOME distribution is based on the GAR Architecture; it allows a user to build bleeding-edge software without impacting their current system setup, and without having to check releases out of CVS. This is very handy when using a single system for software testing and everyday work that requires a stable desktop.

GARNOME took the better part of an afternoon to build the GNOME 2.5.92 desktop and basic GNOME components on a machine with an Athlon XP 2600+ CPU and 1 GB of RAM. The basic desktop build consumed a little more than 300 MB of space.

The first thing that most users will notice about GNOME 2.6 is that it seems much faster than previous releases, particularly at startup. The Nautilus shell is also much faster than previous releases, but the default behavior has changed for the worse. When navigating through a directory structure using Nautilus, the default is now for Nautilus to open a new window each time the user opens a directory. Needless to say, this behavior rapidly results in a cluttered desktop. It is possible to override this behavior by using the "--browser" option, but it would be preferable for the default behavior to be the least annoying.

Epiphany 1.2 is speedy, and quite streamlined. Perhaps a little too streamlined, in fact. Epiphany's limited feature set may be less confusing for new users who would be overwhelmed by Mozilla's vast array of options. However, users who have become accustomed to Mozilla may find that Epiphany's minimal features are a bit constrictive. The absence of site-specific pop-up blocking could be a problem for some users who have used Mozilla and Firefox's pop-up blocking features. Epiphany also requires that the user close each browser window individually rather than offering the user the ability to exit all browsers. This may save a user from accidentally closing all of their browser windows when they wish to close only one, but it also requires quite a bit of clicking when a user wishes to exit multiple browser windows.

A smaller annoyance is that Epiphany 1.2 does not allow the user to scroll through recently visited sites via the location toolbar. It's unclear what advantage there is to removing such a simple and commonplace feature. The user is able to select from similar URLs after clicking on the location bar and typing a few letters of the URL, but there is no button to allow the user to simply click and highlight a recently visited URL that remains in the location bar history.

A short while ago I tested the Evolution 1.5 release included in the first Fedora Core 2 test release. GNOME 2.6 includes Evolution 1.5.5, which seems far more stable than it was back in February. They are still including a dialog that warns users that 1.5.5 is test software and recommends that the user download 1.4 if they wish to use a stable branch of Evolution. Evolution 1.5 has a few new features, and loses a few as well. The most notable new feature in 1.5 is junk mail filtering. Notably absent is Evolution's "Summary" panel.

GNOME 2.6 also includes the GTK+ 2.4.0 release. This release introduces a new file browser dialog that, in this writer's opinion, is a vast improvement over the "standard" file dialog. When the user navigates into a directory tree, the file browser creates navigation buttons for each directory. For example, if a user navigates into "local/mozilla/chrome" under their home directory, the dialog will create buttons for "local," "mozilla," and "chrome," in addition to the ever-present "Home" button in the dialog. When the user navigates upward in the directory tree, the sub-directories will still be represented as long as they are in the same hierarchy. This allows the user to navigate through the directory structure much more quickly.

Another application included in GARNOME, though not part of the default desktop build, is Totem movie player based on Xine. It's a nice little media player that plays a wide variety of media, including CDs, VCDs and DVDs (providing libdvdcss is installed for encrypted movies), MPEG video, Ogg files and MP3s. Having used Ogle a great deal in the past, this writer is far happier with Totem for DVD playback. It should also be noted that this author spent more than an adequate amount of time testing Gnometris 2.5.9, and can verify that it is fully ready for deployment.

There are, of course, far too many useful applications in the GNOME arsenal to mention here or to test in a reasonable amount of time. It should suffice to say that GNOME/GARNOME 2.5.92 includes a wide array of useful applications for desktop use, including Gnumeric, the Conglomerate XML editor, gLabels (a handy label-making program), Sodipodi, and many others.

For the most part, the 2.5.92 release is ready for widespread use. There were a few glitches here and there, but it's likely they will be ironed out by the final 2.6 release. One also wishes that it were possible to change certain GNOME settings without having to resort to using the GConf editor. One is unpleasantly reminded of the Windows Registry when tinkering with GConf.

Aside from small glitches and minor annoyances, GNOME 2.5.92 was extremely stable and pleasant to use. Pleasant enough, in fact, to cause this writer to seriously consider switching from XFce to GNOME on a permanent basis. Though one may not agree with all of the interface decisions made by GNOME's developers, it is obvious that the GNOME developers have been working hard to make GNOME a useful and user-friendly desktop environment.

Comments (18 posted)

The Aberdeen Group looks at free databases

The Aberdeen Group has put together an "analyst report" on free databases, as typified by MySQL, PostgreSQL, and Berkeley DB. The report is available for download, in PDF format, from the SleepyCat site, but one must get through a moderately obnoxious registration screen first. For those who don't want to do that, here's a quick summary.

The report starts with a set of reasons why free databases are of interest; they include control over maintenance and support, source availability, cost, flexibility, and reliability. A quick summary of the three covered systems follows, with the "key features" which are supported or missing. The report summarizes the situation in this way:

The free database systems have reached "enterprise" levels of scalability and robustness, however.

The free database market, says Aberdeen, is currently worth about $100 million per year - compared to $10.5 billion for the proprietary variety. Free databases have mostly been making inroads at the low end of the market (the report doesn't say this, but that is how disruptive technologies usually get their start). Aberdeen mentions several times in particular that free databases on Linux are displacing SCO installations. The biggest area for free databases, however, is "new in-house applications." Displacing entrenched systems in other applications is currently too hard, but new applications typically do not have legacy issues to deal with. The best markets for free databases have been in retail and telecommunications.

As for the future:

The authors of the report talked with free database users, and found that those users are well pleased with the level of programming help and support available for the software. If you use a free database system, you can actually talk with the engineers who wrote it, which is not possible with large, proprietary systems. Thus, notes the report, if you're using a free database, you should expect to communicate with the development community, and not just with a vendor.

The talk of licensing is remarkably FUD-free:

The report concludes by saying that free database adoption will stay slow for the next couple of years before beginning to ramp up. The authors state the the lower-level programming tools offered with free database systems will slow down adoption somewhat. Over time, however, the advantages of free databases will lead to those systems having a "moderately bright" future.

Comments (13 posted)

Test releases - be careful out there

The announcement for the second Fedora Core 2 test release went out right on schedule. We hope to have a review of this release done in the near future. In the mean time, it's worth noting that the interest in this release appears to be relatively high, and that some testers are encountering significant difficulties with this release.

Some of the problems being encountered are not surprising to anybody. FC2t2 is the first test release which has SELinux enabled. The incorporation of SELinux into a multipurpose distribution like Fedora is simply guaranteed to generate a fair number of surprises. Working with SELinux in the test release is, in fact, likely to be relatively obnoxious; it is, after all, a fundamentally different security model. There will be a lot of glitches to shake out. Anybody who is even thinking about going near Fedora SELinux in the near future should have a good look at the FC2 SELinux FAQ first. Then read it a second time.

Adding SELinux is certain to be disruptive. Some users will no doubt be unhappy about the fact that they are, in some sense, helping Red Hat debug this feature so that it can be incorporated (with less pain) into the Enterprise Linux products. Bringing in SELinux is an important thing to do, however; we have to improve the security of our systems, and SELinux has the potential to help in the containment of compromises. The Fedora Project is doing us all a favor by blazing this particular trail.

The FC2t2 installation disk has also surprised a number of testers by refusing to boot on their systems. The workaround is fairly straightforward: boot from an earlier Fedora disk, then swap CDs at the boot prompt. But this failure, combined with some other difficulties, has led some potential testers to criticize Red Hat in a loud and public way. The claim is that insufficient quality control on Red Hat's part led to them wasting a bunch of time and bandwidth downloading a release that they cannot even install, much less test.

What may be happening here is that Fedora is bringing in some new users who are unaccustomed to testing bleeding-edge software. New participants in the development process are more than welcome, but they do need to realize that they are exactly that: participants in the development process. No product as complicated as a Linux distribution is going to reach a steady state without a great many testers giving it a try and shaking out the bugs; this is true even of distribution releases which do not include little novelties like the 2.6 kernel and SELinux. If you install (or attempt to install) a test release, you have to be prepared for surprises. When a surprise finds you, it's time to pick up the pieces and help the developers figure out what's going on. But it helps nobody if testers criticize those developers when the test release they have provided (for free) has problems.

Comments (4 posted)

A quick SCO update

There has been action in a couple of the SCO Group's legal cases, so it's time for an update.

IBM has amended its counterclaims in response to SCO's second amended complaint. One of the patent claims has been dropped, and quite a bit of strong language has been added. For example, paragraph 60:

Several paragraphs describing Novell's claims and actions, including the claims to have retained the Unix copyrights, have been added. Some new claim language states:

If IBM obtains such a judgment, SCO's case is essentially over; all that will be left is SCO's defense against IBM's counterclaims.

SCO, meanwhile, has filed a motion to bifurcate the IBM trial. SCO would like to split IBM's patent charges into a separate, trial with its own schedule. SCO's claims that the patent case is unrelated to the Linux-related charges are not entirely without merit; this motion might just be granted.

In the Novell case, SCO has been trying to get the trial moved back to Utah state court where, one assumes, it believes it will get a more favorable hearing. Novell has filed a memorandum in opposition of this motion (available in PDF format) that minces no words; from the opening paragraph:

Novell then dedicates several pages of legalese to the destruction of SCO's arguments. From an outside point of view, Novell's arguments look hard to answer.

In the Red Hat case: nothing has happened, as usual.

Finally, SCO has announced that SCO Forum 2004 will be held August 1 to 3 in Las Vegas. Even here, the company is rather economical with the truth: "SCO Forum 2004 will highlight the company's 25th anniversary in bringing powerful UNIX software solutions to businesses around the world." The SCO Group, originally Caldera, has been incorporated since 1998 (though Caldera, in a different form, had been around since the early 1990's). This company will not be celebrating its 25th anniversary anytime soon.

In any case, the event could be amusing; one can well imagine that, by August, the tone will not be particularly upbeat. Mark your calendars.

Comments (9 posted)

Page editor: Jonathan Corbet

Security

Utah's anti-spyware law

There oughta be a law, as they say, and now there is one in Utah. Yes, Utah is first state in the US to pass legislation banning certain kinds of spyware, the Spyware Control Act, and they took a heap of criticism from the likes of Microsoft and even cuddlier companies like Google, Novell and Amazon, who tried to block it from being passed, but failed. The governor just signed it last week.

Why? What is in this bill that such a broad coalition of companies took a look at it and didn't like what they saw? The best place to go to understand the new law is Ben Edelman's page, A Close Reading of Utah's Spyware Control Act (H.B.323). He has a clear chart showing in a creative way what the law says, with all its subclauses visually laid out. He consulted with the Utah legislators who prepared the bill, and his take on it is worth reading.

He was mightily surprised to see companies like Yahoo and AOL and Amazon and all the rest united against this bill. He concludes they have misunderstood the bill, and after researching it, I think that is indeed part of the problem. Novell's Vice President and Deputy General Counsel Ryan Richards wrote an Op Ed piece for the local paper about the bill in mid-March, "'Spyware' Bill Would Hurt Net Use", where he lays out the objections that he had to the bill and what he felt would be its unintended consequences. Here's a bit of what he wrote: ". . . the bill in its current form could potentially criminalize some of the most popular consumer software on the market, including popular media players, anti-virus programs, internet services, e-mail programs, and networking software."

After reading the bill itself, however, I believe he misunderstood the law, and I have concluded that the consequences are not unintended but rather precisely what the legislators meant to achieve. They intended that hidden spyware that transmits information about users without their consent, be outlawed. It's a bit like the definition of spam. "Legitimate" advertisers would like us to exempt their mailings from that definition. Now they want us to exempt them from the definition of spyware. The Utah legislators passed a bill that doesn't make that distinction. They are telling all companies to just quit it.

Because Ed Felton's analysis of the bill included the statement, "I have not seen specific examples of legitimate software that would be affected," I asked Novell's Bruce Lowry what products of theirs might be impacted by this bill, if any. He replied that while the bill is written in a vague enough way that he wasn't quite sure, one product might be ZENworks, used to configure machines and update software, including security patches, remotely. You can see a demonstration of ZENworks in a video on Novell's coverage of its recent Brainshare conference. I thought it looked like a wonderful product, but it does have to monitor computer usage to work and it sends reports back to a remote server, "both actions that would appear to make ZENworks 'spyware' under the terms of the legislation," Lowry worries. "The language doesn't distinguish between this type of high value, legitimate monitoring of computer activity from those actions that the legislation is ostensibly targeting - i.e. unsolicited advertising."

That would be an understandable worry, if he were correct that the law outlawed that product and others like it. But my reading of the statute convinces me that the bill only requires companies to let users know how products like ZENworks do what they do, get user consent, which presumably they already do, and make it possible to uninstall ZENworks, if users want to later. How burdensome is that? Further, Section 5 specifically excludes "software designed and installed solely to diagnose or resolve technical difficulties."

The strong reaction to this modest bill -- and you can read a PDF letter written by the companies and organizations that united to oppose it -- makes me heart-sinkingly sure that companies currently do quite a bit of monitoring and that the bill is designed to solve a runaway problem. Obviously, currently there is no law against spyware, except in Utah, although there is a bill being prepared on the federal level, and the FTC is holding hearings in April. Europe is considerably ahead of the US on privacy issues, maybe because Madison Avenue is an American phenomenon.

Might Mr. Richards be referring to that popular media player of the same name that the EU Commission just ordered Microsoft to unbundle, for example? Considering Microsoft Media Player's calling-home features, I'd say "probably." And while everyone has been talking about "benign" and "important and beneficial Internet communication software", that perennial favorite "stifling innovation", and the bill burdening users with notices, as if anybody cared about us anyhow, the truth is more likely to be elsewhere. Might it be that advertisers are worried about their income stream, and that at least some of the objecting parties - who are also entertainment purveyors - want to know exactly what everybody is up to with their music and DVDs and intend to spy to the extent they think they can get away with?

