LWN.net Logo

LWN.net Weekly Edition for June 6, 2002

Fun with software patents

Much of this week's LWN front page has to do with software patents, and how to respond to them. Doubtless some people are tired of the topic, but it remains important. The shape of our free software systems in the future will, unfortunately, be much affected by software patents. It is important that we figure out how to deal with them.

Comments (3 posted)

Red Hat and software patents

Software companies worry about software patents; an infringement suit can, after all, ruin your whole day. Red Hat has decided that the best way to deal with the problem of software patents is to get into the game. So, the company has applied for (at least) two patents:

Both of these techniques show Ingo Molnar as the inventor. And where might one find the patented technology?

The embodiments of the present invention described are implemented in a computing platform based on the computer operating system commonly known as 'Linux' that is available as open source directly over the Internet. Linux is also available through various vendors who provide service and support for the Linux operating system. Among these vendors are Red Hat, Inc., of Research Triangle Park, N.C., the assignee of the present invention.

(This news was originally reported (in Italian) on FreeGo).

After letting people worry over the holiday weekend, Red Hat issued a statement of position on software patents. According to that statement, Red Hat's intent is defensive:

Red Hat has consistently taken the position that software patents generally impede innovation in software development and that software patents are inconsistent with open source/free software.... At the same time, we are forced to live in the world as it is, and that world currently permits software patents. A relatively small number of very large companies have amassed large numbers of software patents. We believe such massive software patent portfolios are ripe for misuse because of the questionable nature of many software patents generally and because of the high cost of patent litigation. One defense against such misuse is to develop a corresponding portfolio of software patents for defensive purposes. Many software companies, both open source and proprietary, pursue this strategy.

Red Hat, too, has decided to pursue that strategy; it has joined the software patent arms race by arming itself.

What do these patents mean for free software? According to Red Hat's position, not much; the statement includes a promise to not enforce any patent claims against software using an "approved" open source license. So the free software community can relax; Red Hat is simply trying to protect itself from patent suits and will not be exploiting the dark side of software patents.

Not so fast. The situation, unfortunately, is not quite that simple. There are a couple of problems with Red Hat's position that should be kept in mind.

The first of these problems is that a promise on Red Hat's web site only means so much. It is not an enforceable contract that anybody can count on; Red Hat can change its position at any time. A court may take the published promise into account in a future case, but that promise may not keep such a case from happening in the first place. Red Hat, under its current management, seems unlikely to change its approach to patents - the posted promise is undoubtedly sincere. But corporate management and ownership can change quickly - and, with them, posted patent policies.

More disturbing in the short term, however, is Red Hat's list of "approved" licenses. It includes the GPL, the IBM Public License, the Common Public License, the Q Public License, and "any open source license granted by Red Hat." A whole class of licenses, including the LGPL and, crucially, the BSD license, has been excluded from Red Hat's patent promise.

In other words, the various versions of BSD Unix are not welcome to use Red Hat's patented technology. In fact, they can be sued for infringement if they do use that technology. The license wars, it seems, are still being waged, and Red Hat has just launched a new offensive. This is a move which will encourage division in the free software community, to say the least.

The cynical among us could even see this policy as a strike by Red Hat against a whole class of competing free operating systems. That is almost certainly not the case: Red Hat is just trying to ensure that its patent weapons can actually be used. As the company told us:

We elected to specifically exclude licenses that don't expressly prohibit open source code from being incorporated into proprietary code. Absent that stance, the patents would be of little benefit.

It's not worth it. Red Hat ships a great deal of software under licenses which, it seems, are now too free: consider the X window system or OpenSSH, for starters. There has been a great deal of exchange of ideas between Linux and *BSD; the FreeBSD VM subsystem, for example, has long been seen as an inspiration by at least some Linux kernel hackers. We have all benefitted from the OpenBSD security auditing work. Red Hat, in the name of patent defense, is cutting off the flow of ideas in one direction. That is not how free software is supposed to work. Red Hat should find a way to deal with software patents that does not alienate a large and valuable part of the free software community.

As a starting point, why not contribute these new patents (and the various gcc patents said to have been originally obtained by Cygnus) to a free software "patent pool"? The patents would be licensed for any use as long as the licensee does not sue any company alleging patent infringement by any free software used or distributed by that company. If it is absolutely necessary to dirty one's hands with software patents, this approach seems more constructive and beneficial to the community.

Comments (23 posted)

ADEOS - avoiding real-time Linux patents

The current systems for performing hard real-time tasks with Linux (RTLinux and RTAI) take the same approach: use a real-time kernel at the lowest level of the system, and run the general purpose kernel (i.e. Linux) as the lowest-priority task. This technique has been patented by Victor Yodaiken, and the patent has been licensed to the community under terms similar to those used by Red Hat: as long as your work is licensed under the GPL, you can use the patented technology without paying royalties.

This patent and its license have been the subject of endless controversy in the free software community. In particular, developers and users of RTAI have always felt a little nervous, especially when the RTAI core was licensed under the LGPL. The recent relicensing of the RTAI core was undertaken to be sure of compliance with the patent license, but not everybody has been satisfied. In particular, people who wish to run or distribute proprietary systems using RTAI have been unsure of their status.

An obvious solution, one might think, would be to not use the patented technology; until recently, however, alternatives have been somewhat scarce. That situation may have changed, however, as the result of the announcement of the upcoming first release of ADEOS.

ADEOS is, essentially, a small "nanokernel" which takes charge of low-level hardware resources (interrupts in particular). Any number of higher level operating systems can run in parallel on top of ADEOS; they run independently and know little of each other. ADEOS implements an abstraction called an "interrupt pipeline," which is essentially an ordered list of systems which are interested in a particular interrupt. Real-time systems put themselves at the head of the list, and are thus able to respond quickly to interrupts. General purpose systems can handle any interrupts which the real-time systems allow to pass down the pipeline.

The idea of running multiple operating systems over a small, low-level kernel is not particularly new; IBM has been doing it for decades. It is interesting, however, in that the ADEOS developers claim that it is suffiently different from the RTLinux approach that it is not covered by the patent. The reality of the situation, however, may not be determined until a fair number of lawyers have been involved.

The RTAI project plans to move over to ADEOS and thus, with luck, free itself of patent worries. Whether RTAI will be able to rid itself of the persistent claims that it is a derivative of RTLinux could be another story. RTLinux supporters will point out strong similarities between a number of source files in the two projects. If RTAI really used RTLinux code at the beginning, and released that code under a different license (even if that license was the LGPL), the project has, in theory, lost its rights to use that code. Nobody has seriously pursued a GPL infringement claim against RTAI, but, as long as the allegations persist, such an action is a possibility.

Meanwhile, ADEOS embodies a different approach to dealing with software patents: find a way to work around them. From the press release:

Often a piece of Free Software, into which many people have invested years of work, can be turned into non-free software by a patent for one simple but essential calculation rule. Our example shows that the developers need not always give up. Sometimes, by trying very hard, an alternative calculation rule that does the work and is not completely useless can be found. Developers should not shy [from] the effort that this takes, because even if the patent owner offers a license on friendly terms, usually the project will be restricted in some way or other and the intentions of the developers to create real Free Software will be betrayed.

This approach has been taken with other patents: using JPEG and PNG files to get around the GIF patent, and Ogg Vorbis as an alternative to MP3, for example. As software patents proliferate in the U.S., however (and possibly spread to Europe), it will get always harder to dodge them all. And tiresome as well. Software patents remain a threat to free software.

(See also: a more detailed, technical description of how ADEOS works.)

Comments (none posted)

UnitedLinux makes its launch

After a suitable period of pre-launch hinting, the UnitedLinux initiative sent out a press release announcing its existence. A press release is about all there is, at the moment; the realization of the goals behind United Linux will take a little longer.

UnitedLinux is a joint venture between Caldera, Conectiva, SuSE and Turbolinux. Essentially, the four will be combining much of their Linux distribution development operation. The advantages of this combination are fairly clear: much duplicated work can be eliminated, and the companies will have at their disposal a single base distribution which is standards compliant and uniform. The companies' four distributions have all lacked sufficient market share to inspire software vendors to target them. One, larger distribution, it is hoped, will be more successful at attracting the independent software vendors of the world.

An alpha release of UnitedLinux, apparently based most heavily on SuSE's distribution, is due in the near future, with the general release happening in the fourth quarter of this year. Each distributor will then add its own special offerings and sell the result under its own brand. Interestingly, the UnitedLinux release plans page mentions KDE 3.0, but says nothing about GNOME. Several "installation languages" will be supported.

The biggest controversy over UnitedLinux would appear to be whether it will be available as a free download. The initial statements from the group have been mixed. We will have to wait and see on that one. A more worthwhile question might be: will UnitedLinux expose its development version the way Mandrake, Debian, and Red Hat (sort of) do? Inviting outsiders into the development process is a far more convincing sign of openness than distributing free binaries.

The other open question, of course, is: what other companies might join? An invitation has been extended to Red Hat, but nobody really expects that company to want to be a part of UnitedLinux. MandrakeSoft is a more interesting possibility; it is by far the largest other distributor which is not currently a part of the group. Thus far, MandrakeSoft has been awfully quiet about UnitedLinux.

If UnitedLinux lives up to its promise, it could become the platform upon which a new generation of distributions can grow. Doing UnitedLinux right, however, will require keeping both the free software community and the commercial world happy. This goal should be achievable; we wish this group luck.

Comments (1 posted)

The new LWN.net site

Back in August, 1998, LWN made a major site change: we went from the "everything on one big page" format to the multi-page format that is still used for the weekly edition. We got over 100 complaints about that change - people liked things the old way. So we restored the "one big page" as an option, and it is still used by a (declining) number of LWN readers.

As you can see, LWN has changed format again; see our introductory posting for a description of what has changed. We'll say here, however, that what has not changed is LWN's content. The presentation is different, and a number of new capabilities have been added, but our writing remains as always.

By the standards of 1998, the reaction to this change has been relatively muted. Some people like the new site, others do not, but there has been no avalanche of complaints. Which is fine with us. We are certainly interested in hearing from our readers (at lwn@lwn.net) about ways we could improve the new site; we do request, however, that commenters be specific about what they do or do not like. We try to respond to specific complaints, but there's not much that we can do with a message that just says "I hate the new site."

There are certainly some rough edges on the new site. Bear with us, and we'll do our best to straighten them out. Meanwhile, please check out the new features, and, we hope, enjoy the new LWN experience.

(Note that people who want to see something that resembles the old site can bookmark lwn.net/current, which always gives the current weekly edition, or lwn.net/current/bigpage, which is the "one big page" format).

Comments (20 posted)

Page editor: Jonathan Corbet

Security

Welcome to the new LWN.net Security Page

Our first site code upgrade in nearly four years introduces an integrated security alert and vulnerability database. Our archive of security alerts dating back to July, 2001 now lives in a PostgreSQL relational database. Vulnerabilities and alerts are actually linked to each other. Recent alerts and vulnerabilities use Common Vulnerabilities and Exposures (CVE) numbers to uniquely identify each vulnerability.

Today you can browse alerts and vulnerabilities using the links at the top of each page. When viewing an alert, you can view the corresponding vulnerability description with a mouse click.

In the future expect, and please continue to suggest, ways for us to better provide you with the security information you seek.

Comments (none posted)

US TurboLinux Security Severely Out of Date (iDEFENSE Labs)

iDEFENSE Labs has issued a security advisory for the US TurboLinux distribution.

The collective security weakness of the outstanding issues listed below is staggering. The following is a list of the most serious problems for which most other Linux vendors have provided updates on their US sites. It represents the outstanding security problems associated with the limited TurboLinux distributions and updates that have been available on the US sites only.

LWN has pointed out in the past that Turbolinux has not been serious about security updates. With luck this advisory - or, perhaps, the UnitedLinux effort - will help get this distributor back on track.

Comments (1 posted)

Brief items

Unique Preventative IDS for Linux

Scott Wimer, Chief Technology Officer of Cylant, dicusses preventive security in this paper.

The recent vulnerabilities with OpenSSH software demonstrate that even intensive auditing cannot necessarily root out all the defects from software. As software systems become larger and more complex, intensive auditing becomes more expensive and more difficult. Software audits simply cannot be relied upon to find all of the security vulnerabilities in any given system.

Full Story (comments: 7)

Biometric Access Protection Devices and their Programs Put to the Test (c't)

C't has published a study of eleven biometric access controls intended to prevent unauthorized access. "In our attempts at outfoxing the protective programs and devices we have concentrated on the first method: direct attempts at deceiving the systems with the aid of obvious procedures (such as the reactivation of latent images) and obvious feature forgeries (photographs, videos, silicon fingerprints)."

Also see Bruce Schneier's previously published CRYPTO-GRAM newsletter for May for a look at a technique for fooling fingerprint scanners with fake fingers made of gelatin.

Comments (none posted)

Security reports

Download Sites Hacked, Source Code Backdoored (Security Focus)

Brian McWilliams reports on the recent contamination of Fragroute with a backdoor. "According to program developer Dug Song, the source code to the Dsniff, Fragroute, and Fragrouter security tools was contaminated on May 17th after an attacker gained unauthorized access to his site, Monkey.org."

Note: Copies of Dsniff, Fragroute or Fragrouter downloaded from Monkey.org between May 17th and May 24th are contaminated and require replacement. For more details, see Dug Song's post to bugtraq about the incident.

Full Story (comments: none)

OpenSSH 3.2.3 released

Following on the heels of the last release, OpenSSH version 3.2.3 has been announced. This version fixes a few bugs that showed up in version 3.2.2.

Full Story (comments: none)

Ethereal 0.9.4 released

Ethereal 0.9.4 was released on May 19, 2002 fixing four potential security issues in Ethereal 0.9.3:
  • The SMB dissector could potentially dereference a NULL pointer in two cases.
  • The X11 dissector could potentially overflow a buffer while parsing keysyms.
  • The DNS dissector could go into an infinite loop while reading a malformed packet.
  • The GIOP dissector could potentially allocate large amounts of memory.