There is also a chilling statement in the letter listing reasons the signatories oppose the bill: "The bill also would create serious barriers to collection of data that Internet companies and security companies use to analyze and prevent hacker attacks on the Internet. This security problem is exacerbated by the fact that computer hackers, and other criminals could refuse to consent to use the software that law enforcement officials need to be able to conduct investigations." What are they saying? That instead of getting court orders to track criminals, which doesn't require their permission, law enforcement officials currently track everybody with commercial spyware? That's the kind of revelation, if that's what they meant, that gives privacy lovers hives.

So, what does the bill outlaw?

First, what it doesn't outlaw. It doesn't say they can't spy on us customers. They just have to tell us, in plain language, what they intend to do and get our consent, and make it possible for us to uninstall whatever we let them put on our computers, if we later change our minds. Before you say no one would ever give consent, think about Google's toolbar. A lot of folks trust Google, and they say yes when Google asks if they can track them. And no, Google's toolbar is not outlawed by this bill, because they comply with the notice and uninstall requirements already. Maybe that's why many trust them.

Excluded from the definition of spyware, are programs that diagnose or resolve technical problems, cookies, HTML code, and JavaScript used to report info stored on the user's computer, and operating systems. Plenty of wiggle room there. Anti-virus software and firewalls typically come with licenses that tell you what they do and thus get the necessary consent. The bill also outlaws intrusive ads that block the user's view of "legitimate" paid ads and website content. The liability for those who do it anyway is $10,000 per ad displayed, and that is tripled if the jury thinks they did it on purpose.

There is a catch. The victim can't bring a lawsuit. Only website owners, advertisers, and copyright and trademark owners (that elite bunch that legislators adore to write laws for) can sue. The rest of Utah's citizens must report violations to the Division of Consumer Protection, and the agency follows through, hopefully. The Utah legislators need to vote some funding if they are serious about stamping out spyware in Utah.

Ben Edelman tells me it wouldn't surprise him to see exactly that happen in coming years. "I think the bill reflects a good initial attempt to protect consumers and web sites from the many negative effects of spyware programs," he says, "and I think it offers a sensible and workable framework for doing so."

Comments (22 posted)

New vulnerabilities

courier - Remote buffer overflow vulnerabilities

Package(s):	Courier	CVE #(s):	CAN-2004-0224
Created:	March 29, 2004	Updated:	April 1, 2004
Description:	Remote buffer overflow vulnerabilities have been found in Courier-IMAP and Courier MTA. These exploits may allow the execution of arbitrary code, allowing unauthorized access to a vulnerable system.
Alerts:	Gentoo 200403-06 2004-03-26

Comments (2 posted)

emil: Buffer overflow and format string vulnerabilities

Package(s):	emil	CVE #(s):	CAN-2004-0152 CAN-2004-0153
Created:	March 25, 2004	Updated:	March 31, 2004
Description:	The emil mail filter utility has buffer overflow and format string vulnerabilities that can be exploited locally and remotely, It may be possible to craft an email that exploits the vulnerability and executes arbitrary code.
Alerts:	Debian DSA-468-1 2004-03-24

Comments (none posted)

ethereal - multiple vulnerabilities

Package(s):	ethereal	CVE #(s):	CAN-2004-0176 CAN-2004-0365 CAN-2004-0367
Created:	March 29, 2004	Updated:	June 2, 2004
Description:	There are multiple vulnerabilities in versions of Ethereal earlier than 0.10.3. More information can be found in this advisory from ethereal.com and in this Eye on Security advisory.
Alerts:	Debian DSA-511-1 2004-05-30 OpenPKG OpenPKG-SA-2004.015 2004-04-16 Red Hat RHSA-2004:137-01 2004-03-31 Mandrake MDKSA-2004:024 2004-03-30 Conectiva CLA-2004:835 2004-03-31 Red Hat RHSA-2004:136-01 2004-03-30 Netwosix NW-2004-0007 2004-03-29 Gentoo 200403-07 2004-03-28

Comments (none posted)

monit: buffer overflow and DOS

Package(s):	monit	CVE #(s):
Created:	March 31, 2004	Updated:	April 19, 2004
Description:	The monit system administration program through version 4.1 suffers from remotely exploitable buffer overflow and denial of service vulnerabilities. Two additional vulnerabilities have been found in the HTTP interface of monit, possibly leading to denial of service or execution of arbitrary code.
Alerts:	Gentoo 200404-16 2004-04-19 Netwosix NW-2004-0008 2004-04-06 Gentoo 200403-14 2004-03-31

Comments (none posted)

oftpd - denial of service

Package(s):	oftpd	CVE #(s):
Created:	March 29, 2004	Updated:	April 5, 2004
Description:	A remotely-exploitable overflow exists in versions of oftpd 0.3.6 and earlier, allowing an attacker to crash the oftpd daemon. Issuing a port command with a number higher than 255 causes the server to crash. The port command may be issued before any authentication takes place, meaning the attacker does not need to know a valid username and password in order to exploit this vulnerability.
Alerts:	Debian DSA-473-1 2004-04-03 Gentoo 200403-08 2004-03-29

Comments (1 posted)

openldap: denial of service

Package(s):	openldap	CVE #(s):
Created:	March 31, 2004	Updated:	March 31, 2004
Description:	Versions of the OpenLDAP server through 2.1.12 suffer from a remotely exploitable denial of service vulnerability; some more information can be found in the OpenLDAP bug tracker.
Alerts:	Gentoo 200403-12 2004-03-31

Comments (none posted)

pam-pgsql - missing input sanitizing

Package(s):	pam-pgsql	CVE #(s):	CAN-2004-0366
Created:	March 29, 2004	Updated:	March 31, 2004
Description:	Primoz Bratanic discovered a bug in libpam-psgl, a PAM module to authenticate using a PostgreSQL database. The library does not escape all user-supplied data that are sent to the database. An attacker could exploit this bug to insert SQL statements.
Alerts:	Debian DSA-469-1 2004-03-29

Comments (none posted)

squid - vulnerability in URL decoding

Package(s):	squid	CVE #(s):	CAN-2004-0189
Created:	March 29, 2004	Updated:	April 20, 2004
Description:	A bug was found in the processing of %-encoded characters in a URL in versions of Squid 2.5.STABLE4 and earlier. If a Squid configuration uses Access Control Lists (ACLs), a remote attacker could create URLs that would not be correctly tested against Squid's ACLs, potentially allowing clients to access prohibited URLs.
Alerts:	Whitebox WBSA-2004:133-01 2004-04-19 Fedora FEDORA-2004-104 2004-04-15 Red Hat RHSA-2004:133-01 2004-04-14 Conectiva CLA-2004:838 2004-04-12 Debian DSA-474-1 2004-04-03 OpenPKG OpenPKG-SA-2004.008 2004-04-01 Mandrake MDKSA-2004:025 2004-03-30 Gentoo 200403-11 2004-03-30 Red Hat RHSA-2004:134-01 2004-03-29

Comments (none posted)

tcpdump: ISAKMP payload handling denial-of-service vulnerabilities

Package(s):	tcpdump	CVE #(s):	CAN-2004-0183 CAN-2004-0184
Created:	March 30, 2004	Updated:	September 30, 2004
Description:	TCPDUMP v3.8.1 and earlier versions contain multiple flaws in the packet display functions for the ISAKMP protocol. Upon receiving specially crafted ISAKMP packets, TCPDUMP will try to read beyond the end of the packet capture buffer and crash. More information is available in this Rapid7 advisory.
Alerts:	Fedora-Legacy FLSA:1468 2004-09-29 Whitebox WBSA-2004:219-01 2004-06-10 Red Hat RHSA-2004:219-01 2004-05-26 Fedora FEDORA-2004-120 2004-05-13 Slackware SSA:2004-108-01 2004-04-17 Mandrake MDKSA-2004:030 2004-04-14 OpenPKG OpenPKG-SA-2004.010 2004-04-07 Debian DSA-478-1 2004-04-06 Trustix TSLSA-2004-0015 2004-03-30

Comments (none posted)

Updated vulnerabilities

apache2: Denial of Service vulnerability

Package(s):	apache2	CVE #(s):
Created:	September 29, 2003	Updated:	March 25, 2004
Description:	A problem was discovered in Apache2 where CGI scripts that write more than 4k to the standard error stream will hang the script's execution. This problem can lead to a denial of service situation. See this bug report for additional details.
Alerts:	Gentoo 200403-04 2004-03-22 Netwosix NW-2004-0006 2004-03-25 Mandrake MDKSA-2003:096-1 2003-10-24 Mandrake MDKSA-2003:096 2003-09-26

Comments (none posted)

ecartis: several vulnerabilities

Package(s):	ecartis	CVE #(s):	CAN-2003-0781 CAN-2003-0782
Created:	March 24, 2004	Updated:	March 24, 2004
Description:	The ecartis mailing list manager (version 1.0) suffers from an input validation vulnerability which can result in the disclosure of list passwords. Ecartis also has several buffer overflow vulnerabilities. See this advisory for more information.
Alerts:	Debian DSA-467-1 2004-03-23

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail may crash on specially crafted message

Package(s):	fetchmail	CVE #(s):	CAN-2003-0792
Created:	October 17, 2003	Updated:	April 8, 2004
Description:	A bug was discovered in fetchmail 6.2.4 where a specially crafted email message can cause fetchmail to crash.
Alerts:	OpenPKG OpenPKG-SA-2004.012 2004-04-08 Gentoo 200403-10 2004-03-30 Netwosix NW-2004-0002 2004-02-20 SCO Group CSSA-2004-004.0 2004-02-19 Slackware SSA:2003-300-02 2003-10-22 Mandrake MDKSA-2003:101 2003-10-16

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

httpd - vulnerabilities fixed in Apache HTTP Server v2.0.49

Package(s):	httpd	CVE #(s):	CAN-2004-0174 CAN-2003-0020 CAN-2004-0113
Created:	March 23, 2004	Updated:	March 30, 2004
Description:	The Apache Software Foundation and the Apache HTTP Server Project have announced the release of version 2.0.49 of the Apache HTTP Server ("Apache"). More on the vulnerabilities fixed in this release can be found in this announcement.
Alerts:	Trustix TSLSA-2004-0017 2004-03-30

Comments (none posted)

iproute: local denial of service

Package(s):	iproute net-tools	CVE #(s):	CAN-2003-0856
Created:	November 25, 2003	Updated:	December 14, 2004
Description:	The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible.
Alerts:	Mandrake MDKSA-2004:148 2004-12-13 Fedora FEDORA-2004-154 2004-06-03 Fedora FEDORA-2004-115 2004-05-11 Debian DSA-492-1 2004-04-18 Gentoo 200404-10 2004-04-09 Red Hat RHSA-2003:316-01 2003-11-24

Comments (none posted)

kdelibs: cookie disclosure

Package(s):	kdelibs	CVE #(s):	CAN-2003-0592
Created:	March 10, 2004	Updated:	August 24, 2004
Description:	kdelibs (and, thus, Konqueror) has a vulnerability where a hostile server can force the disclosure of cookies that should not be presented to it. KDE versions 3.1.3 and later contain a fix.
Alerts:	Gentoo 200408-23 2004-08-24 Red Hat RHSA-2004:074-01 2004-03-10 Red Hat RHSA-2004:075-01 2004-03-10 Mandrake MDKSA-2004:022 2004-03-10 Debian DSA-459-1 2004-03-10

Comments (none posted)

kdepim: VCF file information reader vulnerability

Package(s):	kdepim	CVE #(s):	CAN-2003-0988
Created:	January 15, 2004	Updated:	May 26, 2004
Description:	KDE has issued a security advisory for all versions of kdepim as distributed with KDE versions 3.1.0 through 3.1.4 inclusive. A carefully crafted .VCF file potentially enables local attackers to compromise the privacy of a victim's data or execute arbitrary commands with the victim's privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0988 to this issue.
Alerts:	Fedora FEDORA-2004-133 2004-05-19 Gentoo 200404-02 2004-04-06 Whitebox WBSA-2004:005-01 2004-02-12 Conectiva CLA-2004:810 2004-01-20 Slackware SSA:2004-014-01 2004-01-14 Mandrake MDKSA-2004:003 2004-01-14 Red Hat RHSA-2004:006-01 2004-01-07

Comments (none posted)

kernel: local root exploit in 2.4.22

Package(s):	kernel	CVE #(s):	CAN-2003-0961
Created:	December 1, 2003	Updated:	April 5, 2004
Description:	A vulnerability was discovered in the Linux kernel versions 2.4.22 and previous. A flaw in bounds checking in the do_brk() function can allow a local attacker to gain root privileges. This vulnerability is known to be exploitable. The 2.4.23 kernel contains the fix. For more details on how this vulnerability works, see this LWN article.
Alerts:	Debian DSA-475-1 2004-04-05 Debian DSA-470-1 2004-04-01 Debian DSA-442-1 2004-02-19 Debian DSA-433-1 2004-02-04 Debian DSA-423-1 2004-01-15 Red Hat RHSA-2003:368-01 2003-12-19 Conectiva CLA-2003:796 2003-12-05 Gentoo 200312-02 2003-12-04 SuSE SuSE-SA:2003:049 2003-12-04 Yellow Dog YDU-20031203-1 2003-12-03 Red Hat RHSA-2003:389-01 2003-12-01 Fedora FEDORA-2003-026 2003-12-02 Slackware SSA:2003-336-01 2003-12-01 Red Hat RHSA-2003:392-00 2003-12-01 Trustix 2003-0046 2003-12-01 Mandrake MDKSA-2003:110 2003-12-01 Debian DSA-403-1 2003-12-01

Comments (1 posted)

Linux kernel 2.2.10 failing function and TLB flush vulnerability

Package(s):	kernel-source-2.2.10	CVE #(s):	CAN-2004-0077
Created:	March 18, 2004	Updated:	June 4, 2004
Description:	A local root exploit is possible due to early flushing of the TLB.
Alerts:	Debian DSA-514-1 2004-06-04 Debian DSA-466-1 2004-03-18

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):	libxml2	CVE #(s):	CAN-2004-0110
Created:	February 26, 2004	Updated:	August 19, 2009
Description:	Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:	Fedora FEDORA-2009-8594 2009-08-15 Fedora FEDORA-2009-8582 2009-08-15 Fedora-Legacy FLSA:1324 2004-07-19 Conectiva CLA-2004:836 2004-03-31 Gentoo 200403-01 2004-03-06 Trustix TSLSA-2004-0010 2004-03-05 OpenPKG OpenPKG-SA-2004.003 2004-03-05 Netwosix NW-2004-0004 2004-03-04 Debian DSA-455-1 2004-03-03 Mandrake MDKSA-2004:018 2004-03-03 Red Hat RHSA-2004:091-02 2004-03-03 Whitebox WBSA-2004:090-01 2004-03-01 Red Hat RHSA-2004:090-01 2004-02-26 Fedora FEDORA-2004-087 2004-02-25 Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

mailman denial of service

Package(s):	mailman	CVE #(s):	CAN-2003-0991
Created:	February 9, 2004	Updated:	May 25, 2004
Description:	Matthew Galgoci of Red Hat discovered a Denial of Service (DoS) vulnerability in versions of Mailman prior to 2.1. An attacker could send a carefully-crafted message causing mailman to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0991 to this issue.
Alerts:	Conectiva CLA-2004:842 2004-05-25 Red Hat RHSA-2004:156-01 2004-04-14 Mandrake MDKSA-2004:013 2004-02-13 Red Hat RHSA-2004:019-01 2004-02-09

Comments (1 posted)

mc: arbitrary code execution

Package(s):	mc	CVE #(s):	CAN-2003-1023
Created:	January 16, 2004	Updated:	April 5, 2004
Description:	A vulnerability was discovered in Midnight Commander, a file manager, whereby a malicious archive (such as a .tar file) could cause arbitrary code to be executed if opened by Midnight Commander.
Alerts:	OpenPKG OpenPKG-SA-2004.009 2004-04-05 Gentoo 200403-09 2004-03-29 Conectiva CLA-2004:833 2004-03-31 SCO Group CSSA-2004-014.0 2004-03-25 Whitebox WBSA-2004:035-01 2004-02-12 Fedora FEDORA-2004-058 2004-02-09 Red Hat RHSA-2004:035-01 2004-01-19 Mandrake MDKSA-2004:007 2004-01-26 Red Hat RHSA-2004:034-01 2004-01-19 Debian DSA-424-1 2004-01-16

Comments (none posted)

metamail: integer and buffer overflows

Package(s):	metamail	CVE #(s):	CAN-2004-0104 CAN-2004-0105
Created:	February 18, 2004	Updated:	May 21, 2004
Description:	Versions of metamail through 2.7 contain a set of integer and buffer overflows which are remotely exploitable via a properly crafted message.
Alerts:	Gentoo 200405-17 2004-05-21 Debian DSA-449-1 2004-02-24 Mandrake MDKSA-2004:014 2004-02-18 Slackware SSA:2004-049-02 2004-02-18 Red Hat RHSA-2004:073-01 2004-02-18

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mod_python: denial of service vulnerability

Package(s):	mod_python	CVE #(s):	CAN-2003-0973
Created:	January 27, 2004	Updated:	October 4, 2004
Description:	Apache's mod_python module could crash the httpd process if a specific, malformed query string was sent. The Apache Foundation has reported that mod_python may be prone to Denial of Service attacks when handling a malformed query. Mod_python 2.7.9 was released to fix the vulnerability, however, because the vulnerability has not been fully fixed, version 2.7.10 has been released. Users of mod_python 3.0.4 are not affected by this vulnerability.
Alerts:	Fedora-Legacy FLSA:1325 2004-10-03 Conectiva CLA-2004:837 2004-04-12 Whitebox WBSA-2004:058-01 2004-03-01 Debian DSA-452-1 2004-02-29 Red Hat RHSA-2004:058-01 2004-02-26 Red Hat RHSA-2004:063-01 2004-02-26 Gentoo 200401-03 2004-01-27

Comments (none posted)

mozilla: multiple vulnerabilties

Package(s):	mozilla	CVE #(s):	CAN-2003-0594 CAN-2003-0564
Created:	March 10, 2004	Updated:	August 19, 2004
Description:	Mozilla 1.4 contains a few vulnerabilities, including disclosure of cookies to the wrong server, a scripting vulnerability which can allow an attacker to run arbitrary code, and an S/MIME vulnerability which can lead to remote denial of service or code execution attacks.
Alerts:	Whitebox WBSA-2004:421-01 2004-08-19 Whitebox WBSA-2004:110-01 2004-03-29 Red Hat RHSA-2004:112-01 2004-03-17 Mandrake MDKSA-2004:021 2004-03-10

Comments (none posted)

mpg321: format string vulnerability

Package(s):	mpg321	CVE #(s):	CAN-2003-0969
Created:	January 6, 2004	Updated:	March 28, 2005
Description:	A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
Alerts:	Gentoo 200503-34 2005-03-28 Debian DSA-411-1 2004-01-05

Comments (none posted)

mplayer: remotely exploitable buffer overflow vulnerability

Package(s):	mplayer	CVE #(s):	CAN-2003-0835
Created:	September 29, 2003	Updated:	April 6, 2004
Description:	A remotely exploitable buffer overflow vulnerability was found in MPlayer. A malicious host can craft a harmful ASX header, and trick MPlayer into executing arbitrary code upon parsing that header. Read the full advisory for details.
Alerts:	Mandrake MDKSA-2004:026 2004-04-05 Gentoo 200403-13 2004-03-31 Conectiva CLA-2003:760 2003-10-06 Mandrake MDKSA-2003:097 2003-09-30 Gentoo 200309-15 2003-09-27

Comments (none posted)

mutt: buffer overflow

Package(s):	mutt	CVE #(s):	CAN-2004-0078
Created:	February 12, 2004	Updated:	March 26, 2004
Description:	mutt suffers from a buffer overflow in its "index menu" code. This overflow can be exploited via a hostile message to crash mutt and, perhaps, execute arbitrary code. Version 1.4.2 fixes the problem; see this advisory for details.
Alerts:	SCO Group CSSA-2004-013.0 2004-03-25 OpenPKG OpenPKG-SA-2004.005 2004-03-09 Netwosix NW-2004-0001 2004-02-16 Trustix 2004-0006 2004-02-13 Whitebox WBSA-2004:050-01 2004-02-12 Mandrake MDKSA-2004:010 2004-02-11 Slackware SSA:2004-043-01 2004-02-12 Red Hat RHSA-2004:051-01 2004-02-11 Red Hat RHSA-2004:050-01 2004-02-11 Fedora FEDORA-2004-061 2004-02-11

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

netpbm: insecure temporary files

Package(s):	netpbm	CVE #(s):	CAN-2003-0924
Created:	January 19, 2004	Updated:	December 29, 2004
Description:	netpbm is graphics conversion toolkit made up of a large number of single-purpose programs. Many of these programs were found to create temporary files in an insecure manner, which could allow a local attacker to overwrite files with the privileges of the user invoking a vulnerable netpbm tool.
Alerts:	Conectiva CLA-2004:909 2004-12-29 Gentoo 200410-02 2004-10-04 Mandrake MDKSA-2004:011-1 2004-09-27 Whitebox WBSA-2004:031-01 2004-02-12 Mandrake MDKSA-2004:011 2004-02-11 Red Hat RHSA-2004:030-01 2004-02-05 Fedora FEDORA-2004-068 2004-02-06 Red Hat RHSA-2004:031-01 2004-01-22 Debian DSA-426-1 2004-01-18

Comments (1 posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

OpenSSL: denial of service vulnerabilities

Package(s):	OpenSSL	CVE #(s):	CAN-2004-0081 CAN-2003-0851
Created:	March 17, 2004	Updated:	November 2, 2005
Description:	Versions 0.9.7a-c of the OpenSSL library suffer from two denial of service vulnerabilities; see the version 0.9.7d release announcement for details.
Alerts:	Red Hat RHSA-2005:830-00 2005-11-02 Red Hat RHSA-2005:829-00 2005-11-02 Fedora FEDORA-2005-1042 2005-10-31 Fedora-Legacy FLSA:1395 2004-05-08 Conectiva CLA-2004:834 2004-03-31 Whitebox WBSA-2004:084-01 2004-03-23 Red Hat RHSA-2004:084-01 2004-03-23 Fedora FEDORA-2004-095 2004-03-19 Whitebox WBSA-2004:120-01 2004-03-22 Trustix TSLSA-2004-0012 2004-03-17 Slackware SSA:2004-077-01 2004-03-17 Red Hat RHSA-2004:121-01 2004-03-17 OpenPKG OpenPKG-SA-2004.007 2004-03-18 Gentoo 200403-03 2004-03-17 Debian DSA-465-1 2004-03-17 Netwosix NW-2004-0005 2004-03-17 Mandrake MDKSA-2004:023 2004-03-17 SuSE SuSE-SA:2004:007 2004-03-17 Red Hat RHSA-2004:120-01 2004-03-17 Red Hat RHSA-2004:119-01 2004-03-17 EnGarde ESA-20040317-003 2004-03-17

Comments (1 posted)

perl information leak

Package(s):	perl	CVE #(s):	CAN-2003-0618
Created:	February 2, 2004	Updated:	April 21, 2004
Description:	Paul Szabo discovered a number of bugs in suidperl, a helper program to run perl scripts with setuid privileges. By exploiting these bugs, an attacker could abuse suidperl to discover information about files (such as testing for their existence and some of their permissions) that should not be accessible to unprivileged users.
Alerts:	Debian DSA-431-2 2004-04-16 Debian DSA-431-1 2004-02-01

Comments (none posted)

postfix: denial of service vulnerabilities

Package(s):	postfix	CVE #(s):	CAN-2003-0468 CAN-2003-0540
Created:	August 5, 2003	Updated:	May 27, 2004
Description:	The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:	Mandrake MDKA-2004:028 2004-05-26 Trustix 2003-0029 2003-08-04 Mandrake MDKSA-2003:081 2003-08-04 EnGarde ESA-20030804-019 2003-08-04 Conectiva CLA-2003:717 2003-08-04 SuSE SuSE-SA:2003:033 2003-08-04 Red Hat RHSA-2003:251-01 2003-08-04 Debian DSA-363-1 2003-08-03

Comments (none posted)

PWLib: possible Denial of Service

Package(s):	PWLib	CVE #(s):	CAN-2004-0097
Created:	February 13, 2004	Updated:	April 9, 2004
Description:	PWLib is a cross-platform class library designed to support the OpenH323 project. OpenH323 provides an implementation of the ITU H.323 teleconferencing protocol, used by packages such as Gnome Meeting. A test suite for the H.225 protocol (part of the H.323 family) provided by the NISCC uncovered bugs in PWLib prior to version 1.6.0. An attacker could trigger these bugs by sending carefully crafted messages to an application. The effects of such an attack can vary depending on the application, but would usually result in a Denial of Service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0097 to this issue.
Alerts:	Gentoo 200404-11 2004-04-09 Mandrake MDKSA-2004:017 2004-03-03 Fedora FEDORA-2004-078 2004-03-02 Debian DSA-448-1 2004-02-22 Whitebox WBSA-2004:047-01 2004-02-18 Red Hat RHSA-2004:047-01 2004-02-18 Red Hat RHSA-2004:048-01 2004-02-13

Comments (none posted)

python: buffer overflow

Package(s):	python	CVE #(s):	CAN-2004-0150
Created:	March 10, 2004	Updated:	October 11, 2004
Description:	Python (versions 2.2 and 2.2.1 only) has a buffer overflow in the getaddrinfo() function which can be exploited by a malformed IPv6 address.
Alerts:	Debian DSA-458-3 2004-10-10 Gentoo 200409-03 2004-09-02 Debian DSA-458-2 2004-08-31 Mandrake MDKSA-2004:019 2004-03-09 Debian DSA-458-1 2004-03-09

Comments (none posted)

samba privilege escalation

Package(s):	samba	CVE #(s):	CAN-2004-0186
Created:	March 15, 2004	Updated:	April 20, 2004
Description:	Samba, a LanManager-like file and printer server for Unix, was found to contain a vulnerability whereby a local user could use the "smbmnt" utility, which is setuid root, to mount a file share from a remote server which contained setuid programs under the control of the user. These programs could then be executed to gain privileges on the local system.
Alerts:	Mandrake MDKSA-2004:035 2004-04-19 Debian DSA-463-1 2004-03-12

Comments (none posted)

sysstat: temporary file vulnerability

Package(s):	sysstat	CVE #(s):	CAN-2004-0107 CAN-2004-0108
Created:	March 10, 2004	Updated:	October 4, 2004
Description:	The sysstat utility has a temporary file vulnerability which can be exploited by a local attacker to overwrite system files.
Alerts:	Fedora-Legacy FLSA:1372 2004-10-03 Gentoo 200404-04 2004-04-06 Debian DSA-460-2 2004-04-03 Trustix TSLSA-2004-0011 2004-03-16 Whitebox WBSA-2004:053-01 2004-03-10 Red Hat RHSA-2004:053-01 2004-03-10 Red Hat RHSA-2004:093-01 2004-03-10 Debian DSA-460-1 2004-03-10

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tcpdump: flaws in the ISAKMP decoding routines