No known exploits exist "in the wild" at the present time for any of these issues.

Comments (none posted)

Information Disclosure Vulnerability in IDS 0.8x

IDS is a CGI script that generates a multi-gallery photo album for a website on the fly. IDS 0.8x is reported to have a directory disclosure vulnerability.

Full Story (comments: none)

CGIscript.net - csPassword.cgi has multiple vulnerabilities

Steve Gustin has reported multiple vulnerabilities in the csPassword.cgi script from CGIscript.net "Make sure you only allow trusted users to use the csPassword application and make sure your web server in configured to deny requests for .ht* and *.tmp files."

Full Story (comments: none)

Caldera Security Advisory - Volution Manager

Volution Manager stores the unencrypted Directory Administrator's password in the /etc/ldap/slapd.conf file. This vulnerability will be corrected in the next release of Volution Manager.

Full Story (comments: none)

(Proprietary product) Informix SE-7.25 Local Vulnerability

A buffer overflow vulnerability was reported in Informix SE-7.25 if INFORMIXDIR enviroment variable is defined with a size greater than 2023 bytes.

Full Story (comments: none)

New vulnerabilities

Denial of service vulnerability in version 9 of BIND

Package(s):bind CVE #(s):CAN-2002-0400
Created:June 5, 2002 Updated:August 19, 2002
Description: Here is an advisory from the Computer Emergency Response Team (CERT) regarding the denial of service vulnerability in version 9 of the BIND nameserver, up to 9.2.1. An attacker can send a properly crafted packet which triggers a check within BIND and causes it to shut down. The vulnerability can not be exploited for any purpose beyond denial of service, but that is bad enough; if you are running BIND 9, an upgrade is probably a good idea.

Note that many or most systems out there will still be running BIND 8, and thus will not be vulnerable.

News articles on the vulnerability appear in the Register and Network World Fusion News.

Alerts:
Mandrake MDKSA-2002:038-1 2002-08-15
Yellow Dog YDU-20020606-6 2002-06-06
Conectiva CLA-2002:494 2002-06-06
SuSE SuSE-SA:2002:021 2002-06-06
Mandrake MDKSA-2002:038 2002-06-04
Red Hat RHSA-2002:105-09 2002-06-04

Comments (none posted)

Ghostscript arbitrary command execution vulnerability

Package(s):ghostscript CVE #(s):CAN-2002-0363
Created:June 5, 2002 Updated:June 12, 2002
Description: Ghostscript may be used to execute arbitrary commands with a maliciously formed PostScript file. Since ghostscript is frequently used while printing documents, updating is strongly recommended.

The vulnerability has been fixed in the 6.53 source release of GNU Ghostscript.

Alerts:
SCO Group CSSA-2002-026.0 2002-06-11
Yellow Dog YDU-20020606-4 2002-06-06
Eridani ERISA-2002:022 2002-06-05
Red Hat RHSA-2002:083-22 2002-06-03

Comments (none posted)

Mailman 2.0.11 fixes two cross-site scripting vulnerabilities

Package(s):mailman CVE #(s):CAN-2002-0388
Created:June 5, 2002 Updated:August 28, 2002
Description: Barry A. Warsaw announced the release of Mailman 2.0.11 "which fixes two cross-site scripting exploits, one reported by "office" in the admin login page, and another reported by Tristan Roddis in the Pipermail index summaries. It is recommended that all sites upgrade their 2.0.x systems to this version."
Alerts:
Debian DSA-147-2 2002-08-26
Debian DSA-147-1 2002-08-08
Red Hat RHSA-2002:101-06 2002-06-27
Red Hat RHSA-2002:099-04 2002-06-06
Red Hat RHSA-2002:100-03 2002-06-06
Conectiva CLA-2002:489 2002-05-24

Comments (none posted)

String format bug in pam_ldap logging

Package(s):nss_ldap CVE #(s):CAN-2002-0374
Created:June 5, 2002 Updated:October 29, 2002
Description: The nss_ldap package includes the pam_ldap module for authenticating a user with an LDAP database. Pam_ldap versions prior to 144 have a string format bug in the logging mechanism.
Alerts:
SCO Group CSSA-2002-041.0 2002-10-28
Yellow Dog YDU-20020606-2 2002-06-06
Red Hat RHSA-2002:084-17 2002-05-26
Eridani ERISA-2002:019 2002-05-28

Comments (none posted)

Malformed NFS packet buffer overflow vulnerability in tcpdump

Package(s):tcpdump CVE #(s):CAN-2002-0380
Created:June 5, 2002 Updated:October 9, 2002
Description: A buffer overflow in tcpdump can be triggered by a bad NFS packet when tracing the network. Unmodified tcpdump versions 3.6.2 and earlier are vulnerable.
Alerts:
Red Hat RHSA-2002:094-16 2002-10-04
Yellow Dog YDU-20020606-3 2002-06-06
Trustix 2002-0055 2002-06-05
SCO Group CSSA-2002-025.0 2002-06-04
Conectiva CLA-2002:491 2002-06-05
Red Hat RHSA-2002:094-08 2002-05-29
Eridani ERISA-2002:020 2002-05-30

Comments (none posted)

Uucp authentication agent, in.uucdp, bad string termination

Package(s):uucp CVE #(s):
Created:June 5, 2002 Updated:June 5, 2002
Description: The in.uucpd authentication agent in the uucp package does not properly terminate some long input strings.
Alerts:
Debian DSA-129-1 2002-05-27

Comments (none posted)

xchat IC server based dns query vulnerability

Package(s):xchat CVE #(s):CAN-2002-0382
Created:June 5, 2002 Updated:September 24, 2002
Description: A malicious IRC server may return a response to a /dns query that executes arbitrary commands with the privileges of the user running XChat. Versions of XChat prior to 1.8.9 are vulnerable.
Alerts:
Conectiva CLA-2002:526 2002-09-23
Mandrake MDKSA-2002:051 2002-08-14
Yellow Dog YDU-20020606-5 2002-06-06
Eridani ERISA-2002:021 2002-06-05
Red Hat RHSA-2002:097-08 2002-06-04

Comments (none posted)

Updated vulnerabilities

Ethereal packet handling vulnerabilities

Package(s):ethereal CVE #(s):CAN-2002-0353
Created:June 5, 2002 Updated:June 12, 2002
Description: Ethereal 0.9.3 fixed three packet handling vulnerabilities present in 0.9.2 when it was released by the ethereal team on March 30th. The PROTOS test suite found some flaws in SNMP and LDAP protocols support. Malformed packets could also crash ethereal 0.9.2 due to a ASN.1 zero-length g_malloc problem. The zlib "double free" vulnerability was addressed by the updates for that bug from many distributors. (First LWN report: May 2).

Update: The May 19, 2002 release of Ethereal 0.9.4 fixes four potential security issues in Ethereal 0.9.3.Please see the new vulnerability for more information.

Alerts:
Debian DSA-130-1 2002-06-01
Conectiva CLA-2002:474 2002-04-25

Comments (none posted)

Remotely-exploitable buffer overflow vulnerability in fetchmail

Package(s):fetchmail CVE #(s):CAN-2002-0146
Created:June 5, 2002 Updated:June 18, 2002
Description: Fetchmail versions prior to 5.9.10 have a buffer overflow vulnerability that may be exploited by a malicious IMAP server. The fetchmail client allocated memory to store the sizes of the messages it is attempting to retrieve based on a message count provided by the IMAP server. A malicious IMAP server could provide an artifically large message count to force the fetchmail process to write data outside of the allocated memory. (First LWN report: May 9).
Alerts:
SCO Group CSSA-2002-027.0 2002-06-17
Yellow Dog YDU-20020522-2 2002-05-22
Red Hat RHSA-2002:047-10 2002-05-20
Mandrake MDKSA-2002:036 2002-05-28
Eridani ERISA-2002:016 2002-05-22

Comments (none posted)

UW imapd remotely exploitable buffer overflow

Package(s):imap CVE #(s):CAN-2002-0379
Created:June 5, 2002 Updated:December 20, 2002
Description: UW imapd versions 2000c and prior allow remote authenticated users to execute code via a buffer overflow. A malicious user can craft a request to run commands on the server under their UID and GID. (First LWN report: May 23).
Alerts:
SuSE SuSE-SA:2002:048 2002-12-20
Trustix 2002-0054 2002-06-06
EnGarde ESA-20020607-013 2002-06-07
Yellow Dog YDU-20020606-1 2002-06-06
Red Hat RHSA-2002:092-11 2002-05-22
Mandrake MDKSA-2002:034 2002-05-27
Eridani ERISA-2002:018 2002-05-25
Conectiva CLA-2002:487 2002-05-24
SCO Group CSSA-2002-021.0 2002-05-15

Comments (2 posted)

OpenSSH 3.2.2 fixes multiple vulnerabilities

Package(s):openssh CVE #(s):
Created:June 5, 2002 Updated:June 5, 2002
Description: The OpenSSH developers have released OpenSSH 3.2.2. Security fixes in this release are: "
- fixed buffer overflow in Kerberos/AFS token passing
- fixed overflow in Kerberos client code
- sshd no longer auto-enables Kerberos/AFS
- experimental support for privilege separation [...]
- only accept RSA keys of size SSH_RSA_MINIMUM_MODULUS_SIZE (768) or larger"

(First LWN report: May 23).
Alerts:
Eridani ERISA-2002:017 2002-05-23

Comments (none posted)

UTF8 interaction bug in the perl-Digest-MD5 module

Package(s):perl-Digest-MD5 CVE #(s):
Created:June 5, 2002 Updated:June 5, 2002
Description: Versions prior to 2.20 of the perl-Digest-MD5 module have a bug in the UTF8 interaction with perl that produces UTF8 strings with improper MD5 digests. (First LWN report: May 16).
Alerts:
Red Hat RHSA-2002:081-06 2002-05-10
Mandrake MDKSA-2002:035 2002-05-28

Comments (none posted)

Heap corruption vulnerability in at

Package(s):at at, sudo, xchat CVE #(s):CAN-2002-0004
Created:May 21, 2002 Updated:May 15, 2003
Description: The at command has a potentially exploitable heap corruption bug. (First LWN report:  January 17th).
Alerts:
EnGarde ESA-20030515-015 2003-05-15
Yellow Dog YDU-20020127-9 2002-01-27
SuSE SuSE-SA:2002:003 2001-01-16
Slackware sl-1011706104 2002-01-22
Red Hat RHSA-2002:015-15 2002-02-07
Red Hat RHSA-2002:015-13 2002-01-22
Mandrake MDKSA-2002:007 2002-01-18
Debian DSA-102-2 2002-01-18
Debian DSA-102-1 2002-01-16

Comments (none posted)

DHCP remotely exploitable format string vulnerability

Package(s):dhcp/dhcp-server dhcp CVE #(s):
Created:May 21, 2002 Updated:June 20, 2002
Description: The May 8, 2000 release of ISC DHCP 3.0p1 fixes this serious vulnerability in ISC DHCPD 3.0 to 3.0.1rc8 inclusive.

We encourage dhcp users to upgrade, disable dhcp or, at a minimum, consider using ingress filtering as described in the CERT advisory. (First LWN report: May 16).

Note: Distributions which use version 2 of ISC DHCP, such as Red Hat Linux, are not vulnerable.

Alerts:
SCO Group CSSA-2002-028.0 2002-06-19
Mandrake MDKSA-2002:037-1 2002-05-30
SuSE SuSE-SA:2002:019 2002-05-22
Mandrake MDKSA-2002:037 2002-05-29
Conectiva CLA-2002:483 2002-05-09

Comments (none posted)

GNU fileutils race condition

Package(s):fileutils ucdsnmp CVE #(s):CAN-2002-0435
Created:May 21, 2002 Updated:May 16, 2003
Description: A race condition in rm may cause the root user to delete the whole filesystem. The problem exists in the version of rm in fileutils 4.1 stable and 4.1.6 development version. A patch is available. (First LWN report: May 2).
Alerts:
Immunix IMNX-2003-7+-010-01 2003-05-16
Red Hat RHSA-2003:015-05 2003-02-12
Trustix 2002-0052 2002-06-06
SuSE SuSE-SA:2002:012 2002-04-08
Mandrake MDKSA-2002:031 2002-05-16
SCO Group CSSA-2002-018.1 2002-05-13

Comments (none posted)

Buffer overflow problem in glibc

Package(s):glibc glibc/shlibs, glibc, nscd CVE #(s):CAN-2001-0886
Created:May 21, 2002 Updated:July 14, 2002
Description: The glibc filename globbing code has a buffer overflow problem. For those who are interested, Global InterSec LLC has provided a detailed description of this vulnerability. This problem was first reported by LWN on December 20th.
Alerts:
Trustix 2001-0029 2001-12-19
SuSE SuSE-SA:2001:046 2001-12-24
Slackware sl-1010856829 2002-01-12
Red Hat RHSA-2001:160-09 2001-12-14
Mandrake MDKSA-2001:095 2001-12-19
Mandrake MDKSA-2001:095-1 2002-01-08
Immunix IMNX-2001-70-037-01 2001-12-19
EnGarde ESA-20011217-01 2001-12-17
Debian DSA-103-1 2002-01-13
Conectiva CLA-2002:447 2002-01-03

Comments (2 posted)

Buffer overflow in groff

Package(s):groff CVE #(s):CAN-2002-0003
Created:May 21, 2002 Updated:December 9, 2002
Description: The groff package has a buffer overflow vulnerability; if it is used with the print system, it is conceivably exploitable remotely.
Alerts:
SCO Group CSSA-2002-057.0 2002-12-06
Gentoo groff-20021019 2002-10-19
Yellow Dog YDU-20020127-11 2002-01-27
Trustix 2002-0020 2002-01-18
Red Hat RHSA-2002:004-06 2002-01-14
Mandrake MDKSA-2002:012 2002-02-07

Comments (none posted)

Problem loading untrusted images in imlib

Package(s):imlib CVE #(s):CAN-2002-0167 CAN-2002-0168
Created:May 21, 2002 Updated:June 6, 2002
Description: Versions of imlib prior to 1.9.13 used the NetPBM package in ways which "make it possible for attackers to create image files such that when loaded via software which uses Imlib, could crash the program or potentially allow arbitrary code to be executed." (First LWN report: March 28).
Alerts:
Yellow Dog YDU-20020522-3 2002-05-22
SuSE SuSE-SA:2002:015 2002-05-07
Red Hat RHSA-2002:048-14 2002-05-16
Red Hat RHSA-2002:048-06 2002-03-20
Mandrake MDKSA-2002:029 2002-04-25
Eridani ERISA-2002:015 2002-05-18
Eridani ERISA-2002:011 2002-03-27
Conectiva CLA-2002:481 2002-05-08
Conectiva CLA-2002:470 2002-03-28
SCO Group CSSA-2002-019.0 2002-04-29

Comments (none posted)

Cross-site scripting vulnerability in Horde/IMP 2.2.7 and 3.0

Package(s):imp horde/imp CVE #(s):
Created:May 21, 2002 Updated:June 19, 2002
Description: Version 2.2.8 of IMP has been released, it fixes some vulnerabilities. "The Horde team announces the availability of IMP 2.2.8, which prevents some potential cross-site scripting (CSS) attacks." Upgrading to IMP 3.1 or, at least, 2.2.8 is recommended (First LWN report: April 11, 2002).