Package(s):	tcpdump	CVE #(s):	CAN-2003-0989 CAN-2004-0057 CAN-2004-0055
Created:	January 15, 2004	Updated:	April 6, 2004
Description:	George Bakos discovered flaws in the ISAKMP decoding routines of tcpdump versions prior to 3.8.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0989 to this issue. Jonathan Heusser discovered two additional flaws in the ISAKMP decoding routines of tcpdump versions up to and including 3.8.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0057 to this issue. Jonathan Heusser discovered a flaw in the print_attr_string function in the RADIUS decoding routines for tcpdump 3.8.1 and earlier. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0055 to this issue. Remote attackers could potentially exploit these issues by sending carefully-crafted packets to a victim. If the victim uses tcpdump, these packets could result in a denial of service, or possibly execute arbitrary code as the 'pcap' user.
Alerts:	Gentoo 200404-03 2004-03-31 Fedora FEDORA-2004-091 2004-03-04 SCO Group CSSA-2004-008.0 2004-03-02 Fedora FEDORA-2004-092 2004-03-02 Whitebox WBSA-2004:008-01 2004-02-12 Fedora-Legacy FLSA:1222 2004-01-31 Mandrake MDKSA-2004:008 2004-01-26 EnGarde ESA-20040119-002 2004-01-19 Debian DSA-425-1 2004-01-16 OpenPKG OpenPKG-SA-2004.002 2004-01-16 Trustix 2004-0004 2004-01-05 SuSE SuSE-SA:2004:002 2004-01-14 Red Hat RHSA-2004:008-01 2004-01-15 Red Hat RHSA-2004:007-01 2004-01-14

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

util-linux: information leak in the login program

Package(s):	util-linux	CVE #(s):	CAN-2004-0080
Created:	February 3, 2004	Updated:	April 8, 2004
Description:	The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. In some situations, the login program could use a pointer that had been freed and reallocated. This could cause unintentional data leakage.
Alerts:	Netwosix NW-2004-0010 2004-04-08 Gentoo 200404-06 2004-04-07 Fedora-Legacy FLSA:1256 2004-03-04 Whitebox WBSA-2004:056-01 2004-02-12 Red Hat RHSA-2004:056-01 2004-02-02

Comments (1 posted)

uudeview temp file problem

Package(s):	uudeview	CVE #(s):
Created:	March 13, 2004	Updated:	March 29, 2004
Description:	uudeview 0.5.19 and later has problem with insecure temp file handling that can lead to failure retrieving the filename during decode.
Alerts:	Gentoo 200403-05 2004-03-26 OpenPKG OpenPKG-SA-2004.006 2004-03-12

Comments (none posted)

Resources

Open Source Vulnerability Database Opens

After some two years in the development process, the Open Source Vulnerability Database has opened its virtual doors. "The Open Source Vulnerability Database (OSVDB) is an open project to collect and distribute vulnerability information freely to everyone. The project team contains skilled volunteers working together to document every security vulnerability that arises."

Full Story (comments: none)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current 2.6 prepatch is 2.6.5-rc3, which was announced by Linus on March 29. Additions this time around include lots of architecture updates, an AGPGART update, a few networking tweaks, an ACPI update, and various fixes. "Nothing earth-shattering," says Linus; things seem to be slowly settling down toward a real 2.6.5 release. See the long-format changelog for the details.

Linus's BitKeeper repository, as of this writing, contains an ALSA update, some PowerPC updates, and various other fixes.

The current tree from Andrew Morton is 2.6.5-rc3-mm2. Recent additions to -mm include some architecture updates, more scheduler work, a reworked laptop mode patch, support for huge serial ATA requests (see below), and lots of fixes.

The current 2.4 prepatch is 2.4.26-rc1, announced by Marcelo on March 28. Previously, 2.4.26-pre6 had come out on March 25. Recent changes include lots of fixes and support for Intel's AMD64-like IA32e architecture.

Comments (none posted)

Kernel development news

Merging the virtual memory work

The LWN Kernel Page has included several articles over the last month on the work to improve the scalability of the virtual memory subsystem by eliminating the reverse mapping chains currently used by the 2.6 kernel. That work reached a milestone on March 26, when Andrea Arcangeli released 2.6.5-rc2-aa3 with more virtual memory changes and a comment:

Andrea raised the issue again when he released 2.6.5-rc3-aa1. Andrew Morton finally replied at that point:

It is not surprising that Andrew would hesitate to rush into merging major virtual memory changes in the middle of a stable kernel series. Most 2.6 users will, one imagines, be relieved to see that some caution is being applied here - regardless of the eventual value of this work. Andrea, however, is in more of a hurry: "Keep in mind this whole thing is going in production in a matter of a week, so please test and review now." Those words suggest that SUSE Linux 9.1 will include the new VM code. One can only hope that Andrea's high level of confidence in that code is justified.

Comments (none posted)

COW Links

Free software hackers often find themselves cloning a large tree full of source files; with a duplicate tree, it is easy to see which files have been changed and to generate patch files. Creating such a tree can be easy as typing:

    cp -rl old-tree new-tree

This technique works well if you use a tool (emacs, say) which moves files aside before rewriting them. By moving the file, emacs breaks the link and leaves the original copy (in the old tree) unchanged. If, however, the tool rewrites the file in place (as vi tends to do), the file, as seen in both trees, will be changed.

As a solution to this problem, Jörn Engel has been working on a patch which implements "cowlinks." The idea behind a COW (copy-on-write) link is that, if the file linked to is written to, a copy will be made (thus breaking the link) and the write will be performed on the copy. With this capability, somebody wishing to duplicate and modify a tree of files could use COW links; the duplicate files would share the same blocks on disk until one was modified. And it would all work regardless of the tool being used to perform the modifications.

In fact, COW links could be used for any copy operations within the same filesystem. The result would be faster copies and, perhaps, substantial savings of disk space.

The current cowlink patch does not actually implement this behavior, however. It implements a COW bit in the inode structure, but, rather than actually perform the copy, it simply fails any attempt to write a file with more than one link. User space is then expected to notice the error and do the right thing. This is not the long-term planned behavior; from a comment in the code:

The full behavior has not yet been implemented because it requires some tricky filesystem-level programming. There is also the issue that the right behavior for COW links has not, yet, been worked out. One obvious implementation would have COW links behave just like regular, "hard" links, with the file being truly copied when the first write is done. With that approach, however, the file will change its inode number after the writing application has opened it. That is just the sort of anomalous, nonstandard behavior that can break applications in strange and unexpected places.

An alternative would be for two COW-linked files to have separate inode numbers from the beginning, even though they share the same on-disk data. If COW links are implemented this way, no application will notice when the link is broken. What will break, however, is any application which depends on inode numbers to detect identical files. Recursive diffs will be much slower, "du" will give wrong numbers, and tar could do the wrong thing. Fixing all of these applications would require the addition of a nonstandard system call and fixing the programs to use it.

Linus has made his opinion known:

That opinion makes it likely that development will go in that direction, but, until the code shows up, nobody knows for sure.

Comments (11 posted)

Big block transfers: good or bad?

Users of serial ATA drives on Linux will be familiar with Jeff Garzik's "libata" driver, which provides solid support for those drives with several controllers. Jeff recently posted a patch which has the potential to make SATA users happier; with this patch, libata will use the "LBA48" mode, which can perform transfers of up to 32MB in length. Says Jeff:

Interestingly, the whole family was not entirely thrilled by the idea. The problem is latency: most SATA drives will take the better part of a second to perform a 32MB transfer, during which no other requests are being processed. Several people complained, saying that a 32MB limit is far too high, and that, in any case, the performance benefits of transfers above around 1MB are minimal at best. Jeff's explanation that, in reality, transfers would be limited to 8MB with the current libata driver did little to slow the debate.

The issue being debated is not whether 32MB transfers could create latency problems; everybody agrees on that point. The difference of opinion is over where the decision on transfer sizes should be made. A device driver's job, according to Jeff, is to make the full capabilities of the device available to the kernel without imposing arbitrary limits. He would rather see the block layer deal with maximum transfer size issues. Jens Axboe, the maintainer of the block layer, responds that the block layer has no idea of the performance characteristics of any individual device, while the driver does. The driver, thus, is in the best position to make decisions about maximum transfer sizes.

In truth, the driver doesn't know the right number, either; it can depend on individual drives, the controller being used, etc. As a result, the final outcome looks like it will involve some sort of adaptive, dynamic tuning. The block layer will track the execution time of requests and note when that time gets to be too long; at that point, it will have the information needed to put a lid on request size. The same timing information could also be used to tweak the maximum tagged command queueing depth (the number of requests which can be fed simultaneously to the drive), since a number of similar issues come up there.

Comments (2 posted)

Patches and updates

Kernel trees

• Linus Torvalds: Linux 2.6.5-rc3. (March 30, 2004)

• Andrew Morton: 2.6.5-rc3-mm1. (March 30, 2004)

• Andrew Morton: 2.6.5-rc3-mm2. (March 31, 2004)

• Andrea Arcangeli: 2.6.5-rc3-aa1. (March 31, 2004)

• Martin J. Bligh: 2.6.5-rc3-mjb1. (March 31, 2004)

• Andrew Morton: 2.6.5-rc2-mm4. (March 26, 2004)

• Andrew Morton: 2.6.5-rc2-mm5. (March 29, 2004)

• Andrea Arcangeli: 2.6.5-rc2-aa3. (March 26, 2004)

• Andrea Arcangeli: 2.6.5-rc2-aa4. (March 26, 2004)

• Andrea Arcangeli: 2.6.5-rc2-aa5. (March 29, 2004)

• Andrea Arcangeli: 2.6.5-rc2-aa6. (March 29, 2004)

• Antony Suter: 2.6.5-rc2-as1 patchset of ckstaircase5 and cfq and aa4. (March 30, 2004)

• Con Kolivas: 2.6.4-ck2. (March 26, 2004)

• Marc-Christian Petersen: WOLK v2.3 for Kernel v2.6.4. (March 26, 2004)

• Marcelo Tosatti: Linux 2.4.26-rc1. (March 28, 2004)

• Marcelo Tosatti: Linux 2.4.26-pre6. (March 25, 2004)

Core kernel code

• Con Kolivas: Staircase scheduler - experimental. (March 25, 2004)

• Paul Jackson: Introduce mask ADT, rebuild cpumask_t and nodemask_t [0/22]. (March 29, 2004)

• Nigel Cunningham: New swsusp test patches on Sourceforge.. (March 30, 2004)

• Ingo Molnar: sched-2.6.5-rc3-mm1-A0. (March 30, 2004)

• Ingo Molnar: new-context balancing, 2.6.5-rc3-mm1. (March 31, 2004)

Device drivers

• Robert Schwebel: RNDIS Gadget Driver. (March 26, 2004)

• Len Brown: ACPI for 2.6. (March 28, 2004)

• Jeff Garzik: libata update. (March 28, 2004)

• Jeff Garzik: libata update. (March 31, 2004)

• Jeff Garzik: speed up SATA. (March 28, 2004)

• Mike Christie: iSCSI transport class. (March 29, 2004)

• Manish Kumar Bhojasia: Updated iscsi driver 4.0.1.3. (March 31, 2004)

• Jaroslav Kysela: ALSA update - 1.0.4rc2. (March 31, 2004)

• Justin Cormack: libata transport attributes. (March 31, 2004)

Filesystems and block I/O

• Matt Miller: 2.6: fdmap 0.2. (March 25, 2004)

• Justin T. Gibbs: "Enhanced" MD version 0.8.0 now available. (March 25, 2004)

• Nikita Danilov: new reiser4 snapshot released.. (March 26, 2004)

• Nigel Kukard: DVD+-RW support for 2.6.x. (March 29, 2004)

• Mingming Cao: Reservation based ext3 preallocation. (March 30, 2004)

Janitorial

• Sridhar Samudrala: [PATCH] Consolidate multiple implementations of jiffies-msecs conversions. (March 29, 2004)

Memory management

• Andy Whitcroft: [0/6] HUGETLB memory commitment. (March 25, 2004)

• Andy Whitcroft: [1/6] HUGETLB memory commitment. (March 25, 2004)

• Andy Whitcroft: [2/6] HUGETLB memory commitment. (March 25, 2004)

• Andy Whitcroft: [3/6] HUGETLB memory commitment. (March 25, 2004)

• Andy Whitcroft: [4/6] HUGETLB memory commitment. (March 25, 2004)

• Andy Whitcroft: [5/6] HUGETLB memory commitment. (March 25, 2004)

• Andy Whitcroft: [6/6] HUGETLB memory commitment. (March 25, 2004)

• Hugh Dickins: anobjrmap 8/6 unmap nonlinear. (March 26, 2004)

Networking

• Catalin BOIE: sch_dup - duplicate packet queue discipline [2.6]. (March 29, 2004)

• Andi Kleen: Avoid gettimeofday when not needed. (March 31, 2004)

Architecture-specific

• Hyok S. Choi: 2.6.4-hsc1 patch for MMU-less ARM is available.. (March 28, 2004)

Miscellaneous

• Greg KH: udev 023 release. (March 25, 2004)

• Greg KH: 2004-03-29 release of hotplug scripts. (March 30, 2004)

• Ananth N Mavinakayanahalli: Libsysfs v1.1.0 release. (March 31, 2004)

• Mariusz Mazur: linux-libc-headers 2.6.4.0. (March 28, 2004)

Page editor: Jonathan Corbet

Distributions

News and Editorials

New Linux Distributions: A Short List of Keepers

Several new Linux distributions are born every week. Are any of these new projects worth your attention? Here is a short list of some of the more interesting among them, in no particular order.

SystemRescueCd. SystemRescueCd could be thought of as a clone of Partition Magic, only a lot more powerful, and, at $0.00, a lot cheaper. The most interesting feature of the bootable CD is its point-and-click partitioning functionality, courtesy of QTParted and PartGUI. The QtEmbedded toolkit ensures that XFree86 is not necessary to get the graphical partitioning tools running. The two tools are capable of creating and resizing FAT/FAT32, NTFS, ext2/3 and ReiserFS partitions and creating JFS and XFS partitions (resizing of JFS and XFS partitions is not yet supported). The CD also includes a number of other useful tools, such as Partimage (a Ghost/DriveImage clone), several file system and archiving applications, a memory testing utility and other software. The ISO is only around 100MB in size and a PowerPC edition is also available. SystemRescueCd is an excellent distribution to keep around and use whenever you need to (re)partition a hard disk or perform basic rescue tasks.

Puppy Linux. Puppy Linux is an independently developed Linux mini distribution. It is unusual in that it comes in 6 different variants, depending on the boot media. Puppy Linux can be booted from a CD, a USB memory device, a Zip drive, a floppy disk, hard disk, as well as a thin client off a network drive. Whatever your boot device, the entire distribution loads into a 48 - 54MB ramdisk, ready for use. Creating a desired boot device is as simple as following a text-mode wizard launched from the main desktop menu, which, incidentally, is based on Fvwm'95. Puppy Linux is remarkably full-featured for such a small product: it includes a variety of applications for a home user, including two web browsers, a mail, FTP and IRC client, basic word processing, spreadsheet and home finance applications, and a Samba client. A considerable range of multimedia applications is available too; this includes several media players, a CD burning application, an image viewer, and a scanner tool, just to mention a few. All the usual Linux utilities are present as well. Puppy Linux is definitely worth the download just to see how much useful software one can fit onto a 45MB CD! It can also serve as the perfect operating system for that old laptop that has been sitting idly in your cupboard for years!

INSERT. As Knoppix variants go, the Inside Security Rescue Toolkit, or INSERT for short, is one of the more useful distributions. The 50MB business card size CD does not come with many applications, but its ability to write to NTFS partitions, together with the presence of the GPL-ed Clam AntiVirus virus scanner on the CD means that INSERT is a great recovery and virus removal tool for infected Windows machines. It also provides many network analysis, disaster recovery and computer forensics tools, in addition to some general applications. Once booted into Fluxbox, users can download and install Mozilla Firefox for enhanced Internet surfing. Virus signatures can be updated with a single click. Because of its portability, INSERT is a worthy addition to your rescue toolkit, especially if you are unfortunate enough to having to deal with Microsoft systems in your line of work.

PCLinuxOS and MEPIS Linux. Both PCLinuxOS and MEPIS Linux have been getting good reviews and positive feedback from users. What is their secret? Simple: both come pre-configured with a variety of non-free, but essential applications, such as the NVIDIA driver, Flash plugin, Java, RealPlayer and others, and both can be painlessly updated to new versions with apt-get. Granted, these are hardly breathtaking ideas, yet they are a welcome change when compared to all major distributions, none of which integrates these useful applications into their products. PCLinuxOS, initially based on Mandrake Linux, is developed by "Texstar", a well-known personality in the Mandrake user community, with years of experience in building up-to-date RPM packages for various Mandrake releases. MEPIS Linux is based on (and is fully compatible with) Debian. Both distributions can be used as live CDs, thus providing an added value as demonstration tools. Highly recommended; either of them is perfectly suitable for new Linux users as a painless introduction to the world of Free Software.

Rubyx. Rubyx is a new, independently developed source-based distribution. As the name suggests, the distribution's package management tool is programmed in Ruby, an interpreted object-oriented scripting language developed in Japan. If you've ever installed Gentoo, you will be amazed at how much simpler, albeit not less time-consuming, the Rubyx installation process is: all that needs to be done is download a small script, create a new partition for the distribution, and run a single command from within your existing Linux installation. The script will then download, compile and install all the required base applications onto the new partition. The download process uses a custom BitTorrent-like peer-to-peer file sharing utility called WhiteWater. The project is still new and the number of available applications is not nearly as vast as the ones available for Gentoo, but the distribution should be of interest to those users who enjoy tinkering on their spare partitions, or to those who enjoy the power of Ruby.

Comments (3 posted)

Distribution News

Fedora Core 2 Test 2 available

The second test release of Fedora Core 2 has been announced, right on schedule. This version supports the x86_64 architecture along with i386. Click below for the announcement and a list of mirrors.

Full Story (comments: 9)

Debian GNU/Linux

The Debian Weekly News for March 30, 2004 is out. This week's issue looks the next update of Debian GNU/Linux 3.0, with a discussion about the Linux Standard Base; the second call for votes in the DPL elections; discussion on the editorial amendments to the Social Contract; will GNOME 2.6 make it into Sarge?; and more.

Martin Schulze reports on the progress of the third revision of the current stable Debian distribution (woody).

The second call for votes is out for the Debian Project Leader Election. Debian developers have until April 10 to get their votes counted.

Colin Watson has a status report on the debian-installer, now at beta3. "If you have some spare time and want to help Debian release, working on debian-installer should be your number one priority. Without an installer, we don't release; architectures without a working d-i won't be candidates for releasing."

Comments (none posted)

Gentoo Weekly Newsletter - Volume 3, Issue 13

Here is the Gentoo Weekly Newsletter for the week of March 29, 2004. This week's edition covers supporting multiple MTAs with a mailwrapper and other topics.

Full Story (comments: none)

Lycoris Desktop/LX: Authorized User Guide Available

CFG Press and Lycoris have announced the immediate availability of /Lycoris Desktop/LX: Authorized User Guide/, an in-depth guide to the desktop Linux operating system.

Full Story (comments: none)

MontaVista Linux Consumer Electronics Edition

MontaVista Software and ARM have announced that MontaVista Linux Consumer Electronics Edition will support the ARM1136J-S and ARM1136JF-S processor cores.

Full Story (comments: none)

TimeSys Embedded Linux RTOS

TimeSys Corp. has announced a Linux RTOS, Software Development Kit (SDK) and TimeStorm tools for Pentek's Model 4294 VME Board.

Comments (none posted)

Wal-Mart sells PCs with Sun's Linux (News.com)

News.com reports that Sun's Java Desktop System has joined the ranks of "Linux Inside" computers available at California Wal-Mart stores. "The PCs join several other Microtel Linux models that Wal-Mart has sold, including models with Novell's SuSE Linux, in addition to Lycoris and Lindows."

Comments (none posted)

Interesting New Ports (O'ReillyNet)

Dru Lavigne looks at some new packages for FreeBSD in this O'Reilly article. "In today's article, I'd like to demonstrate some useful utilities that recently arrived in the ports collection. I usually discover these from FreshPorts, which keeps statistics on which ports have been added in the last 24 hours, 48 hours, week, fortnight, and month."

Comments (none posted)

Mandrakelinux EOL and Modified Support for Products

MandrakeSoft has sent out a reminder that support has ended for Mandrakelinux 9.0, and Mandrakelinux 9.1 (x86 and ppc) will receive only "base" or critical updates starting immediately.

Full Story (comments: none)

Fedora Perl update

Fedora has a perl update that resolves dependency issues regarding Fedora Core 1 on AMD64 systems. No changes to Fedora Core 1 i386 besides version increment.

Full Story (comments: none)

Slackware Linux

Slackware has new versions of clisp, distcc, j2sdk, slacktrack, slackpkg, php, reiserfsprogs, madplay, cvs, strace, gnumeric, tcpdump and more; plus some bug fixes available for Slackware-current. See the changelog for complete details.

Comments (none posted)

Trustix Secure Linux

Trustix has a couple of bug fixes available for TSL 2.1:

• this advisory covers miscellaneous bugs in fcron, crontabs, stunnel, kernel and ntp.
• multiple bugs have been fixed in xinetd, dev and filesystem

Comments (none posted)

New Distributions

Cobind Desktop

Cobind Desktop is based on Fedora Core Linux, stripped into a lightweight desktop environment designed with the average user in mind. Using XFce and Nautilus, it offers a Linux distribution that crosses into the mass technology market by giving typical users a fast and familiar desktop experience.

Flexbeta reviews Cobind Desktop and includes a mini-interview with the developers.

Comments (none posted)

Minor distribution updates

ALT Linux

ALT Linux has released v2.3 Compact. "Changes: ALT Linux Compact is further development of the Junior branch towards an OEM product which focuses on providing a consistent toolset for common tasks while Junior maintains more versatility. This version adds the latest hardware compatibility, improved usability (e.g., USB Flash automounting), and updated software (with more than 3Gb of packages in Contribs)."

Comments (none posted)

Astaro Security Linux

Astaro Security Linux has released beta v4.770 with major bugfixes. "Changes: This beta snapshot includes an ASL V4 configuration import, dynamic update of the network definition type "IPSec User Group", IPsec tunnels with DES encryption, new PPPoE/DSL MTU settings, a Factory Reset option, improvements for remote syslog support, for the proxy content manager, and for uplink failover, and bugfixes for Alias interfaces for standard/VLAN interfaces. Most reporting capabilities are now finished and more Online Help is included. The performance has been tuned and a lot of small bugfixes and improvements built in."

Comments (none posted)

Aurox Linux

Aurox Linux has released Aurox Live v1.4.2 with major feature enhancements. "Changes: This release is based on Aurox 9.3 and supports Polish, German, French, and Spanish. The KDE and Fluxbox graphical environments are now included. Internet connectivity can now be achieved using SmartLink-compatible winmodems (such as some Intel devices). Support for ext2, ext3, VFAT, and NTFS partitions was included, and qtparted, multimedia applications, Wine, and Mozilla with mozplugger were added. NVidia 3D drivers (5336) and OpenGL were fixed, and USB keyboards and ACPI are now issupported."

Comments (none posted)

blueflops

blueflops has released v2.0.2 with minor feature enhancements. "Changes: This release uses kernel 2.6.4 with support for all PCMCIA ethernet drivers compiled in. There are now 79 ethernet drivers included. tirc, a new, small IRC client was included, and syslinux now uses the "-s" option, which may fix some booting problems. The "links" colors were changed to nicer ones, and the browser font quality (hopefully not noticable) and size were reduced. Some accented characters were also left out. The name of the bootable image for use with CDs was changed, and there is no longer a help screen in e3."

Comments (none posted)

Buffalo Linux

Buffalo Linux has released v1.1.6 with major feature enhancements. "Changes: Highligts in this release include XFree86-4.4.0 and a DMA-enabled 2.6.4 kernel. ALSA was updated to 1.0.3, and openssl was updated to 0.9.7d. A 63MB upgrade (from 1.1.5 to 1.1.6) is available for download. In the "extra_packages" directory, a bundle install package, "gnome-2.4-buff-1.bz2", was added, and is not included in the CD image."

Comments (none posted)

CDLinux

CDLinux has released alpha v0.5.3 with minor feature enhancements. "Changes: This release has been upgraded to XFree86-4.4.0, has adopted XFCE-4.0.4 as the default WM, and has many other bugfixes/upgrades."

Comments (none posted)

Feather Linux

Feather Linux has released v0.3.9 with minor feature enhancements. "Changes: In this version, emelfm now runs as root. smb.conf and firewall config files are writable from the CD. index, recoverdm, mtr, and wmapm were added. The --passive-ftp option was added to scripts. There are small changes to the HD install script. A Synaptic script was added (experimental). There are small changes to the Getting Started HOWTO. This release also fixes ABS size, tcc, and keymap selection, makes xterm colours match up, is able to start SSHd, NFS services, and the Monkey Web server from the boot line (e.g. knoppix monkey), adds APM support, updates wman, changes restoration system (now specify files to restore in restore.list), and makes sudo work properly on HD installs."

Comments (none posted)

Hakin9 Live

Hakin9 Live has released v1.5.0 with major feature enhancements. "Changes: This version adds user mode Linux, enhances documentation, and adds more tutorials."

Comments (none posted)

Linux LiveCD

Linux LiveCD has released v1.9.2 with minor feature enhancements. "Changes: This release adds hostap driver version 0.1.3 and a Sierra Wireless AirCard 710/750 Driver."

Comments (none posted)

MoviX

MoviX has released v0.8.2 with minor feature enhancements. "Changes: Translations have been added or upgraded for Chinese, French, German, Italian, Polish, Portuguese, Russian, Spanish, and Turkish. An FTP server has been added to let users easily upload files to a MoviX box. Pre-made international ISOs are available."

Comments (none posted)

PLD Live CD

PLD Live CD has released v0.586 with major feature enhancements. "Changes: The CD is now based on the official PLD Linux RPMs repository. (It was previously using a private set of packages.) It was optimized for i586, and can be booted on a system with 48 MB RAM. A lot of bugs were fixed. PCMCIA devices are now autodetected, and the home directory can be mounted at boot up. Scripts for remastering the LiveCD are included on the CD. Most of the packages were updated (including KDE 3.2.0 and kernel 2.6.4)."

Comments (none posted)

ThinTUX

ThinTUX has released v0.13 with major bugfixes. "Changes: This release updates rdesktop to 1.3.1, adds a video card driver for CLE266 (VIA mini-ITX M6000/9000), and updates the boot images and the installation guide."

Comments (none posted)

Page editor: Rebecca Sobol

Development

Getting ready for the GIMP 2.0

The GNU Image Manipulation Program, known better by its acronym "GIMP", reached a rare but welcome milestone recently - a major release. The 2.0 release has been in development since late December of 2000, and this is only the second major release for a popular project that is pushing 9 years old.

There are vast improvements to the GIMP in all areas of the application, too many to cover in any one article. In this article we'll look only briefly at the features with the biggest impact on day-to-day work.

The User Interface

Integrating the latest in GTK+ 2.4 enhancements, the GIMP 2.0 now provides improved cross-platform support for both Windows and Mac OS X. This will impact the GIMP developers more than users. It will bring in far more users with less technical background, these new users may not be as easy to support as the typical Linux user. But it may also bring in fresh development talent, and that is always a good thing.

GTK+ 2.4 provides the GIMP with dockable dialogs, allowing users to customize their desktop for the best use of space. Users can drag and drop dialog titles into a dock, and the dialog will then be added as a new tab in that dock. Some dialogs serve multiple purposes, such as the Tool Options dialog which changes when the user selects a different Toolbox tool. When docked, this dialog's tab will have the same icon as its Toolbox icon, making it easy to determine what tool is currently active.

Another big improvement is the menu layout. Menus now adorn Canvas windows by default, and the menu contents have been modified to be more consistent with their use. Color tools like Curves and Levels, for example, are now in the Layers menu, since they work on the current layer. Menus can still be accessed with the old right-mouse-click in a Canvas menu, or by using the Menu arrow in the upper left side of the Canvas window. Better yet - you can hide the menu bar on a Canvas-by-Canvas basis. This is true even for the new full screen mode, where the menu can be enabled or disabled from view, separate from all other Canvas windows.