Update: IMP 3.0, which was initially believed to be immune, is also vulnerable. The problem is fixed in IMP 3.1.

Alerts:
Debian DSA-126-1 2002-04-16
SCO Group CSSA-2002-016.0 2002-04-16

Comments (1 posted)

Mozilla XMLHttpRequest file disclosure vulnerability

Package(s):mozilla CVE #(s):CAN-2002-0354
Created:May 21, 2002 Updated:October 18, 2002
Description: This XMLHttpRequest security bug impacts all Mozilla-based browsers. "The bug is found in versions of Mozilla from 0.9.7 to 0.9.9 on various operating system platforms, and in Netscape versions 6.1 and higher." (First LWN report: May 2).
Alerts:
Red Hat RHSA-2002:192-13 2002-10-09
Red Hat RHSA-2002:079-13 2002-05-13
Conectiva CLA-2002:490 2002-05-29

Comments (none posted)

Remotely exploitable vulnerability in pine

Package(s):pine CVE #(s):CAN-2002-0014
Created:May 21, 2002 Updated:November 27, 2002
Description: Pine has an unpleasant vulnerability in URL handling vulnerability which can lead to command execution by remote attackers. (First LWN report:  January 17th).

This vulnerability is remotely exploitable; updating is a good idea.

Note: If an update isn't yet available for your distribution, setting enable-msg-view-urls to "off" in pine's setup will avoid the vulnerability. (Thanks to Greg Herlein).

Alerts:
SuSE SuSE-SA:2002:046 2002-11-25
Yellow Dog YDU-20020127-8 2002-01-27
Slackware sl-1010936849 2002-01-13
Red Hat RHSA-2002:009-06 2002-01-14
EnGarde ESA-20020114-002 2002-01-14
Conectiva CLA-2002:460 2002-01-31

Comments (none posted)

Sharutils potential privilege escalation using uudecode

Package(s):sharutils CVE #(s):CAN-2002-0178
Created:May 21, 2002 Updated:October 31, 2002
Description: According to the CVE entry, "uudecode, as available in the sharutils package before 4.2.1, does not check whether the filename of the uudecoded file is a pipe or symbolic link, which could allow attackers to overwrite files or execute commands." (First LWN report: May 16).
Alerts:
Gentoo 200210-012 2002-10-30
SCO Group CSSA-2002-040.0 2002-10-28
Mandrake MDKSA-2002:052 2002-08-14
Yellow Dog YDU-20020522-4 2002-05-22
Red Hat RHSA-2002:065-13 2002-05-14
Eridani ERISA-2002:014 2002-05-16

Comments (none posted)

Multiple vulnerabilities in tcpdump

Package(s):tcpdump CVE #(s):
Created:May 21, 2002 Updated:June 5, 2002
Description: Version 3.5.2 fixed a buffer overflow vulnerability in all prior versions. However, newer versions, including 3.6.2, are vulnerable to another buffer overflow in the AFS RPC functions that was reported by Nick Cleaton. (First LWN report: May 9).

Both problems appear to have been reported and fixed in FreeBSD some months ago. The CIAC report on the vulnerability in versions prior to 3.5.2 is dated October 31, 2000. Nick Cleaton's FreeBSD security advisory on the AFS RPC bug, and reference to a fix for FreeBSD, is dated July, 17, 2001. Tcpdump 3.7 was released on January 21, 2002.

Alerts:
SuSE SuSE-SA:2002:020 2002-05-29
Red Hat RHSA-2001:089-08 2002-02-12
Mandrake MDKSA-2002:032 2002-05-16
Conectiva CLA-2002:480 2002-05-07

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5 CVE #(s):
Created:May 21, 2002 Updated:October 5, 2004
Description: This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:
Gentoo 200410-03 2004-10-05
Yellow Dog YDU-20010810-2 2001-08-10
Yellow Dog YDU-20010810-1 2001-08-10
SuSE SuSE-SA:2001:029 2001-09-03
Slackware sl-997726350 2001-08-09
Red Hat RHSA-2001:100-02 2001-08-09
Red Hat RHSA-2001:099-09 2002-02-07
Red Hat RHSA-2001:099-06 2001-08-09
Progeny PROGENY-SA-2001-27 2001-08-14
Mandrake MDKSA-2001:093 2001-12-17
Mandrake MDKSA-2001:068 2001-08-13
HP HPSBTL0202-023 2002-02-12
Debian DSA-075-2 2001-08-14
Debian DSA-075-1 2001-08-14
Conectiva CLA-2001:413 2001-08-24
SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

Multiple vulnerabilities in SNMP implementations

Package(s):ucdsnmp ucd-snmp CVE #(s):CAN-2002-0012 CAN-2002-0013
Created:May 21, 2002 Updated:September 17, 2002
Description: Most SNMP implementations out there have a variety of buffer overflow vulnerabilities and should be upgraded at first opportunity. See this CERT advisory for more. (First LWN report: February 14).
Alerts:
Red Hat RHSA-2002:036-26 2002-09-12
Yellow Dog YDU-20020211-1 2002-02-11
Red Hat RHSA-2001:163-20 2002-02-12
Mandrake MDKSA-2002:014 2002-02-15
Debian DSA-111-2 2002-02-28
Debian DSA-111-1 2002-02-14
Conectiva CLA-2002:462 2002-02-14
SCO Group CSSA-2002-004.0 2002-01-22

Comments (none posted)

webalizer: reverse DNS buffer overflow vulnerability

Package(s):webalizer CVE #(s):
Created:May 21, 2002 Updated:January 27, 2003
Description: The cause is a buffer overflow bug. This one sounds nasty. If reverse DNS lookups are enabled in webalizer, "an attacker with control over the victims DNS may spoof responses thus triggering a buffer overflow, potentially leading to a root compromise." Webalizer 2.01-10 "fixes this and a few other buglets that have been discovered in the last month or so". (First LWN report:  April 18th, 2002).
Alerts:
Yellow Dog YDU-20030127-4 2003-01-27
Red Hat RHSA-2002:254-05 2002-12-04
SCO Group CSSA-2002-036.0 2002-10-22
EnGarde ESA-20020423-009 2002-04-23
Conectiva CLA-2002:476 2002-04-26

Comments (none posted)

Webmin/Usermin vulnerabilities

Package(s):webmin CVE #(s):
Created:May 21, 2002 Updated:January 10, 2003
Description: Webmin is a web-based interface for system administration for Unix. Webmin has cross-site scripting and session ID spoofing vulnerabilities which are fixed in the May 6, 2002 release of version 0.970. (First LWN report: May 9).

This one is scary. The session ID spoofing vulnerability allows the "possibility that arbitrary commands may be executed with root privileges." Upgrading is strongly recommended. At a minimum avoid the "preconditions for a successful exploit" by disabling password timeouts under Webmin->Configuration->Authentication.

Alerts:
SCO Group CSSA-2003-002.0 2003-01-09
Yellow Dog YDU-20020522-7 2002-05-22
Mandrake MDKSA-2002:033 2002-05-21

Comments (1 posted)

Problems with libgtop_daemon

Package(s):wuftpd libgtop CVE #(s):
Created:May 21, 2002 Updated:May 7, 2003
Description: The libgtop_daemon package is a GNOME program which makes system information available remotely. LWN reported the remotely exploitable format string and buffer overflow vulnerabilities in that package on December 6th. On November 28th disabling the libgtop_daemon on systems where it is running until an update is available.

Many Linux systems do not run libgtop by default, but applying the update is a good idea anyway.

Alerts:
Debian DSA-301-1 2003-05-07
Mandrake MDKSA-2001:094 2001-12-19
Debian DSA-098-1 2002-01-09
Conectiva CLA-2002:448 2002-01-03

Comments (1 posted)

zlib corrupts malloc data structures via double free

Package(s):zlib rsync libz vnc zlib, cvs, gnupg, rrdtool, libz/zlib packages upgrade security problems cvs recompiled against updated + /tmp CVE #(s):CAN-2002-0059 CAN-2002-0092 CAN-2002-0080
Created:May 21, 2002 Updated:June 6, 2002
Description: This vulnerability impacts all major Linux vendors. It may impact every Linux installation on Earth. Updates are required to zlib and any packages that were statically built with the zlib code. (First LWN report: March 14).

LinuxSecurity describes the vulnerability and coordinated distributor efforts in detail. "Packages including X11, rsync, the Linux kernel, QT, mozilla, gcc, vnc, and many other programs that have the ability to use network compression are potentially vulnerable."

Updating is recommended. As always, please proceed with caution when applying updates to the kernel.

Alerts:
Conectiva CLA-2002:493 2002-06-05
Trustix 2002-0040 2002-03-18
SuSE SuSE-SA:2002:011 2002-03-11
SuSE SuSE-SA:2002:010 2002-03-11
Slackware sl-1015950525 2002-03-12
Slackware sl-1015949806 2002-03-12
Red Hat RHSA-2002:027-22 2002-03-11
Red Hat RHSA-2002:026-39 2002-03-15
Red Hat RHSA-2002:026-35 2002-03-11
OpenPKG OpenPKG-SA-2002.003 2002-03-12
Mandrake MDKSA-2002:023-1 2002-03-13
Mandrake MDKSA-2002:023 2002-03-12
Mandrake MDKSA-2002:022 2002-03-12
Eridani ERISA-2002:009 2002-03-13
Eridani ERISA-2002:008 2002-03-13
Debian DSA-122-1 2002-03-11
SCO Group CSSA-2002-015.0 2002-04-04

Comments (none posted)

Resources

CERT Summary CS-2002-02

The CERT Coordination Center (CERT/CC) issued their CERT quaterly summary "to draw attention to the types of attacks reported to our incident response team, as well as other noteworthy incident and vulnerability information."

Full Story (comments: none)

Announcing Fenris 0.06

Fenris 0.06 has been released by Michal Zalewski. "This release brings you much improved debugging capabilities, from a console-based debugging GUI [...], to core functionality fixes, anti-debugger techniques detection, better performance, or an updated write-up on debugging burneye-protected code."

Full Story (comments: none)

Linux Security Week and Advisory Watch

The June 3 Linux Security Week from LinuxSecurity.com is available, as are the Linux Advisory Watch Newsletters from May 24 and May 31.

Comments (none posted)

Book Review: SSH, The Secure Shell - The Definitive Guide

Danny Yee has reviewed SSH, The Secure Shell - The Definitive Guide published by O'Reilly & Associates in 2001.

Full Story (comments: none)

Events

Upcoming Security Events

Date Event Location
June 6 - 7, 2002Qualys Security Conference(Hotel Nikko)San Francisco, CA
June 17 - 19, 2002NetSec 2002San Fransisco, California, USA
June 24 - 28, 200214th Annual Computer Security Incident Handling Conference(Hilton Waikoloa Village)Hawaii
June 24 - 26, 200215th IEEE Computer Security Foundations Workshop(Keltic Lodge, Cape Breton)Nova Scotia, Canada
June 28 - 29, 2002Edinburgh Financial Cryptography Engineering 2002Edinburgh, Scotland
July 31 - August 1, 2002Black Hat Briefings 2002(Caesars Palace Hotel and Resort)Las Vegas, NV, USA
August 2 - 4, 2002Defcon(Alexis Park Hotel and Resort)Las Vegas, Nevada
August 5 - 9, 200211th USENIX Security SymposiumSan Francisco, CA, USA

For additional security-related events, included training courses (which we don't list above) and events further in the future, check out Security Focus' calendar, one of the primary resources we use for building the above list. To submit an event directly to us, please send a plain-text message to lwn@lwn.net.

Comments (none posted)

Page editor: Dennis Tenney

Kernel development

Kernel release status

The current development kernel is 2.5.20, which was released by Linus on June 2. Big changes this time include a large ACPI merge, a bunch more buffer/VM work, a PowerPC64 merge, the usual set of IDE patches, various merges from the -dj series, some device model work, and numerous other fixes and updates. The long format changelog is also available.

Other releases from Linus since the last LWN Kernel Page include:

  • 2.5.19 (short, long). Changes include more block, buffer, and IDE layer work, some enhancements to the driver model code, more kbuild tweaks, and many other fixes and updates.

  • 2.5.18 (short, long). This one included the software suspend patch (as covered in the May 23 LWN Kernel Page), a bunch of kbuild fixes (which are not Keith Owens's new kbuild system - see below), more IDE reworking, more VFS changes, and a bunch of other fixes and improvements.

The current prepatch from Dave Jones is 2.5.20-dj3. The most significant feature of this patch, perhaps, is the merging of some small pieces of the kbuild 2.5 code.

The latest 2.5 status summary from Guillaume Boissiere came out on June 5.