Selection tools now offer modal operation, allowing the user to specifically set the mode of operation for the current selection. This means that a button can now be pressed where previously you had to understand the nuances of Shift-Ctrl-Alt-Mouse-click combinations. For old timers, the old method still works.

All paint tools now offer independent brush and gradient options, which means you can configure a different brush for each of the paint tools. An interesting addition to this is that the brush and gradients can be selected using a mouse wheel from within the Tool Options dialog.

Text Management

The 1.2 version of GIMP offered multiple text management tools, a confusing and not always editable solution. The GIMP 2.0 integrates most of the features of the old text management tools into a single interface, and adds font previews as well. Text editing is performed in a small preview window, and changes are reflected immediately in the Canvas window. Editing is done by selecting the Text layer - which is now more easily identifiable by a Text icon in the Layers dialog. Multi-line text is possible, including the proper handling of newlines.

The downside here is that font previews can consume memory resources, especially if you have hundreds or thousands of fonts. The previews can definitely slow your system down, especially when the GIMP is first started. Unfortunately there is no configuration option to turn off the previews, so every time you work with the font selection window, things can slow down considerably.

Also, features such as kerning are not yet supported. The FreeType plugin from the 1.2 version is not part of the core distribution, and not all of its features - including slant and rotation options for text - are supported.

Scripting changes

The default scripting language remains Script-FU, a derivative of the Scheme language. While powerful because of its integrated nature, Script-FU is far from a friendly language.

In the GIMP 1.2 many users turned to the GIMP Perl extension which allowed Perl scripts to be written for the application. GIMP Perl is not distributed directly with the GIMP 2.0 however, and it has been replaced with Python. That said, GIMP Perl will be available as a add-on feature in a separate package (probably to be released sometime after the 2.0 core).

Along with GIMP Perl, the GAP animation tools are also being distributed in their own package. This isn't something new for the GIMP - remember that GTK+ found its own way after the GIMP, and so has the very powerful GIMP Print tool set.

What's Missing

Color management, plain and simple. The goal to integrate GEGL, a low level library that would add deep paint (i.e. multi-byte channels) to the GIMP, wasn't met with this release, primarily because of the need to clean up the core software first. This will help with integration with GEGL as well as many other feature enhancements down the road.

While deep paint and color management is lacking, help is definitely on its way. Financial support is being made to the GEGL developers by South African venture capitalist Mark Shuttleworth as a way to bootstrap important open source projects. Talk on the GIMP developers' list indicates that GEGL will be moving forward quickly this year. GEGL may see final integration by early fall, though that depends on pending GIMP development as much as GEGL development.

Side stepping this issue one last time (we hope), there is little left that is missing from the GIMP. With a recent pre-release of the GIMP Perl extension, users can expect to make use of their Perl scripts again, though some modifications may be required. The developers also removed the requirement that images should be manually flattened or merged prior to saving to a non-layered format, and now manage that task directly, only prompting the user for final approval. This minor step can end up saving a lot of time and frustration, not to mention saving a few undo levels.

Summary

There is much to be gained from the 2.0 release by users, and there is little reason to not consider upgrading. Most distributions are likely to integrate this version of the GIMP into their next public release, but this could take months, depending on release cycles for the distributions. So, consider pulling the source and building it yourself if you can, or perhaps check the apt and RPM repositories periodically to see if the application has been packaged for you. Any way you get it, the GIMP 2.0 is definitely worth the effort.

Comments (6 posted)

System Applications

Audio Projects

ALSA 1.0.4rc2 driver release

Version 1.0.4rc2 of the ALSA sound driver has been released with the following comment: "report compilation problems, please".

Comments (none posted)

AudioSlack is back on track!!

AudioSlack, a Slackware-based Linux distribution geared toward audio applications, is under active development again. "Well, after several months, I am back again, packaging software for our favourite Linux distribution right? :) Updates are now available for the kernel, ALSA, and a couple of sound libraries."

Comments (none posted)

Database Software

libgdamm 1.3.1 released

Version 1.3.1 of libgdamm has been released. "libgdamm provides C++ wrappers for libgda for use with gtkmm. libgda is a generic database API with several database provider implementations. This is still an early unused version, to try to get some attention from interested hackers. If you'd like this stuff to work, you should try to create working examples and submit patches."

Full Story (comments: none)

PostgreSQL Weekly News

The March 29, 2004 edition of the PostgreSQL Weekly News is online.

Full Story (comments: none)

Networking Tools

OSSIM 0.9.2 released - major bugfixes (SourceForge)

Version 0.9.2 of OSSIM is available. "OSSIM aims to unify network monitoring, security, correlation and qualification in one single tool. Using Snort, Acid, mrtg, NTOP, OpenNMS, nmap, nessus and rrdtool we want the user to have full control over every network or security aspect. Ossim 0.9.2 is out, another bugfix release."

Comments (none posted)

Peer to Peer

LibBT: BitTorrent C Library release 1.0 (SourceForge)

Version 1.0 of LibBT, a C library for the BitTorrent peer-to-peer protocol, has been announced. "Version 1.0 is capable of downloading multiple torrents simultaneously, and can download the torrent from a URL before starting the P2P transfer."

Comments (none posted)

Printing

LinuxPrinting.org additions

The latest additions on LinuxPrinting.org include new support for the Epson Stylus Photo R series printers, Epson multi-function devices, and the Lexmark X125.

Comments (none posted)

Web Site Development

Blumberjack 0.0.0.2 pre alpha 1 is available

Version 0.0.0.2 pre alpha 1 "He's a Blumberjack and He's OK", of Blumberjack, a Python-based Blogging utility, is out.

Full Story (comments: none)

Using a Request Filter to Limit the Load on Web Applications (O'ReillyNet)

Ivelin Ivanov and Kevin Chipalowsky show how to throttle requests coming into a web server in an O'Reilly article. "When your site is slow, users keep clicking and making new requests, which only makes things worse. Kevin Chipalowsky and Ivelin Ivanov present a servlet filter that limits the stress a single user can put on your Java web application."

Comments (none posted)

jCV 1.0 Released

Version 1.0 of jCV, a web-based J2EE resume creation and administration tool, is available.

Full Story (comments: none)

Moodle 1.2.1 is released (SourceForge)

Version 1.2.1 of Moodle, a PHP-based online course application, has been released. "This maintenance release fixes a few bugs discovered since Moodle 1.2. Upgrading is recommended."

Comments (none posted)

Miscellaneous

StinkFoot 1.0 is out

Version 1.0 of StinkFoot, a Python boot utility, has been released.

Full Story (comments: none)

GPSBabel 1.2.2 released (SourceForge)

Version 1.2.2 of GPSBabel has been released. "GPSBabel reads and writes GPS waypoints in a variety of forms. Backends include GPX, Magellan and Garmin serial protocols, Geocaching.com *.loc, GPSMan, Garmin Mapsource *.mps, Magellan Mapsend *.wpt, and many others. This release adds support for a few new formats, a few new features, and a whole lotta minor fixes."

Comments (none posted)

Desktop Applications

Audio Applications

Grip 3.1.8 (development) released

Development version 3.1.8 of Grip, a CD Ripping utility for GNOME, is available. Change information is in the source code.

Comments (none posted)

Rhythmbox 0.6.10 released

Version 0.6.10 of Rhythmbox, an integrated music management application, is available. This release features several bug fixes.

Full Story (comments: none)

WaveSurfer 1.6.3 released

Version 1.6.3 of WaveSurfer, an audio editor, is out with bug fixes, new keyboard bindings, and a Python binding. See the Change History document for details.

Comments (none posted)

Data Visualization

GENIUS 0.6.0 released

Version 0.6.0 of GENIUS, a calculator program with plotting capabilities, has been announced.

Full Story (comments: none)

PyX 0.6 was released

Version 0.6 of PyX, the Python graphics package is available. See the change log file for details on what's new.

Comments (none posted)

Desktop Environments

GNOME 2.6.0 is out

At last: the announcement for GNOME 2.6.0 has gone out. There is no end of new stuff in this release; click below for the announcement or see the release notes for the details.

Full Story (comments: none)

GNOME CPU Frequency Scaling Monitor 0.1.2

Version 0.1.2 of the GNOME CPU Frequency Scaling Monitor is available.

Full Story (comments: none)

KDE-CVS-Digest (KDE.News)

The March 26, 2004 edition of the KDE CVS-Digest is out. Here's the content summary: "Quanta goes KMDI. KMail's IMAP support is optimized. Konqueror gains type-ahead find. amaroK has a new visualization scheme. Start of KDOM ECMA support. Continued work on certificate handling in KMail. And the usual bugfixes."

Comments (none posted)

Electronics

Covered 20040325 released

Version 20040325 of Covered, a Verilog code coverage analysis tool, is out. "This release contains lots of bug fixes and also contains the initial version of the Covered report viewing GUI (line coverage only)."

Comments (none posted)

Graphics

Ayam 1.7 stable released

Stable version 1.7 of Ayam, a 3D modeling package, is out. See the Changes document for details.

Comments (none posted)

GUI Packages

FLU 2.10 released

Version 2.1.0 of FLU, the FLTK Utility Widgets, has been announced. Lots of changes are included.

Comments (none posted)

gob2 2.07 released

Version 2.0.7 of gob2 has been released. "So what is this gob thing? Well besides being the cure for cancer, it also generates GObjects (or GTK+ objects)."

Full Story (comments: none)

gtkmm 2.3.7 and glibmm 2.3.8 released

Version 2.3.7 of gtkmm, a C++ interface to GTK+, and version 2.3.8 of the associated glibmm, are available.

Full Story (comments: none)

Java-GNOME 2.5.7 beta 2

Version 2.5.7 beta 2 of Java-GNOME, the GNOME-Java binding, is available. "Java-GNOME is API Frozen and we are approaching our official 2.6 release date."

Full Story (comments: none)

PyGTK 2.3.90 unstable available

Version 2.3.90 unstable of PyGTK, the Python bindings to GTK, is out with a number of new features, documentation updates, and bug fixes.

Full Story (comments: none)

Imaging Applications

Pre-Releases of Perl bindings, Help pages and GAP for GIMP 2.0

In addition to the release of version 2.0 of the GIMP this week, a few ancilliary GIMP projects have also been announced. "Pre-releases of the GIMP Perl bindings, the new help pages and the GIMP Animation Package are now available at ftp.gimp.org and its mirror sites. These pre-releases are all updated to work with GIMP 2.0."

Comments (none posted)

Interoperability

Wine Traffic

The March 26, 2004 edition of Wine Traffic is online. Take a look for news from the Wine community.

Comments (none posted)

Medical Applications

OpenEMR 2.5.2 with HL7 (LinuxMedNews)

Version 2.5.2 of OpenEMR, a medical record system, has been announced. "2.5.2 includes support for HL7, which includes the ability to parse HL7 code." Other bug fixes and enhancements are included.

Comments (none posted)

FreeMED 0.7.0 Beta 3 Released (LinuxMedNews)

Version 0.7.0 Beta 3 of FreeMED, a web-based Electronic Medical Record and Practice Management system, is out. "It is the third in a series of beta releases in preparation for the final 0.7.0 release. This release consists mostly of packaging fixes and user contributed bugfixes, as well as more specialized reports. All users who are currently testing 0.7.0b2 should upgrade to this release."

Comments (none posted)

LiveOIO-1.0.9 with Advanced Form Controls and Data Import (LinuxMedNews)

Version 1.0.9 of LiveOIO has been announced on LinuxMedNews. "This is an upgrade release of the Open Infrastructure for Outcomes (OIO) server software, packaged on a remastered Knoppix 3.3 2004/02/16. This release contains both new features and bug fix."

Comments (none posted)

Multimedia

New Release of Kaffeine Media Player (KDE.News)

Version 0.4.2 of Kaffeine, a xine-based media player for KDE, is available. "For the latest release the emphasis has been put on stability rather than on the implementation of new features. Some very annoying bugs where fixed, including some problems with control panel, various crashes and some interoperability bugs with KDE 3.2. Despite the emphasis on stability there are also some new features such as a new setup dialog, better embedding in Konqueror and support for multiple external subtitle files that can be changed on the fly while playing."

Comments (none posted)

gst-python 0.7.90 is out

Version 0.7.90 of gst-python, the Python bindings to GStreamer, are available. This release targets GStreamer 0.8, it features audio and video playing via GstPlay, among other things.

Full Story (comments: none)

Music Applications

liblo 0.5 released

Version 0.5 of liblo, an OSC (Open Sound Control) implementation written in C, is available with bug fixes, better documentation and examples, and lots more. The OpenSound Control: "is a protocol for communication among computers, sound synthesizers, and other multimedia devices that is optimized for modern networking technology."

Full Story (comments: none)

Rosegarden-4 0.9.7 released

Version 0.9.7 of Rosegarden-4, an audio and MIDI sequencer and score editor for Linux, is available. "The main focus of this release is to introduce a new, more accurate and efficient audio layer with a mixer window, basic internal routing capabilities, more complete plugin support, and support for the JACK transport API."

Full Story (comments: none)

Office Applications

Gnumeric 1.3.0 released

Version 1.3.0 of the Gnumeric spreadsheet is out. This is a development release which incorporates a number of new features, including a GTK 2.4 port, bubble plots, error bars, radar plots, the beginnings of rich text editing in cells, a new file selector, and more.

Full Story (comments: none)

Office Suites

OpenOffice.org 1.1.1 available

OpenOffice.org 1.1.1 has been released. This version includes PDF export improvements, better font handling, better import/export filters, and the "DicOOo AutoPilot," which can go out and get spelling, hyphenation, and thesaurus files for numerous languages.

Full Story (comments: 7)

OpenOffice.org Newsletter

The March, 2004 edition of the OpenOffice.org Newsletter has been published.