The current stable kernel release is 2.4.18. Marcelo's plan had been to create a 2.4.19 release candidate, but some problems turned up. So he released 2.4.19-pre10 instead. A very long list of fixes got into this release. With luck, the next prepatch from Marcelo will be the first 2.4.19 release candidate.

Alan Cox has released 2.4.19-pre10-ac2; arguably the most interesting change in this prepatch is the inclusion of the "speakup" console module for blind users.

Comments (none posted)

A new way of block queue plugging

Jens Axboe has posted a patch which, once again, changes some of the main assumptions underlying the block I/O subsystem. It is worth a look at what is going on.

A longstanding feature of the block layer has been "queue plugging." If the request queue for a particular block device has been plugged, that device's driver will not be invoked to execute the operations in the queue. The main reason for plugging has been to allow the block layer to build up a backlog of requests, so that adjacent operations can be merged. By sometimes waiting a little longer to start an operation, the block layer can often achieve better performance overall.

With the 2.5 block layer, however, there is less need for this sort of plugging. The code works harder at not splitting large requests in the first place, so it is not necessary to merge them again. The new plugging code actually serves a different purpose: it is a mechanism by which a block driver can indicate that it is busy and can not handle any more requests at the moment.

As Jens points out in his patch, the block code is starting to look a little (a little!) bit more like the networking subsystem. Like network interfaces, block devices can have multiple requests outstanding. When the device has been given all the simultaneous requests that it can handle, there is no point in further troubling the driver until some of those requests complete. Thus the new plugging code: block devices, too, can ask to be allowed to work in peace for a while.

There's a couple of other, incidental changes in this patch. One is that the venerable tq_disk task queue has been removed. Slowly, the set of standard task queues is shrinking. A block driver's request ("strategy") function is also now called out of a tasklet. The block layer that shows up in 2.6 will be vastly different from what has been seen in previous stable kernels.

Comments (1 posted)

Splitting the kernel stack

The Linux kernel has, for years, run with an 8KB (two page) stack in each process's address space (at least, on i386 systems). That stack holds the "task structure" (the kernel's information about the process) and provides space for automatic variables and call frames when the system is running in kernel mode. The 8KB stack works, of course, but it is not optimal. The biggest problem, perhaps, is the need to find two adjacent pages for a new stack every time a new process is created. On a busy system memory can get badly fragmented, and allocating two pages together can be a challenge.

So Ben LaHaise has posted a patch which splits the kernel stack into two 4KB stacks. One of them holds the task structure and is used by normal kernel code (i.e. handling system calls). The other stack is set aside and is used only when the kernel is handling interrupts.

A separate interrupt stack is not a particularly new idea - many operating systems have had interrupt stacks for decades. There are numerous advantages to doing things this way. Only one interrupt stack (per CPU) is needed, so one page of memory per process is freed up. The interrupt stack is also more likely to stay in the processor cache, improving performance. Interrupt handlers need not worry about other kernel code having consumed most of the stack when they get invoked. And, of course, it is no longer necessary to perform a two-page allocation to set up the regular kernel stack.

The biggest downside, perhaps, is that non-interrupt kernel code must now fit into much less stack space. Some kernel code is not particularly careful about the size of its automatic variables, and risks overflowing the new, smaller stack. As a way of tracking down such code, Ben has also posted a stack checker (followed by a brown paper bag fix) which monitors stack usage and raises the alarm when available space on the stack gets too low. The two patches are probably best used together.

Comments (none posted)

The continuing saga of kbuild 2.5.

The discussion over whether to merge kbuild 2.5 has been covered in this space before. It is one of those conversations that persists, however. A few things have happened over the last few weeks.

Keith Owens, the author of kbuild 2.5, has posted a new set of timing comparisons meant to show the advantages of the new code. The full build process Keith performed took a bit less than 14 minutes with kbuild 2.5, and a little over 20 minutes with the existing kbuild. He also points out that the result is sometimes incorrect with the existing code.

Daniel Phillips also tried it out and obtained similar results. For good measure, Daniel took a look at the code itself: "There is no Python anywhere to be seen in kbuild 2.5, for those who worry about that. It is coded in C, about 10,000 lines it seems. It has a simple built in database which I suppose accounts for some of that. For what it does, it seems quite reasonable."

In general, most (but not all) developers who express an opinion on the matter seem to feel that kbuild 2.5 is worthwhile and should be merged. So it has surprised a number of people to see numerous patches to the existing kbuild system, written by Kai Germaschewski, being merged by Linus. These patches do worthwhile things, but they are not kbuild 2.5. Why bother, one might ask, if the whole thing is going to be replaced?

The answer seems to be that Linus, for now, wants Kai to be the kbuild maintainer. Kai is willing to do things in small pieces, which has always been Linus's preferred method; Keith has, so far, refused to break his kbuild work up in this way. Also, says Linus:

Kai isn't an enthusiastic kbuild-2.5 supporter. In fact, he tends to be a bit down on some of it. Which is a plus in my book: it means that whatever Kai tries to push my way I'll feel just that much more comfortable with as having had critical review.

Meanwhile, a couple of different developers (Sam Ravnborg and "Lightweight patch manager") have started submitting broken up versions of kbuild 2.5. Kai has stated that he will look them over and integrate those which make sense. Some of these patches also found their way into 2.5.20-dj3. It seems like at least a partial victory for the new kbuild.

So one has to wonder why, after all this, Keith felt the need to post his call for an email campaign entitled "If you want kbuild 2.5, tell Linus." It's a full-scale polemic that takes one back to the old devfs wars. It is also, seemingly, counterproductive. One would think that would be better to work with the people who are trying to make kbuild acceptible to Linus than to call for a pressure campaign.

Comments (2 posted)

The value of negative dentries

A "directory entry" (dentry) is an internal data structure used to hold the results of looking up a file in the filesystem. The Linux "dentry cache" keeps a number of recently used dentries around; they tend to be useful, since files are often accessed more than once over a short period of time. Finding a file in the dentry cache can save a lot of time by avoiding a full filesystem lookup.

The kernel also hangs on to "negative dentries," which indicate that the given file does not exist. Andrea Arcangeli recently noted that these negative dentries can take up quite a bit of memory, and wondered what possible use they could be. His message included a patch to force negative dentries out of memory quickly.

It turns out, though, that "this file does not exist" can be useful information. A quick strace run on a GNOME application, for example, turns up dozens of lookups on nonexistent files as the application gropes around looking for the unbelievable number of libraries it needs. Similarly, apache is continually looking for .htaccess files, shells look for executables, etc. It is more than worthwhile to be able to determine that a file doesn't exist without an expensive filesystem call - especially for file names that are often looked up. So negative dentries will stay.

There is one optimization that can be made, though. In Andrea's case, the negative dentries were created by deleting a large directory full of files. When a file is deleted, it is relatively unlikely that it will be looked up again soon, and keeping a negative dentry around is less useful. In this case, perhaps, it is better to just forget about the file name altogether.

Comments (1 posted)

The return of /dev/port

A few weeks ago, LWN reported on the removal of support for /dev/port from the 2.5 kernel. Since then, a few users have reported real uses for /dev/port and a desire that it stay in the kernel. Martin Dalecki, who create the patch removing /dev/port, suggested that users who really need it can patch it back in themselves. Linus disagreed, saying:

So when simplifying, it's not just important to say "we could do without this". You have to also say "and nobody can reasonably expect to need it".

Which doesn't seem to be the case with /dev/ports. So it stays.

That is, of course, the definitive end to the discussion.

Comments (1 posted)

Resources

A few other worthwhile notes:
  • Kernel Traffic issues 168 and 169 are available.

  • The Linux Security Module web site has been overhauled in a big way. "It's no longer an endless dribble of old patches. It contains some information about the project, more navigable patch listing, links to the BK repositories, and links to all the documentation that I am aware of."

  • Late last April, we mentioned that Pacific Northwest National Laboratory was seeking an experienced kernel programmer to work on its new, 1400-node Linux cluster. The position is still open, so go check it out if you think you might be interested.

Comments (none posted)

Patches and updates

Kernel trees

  • Lightweight patch manager: linux-2.5.20-ct1. Adds a number of "trivial patches" to 2.5.20. (June 4, 2002)
  • Andrea Arcangeli: 2.4.19pre9aa1. Included the integration of the O(1) scheduler - "highly experimental." (June 5, 2002)
  • Paul P Komkoff Jr: 2.4.19-pre9-ac1-s1. kbuild 2.5, EVMS, and a number of fixes. (June 5, 2002)
  • Marc-Christian Petersen: 2.2.21-3-secure. Many goodies for 2.2: OpenWall, ext3, ReiserFS, CryptoAPI, ACLs, USAGI, FreeS/Wan, 2.4 IDE, etc. "<span>The intended purpose is for production/servers.</span>" (June 5, 2002)

Build system

Core kernel code

  • Robert Love: scheduler hints. Allow applications to give hints to the scheduler on how they will behave. (June 4, 2002)
  • Russell King: cpufreq core for 2.5. A common (across architectures) interface to CPU clock speed. (June 4, 2002)
  • William Lee Irwin III: lazy_buddy-2.5.19-3. A "bugfix and cleanup release" of the new, deferred coalescing memory allocator. (June 4, 2002)
  • Andrew Morton: direct-to-BIO writeback. Perform filesystem writeouts direct to the block layer via BIO requests - no more buffer heads. At least in simple cases. (June 5, 2002)
  • Andrew Morton: direct-to-BIO readahead. Make the readahead code work without buffer heads. "<span>CPU load for `cat large_file &gt; /dev/null' is reduced by approximately 15%.</span>" (June 5, 2002)

Development tools

  • Randy.Dunlap: kerneltop. A "top"-like display generated from kernel profiling data. (June 4, 2002)

Device drivers

  • Martin Dalecki: 2.5.18 IDE 71. "<span>Scary big patch this time</span>." (June 4, 2002)

Documentation

  • Patrick Mochel: device model documentation 1/3. Documentation of the device model code - part 1 covers the <tt>bus_type</tt> structure. (June 5, 2002)

Filesystems and block I/O

  • Andreas Gruenbacher: Status of 2.5.x port. An initial port of the extended attribute/access control list code to 2.5. (June 5, 2002)

Janitorial

  • Robert Love: remove suser(). The venerable suser() call is gone at last. (June 5, 2002)

Networking

Architecture-specific

  • James Bottomley: i386 arch subdivision into machine types for 2.5.18. "<span>This code rearranges the arch/i386 directory structure to allow for sliding additional non-pc hardware in here in an easily separable (and thus easily maintainable) fashion.</span>" (June 4, 2002)
  • Thomas Capricelli: linux zeta-0.2 released. Zeta is a virtual platform to which the group is porting Linux. (June 5, 2002)

Security-related

  • Chris Wright: 2.5.20-lsm1. New version of the Linux Security Module patch. (June 5, 2002)
  • Chris Wright: 2.4.18-lsm3. Linux Security Module patch for 2.4.18. (June 5, 2002)
  • Amon Ott: RSBAC v1.2.0. Rule Set Based Access Control. (June 4, 2002)

Miscellaneous

  • Andrew Morton: "laptop mode". Optimizations for laptop use - mostly minimizing disk spinups. (June 5, 2002)
  • Bartlomiej Zolnierkiewicz: atapci 0.50. Reads information from ATA PCI chipsets. (June 5, 2002)
  • Bartlomiej Zolnierkiewicz: atapci 0.51. Fixes a problem with 0.50. (June 5, 2002)

Page editor: Jonathan Corbet

Distributions

News and Editorials

Announcement: the AGNULA project

The AGNULA project aims to develop two reference distributions for the GNU/Linux operating system completely based on Free Software (i.e. under a FSF approved Free Software license) and dedicated to audio and multimedia. One distribution will be Debian-based (DeMuDi) and the other will be Red Hat-based (ReHMuDi).

Full Story (comments: none)

Scyld Beowolf

In the May 23rd Distributions page the Scyld Beowulf Cluster Operating System was incorrectly identified as hardware specific. In fact the Scyld distribution supports x86, Alpha, and other platforms.

Comments (none posted)

Distribution News

Debian GNU/Linux

The Debian Project has sent out a release describing what is claimed to be a new intercontinental Internet performance record: the first Debian Woody CD was transferred from Fairbanks, Alaska to Amsterdam in 13 seconds. The systems on both ends were running Debian, of course.

The Debian Weekly News for May 23 is out, with coverage of MPlayer, Nessus, the fair use status of the fortunes file, and more.

Here's the Debian Weekly News for May 29. It looks at the new Debian Flyers, the abortive attempt at packaging WineX, apt preferences, and more.

In this announcement Josip Rodin discusses woody release status. "To reiterate the main point from the April 30th mail by Anthony Towns, the release of woody is being held back because there is no systematic way to build packages in security advisories on all architectures included in woody."

Comments (none posted)

Mandrake Linux

Issue #43 of the Mandrake Linux Community Newsletter is out. "This Week's Summary: StarOffice 6.0 Officially Released; Spotlight on MandrakeExpert; MandrakeClub Activities; Website of the Week (plf.zarb.org); Online Survey; Ximian GNOME for Mandrake 8.2; Mandrake in the News; Website Updates; Software Updates; Headlines from MandrakeForum."

The Mandrake Linux Community Newsletter for June 1 (issue #44) is out. It covers the MandrakeSoft.com redesign, the Business Case of the week, recent security alerts, and more.

Comments (none posted)

Red Hat Linux

Red Hat has two bug fixes out for this week. There are new SANE packages for RH 7.3 which fix a problem observed when upgrading SANE. There are also new XFree86 packages are available which fix various bugs reported since the last erratum update. These are available for RH 7.1 - alpha, i386, ia64 and RH 7.2 - i386, ia64.

Comments (none posted)

Slackware Linux

On May 25, 2002 Slackware 8.1-rc1 was announced. That was followed by Slackware 8.1-rc2, announced on June 1, 2002. Since then much progress has been made on cleaning up the remaining bugs. As always the Slackware-current change log contains the details.

Comments (none posted)

Yellow Dog Linux

Terra Soft Solutions, Inc., publishers of Yellow Dog Linux, announced the Japanese edition of Yellow Dog Linux 2.2, which will be showcased by Amulet at LinuxWorld Tokyo.

Yellow Dog Linux has an updated errata page which YDL users might want to take a look at. There are also some bug fix advisories out.

New glibc packages are available, fixing a bug in YDL 2.2 that may cause programs to seg fault. Updated mpg321 packages are available for which fix a buffer overflow in the network streaming code as well as other bugs. Finally, updated kdebase packages are available that change the default artsd behavior to use 8-bit mode which allows sound to function.

Comments (none posted)

New Distributions

MicroBSD

MicroBSD is a hardened, secure, Posix1e, small foot print OS. It is currently available for x86, with Alpha, Sparc, and PPC ports in the works. It aims to use as little hard disk space as possible while providing a fully functional system. A 0.4 Mini and Full x86 release version was announced May 28, 2002. (Thanks to Joe Klemmer)

Comments (none posted)

New distribution: WISP-Dist

The first public release of WISP-Dist, a new embedded distribution, has been anounced. It runs out of 8MB flash and is aimed primarily at running wireless routers.

Full Story (comments: none)

Minor distribution updates

Astaro Security Linux

Astaro Security Linux has released stable version 3.2. "The most important new key features are a PPPoE client, a DHCP server and client, sophisticated reporting and log file handling, traffic shaping, heavily improved HTTP and SMTP proxies, IPSec with X.509 certificates and AES encryption, PKI management for the X.509 certificates, surf protection (with optional URL listing with 12 mio entries), and High Availability (with optional hot standby)."

Comments (none posted)

Devil-Linux 0.5RC1

Version 0.5RC1 of Devil-Linux has been announced.

Full Story (comments: none)

Gnome2 -beta5 and beyond available on Gentoo

Gnome2 is now available for the Gentoo portage system.

Comments (none posted)

Knoppix

KNOPPIX has released version 1.5, its first appearance on Freshmeat.

Comments (1 posted)

Lycoris Desktop/LX Continues Grow in Popularity

Lycoris products Desktop/LX Personal and Desktop/LX Deluxe are now available at Fry's Electronics retailers; and other Desktop/LX news.

Full Story (comments: none)

Distribution reviews

Mandrake gets top billing in Desktop Linux poll

According to this DesktopLinux.com story, Mandrake Linux is the most popular desktop Linux system.

Comments (none posted)

Linuxlookup.com reviews Red Hat 7.3

LinuxLookup.com features a review of Red Hat Linux version 7.3.

Comments (19 posted)

3 Distributions Power Up Linux (eWeek)

eWeek Labs tested SuSE Linux 8.0, Mandrake Linux 8.2 and Red Hat Linux 7.3. They say "... the penguins have made some great strides in usability - to the point that users unfamiliar with Linux could comfortably find their way through a machine installed with any of these Linux variations." (Thanks to Brian Park)

Comments (1 posted)

SuSE 8.0, KDE 3.0 first look (Register)

The Register checked out SuSE 8.0 and KDE 3.0. "I've been using SuSE 7.3 pretty much exclusively on my personal machines for five or six months now, though with several upgrades of the kernel, FreeType, KDE, etc. It's accessible to Linux newbies if not exactly easy, yet reasonably power-user friendly. It may well be the best of all the packaged distros. And while there are imperfections in a few of the packages, overall I'd have to say that 8.0 is a solid step forward. I'll be keeping it, that's for sure." (Thanks to Micha H. Werner)

Comments (none posted)

Page editor: Rebecca Sobol

Development

Mozilla.org launches Mozilla 1.0

Here it is at last: the press release announcing the launch of Mozilla 1.0. "Built on the Gecko layout engine, Mozilla 1.0 is cross-platform and integrates a core set of applications that allow users to access the capabilities of the Web, including a web browser, an email reader and a chat client." Congratulations are due to the Mozilla team, which has worked a long time to create this release.

For more coverage, see the articles on mozilla.org and Mozillazine.

Comments (4 posted)

System Applications

Education

Linux in education report #71

The Linux in education report #71 is available. This week Sun donates StarOffice 6.0 to schools, the Connexions Project, and more.

Comments (none posted)

Electronics

gEDA news

The gEDA site lists new versions of the Icarus Verilog compiler and gEDA/gaf, a collection of electronic CAD tools.

Comments (none posted)

Networking Tools

OpenSSH 3.2.3 released

Following on the heels of the last release, OpenSSH version 3.2.3 has been announced. This version fixes a few bugs that showed up in version 3.2.2.

Full Story (comments: none)

gFTP: 2.0.12 has been released

Version 2.0.12 of the gFTP FTP client has been released. This release fixes a number of bug fixes and features support for the Bulgarian and Norwegian languages.

Full Story (comments: none)

Printing

Omni printer driver version 0.7.0 released

Version 0.7.0 of the Omni printer driver has been released. This version features a new build environment and a number of bug fixes.

Comments (none posted)

Science

GT.M V4.3-001A Released (Linux Med News)

Linux Med News reports on the release of a new version of GT.M. "For those of you just tuning in, this is an open source Mumps compiler which is making the Veterans Administration VistA software available to civilian types."

Comments (none posted)

Web Site Development

mnoGoSearch 3.2.5 released

Version 3.2.5 of the mnoGoSearch web site search engine has been released. A number of bug fixes and security changes are included, see the Change Log for more details.

Comments (none posted)

New mod_perl's released (use Perl)

Use Perl is carrying an announcement for two new releases of mod_perl.

Comments (none posted)

Zope Members News

The latest items on the Zope Members News site include stable release version 1.5 of the Ordered List Product, version 0.6.1 of the emil email client, and the founding of a German Zope user's group.

Comments (none posted)

Standards

Public review of the LSB's gLSB & archLSB-IA32 v1.2 written specs

The draft gLSB and archLSB-IA32 v1.2 written specifications for Linux will be published on the web Monday June 3rd for a two week public review. The Linux community is invited to comment by Monday June 17th.

Full Story (comments: none)

Miscellaneous

Wine Weekly News Issue 124

Issue #124 of the Wine Weekly News is out. Topics include a Win4Lin review, tips on helping Wine development, code practices, printing multi-byte characters, WineX and Debian, and more.

Comments (none posted)

Desktop Applications

Audio Applications

WaveSurfer 1.4.1 released

Version 1.4.1 of the WaveSurfer sound visualization and manipulation tool has been released. Minor enhancements and bug fixes have been added and some speech utilities have been fixed.

Comments (none posted)

Jack 0.34.0 released

Version 0.34.0 of Jack, the Jack Audio Connection Kit has been released. In this version, the API has been stabilized, see the release notes for all of the details.

Comments (none posted)

Desktop Environments

KDE 3.0.1 released

A new release of the KDE desktop environment has been announced. "KDE 3.0.1 is primarily a translation release for KDE 3.0, which shipped in early April. In addition, KDE 3.0.1 offers a number of performance and usability enhancements." (Thanks to Scott Dowdle.)

Comments (none posted)

GARNOME Preview Seven

GARNOME 0.10.1 ("the bad-ass, bleeding edge GNOME distribution for testers and tweakers everywhere") has been released.. There's a number of new goodies in this release, including a "magicdev" preview and an interesting surprise.

Full Story (comments: none)

GNOME Summary for May 25 to June 1

The Gnome Summary for May 25 through June 1, 2002 is out. Topics include the GNOME 2 hard freeze, hacking GTK+ apps in LOGO, GnomeMeeting for Gnome2, gthumb, the accessibility framework explained, and more.

Comments (none posted)

GNOME Summary for May 19 to May 25

The GNOME Summary for May 19 to May 25th looks at Sun and MetaCity, an interview with Murray Cumming, how AbiWord points the way to tables, GNOME vrs KDE, Glade 1.1.0 beta release, and much more.

Full Story (comments: none)

KC KDE #37 and #38 are Out

Issue #37 of Kernel Cousin KDE covers KMathCenter, Kopete, Kicker improvements, Keramik window decoration, and more. Issue 38 covers the Klingon invasion, CVS Kung-Fu, and Mime news.

Comments (none posted)

Games

New games on Pygame

New items on the Pygame site include Pyx 0.9, Solarwolf 1.1, Cog engine 1.1.2, 4stattack 2.0, and Pyui 0.91.

Comments (none posted)

Graphics

KPovModeler: A Graphical Modeler for KDE

KDE.News covers the 0.2 release of KPovModeler. "KPovModeler is a full-featured graphical modeler and composer for creating POV-Ray(TM) scenes under KDE 3. It now supports almost the full gamut of POV-Ray 3.1 functionality -- see these nice screenshots. KPovModeler is a new member of the KDE Graphics package, but we are still looking for a documentation writer to join the project."

Comments (none posted)

Office Applications

AbiWord 1.0.2 released

Gnotices is carrying the news of the AbiWord 1.0.2 release. The biggest change seems to be the ability to embed AbiWord in other GNOME applications (such as Evolution or Gnumeric).

Comments (none posted)

AbiWord Weekly News

Issue #94 of the AbiWord Weekly News is out. It looks at continuing bug fixing activities and the 1.0.2 release.

Comments (none posted)

LyX 1.2.0 released

Version 1.2.0 of the LyX document processor - the first stable release in some time - has been announced. There is a long list of new features; see the announcement for the full scoop.

Full Story (comments: 3)

Two new Gnumeric releases

The Gnumeric project has announced two new releases of the Gnumeric spreadsheet. Version 1.0.7 is a bug fix release on the stable branch; it also includes better multilingual support. 1.1.5, instead, is a development release with quite a few new features including much improved printing support.

Comments (none posted)

Languages and Tools

Lisp

ILISP 5.12.0 released

Version 5.12.0 of ILISP has been released.

Full Story (comments: none)

Perl

Apocalypse 5 - Regular Expressions

Perl.com is running Apocalypse 5, the next installment in Larry Wall's definition of the Perl 6 language. This one deals with regular expressions. "In fact, regular expression culture is a mess, and I share some of the blame for making it that way. Since my mother always told me to clean up my own messes, I suppose I'll have to do just that."

Comments (none posted)

perl 5.8.0 RC 1 Released (use Perl)

Use.perl.org is carrying the announcement of the first Perl 5.8.0 release candidate. "This is a release candidate, and is not recommended for use in a production environment, but downloading and testing is strongly encouraged."

Comments (none posted)

SVG 2.1 Released (use Perl)

Use Perl Covers the release of SVG 2.1. "RO IT Systems has released SVG 2.1, a module for the server-side generation of images under the W3C SVG 1.0 recommendation. It is available through the CPAN and as a PPM on the company SVG site. Version 2.1 provides improved scripting and SMIL animation support. Also see the SVG::Parser companion module for parsing SVG images into the SVG module DOM. "

Comments (none posted)

PHP

PHP Weekly Summary

The June 3, 2002 PHP Weekly Summary is available. Topics include bug hunting, bundled XML, the PHP C-based extension library, DOMXML code changes, and more.

Comments (none posted)

Python

Catching up with Python-URL

A few issues of Dr. Dobb's Python-URL have come out since the last LWN development page:
  • The May 22 issue has quick looks at Python and KDE, the Python Spread module, and more.
  • The May 28 edition has extensive entries on programming libraries, features discussions, and more.
  • The June 3 issue looks at Pycaml, Twisted, Pygame, email parsing, PySQLite, and much more.

Comments (none posted)

The Daily Python-URL

This week's Daily Python-URL features an interview with Steve Alexander and Stephan Richter, and covers the Snake Farm project, the Toy Parser Generator, XML processing in Python, Python milters for Sendmail, using Zope with Apache, and more.

Comments (none posted)

Ruby

The Ruby Garden

This week's Ruby Garden looks at font initialization, changing the do...end syntax, Array#rotate!, and more.

Comments (none posted)

Ruby Weekly News

The June 6, 2002 edition of The Ruby Garden covers ruby-gsl 0.1.6, REXML 2.3.4 and 2.2.2, FAM-Ruby 0.1.0, RubyStudio 0.2, and Gnokii.

Comments (none posted)

Tcl/Tk

Dr. Dobb's TCL-URL!

The May 23, 2002 Dr. Dobb's Tcl-URL! covers the latest Tcl developments.

Full Story (comments: none)

Dr. Dobb's Tcl-URL!

The May 29, 2002 Dr. Dobb's Tcl-URL! looks at time server interaction, manipulation of TCL lists in C, creating new data types in C, migrating from Java to TCL, and more.

Full Story (comments: none)

Miscellaneous

GNUstep Weekly Editorial

The June 3, 2002 edition of the GNUstep Weekly Editorial is out with coverage of the latest developments in the GNUstep Object Oriented development environment.

Full Story (comments: none)

Jext 3.1pre4 available

Version 3.1pre4 of the Jext programmer's editor is available. This version includes bug fixes, and lots of new features, see the list of changes for the details.

Comments (none posted)

Page editor: Forrest Cook

Linux in Business

Business News

Coalition Asks European Parliament to Vote Against Data Retention

A coalition of 40 civil liberties organizations from 15 countries have sent the European Parliament an open letter which strongly recommends that Members vote against general data retention of communications by law enforcement authorities. There is also a petition that can be signed by those opposed to increased surveillance.

Full Story (comments: none)

SOT, MySQL and EFFI Team up to Oppose Software Patents

SOT has joined forces with MySQL AB and local lobby group Electronic Frontier Finland (EFFi) to file a statement to the Finnish Ministry of Trade and Industrial Affairs opposing the proposed EU directive that could allow software patents within Europe.

Full Story (comments: 1)

Notes from the BPDG conference call

FSF Executive Director Bradley Kuhn took part in a recent conference call held by the Broadcast Protection Discussion Group; here are his notes from the conversation. "I spoke for the FSF, stating that: (a) BPDG's recommendation would retroactively declare existing Free Software as "Covered Products", and (b) since we cannot, as a matter of ethics, add features to such Products that 'frustrate user modifications', we are at a complete impasse. BPDG must take seriously the concerns of Free Software."