Full Story (comments: none)

PDA Software

Guikachu 1.3.8: GNOME Resource editor for PalmOS projects

Development release 1.3.8 of Guikachu is available. "Guikachu is a GNOME application for graphical editing of resource files for PalmOS-based pocket computers. The user interface is modelled after Glade, the GNOME UI builder."

Full Story (comments: none)

Science

GeoTool 2.0-B3 released (SourceForge)

Version 2.0-B3 of GeoTool, a Java-based library for developing OpenGIS applications, has been announced. "As part of a new release schedule the GeoTools project will now be making regular compiled builds available. After some teething problems with B2 it looks like the process is ready to go live with B3. This is the first release of GeoTools2 to contain gui components, and whilst they are still in active development there is at least something for developers interested in the client side development to start playing with."

Comments (none posted)

Web Browsers

Epiphany 1.2.2 released

Version 1.2.2 of Epiphany, a web browser for GNOME, is out. This release features a number of updated translations.

Full Story (comments: none)

Epiphany Extensions 0.8.1 released

Version 0.8.1 of the Epiphany Extensions are available with more updated translations.

Full Story (comments: none)

Nvu 0.2 Released (MozillaZine)

Version 0.2 of Nvu, a web publishing application based on Mozilla Composer, has been released. "The main new feature in Nvu 0.2 is support for the creation, modification and utilisation of templates, preset pages that can include both editable and static elements. Version 0.2 also allows more CSS properties to be applied to pages and lets users to extract inline styles and make them into classes."

Comments (none posted)

Mozilla Links Newsletter

The March 30, 2004 Mozilla Links Newsletter is available. "Following our coverage of other Mozilla applications, this issue is focused in ChatZilla, an IRC client application. If it doesn't tell you much, let's say it allows a group of people to join in virtual rooms and freely talk in it or to a specific person."

Full Story (comments: none)

mozilla.org Status Update (MozillaZine)

The March 29, 2004 mozilla.org Status Update has been published. The content summary says: "It includes news on Mozilla 1.7 Beta, Nvu 0.2, crash bugs, a proposed certificate authority certificate policy, Mozilla Firefox branding, Negotiate Authentication and more."

Comments (none posted)

Independent Status Reports (MozillaZine)

The March 28, 2004 edition of the Independent Status Reports is available. The MozillaZine summary says: "The latest set of status reports includes updates from Link Toolbar, Feed Parser, CookieCuller, One Click, Email Vault for Mozilla (EVM) and Mozwho."

Comments (none posted)

Miscellaneous

gFTP 2.0.17 is out

Version 2.0.17 of gFTP, an ftp client, has been released with a long list of changes.

Full Story (comments: none)

Languages and Tools

C

Open source development using C99 (IBM developerWorks)

IBM's developerWorks has an article on the C99 standard by Peter Seebach. "What is C99? Who needs it? Is it available yet? Peter Seebach discusses the 1999 revision of the ISO C standard, with a focus on the availability of new features on Linux and BSD systems."

Comments (none posted)

Caml

Caml Weekly News

The March 23-30, 2004 edition of the Caml Weekly News has been published. Take a look for news from the Caml language community.

Full Story (comments: none)

New Caml software

The latest new software for the Caml language includes perl4caml: an interface for calling Perl code from OCaml, xmlr: bindings for the libxml xmlreader, and Confluence, a logic design language.

Comments (none posted)

Java

Fixing the Java Memory Model, Part 2 (IBM developerWorks)

Brian Goetz continues his series on the Java Memory Model with part two. "JSR 133, which has been active for nearly three years, has recently issued its public recommendation on what to do about the Java Memory Model (JMM). In Part 1 of this series, columnist Brian Goetz focused on some of the serious flaws that were found in the original JMM, which resulted in some surprisingly difficult semantics for concepts that were supposed to be simple. This month, he reveals how the semantics of volatile and final will change under the new JMM, changes that will bring their semantics in line with most developers' intuition."

Comments (none posted)

Lisp and Java (O'Reilly)

Dan Milstein does Lisp tricks with Java. "In this article, we're going to steal an idea from one of the most theft-worthy languages out there: Lisp. We're going to pick out one of its most useful features -- the ability to treat functions as data -- and talk about how to apply this feature, in a slightly different form, in Java."

Comments (none posted)

Lisp

SBCL 0.8.9 released

Version 0.8.9 of SBCL (Steel Bank Common Lisp) is out. "This version adds new and more general debugger extensions, supports new building options under SPARC/SunOS, and provides a number of optimizations."

Full Story (comments: none)

Perl

This Week on perl5-porters (use Perl)

The March 22-28, 2004 edition of This Week on perl5-porters has been published. Take a look for the latest Perl 5 news.

Comments (none posted)

This week on Perl 6

The March 21, 2004 edition of This week on Perl 6, which should perhaps be called Last week on Perl 6, is online. "Spring is sprung, the Equinoctal gales seem to have blown themselves out, I'm a proud step grandfather and life is generally grand. "So, what's been going on in perl6-internals?" I hear you ask. Let's find out shall we?"

Comments (none posted)

Making Dictionaries with Perl (O'Reilly)

Sean M. Burke explains how to create a dictionary with Perl. "When you woke up this morning, the last thing you are likely to have thought is "If only I had a dictionary!" But there are thousands of languages on Earth that many people want to learn, but they can't, because there are little or no materials to start with: no Pocket Mohawk-English Dictionary, no Cherokee Poetry Reader, no Everyday Otomi: Second Year. Only in the past few years have people realized that these languages are not just curiosities, but are basic indispensable, untranslatable parts of local cultures -- and they're disappearing in droves."

Comments (none posted)

PHP

PHP 4.3.5 released!

Version 4.3.5 of PHP has been released. "This is a bug fix release, without any new features or additions. It is by far the most stable release of PHP to date and it is recommended that all users upgrade to this release where possible. This release resolves over a hundred various bugs and problems with previous versions." More information is available in the Change Log.

Comments (1 posted)

PHP Weekly Summary for March 29, 2004

The PHP Weekly Summary for March 29, 2004 is out. Topics include: Constructor sequence, and studlyCaps again.

Comments (none posted)

Python

MostPopularPythonProjects

If you were wondering which Python-based projects are the most popular, take a look at Kevin Altis' MostPopularPythonProjects site. "This is my current summary list of the most popular Python projects, ranked roughly by the number of downloads per month, either actual or guesstimate based on mailing list subscribers." (found on the Daily Python-URL).

Comments (2 posted)

Python-dev Summary

The March 1-15, 2004 edition of the Python-dev Summary is out with the latest Python language news.

Full Story (comments: none)

Dr. Dobb's Python-URL!

Dr. Dobb's Python-URL! is out for March 24, 2004 with another large collection of Python language article links.

Full Story (comments: none)

PROTHON, a classless Python

A new pre-alpha release of Prothon has been released. "Ben Collins and I have developed a new interpreted object-oriented language very closely based on Python, that is Prototype-based, like Self ( http://research.sun.com/research/self/language.html) instead of class-based like Python."

Full Story (comments: none)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The March 29, 2004 edition of Dr. Dobb's Tcl-URL! is available with the latest Tcl/Tk article links.

Full Story (comments: none)

XML

Rik Hemsley: XAML versus Qt (KDE.News)

Rik Hemsley talks about previewing XAML using Qt. XAML is an XML file format that is used for describing GUIs. "An article on MSDN previewing XAML, a not-so-new idea by Microsoft, prompted me to try implementing the given example using Qt instead. It also prompted me to be a little scornful -- but don't let that fool you -- I'm rather pleased to see the company continuing to make life easier for us developers."

Comments (none posted)

UML, XMI, and code generation, Part 1 (IBM developerWorks)

Benoît Marchal shows how to design XML vocabularies with UML tools on IBM's developerWorks. "In this first article in a new series on UML and XML schema development, Benoît discusses the motivations for modeling XML schema through the use of UML. He also introduces XML Metadata Interchange (XMI) and sketches out a strategy for deriving XML schemas automatically from UML models."

Comments (none posted)

Tunneling Variables (O'Reilly)

Bob DuCharme explains parameter tunneling with XSLT on O'Reilly. "While coding for a large, complex stylesheet project at work last year, I wanted to reuse code that I had already written elsewhere in the same template rule. Like a good little programmer, I resisted the temptation to copy the old code and paste it in the location I was working on; instead, I moved the code to be shared into a named template and called the template rule from the two locations. And it didn't work."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Death to the Wizards! (OSViews)

Here's an OSViews editorial blasting software "wizards" and other user-friendly GUIs. "The software "wizard" is the single greatest obstacle to computer literacy since the Mac. The wizard's underlying assumption is that the user is incapable of learning how to perform a task and/or should be protected from certain decisions or information."

Comments (40 posted)

SCO Linux licensee has second thoughts on deal (InfoWorld)

According to this InfoWorld article, EV1Servers.Net CEO Robert Marsh isn't so hot on the "license" he bought from SCO anymore. "So how does Marsh feel about the deal nearly a month later? 'Would I do it again? No. I'll go on the record as saying that,' Marsh said. 'I certainly know a lot more today than I knew a month ago, in a lot of respects.'"

Comments (20 posted)

Marc Andreessen: "Linux Has Matured" (BusinessWeek)

BusinessWeek talks with Marc Andreessen about Linux. "Another key thing to remember is that everyone coming out of college is familiar with Linux. It has overwhelming market share in colleges and universities. In every computer science program I'm aware of, it's the default language people teach on. They like it because it's open-source, and you can look at how it really works. The reason that's important is because those kids leaving college will enter the workforce and bring those skills to their employers."

Comments (14 posted)

Trade Shows and Conferences

Want to "Go" to Novell's Brainshare and See Linus? (Groklaw)

Groklaw reports on Novell's Brainshare conference. "I got a real feel for what Novell is doing with SuSE Linux from this conference. They are making Linux easy enough for your mom. That includes the enterprise solutions. Wait until you see their patch demo. So much for retraining costs if you want to switch to GNU/Linux. You don't need retraining to know how to click on an icon. This is the end of Microsoft's FUD about TCO being higher if you switch to Linux, methinks, the lovely and tireless Ms. DiDio notwithstanding."

Comments (1 posted)

F/OSS and KDE in Africa (KDE.News)

KDE.News covers the African Source conference. "54 people from 15 African countries and 16 facilitators/helpers from outside Africa gathered in Okahandja, a small Namibian town, for African Source from 15th of March to 19th of March 2004. African Source was the first all African conference of Free Software/Open Source Software (F/OSS) developers."

Comments (none posted)

The SCO Problem

The GPL And The Legal Challenge To It (IT-Director)

Robin Bloor comments on the SCO case on IT-Director. "SCO could easily rectify any IP violation at once and this would not prejudice any legal position it has in respect of past violations against any legal entity. In the IT industry, source code and IP is quite frequently abused, but its abuse is protected by companies keeping their source code private (if a good deal of anecdotal information I have been given over the years is true). In contrast, the Open Source community is an honest breath of fresh air."

Comments (2 posted)

Companies

Linux move for Itanium (vnunet)

The semiconductor industry must be taking Linux fairly seriously these days, as indicated by this article on Vnunet. "Fujitsu Siemens Computers (FSC) has said it is working with Intel to customise the Itanium 64bit chip for an enterprise Linux server, due in 2006. The duo will add features such as instruction-retry now seen only in proprietary high-end Unix systems."

Comments (none posted)

Being Steve Ballmer: the view from inside (Mercury News)

Dan Gillmor channels Steve Ballmer's reaction to the EU antitrust ruling in this Mercury News column. "Besides, it looks like they might have left us a killer loophole. We can get 'reasonable remuneration' for any intellectual property we're forced to license. So maybe we can prevent the Linux people -- and all those other 'software should be free' communists who give away what they create -- from using or even seeing the programming interfaces that let them interoperate with our software. Your move, Torvalds."

Comments (12 posted)

Sun Opens Java Management Process (Wired)

Wired reports that Sun now plans to open up the management of Java. "To date, Sun has made all the decisions regarding the direction for Java. In a major change for the Palo Alto, California-based company, Sun is forming an executive committee that will include 16 members from other Java players. The committee, with executives from Oracle, IBM, and Novell, will decide which proposals for new specs are approved for development."

Comments (2 posted)

Linux Adoption

Switzerland approves new open source software strategy (Europa IDA)

The Swiss Confederation has adopted a new open source software strategy, according to this report. "Pointing out that the Swiss Federal Administration must base its software choices on grounds of interoperability and cost-effectiveness, and that open source software “stimulates competition in the software sector”, the strategic paper defines three priorities for the Federal OSS strategy. The strategic priorities are equality of treatment (both open source and proprietary software must be put on equal footing when evaluated or procured by the Federal administration), sharing of software (federal agencies should whenever appropriate share software developed in-house, according to a licence model similar to the OSS concept), and the implementation of pre-requirements for OSS adoption (federal authorities must work towards establishing certain pre-requirements for successful OSS implementation)." Thanks to Jeroen Baten.

Comments (9 posted)

Linux at Work

RIAA site intermittently available, now running Linux (Netcraft)

Netcraft reports that the RIAA web site is now running Linux after having problems with the MyDoom.F virus. "The Recording Industry Association of America (RIAA)'s site is now transiently available after an extended outage and now appears to be running Linux. Inevitably, this will lead to speculation that SCO might add the RIAA to the list of Linux using organizations currently receiving attention from its lawyers. Of course, the RIAA is itself well endowed with lawyers should it need to defend itself, and just yesterday announced the latest in its own series of lawsuits against Internet users it believes are improperly sharing copyrighted music files."

Comments (7 posted)

Legal

Lindows Judge Proposes MS Suspend Overseas Actions or Lose Permission to Appeal (Groklaw)

Groklaw covers the Lindows hearing in Seattle. "The Lindows hearing yesterday resulted in the judge in Seattle suggesting Microsoft should suspend its overseas legal pursuit of Lindows until the US case is settled, or he will withdraw his permission to let the company appeal his ruling against them in the US and they will have to go directly to trial."

Comments (1 posted)

Interviews

Torvalds: Open Source Keeps People Honest (TechWeb)

Information Week interviews Linus Torvalds. "I think the SCO case has made it clear that it's been very useful to have big commercial companies involved, because they do not just [do] marketing and customer support, but they also have lawyers and are able to fight the FUD on that side. So I think we've seen how well the symbiosis between commercial interests and the technical interests of open source can really work."

Comments (none posted)

The People Behind KDE: Till Adam (KDE.News)

KDE.News introduces the next interview in the 'People Behind KDE' series; KMail hacker Till Adam. "- How and when did you get involved in KDE? - About a year or so ago I sent some patches to the KMail list with stuff I missed when switching from mutt. They were warmly received and I kept fixing stuff I came across and adding small features. I got stuck pretty quickly, it's just too much fun."

Comments (none posted)

Reviews

Linux-based handheld debuts in India (News.com)

News.com looks at a new Linux-based PDA. "The Amida Simputer, originally developed as a "poor man's computer," is now being pitched as a device that can handle a wide range of business and personal-computing requirements. The Linux-powered handheld combines the functions of an organizer and an MP3 player and has handwriting recognition capabilities."

Comments (4 posted)

Can Kopete replace GAIM and XChat? (NewsForge)

NewsForge reviews Kopete, KDE's instant messaging and chat program. "Accounts and user identities are added through a simple "Wizard" utility that's about as easy to understand as any IM or IRC setup can possibly be. If you don't have an account on a particular network, the wizard even has links to the signup page of each one Kopete supports. I tested this by setting up an MSN messenger account, and immediately had the same access to this popular chat service as any Windows user. It took me less than five minutes to set up access for three IM services and three IRC networks. Another 10 minutes of experimenting with display settings, and I was 100% in business, with everything set to my taste -- and had strangers offering to chat with me through Yahoo Messenger, a service I hadn't used in at least two years."

Comments (11 posted)

Linux Kernel 2.6: the Future of Embedded Computing, Part I (Linux Journal)

The Linux Journal looks at how the 2.6 kernel supports embedded systems. "Linux 2.6 introduces many new features that make it an excellent operating system for embedded computing. Among these new features are enhanced real-time performance, easier porting to new computers, support for large memory models, support for microcontrollers and an improved I/O system."

Comments (7 posted)

Linux Kernel 2.6: the Future of Embedded Computing, Part II (Linux Journal)

Linux Journal continues looking at how the 2.6 kernel supports embedded systems. "Linux is easily the fastest growing operating system in the embedded world. The introduction of kernel 2.6 has boosted the use of Linux in real-time applications. It still does not come close to a real hard RTOS, and nursing such expectations is incorrect given the vast differences between the characteristics and requirements of general and real-time applications. But it can be expected that RTOSes with kernel 2.6 as the basic kernel now can compete with the biggies of the embedded world and offer the embedded developer community a reliable and free embedded operating system."

Comments (2 posted)

Port scanning and Nmap 3.5 (NewsForge)

Joe Barr examines the latest release of Nmap in a NewsForge article. "Inspired by the release of Nmap 3.5, the latest version of the award-winning network security tool, I've been exploring network security issues for a couple of weeks now. Nmap's major skill is port scanning -- learning which ports on a machine are "open" and what applications are using them. Sound network security planning dictates that you take a look at your network machines to see what the bad guys can see from outside."

The article also includes an interesting subtext entitled: Nmap terminates SCO's license.

Comments (none posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

LPI-US Launches National Training Partner Program

The Linux Professional Institute's United States Affiliate (LPI-US) has announced that The Training Camp has been approved to receive designation as a LPI-US Approved Training Partner (LATP).

Full Story (comments: none)

Legislative fun: the "PIRATE" act

Here is a press release from Senator Patrick Leahy on his sponsorship of the "protecting intellectual property rights against theft and expropriation" act in the Senate. This law would allow the federal government to get into the business of filing copyright infringement suits and set up a fund to pay for them. "Under current law, the Attorney General can only bring criminal copyright cases, which can be difficult to prosecute because, among other factors, they require a high standard of proof. The Leahy-Hatch bill would allow the Attorney General to file civil claims that could include damages and restitution without criminal penalties." Once upon a time, requiring a high standard of proof was considered to be a good thing.

Comments (15 posted)

Commercial announcements

Mandrakesoft Exits Bankruptcy

The Commerce Court has accepted Mandrakesoft's exit plan from 'redressement judiciaire' (Chapter 11 like protection). The plan was approved as proposed by the company and its court appointed administrator.

Full Story (comments: none)

DRLX 1.0 Ships; Simplifies Deployment of Linux-Based Embedded System Applications

Devicelogics has announced DRLX 1.0, a DR-DOS-based Linux loader that loads a complete Linux kernel while preserving DR-DOS in memory so that, upon Linux session completion, the system returns to DR-DOS.

Comments (6 posted)

Linux Thin Clients To Replace Sun In School Board

Systems Aligned Inc. has announced a project where Sun computers will be replaced by Linux boxes. "Selected for a pilot project to replace Sun Microsystems software and hardware, the Linux thin clients and servers will be used to lower hardware maintainence costs, take advantage of the thousands of open source applications available for Linux, and to ensure the student to computer ratio remains at near two to one."

Full Story (comments: none)

Mozilla Foundation Soliciting Proposals for Support Services (MozillaZine)

MozillaZine has posted this request for help with end user support. "The Mozilla Foundation is exploring offering additional end user support options, in addition or instead of the existing telephone support provided by DecisionOne. To this end, the Foundation is soliciting proposals from companies or community members who wish to be awarded contracts to provide these services. Submissions must be well thought out and shown to be viable."

Comments (none posted)

SOT donates source code worth over 1M Euro

Finland's SOT has converted a large project, the Pupesoft.com financial software, to open-source. "SOT has donated over 50,000 lines of source code to a financial software project. The code has taken over 10 work years to create, and represents more than a million euros worth of effort. The code will be freely available as a part of the pupesoft.com project and will be released under the GPL license."

Full Story (comments: none)

OSRM's open source risk management seminars

Open Source Risk Management, the company offering insurance against open source intellectual property risks, has announced a series of seminars across the U.S. on, presumably, why you need to buy their offerings. "Each one-day seminar will give attendees an introduction to Free and Open Source Software, the top five most important potential IP risks, Open Source- specific risks, and best practice protocols for mitigating those risks. Seminar directors will also provide an analysis of current litigation around Open Source software."

Comments (none posted)

The MPEG "Rights Expression Language"

A whole pile of companies has sent out a press release proclaiming the approval by the International Organization for Standardization of its first digital rights management standard. The "Rights Expression Language" (REL) is a mechanism which allows content providers to have (or at least specify) fine-grained control over what can be done with digital information. "This rich language will be used not only in the entertainment industry, but also by enterprises and individuals to enable the authorized distribution and persistent protection of valuable data and content in accordance with privacy and confidentiality requirements."

Comments (6 posted)

New Books

Larry Lessig's New Book - Free Online Version of "Free Culture" (Groklaw)

Groklaw has an announcement for the book Free Culture by Lawrence Lessig. The book is available for download in pdf format.

Comments (1 posted)

"Cascading Style Sheets: The Definitive Guide, 2nd Edition" Released by O'Reilly

O'Reilly has published the second edition of Cascading Style Sheets: The Definitive Guide by Eric A. Meyer.

Full Story (comments: none)

Resources

Mozilla Developer Day Slides for Firefox, Thunderbird and Advanced RDF Talks (MozillaZine)

MozillaZine reports on the availability of slides from the Mozilla Developer Day. "The Mozilla Firefox slides discuss the future of the standalone browser, while the Mozilla Thunderbird slides do much the same for the standalone email and newsgroups client. A set of slides on advanced RDF completes the trio."

Comments (none posted)

The LDP Weekly News

The March 31, 2004 edition of the Linux Documentation Project Weekly News is out with the latest new documentation releases.

Full Story (comments: none)

Contests and Awards

TPF Grant for 1st Quarter 2004 (use Perl)

The Perl Foundation has awarded $1000 to Simon Cozens. "The Perl Foundation is proud to announce the latest grant aimed at furthering development in Perl, Simon Cozens will receive $1000 to enhance Maypole. Maypole is a new Model-View-Controller (MVC) framework for web applications, similar to Java's Struts, but designed for minimal coding and maximal flexibility."

Comments (none posted)

Event Reports

The ongoing Novell PR flood

Novell continues to crank out the press releases from its "BrainShare" party:

• The company has announced a deal with HP whereby SUSE Linux will become HP's standard distribution for its desktop and laptop systems.

• The $50 million investment from IBM (announced at the same time as the SUSE purchase) has now been finalized.

• IBM and Novell have also announced a deal that lets IBM preload SUSE Linux on its entire server line.

Comments (none posted)

Some embedded Linux press releases

The Embedded Systems Conference is underway, resulting in the usual pile of press releases. Here's a few of the Linux-related ones:

• Axentra has announced a line of "server appliance systems," along the lines of the boxes Cobalt used to sell.
• Devicelogics has announced the availability of KDeBUG, a proprietary Linux kernel debugger.
• Kenati Technologies has announced the release of "NP Blox," an application development tool for embedded Linux systems.
• LynuxWorks announces a new embedded Java development environment and a real-time specification for Java.
• MontaVista has announced that its distribution is being used for parking lot fare collection systems made by the Thales Group; they have been deployed at the Paris Orly and Charles de Gaulle airports.
• MontaVista and DoubleWide Software have let it be known that DoubleWide's virtualization products work on MontaVista Linux.
• Openwave Systems and MontaVista have announced a partnership "to further develop the emerging ecosystem around advanced Linux- based phones."
• TimeSys has announced that its "TimeStorm" tool suite works with any embedded Linux distribution.

Comments (none posted)

PyCon DC 2004 coverage

David Goodger has posted his coverage of the PyCon DC 2004 event.

Comments (none posted)

Upcoming Events

A Linux-based "flash mob" supercomputer

On April 3, the University of San Francisco will be hosting "FlashMob 1," an attempt to bring together a large number of people with laptops and link them together into a supercomputer powerful enough to get onto the "top 500" list. To this end, each participant will be given a CD with a special-purpose, CD-based Linux distribution on it. Click below for the press release, or see the FlashMob Computing web site for more information.

Full Story (comments: 1)

LinuxWorld Malaysia and Singapore

Two new LinuxWorld Conference & Expo events have been announced. One will be held on May 11 and 12 in Kuala Lumpur, Malaysia, the other will take place in Singapore on May 25 and 26.

Full Story (comments: none)

COMDEX Las Vegas 2004

MediaLive has announced the dates for COMDEX Las Vegas 2004 (November 14 - November 18). The call for papers is open.

Comments (none posted)

Python UK Conference

The Python UK Conference will be held on April 16 and 17, 2004 in Oxford, England.

Full Story (comments: none)

Events: April 1 - May 27, 2004

Date	Event	Location
April 1, 2004	Embedded Systems Conference	(Moscone Center)San Francisco, CA
April 1 - 2, 2004	USENIX Conference on File and Storage Technologies(FAST '04)	(Grand Hyatt Hotel)San Francisco, CA
April 5 - 7, 2004	Samba eXPerience 2004	(Hotel Freizeit In)Göttingen, Germany
April 5 - 8, 2004	ClusterWorld Conference & Expo	(San Jose Convention Center)San Jose, California
April 13 - 15, 2004	Real World Linux 2004 Conference & Expo	(Metro Toronto Convention Centre)Toronto, Ontario, Canada
April 14 - 16, 2004	MySQL Users Conference and Expo 2004	(Peabody Hotel Orlando)Orlando, FL
April 14 - 17, 2004	ACCU Spring Conference 2004	(Randolph Hotel)Oxford, England
April 16 - 18, 2004	Penguicon 2.0	(Detroit Sheraton Novi Hotel)Novi, MI
April 16 - 17, 2004	Python UK Conference	(Randolph Hotel)Oxford, England
April 20 - 21, 2004	LinuxUser & Developer Expo	(Olympia)London, England
April 22 - 23, 2004	2004 Desktop Linux Summit	(Del Mar Fairgrounds)San Diego, California
April 26 - 27, 2004	Digital Media Project Traditional Rights and Usages Workshop	Los Angeles, CA
April 29 - May 2, 2004	2nd Linux Audio Developers Conference	(Institute for Music and Acoustics)Karlsruhe, Germany
May 3 - 5, 2004	International PHP Conference 2004 Spring Edition	Amsterdam, Netherlands
May 6 - 8, 2004	TheServerSide Java Symposium	(The Venetian)Las Vegas, NV
May 11 - 12, 2004	LinuxWorld Conference & Expo	(Hotel Istana)Kuala Lumpur, Malaysia
May 16 - 18, 2004	European Firebird Conference 2004	Fulda, Germany
May 17 - 20, 2004	Fifth LCI International Conference on Linux Clusters	(University of Texas)Austin, TX
May 17 - 19, 2004	Enterprise Software Summit	(The Palace Hotel)San Francisco, CA
May 17 - 20, 2004	Black Hat Briefings Europe 2004	(Grand Hotel Krasnapolsky)Amsterdam, the Netherlands
May 17 - 21, 2004	Apache Boot Camp	Atlanta, GA
May 20 - 22, 2004	Austrian Perl Workshop	Vienna, Austria
May 25 - 26, 2004	LinuxWorld Conference & Expo	(Suntec)Singapore
May 26 - June 6, 2004	DebConf4	Porto Alegre, Brazil
May 26 - 29, 2004	2nd International Symposium on Computer Music Modeling and Retrieval	Esbjerg, Denmark

Comments (none posted)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Miscellaneous

IPI: Has open source reached its limits?

The "Institute for Policy Innovation" has posted an "issue brief" trashing free software in just about every way it can. "For law firms and lawyers, open source represents a rich opportunity to benefit from the increased complexity of licensing and copyright agreements. Only lawyers benefit from this." One can only assume the author has not read many proprietary license agreements recently. (Thanks to Duncan Coutts).

Comments (16 posted)

Page editor: Forrest Cook