Full Story (comments: none)

RealizationEngine 1.0 Released to Open Source Community

Realization Systems, Inc has released version 1.0 of their web-based RealizationEngine communication tool. "By employing a dual-licensing model, we will be able to offer this great project to most people at no charge, but still allow companies to build proprietary products on our code if they choose to purchase a non-GPL License."

Comments (1 posted)

Oracle delivers 'Unbreakable Linux'

Here is Oracle's press release on the availability of Oracle9i for Linux. "The release includes new high availability, business intelligence and XML features, as well as numerous manageability improvements. Oracle's unique approach to database clustering in Oracle9i Database has enabled enterprise customers to reduce the cost of deploying and managing the database." This is the product the company is calling "unbreakable Linux," which will always prove to be a hard claim to live up to.

See also the joint press release from Oracle, Red Hat, and Dell on their collective commitment to the Linux platform, and this one from Oracle and Red Hat on how the two have worked to improve the Red Hat Advanced Server product.

Comments (1 posted)

German government moves to IBM Linux

The German government announced that it will be working with IBM to move a number of its government agencies to the Linux platform.

Full Story (comments: none)

Sherwin-Williams to deploy Linux in 2500 stores

Sherwin-Williams (the largest U.S. paint retailer) has announced that it has contracted with IBM to deploy 9700 Linux systems in its 2500 stores. The systems will run paint tinting and color matching applications, as well as the occasional "manager's workstation." They will be running Turbolinux.

Full Story (comments: none)

PHP: most popular server-side Web scripting technology

Zend Technologies Ltd. announced that as of April 2002, PHP, the open-source software phenomenon, has surpassed Microsoft's ASP as the most popular server-side Web scripting technology on the Internet.

Full Story (comments: 4)

Zend issues new rev of Studio, PHP Development tool

Zend has issued a new release of the PHP development package, Studio 2.5. "Highlights of the new release include a new customization user interface, class browsers for projects and files, variable code completion, bracket matching, integrated function documentation engine and new 'smart' installer."

Full Story (comments: none)

Opera Gives Back to the Community

Opera Software unveiled its new Global Donations Program, giving registered versions of Opera away for free to organizations for the physically challenged, schools grades kindergarten through the 12th grade, as well as Web designer schools or individual programs.

Full Story (comments: 1)

Mandrakesoft Increases Revenue, offers more stock

MandrakeSoft has put out a release describing its recent financial performance: for the six months ending in March the company lost EUR 3.7 on revenue of EUR 2.33. Also announced is a new stock offering; existing shareholders have the first chance to buy more shares from the company. There is a registry for those who do not currently own shares, but who would like to participate in the new offering. If all the new shares are bought, the outstanding shares of MandrakeSoft will increase 33% to 5.1 million, and the company will raise about EUR 3.6 million.

Comments (none posted)

Caldera reports second quarter results

Caldera International has announced its second quarter results. The company lost $6.6 million on $15.5 million in revenue over the quarter.

Comments (none posted)

The May 2002 Netcraft Web Server Survey

The May, 2002 Netcraft Web Server Survey has been published, check it out for the latest web server usage statistics.

Comments (none posted)

Linux Stock Index for May 31 to June 04, 2002

LSI at closing on May 31, 2002 ... 24.30
LSI at closing on June 04, 2002 ... 23.96

The high for the week was 24.30
The low for the week was 23.56

Comments (none posted)

Press Releases

Open Source Announcements

Distributions and Bundled Products

Software for Linux

Products and Services Using Linux

Hardware with Linux support

Cross Platform/Porting Product

Linux at Work

Java Products

Books and Documentation

Partnerships

Financial Results

Personnel and New Offices

Miscellaneous

Page editor: Rebecca Sobol

Linux in the news

Recommended Reading

How Linux will Revolutionize the Embedded Market (LinuxDevices)

Here's a column by Michael Tiemann on LinuxDevices.com about how the embedded Linux market will settle out. "In the mean time, the deeper I look into environments adopting Linux, from embedded to enterprise, the more I believe that Linux has the requisite DNA and development model to truly scale from embedded to enterprise as a single platform, and Red Hat's focus will remain on ensuring that what works for the mainframe, and the server, and the workstation, also works for the appliance, the carrier, the router, the PDA, and the cellphone; and, of course, vice-versa."

Comments (none posted)

Processors: The next commodity? (ZDNet)

David Berlind suggests that processor power could become a tradeable commodity on the Internet. "Will the processor turn virtual and will MIPS ever become a commodity like electricity? Probably. But it may take a while. Current prototypes suggest that the first commercial grids will have some dependencies. For example, there will be Linux grids that are only good for Linux-based applications and they may only be able to run applications designed for a specific processor architecture like IA-64 or IA-32. "

Comments (none posted)

Open-Source Fight Flares At Pentagon (Washington Post)

The Washington Post reports on Microsoft's efforts to head off open source software use in the U.S. Military. "But the effort may have backfired. A May 10 report prepared for the Defense Department concluded that open source often results in more secure, less expensive applications and that, if anything, its use should be expanded."

Comments (none posted)

Obsolete Microkernel Dooms Mac OS X to Lag Linux in Performance (Linux Journal)

Here's a detailed, technical, and opinionated article in the Linux Journal on the superiority of Linux's monolithic kernel architecture. "Given how the microkernel experiment has worked out, I'm surprised by Apple's quaint choice to use a microkernel in a new design. At the very least, it creates an opportunity for Linux to establish and maintain performance leadership on the macppc platform."

Comments (2 posted)

Companies

Hanging onto the desktop, barely (ZDNet)

ZDNet looks at the battle between Microsoft and Sun for the corporate desktop. "It is not the alternative systems like Linux that pose such a threat to Microsoft's desktop hegemony. It is the crossover applications (Java, Open Office, Mozilla, and The Gimp) that could give Chairman Bill a bad hair day he might never get over."

Comments (5 posted)

CodeWeavers and NeTraverse Bring Office to Linux (OpenForBusiness)

Open For Business reviews CrossOver and Win4Lin. "The folks over at CodeWeavers are nothing short of geniuses - they have succeeded in making it a snap to install and operate Microsoft Office in Linux."

Comments (2 posted)

Sony ships PS2-Linux PC conversion kit (ZDNet)

ZDNet reports on Sony's release of a Linux kit for its PlayStation 2 platform. "Sony Computer Entertainment has begun shipping a kit for turning the PlayStation 2 into a Linux console, bowing to the requests of thousands of open-source programmers. The kit is available in the United States and Europe."

Comments (none posted)

Linux for Playstation comes to UK (BBC)

According to this article in the BBC News, Sony has started taking UK orders for a kit to turn the Playstation 2 games console into a computer running the Linux operating system. (Thanks to Jim Jarvie)

Comments (none posted)

IBM boosts Linux for oil industry (News.com)

IBM and Landmark Graphics will be building Linux supercomputers and PCs for oil and gas companies, according to this News.com article.

Comments (none posted)

IBM snags 'Lord of the Rings' deal (ZDNet)

ZDNet reports on IBM's sale of 150 workstations to Weta, a New Zealand-based film company. "The deal underscores IBM's recent push into digital effects as it and other technology giants try to capitalize on studios' move to embrace the Linux operating system, which has been promoted for its cost savings and flexibility."

Comments (none posted)

Sun's StarOffice no longer free (ZDNet)

Here's a ZDNet article on the (May 29) end to free downloads of StarOffice 5.2. "Sun's maneuvres with StarOffice are being closely watched as open-source software businesses continue to search for ways to boost revenues. Paid, proprietary software is controversial in the open-source world, which is based on the theory that profits can be made on 'free' products, but some open-source companies say it is the only way to continue to fund themselves."

Comments (none posted)

Sun to launch new low-end servers (News.com)

Sun Microsystems will launch two new low-end servers, according to this News.com article. "If you can't beat 'em, join 'em," Sun decided, announcing plans to sell low-end servers with Intel or Intel-compatible processors and the Linux operating system. It's better to cannibalize one's own sales than to lose them to other companies, the Santa Clara, Calif.-based company reasoned.

Comments (none posted)

Red Hat banding for compatibility (News.com)

News.com reports on Red Hat's Alliance program, which is intended to improve compatibility among products from different vendors. "The partners include BMC Software, Borland Software, Computer Associates International, IBM and Veritas Software. "

Comments (none posted)

Unified Linux effort won't faze Red Hat (News.com)

Here's News.com's take on UnitedLinux. "UnitedLinux pools some resources while giving much of the technological control to SuSE--a recognition of the reality that SuSE was the only Linux seller that had a development staff with depth comparable to Red Hat's."

Comments (6 posted)

Red Hat might face a new Goliath in 'United Linux' (NewsForge)

NewsForge reports on the upcoming announcement from Caldera, Conectiva, SuSE, and Turbolinux. "The United Linux announcement is marketing at it's most excellent: giving the public what they want. It's business strategy at its finest: Let's find out what makes Red Hat so successful and imitate it. They're nosing in on Red Hat's territory by invading and taking over the paradigm."

Comments (none posted)

Red Hat Co-founder Works on Next Venture (Raleigh, N.C. News & Observer)

In case you've been wondering what Red Hat co-founder Bob Young has been up to since he left his active Red Hat days behind, here's a story from The News & Observer (Raleigh, N.C.) about Bob's latest venture. "Lulu Enterprises -- Young takes the name from the 1930s definition of "lulu" as a remarkable thing, person or idea -- is the parent company of Lulu Press, which acquired some assets from the now-defunct OpenMind Publishing Group of Cary. Lulu Press is still in the formative stages."

Comments (none posted)

Business

Paint retailer brushes up on Linux (News.com)

News.com covers the move of Sherwin-Williams from SCO Unix to Linux. "Sherwin-Williams will use the PCs in more than 2,500 stores for running each store's centralized cash register software, reading e-mail and browsing the company's intranet, and for securely recording customers' choices in custom paint tints."

Comments (none posted)

Linux gets big in Christchurch (ComputerWorld)

ComputerWorld in New Zealand looks at local businesses that are using Linux. "The firm is now conducting policy routing between its ADSL and dedicated data connections, its proxy services, intrusion detection, mail gateways and traffic shaping, all using standard Linux utilities." (Thanks to Ross Boswell)

Comments (none posted)

The Business of Embedded Linux (LinuxDevices)

In this opinion column at LinuxDevices.com, Steven J. Vaughan-Nichols offers a perspective on the business side of the Embedded Linux Market. Vaughan-Nichols sees 'consolidation' in his crystal ball.

Comments (none posted)

Linux players bond for business software (News.com)

Here is another article on News.com about UnitedLinux. "However, the lack of participation by Red Hat in the UnitedLinux alliance is a problem, analysts said. UnitedLinux is redundant to the Linux Standard Base specification backed by Red Hat, according to IDC analyst Dan Kusnetzky."

Comments (6 posted)

Linux United - an operating system grows up (IT-Director)

IT-Director writes about Linux United. "If the announcement rolls out as everyone expects there will be five major Linux distributions - Red Hat, Mandrake, Debian, Slackware and 'Linux United'"

Comments (none posted)

Four Linux Vendors Launch 'UnitedLinux,' Others May Join Soon (Open For Business)

Open For Business looks at UnitedLinux. "In a brief correspondence with Mandrake co-founder Gaël Duval yesterday, he confirmed that MandrakeSoft was in talks with the UnitedLinux group. He noted that there were many factors that his company was considering, delaying any immediate decision by Mandrake on whether to join."

Comments (1 posted)

Commentary: Where UnitedLinux got it wrong (NewsForge)

NewsForge points out a problem with the UnitedLinux "no free binaries" policy. "No, many of the people downloading software from FTP sites are developers. They are the software providers -- the true software vendors, if you will -- who make the code which is UnitedLinux. By cutting off your development people, you are launching into dangerous territory. Alienating the Open Source community is a dumb move for most companies to make. But alienating them, and then expecting them to cooperate with your desire to sell their software, is profoundly foolish." The solution, they say, is to name the FTPable binary distribution "Hackers Linux."

Comments (14 posted)

Together We Get It Together (DesktopLinux)

Here's another view of United Linux, this time from DesktopLinux.com. "IBM plans to support UnitedLinux across its entire range of hardware, according to Scott Handy of IBM Worldwide. "Since UL supports ten languages, it's easier to build and deploy. We will also support Red Hat.""

Comments (none posted)

Linux Dreamworks Redux (Linux Journal)

Linux Journal takes us back to the DreamWorks SKG Glendale studio, to see how Linux was used in the production of Spirit, Stallion of the Cimarron. ""For Spirit the Ink and Paint department was entirely Linux, as was half of rendering", says DreamWorks Head of Animation Technology Ed Leonard. "Now all the departments have been converted. For our current production, Sinbad, every workstation and the entire renderfarm is Linux." Linux gained its first toehold in the motion picture industry on servers for rendering and has now become a standard desktop for artists. For Spirit DreamWorks utilized more than 150 Linux desktops. More than 350 are in use for Sinbad."

Comments (none posted)

Linux in the German government

The German government's plans for using Linux are covered by these articles on News.com and IT-Director.

Comments (1 posted)

German gov deal offers Linux great leap forward in Europe (Register)

The Register covers the announcement of a Linux-based cooperation agreement between IBM and Germany's ministry of the Interior. "The agreement also calls for IBM and the German government to create "innovative and reusable IT solutions for the federal administration," while IBM will be setting up an open source portal and providing support services."

Comments (none posted)

Linux takes on Microsoft turf in Germany (ZDNet)

ZDNet looks at the purchasing deal signed by the German government, IBM, and SuSE. "With the contract with IBM we meet three key targets,' Otto Schily, Minister of the Interior of the Federal Republic of Germany, said in a statement. 'We raise the level of IT security by avoiding monocultures; we lower the dependency on single software vendors; and we reach costs savings in software and operation costs.'"

Comments (2 posted)

(German) Federal Government to increase Linux use (Heise)

Here's an article (in German) on Heise Online about the German government's increased interest in using Linux. Avoidance of "manufacturer dependence" and increased security are cited. An English translation is available Via Google. (Thanks to Dan Kegel).

Comments (none posted)

The Penguin Continues Its March (Wired)

Wired looks at increasing Linux usage in government systems. "Overseas, Linux systems help keep order in Germany's parliament as well as China's post office, France's culture, defense and education ministries and other federal agencies in Europe and Asia."

Comments (1 posted)

Open Road For Open Source (TechWeb)

TechWeb takes a look at the growth of open source software. "It also has Microsoft worried. The company is trying to convince the Pentagon that open source is dangerous, suggesting that its use could jeopardize critical defense systems. (Interesting argument, coming from a vendor that has had more than its share of security problems.)"

Comments (1 posted)

Taiwan gets behind open source (News.com)

News.com reports that the Taiwanese government plans to start an open-source project. "An official with the National Center for High Performance Computing, Chuang Tze-nan, announced the plan Monday. Under the project, the government will encourage research and development in office software and the opening of the source code for government agencies and private establishments."

Comments (1 posted)

Global server market shrinks 15 percent (News.com)

News.com is carrying a Reuters article stating that the market for servers dropped 15% in the first quarter. The news is not all bad, though: "Sales of servers running Linux, the upstart operating system developed by engineers worldwide, jumped 54.7 percent from a year earlier to just under $400 million, with IBM leading the pack."

Comments (none posted)

Microsoft gets diplomatic in China (News.com)

News.com looks at Microsoft's challenges in China. "Still, the company must contend with the realities of the market in China. Linux is catching on here. Earlier this year, the Asia-Pacific wing of research firm Gartner said 15 percent of companies in the region--excluding Japan--used Linux in the fourth quarter of 2001, up from between 5 percent and 7 percent a year earlier."

Comments (none posted)

Interviews

Linux Orbit interviews Murray Cumming

Linux Orbit has an interview with Murray Cumming. "I sat down with Murray Cumming, lead developer on the gtkmm and gnomemm C++ bindings for GTK+ and GNOME to get some information on the status of C++ development in GNOME."

Comments (none posted)

An Interview with Dr. Edgar Villanueva (Linux Journal)

Linux Journal interviews Dr. Edgar Villanueva on the topic of free software in Peru. "Dr. Edgar Villanueva has recently become somewhat of a celebrity in the Free Software and Open Source communities as a result of his legislative efforts favoring free software and his highly publicized, well informed and eloquent response to a Peruvian Microsoft executive's letter."

Comments (none posted)

People Behind KDE: Jason Katz-Brown and Masaji Takeyama

KDE.News has interviews available with Jason Katz-Brown who recently enriched KDE CVS with Kolf, and with Masaji Takeyama who brings KDE to the masses in Japan.

Comments (none posted)

Interview of Paul F. Dubois of Numeric Python Fame

Get ready for the European Python and Zope Conference 2002 with a series of interviews with conference speakers. Here's the first one, with Paul F. Dubois.
"I think open-source science is taking off. If I am right and correctness is more precious to us than to banks, the correctness advantages of open source are important. I will talk about some key ideas for constructing open-source scientific programs, including the issue of how to make reusable components."

Comments (none posted)

Interview: Paul F. Dubois of Numeric Python Fame

Get ready for the European Python and Zope Conference 2002 with a series of interviews with conference speakers. Here's the first one, with Paul F. Dubois. "I think open-source science is taking off. If I am right and correctness is more precious to us than to banks, the correctness advantages of open source are important. I will talk about some key ideas for constructing open-source scientific programs, including the issue of how to make reusable components."

Comments (none posted)

Natural Curiosity: Dr. Mitra and the Hole in the Wall Experiment (Linux Journal)

Linux Journal has received an invitation for LJ readers to help interview Dr. Mitra about sustainable development and Linux.

Comments (none posted)

Resources

Visual Development with Qt 3.0 (Linux Journal)

Boudewijn looks at Qt 3.0 and talks about why its such a strong and useful visual design environment.

Full Story (comments: none)

Update on Linux compatible Single-Board Computers (LinuxDevices)

LinuxDevices.com is running a survey of Linux-friendly single-board computers. "With the growing availability of application-oriented system-on-chip processors, SBC vendors are beginning to target their boards at specific applications or classes of applications. For example, there are boards with two or more Ethernet ports that are intended for firewall/router uses or small palm-sized boards with built-in LCD controllers and touch input controllers for specialized handheld computer apps."

Comments (none posted)

Embedded Linux Newsletter

The May 30, 2002 Linux Devices Embedded Linux Newsletter is out. Topics include the business of embedded linux, the Dragonix Linux SBC, BOEL part 2, unification by Linux vendors, and more.

Full Story (comments: none)

Embedded Linux Newsletter for May 23, 2002 (Linux Devices)

The Linux Devices Embedded Linux Newsletter for May 23, 2002 features a guest editor by Red Hat CTO Michael Tiemann, an interview with ELC chair Mark Brown, and lots more on the topic of embedded Linux.

Full Story (comments: none)

What is Ogg Vorbis?

The Ogg Vorbis site has posted an introductory document that describes the Ogg Vorbis audio compression system.

Comments (14 posted)

Open Source Software Image Map

The National Imagery and Mapping Agency's National Technical Alliance has produced some reports on the benefits of open-source software development. ...a survey of relevant open source software packages was performed. Demonstrations were provided on an acquired workstation. The objective was to determine how Open Source Software technology and methodology could be applied to meet government requirements. The effort demonstrated the technological advantages of Open Source Software while highlighting several organizational challenges. Thanks to David Wheeler.

Comments (3 posted)

Is Beauty Only Pixel Deep?, Part 1 (Linux Journal)

The Linux Journal talks about management of X11 fonts in this "how to" article. "The real problem with fonts under Linux (under X actually) is the many different ways of handling fonts, not to mention different font types. We have both bitmap and outline fonts; which further break down into Speedo fonts, portable compiled fonts, Type1, TrueType, ghostscript fonts and others. This is one place where 'more than one way to do it' hasn't paid off."

Comments (none posted)

A TimeSys perspective on the Linux preemptible kernel (LinuxDevices)

LinuxDevices.com is running a whitepaper by Dr. Doug Locke, Vice President of Technology at TimeSys Corp. Dr. Locke explores the changes recently made to the mainstream Linux development kernel to improve its preemptibility, discusses the implications of these changes relative to embedded and real-time applications, and contrasts the recently adopted approach with that used in TimeSys Linux GPL.

Comments (none posted)

Asterisk -- punctuating the path to open source Packet Voice (LinuxDevices)

LinuxDevices.com has a whitepaper on the Asterisk Private Branch Exchange (PBX). "The Asterisk Private Branch Exchange (PBX) and Interactive Voice Response (IVR) platform offers an exciting look at the power and adaptability of the Linux kernel and GNU system. Asterisk turns a GNU/Linux system to the task of switching calls, and offers a large number of features to support communication in the business environment."

Comments (2 posted)

Reviews

Breaking the Ice: IceWM Review (LinuxOrbit)

LinuxOrbit reviews the IceWM window manager. "To start with, IceWM is very easy on system resources. If you've only used KDE or Gnome, then a switch to IceWM on your desktop will seem like a major computer upgrade."

Comments (none posted)

Netscape 7.0 Available As Preview Release (TechWeb)

Internet Week reviews Netscape 7.0 preview release 1. "The Mozilla browser code base, available in nearly complete open-source form for a while now, this week sees light of day for the first time as an official 'preview release' from America Online's Netscape division."

Comments (none posted)

Packet Design unveils Layer 3 switch (InfoWorld)

InfoWorld looks at Route Explorer, a new network appliance from Packet Design. "Within the appliance is an open-source mySQL database running on a Linux operating system. Standard with 20GB of disk space, Route Explorer records as many as 4 months of commands issued over OSPF and IS-IS protocols. Estrin says future releases of the product will also listen to BGP." (Thanks to Lenz Grimmer)

Comments (none posted)

Netscape 7 beta: first looks (Register)

The Register reviews Netscape 7 beta. "Netscape 7.0 Preview Release, which is based on the recent Mozilla 1.0 RC2 build and the Gecko browser engine, features a variety of enhancements on Netscape 6.2. These include tabbed browsing (a la Opera), print preview, the ability to save complete web pages, email return receipts, message labels and S/MIME support. A quick Search within mail and address book, filtering facility and mail alerts, has also been included."

Comments (none posted)

BRU-Pro 2.0: A Product Review (Linux Journal)

Here's a positive review of BRU-Pro 2.0, backup software for Linux, from Linux Journal. "BRU's biggest selling point, besides price, is down in the dirt of how it does backups. The philosophy BRU's creators took was that your backups are only as good as the data on them. It is easy to assume that since you backed something up, your data is safe; unfortunately, that is not always the case. Therefore, the creators designed BRU to provide accountability for every bit of data of every buffer block, local or remote."

Comments (none posted)

Book review: Craig Hollabaugh's Embedded Linux (LinuxDevices)

LinuxDevices.com is carrying a lengthy review of Embedded Linux by Craig Hollabaugh. "Don't let my quibbling with details in Embedded Linux mislead you -- this is an extraordinarily worthwhile book that anyone working with Linux in embedded systems should have."

Comments (none posted)

Cisco $15,000 'blade' is really a PC (Inquirer)

The Inquirer talks with an engineer who opened up the Cisco "Network Access Module" for its 6500 switch. "The card, he claims, is running a Linux kernel and has a number of GPL tools included such as syslogd klogd crond mingetty agetty ps & top. 'If you have access to CCO and download updated software for the NAM you find that it is basically a gziped disk image of a Linux System complete with Lilo and a number of FSF foundation utilities (strings imagefile | grep Foundation)'."

Comments (none posted)

Meet Dragonix (LinuxDevices)

The latest hardware profile from LinuxDevices.com is about "Dragonix." "What's Dragonix? It's an 'Open Hardware' single-board computer (SBC), based on a Motorola Dragonball 68VZ328 processor, running uClinux." Pictures included.

Comments (none posted)

FYI: Introducing Dillo, a lightweight embeddable browser

Linux Devices has published a white paper on Dillo, a small web browser that is suitable for use in embedded systems.

Full Story (comments: none)

It came from Boston U. (News.com)

This News.com article looks at Boston University's Scientific Computing and Visualization Group - Deep Vision Display Wall and the supercomputer that powers it. "A cluster of 52 dual-processor IBM X330 Linux servers renders and manipulates the images, while 24 workstations serve to direct eight projectors, which create the image. Each of the eight NEC liquid-crystal display (LCD) projectors costs about $4,500. In all, this extra equipment costs about $300,000."

Comments (none posted)

Miscellaneous

Experts warn of Linux/Windows virus (vnunet)

Much fuss is being made about the new "Simile" virus which, it is said, can infect both Windows and Linux systems. This vnunet article at least has captured an important point: "Linux users can even sit back smugly and consider themselves secure, as long as they do not log in as root and run dodgy email attachments." Very few Linux users, of course, would do such a thing...

Comments (none posted)

Linux development kernel gets Bluetooth (ZDNet)

Support for Bluetooth has been added to the Linux development kernel, reports ZDNet. "On 8 May the Linux Bluetooth protocol stack made its debut in version 2.5.14 of the Linux development kernel, in its first non-experimental form."

Comments (none posted)

Trial: Microsoft memo disallowed (ZDNet)

This article from Reuters reports on the rejection of a controversial memo as evidence. "In the memo, Microsoft Senior Vice President Joachim Kempin complained to Gates and other senior executives that computer chipmaker Intel was encouraging computer makers to support the rival Linux operating system and funding development of new devices that would work with Linux.

Kempin said Microsoft should withhold technical information from Intel and "work underground" to promote its competitors in the computer chip industry, according to portions of the memo disclosed in the states' legal filing."

Comments (2 posted)

Open Source Software May Offer Target for Terrorists

According to this press release, open-source software makes terrorism easy. "Opening the Open Source Debate", a soon to be released white paper by Alexis de Tocqueville Institution details the complex issues surrounding open source, particularly if federal agencies such as the Department of Defense or the Federal Aviation Administration use software that inherently requires that its blueprints, source code and architecture is made widely available to any person interested - without discretion.

Comments (2 posted)

Microsoft fails to win over the Pentagon (vnunet)

Vnunet reports on an attempt by Microsoft to get the Pentagon to dump its move to open source. "Among the most high-profile efforts is research funded by the National Security Agency to develop a more secure version of the open source Linux operating system..."

Comments (none posted)

Microsoft Finds Upgrade Plan A Tough Sell (TechWeb)

TechWeb examines the slow movement of Microsoft customers to the company's new licensing program. But some users may be holding out so they have the freedom to use alternatives. Microsoft's attempt could backfire. "Everyone's now thinking that Linux is the next best thing, because we're trying to figure out how to best manage the nickels we have left," Lindahl says. "Does Microsoft realize that?"

Comments (3 posted)

Microsoft Shills on the Attack, Again (OOoDocs)

The Open Office Documentation Project is running a commentary on the latest Gartner pronouncements. "The Gartner arguments are shallow and spurious, as if from another age, another time. What plantation are they talking about anyway? All of which causes any sane person to ask not about Open Office.org, but rather, "What's up with Gartner?"" (Thanks to Martijn Dekkers)

Comments (none posted)

From Junkie to, Well, Junkman (Wired)

Wired takes a look at James Burgett, a man who is building a trash empire from recycled computers. "All the machines are loaded with SuSe's version of the free Linux operating system. It takes too long to load Linux via the CD drive, so Burgett hooks each machine onto a network to burn in the operating system."

Comments (none posted)

Page editor: Forrest Cook

Announcements

Resources

Linux man pages at LinuxQuestions.org

You can now view man pages online at LinuxQuestions.org in HTML, Plain Text, PostScript, or PDF.

Comments (none posted)

Linux Gazette #79 (June 2002) available

The Linux Gazette #79 is now available for your reading pleasure. In addition to the usual features there are articles on the Dillo web browser, Compiler design with Python, and much more.

Comments (none posted)

Upcoming Events

GNOME2 and Evo Joint Bug Day

Help make Evolution and GNOME2 bug free. Join the GNOME2 and Evo Joint Bug Day next Thursday.

Comments (none posted)

Open Source Health Care Alliance call for participation (Linux Med News)

A call for participation has been sent out for the Open Source Health Care Alliance (OSHCA) meeting, which will be held in Los Angeles, CA during November.

Comments (none posted)

Boston GNOME Summit in July

The first bicentennial Boston GNOME Summit will be held in Boston July 18 - 20, 2002. This three-day hackfest is open to Foundation members only.

Comments (none posted)

LinuxTag 2002: KDE on Apple iBook and Sun UltraSPARC

The people from KDE will present a number of demonstrations at the LinuxTag conference in Karlsruhe, Germany. " UltraSPARC 60 with Sun Solaris and Apple iBook G4 PowerPC with Mac OS X -- these are amongst the diverse hardware and OS platforms on which KDE will be presenting its latest achievements to the world this week in Karlsruhe, Germany. Both installations will be running CUPS, to demonstrate how KDE Print can provide a great environment for an enterprise printing solution across different platforms. "

Comments (none posted)

LinuxWorld: 'Linux Around the World'

IDG World Expo announced that LinuxWorld Conference & Expo attendees will learn about the use of Linux and Open Source internationally in a new series of show floor presentations called "Linux Around the World."

Comments (none posted)

ActiveState Active Awards - Vote for your favorite (use Perl)

Use Perl has an announcement for the second annual Programmers' Choice and Activators' Choice Awards from ActiveState.

Comments (none posted)

Events: June 6 - August 1, 2002.

Date Event Location
June 6, 2002Linux@workAmsterdam
June 6 - 9, 2002 LinuxTag 2002(Exhibition Center)Karlsruhe, Germany
June 6, 2002 Embedded Systems Conference - Chicago(Donald E. Stephens Convention Center)Rosemont, IL
June 9 - 14, 20022002 USENIX Annual Technical ConferenceMonterey, CA
June 11, 2002Linux@workFrankfurt
June 12, 2002Linux@workZurich
June 12 - 14, 2002JabberConf Europe 2002Munich, Germany
June 13, 2002Linux@workMilan
June 18 - 21, 2002INET 2002(Crystal Gateway Marriott)Arlington, VA
June 20 - 21, 2002First International IFIP/ACM Working Conference on Component Deployment(CD 2002)Berlin, Germany
June 25, 2002
July 23, 2002
Seattle Ruby Brigade May MeetingSeattle, Washington
June 26 - 28, 2002Embedded Systems Expo & Conference in Tokyo(ESEC)(International Exhibition Center)Tokyo, Japan
June 26 - 28, 2002Yet Another Perl Conference(YAPC 2002)(Washington University)Saint Louis, Missouri
June 26 - 28, 2002European Python and Zope Conference(EuroPython 2002)(Charleroi Espace Meeting Européen)Charleroi, Belgium
June 26 - 29, 2002Ottawa Linux Symposium(OLS)Ottawa, Canada
June 27 - 28, 2002European Tcl/Tk User Meeting(Siemens Trainings Center)Munich, Germany
July 4 - 7, 2002UKUUG Linux Developers' Conference(University of Bristol)Bristol, UK
July 5 - 7, 2002Debconf 2(York University)Toronto, Ontario
July 18 - 20, 2002Boston GNOME SummitBoston, Mass.
July 22 - 26, 2002O'Reilly Open Source Convention(Sheraton San Diego Hotel and Marina)San Diego, California
August 1 - 2, 20023rd annual Bioinformatics Open Source Conference(BOSC 2002)Edmonton, Canada

Comments (none posted)

Miscellaneous

German Zope Users Group

A German Zope Users Group has been created, in German, of course. (Thanks to Holger von Ameln.)

Comments (none posted)

Page editor: Forrest Cook

Letters to the editor

software and warranties

From:	 "Krishna E. Bera" <keb@cyblings.on.ca>
To:	 lwn@lwn.net
Subject: software and warranties
Date:	 Fri, 24 May 2002 16:08:05 +0500

Re: http://www.lwn.net/2002/0523/

Under the Free Software model, software is not a product, it is a service.
That is, Free Software creators are continuously and incrementally adapting
the existing knowledge and code base for clients' needs.  Therefore, the
kind of liability laws used by lawyers and doctors would be applicable,
rather than those used by consumer products.

Closed source and proprietary software most closely resembles a black box 
product as you said.

It's a more difficult question how open source proprietary software, such as 
Sun's Java, should be treated.  Having the source and not being allowed to 
modify or release changes seems a lot like a "no user serviceable parts 
inside" kind of label, which implies manufacturer product liability.  On the 
other hand, who is to blame when people follow instructions in, say, 
Chilton's Auto Repair guides and get hurt?

Cheers,
Krishna E. Bera
Consultant, Cybling Systems
Ottawa, Canada

Comments (1 posted)

Software liability

From:	 Duncan Simpson <dps@io.stargate.co.uk>
To:	 letters@lwn.net
Subject: Software liability
Date:	 Thu, 30 May 2002 17:58:31 +0100


Surely the simplest solution for liability is simpler: if you sell the software
you are liable and if not then you can hide behind a disclaimer. Any attempts
to sell software and hide behind a disclaimer would be legally null and void or
simply illegal, with stiff penalties for contravention.

The latter would probably face significant restistance---at present claims that
something sold is not subject to a warranty are just legally null and void.
AFAIK nobody has tried to sue a softwrae manufatcurer on this basis yet,
possibly becuase of the vast sums that would be required to avoid losing by
default when a well funded vendor spins the process out as much as possible.

This is in line with my understanding of existing consumer protection laws. It
should be possible to claim that you are not selling the software if I can buy
one copy, install and use it on an infinte nummber of machines and lend my copy
to anybody else and allow them to do the same.

I am sure RH, SuSe, etc could live with that kind of redsitributability and
suspect the GPL requires them to allow this anyway (modulo the non-free items
merely aggegrated on the same media). I suspect all the commercial software
vendors could not accept these conditions and therefore be forced to sell their
software and thereby be liable for it's security, and hopefully merchantability
and so forth too.

If problems do come to light then vendors should be able to rectify this by
releasing a patch for no charge and notifying their customers, after which
their liability for that particular problem would cease. This might make
security patches avialable sooner because assuming that only 1% of your
customers are affected and therefore the bug does not maytter would become
unsafe. If that 1% might be able to sue you for $100 million+ actual damages
you might not be willing to take that risk.
-- 
Duncan (-:
"software industry, the: unique industry where selling substandard goods is
legal and you can charge extra for fixing the problems."

Comments (2 posted)

The war requires closed source?

From:	 James Crouchet <crouchet@sd.is.irs.gov>
To:	 letters@lwn.net
Subject: The war requires closed source?
Date:	 Tue, 28 May 2002 11:16:46 -0500

Dear LWN,

Reading through this week's front page I was struck by this pair of 
statements:

"The national security of the United States, it would seem, is dependent 
on the continued security-through-obscurity of closed source code.

Of course, there is no way, really, to know if that claim is true or 
not. The code is closed, so we will never know where the problems might 
be until somebody breaks it."

What bothers me is that this accepts Microsoft's Big Lie(tm) to 
concentrate on the small lies. The big lie is that by hiding the source 
code one can hide the workings of a program. The truth is that, at best, 
this approach will deter those of small technical ability or who lack 
determination. For those with more savvy and determination the binaries 
themselves can be analyzed and disassembled. Perhaps even decomplied. 
While it would be daunting to consider such a process for all the code 
in Windows, that is also unnecessary. One need only target the specific 
parts one wishes to break. None of of these are new ideas.

The only effective barrier that closed source builds is legal and foes 
such as crackers, foreign agents and terrorists care nothing about 
whether they might be violating Microsoft's copyright; they have already 
determined to violate much more serious laws.

I urge you to keep Microsoft's claims in perspective and refuse to 
accept their Big Lies(tm)

James Crouchet


Comments (none posted)

GNU/LINUX and RMS

From:	 "Anand Srivastava" <Anand.Srivastava@ascom.ch>
To:	 rms@gnu.org
Subject: GNU/LINUX and RMS
Date:	 Thu, 23 May 2002 09:42:32 +0200
Cc:	 letters@lwn.net

Dear Mr. Stallman,

Reading the letters at lwn today I realised, a basic problem with
your request of calling Linux GNU/Linux. 

Linux is agnostic to the debate of free or commercial software. People
developing Linux do not in general care about whether a software is 
free or not, as exemplified by the Bitkeeper case. If it works they will 
use it. But they are together in that they would use GPL license to 
develop their software because that protects their rights better. 
I believe that is the thinking of the majority of the Linux developers. 
So Linux will end up in free distributions as well as commercial
distributions. In fact the only free distribution that I can think of is
Debian, which already uses the GNU/Linux name.

Calling Linux would associate the name GNU/Linux with all the
commercial distributions as well, with non-free software. Do you
really want GNU name associated with commercial software.

I think its better that GNU/Linux name is only associated with the
Debian distribution. I wouldn't want its significance diluted by it
being used with commercial software.

thanks,
-anand

Comments (3 posted)

Re: it's not GNU/Linux; it's GNU

From:	 Steven Bosscher <s.bosscher@student.tudelft.nl>
To:	 Richard Stallman <rms@gnu.org>
Subject: Subject: Re: it's not GNU/Linux; it's GNU
Date:	 23 May 2002 11:33:43 +0200
Cc:	 letters@lwn.net

GNU/Linux? *sigh* Here we go again...

You know what? How about using the acronym LINU-X from now on, to refer
to the system Linux^WGNU/Linux?

LINU-X: Linu Is Not Unix with X. A perfect mix of Linux/GNU, I would
say. Not a complete GNU system, not a complete Linux system, something
in between. And it also emphasizes another major compoment of the
system: the X window system, which is not part of GNU but should also
get its credits, at least if we apply your reasoning for GNU/Linux to X
as well.

But hey, what's a system without a decent desktop these days? Now this
is interesting, because what would happen if somebody uses KDE? KDE is
not linux, it's not X, and it most certainly is not GNU, either. So
should we call the system LINU-X/KDE? And if somebody want to use an
office suite with that, say OpenOffice? LINU-X/KDE/OpenOffice! And a
system without a browser isn't of much use these days, either. Now I
don't like Konq, so I use Mozilla. LINU-X/KDE/OpenOffice/Mozilla!!!

But then all of a sudden you don't agree!?
> Reductio ad absurdum says that it should be
> GNU/BSD/TrollTech/MySQL/etc/Linux which aside from being unreasonable
> would be bad because it also highlights non-Free and less Free
> licences.

OK I follow you when you say this would be unreadable. But
LINU-X/KDE/OpenOffice/Mozilla doesn't highlight any non-Free and/or less
Free licenses. The whole system would be GPL/LGPL/X, in fact... These
are all Free licenses.

So, what you're actually saying is:
1) Linux is not Linux, it's GNU/Linux because it's actually GNU
GNU deserves credits.

2a) Linux is not X, it's X on Linux, which is actually X on GNU/Linux,
but we should not call this system X/GNU/Linux.
2b) Linux is not KDE, it's KDE on GNU/Linux, etc.
2c) Linux is not {Open,K,GNOME-}office, its... etc.
They don't deserve credits.

You make no sense to me, you're arguments are at best inconsistent. If
you were consistent, your GNU (with hurd) system should be called
GNU/Mozilla/etc. Maybe you can explain once more: Why does GNU have
rights to credits for the Linux system, and why don't other major
contributors have those same rights?

Greetz
Steven

Comments (none posted)

Re: it's not GNU/Linux; it's GNU

From:	 Richard Stallman <rms@gnu.org>
To:	 s.bosscher@student.tudelft.nl
Subject: Re: Subject: Re: it's not GNU/Linux; it's GNU
Date:	 Fri, 24 May 2002 15:13:15 -0600 (MDT)
Cc:	 letters@lwn.net

    You know what? How about using the acronym LINU-X from now on, to refer
    to the system Linux^WGNU/Linux?

This seems to be an attempt to excuse not solving the problem, rather
than a serious attempt to solve it.

In terms of informing the public, and in terms of fairness to the GNU
Project, there is no difference between "LINU-X" and "Linux".  Both of
them will spread the same inaccurate picture of how *and why* the
system was developed.  People will think it was started by Linus
Torvalds in 1991 just for fun, and won't know it was started by the
GNU Project in 1984 for the sake of your freedom and ours.

    Now I
    don't like Konq, so I use Mozilla. LINU-X/KDE/OpenOffice/Mozilla!!!

    So, what you're actually saying is:
    1) Linux is not Linux, it'ss GNU/Linux because it's actually GNU
    GNU deserves credits.

    2a) Linux is not X, it's X on Linux, which is actually X on GNU/Linux,
    but we should not call this system X/GNU/Linux.
    2b) Linux is not KDE, it's KDE on GNU/Linux, etc.
    2c) Linux is not {Open,K,GNOME-}office, its... etc.
    They don't deserve credits.

All of the contributors deserve credit, but some deserve it more
strongly than others.  The system is basically GNU; the GNU Project is
the principal contributor.  The others are secondary contributors.
They all deserve credit, but the principal contributor deserves it
most.

You cannot mention all the secondary contribitions in the name,
because there are too many of them.  But you can mention more than
one, and where to draw the line is up to you.  You can call the system
GNU/KDE/OpenOffice/Linux/Mozilla, and thus give credit to KDE,
OpenOffice, Mozilla and Linux, if you want.  That would not be wrong.

However, if you feel that name is too long, then you can drop some of
the secondary contributions such as KDE, OpenOffice, Linux and
Mozilla.  For instance, you might call it GNU/OpenOffice/Linux, or
GNU/Linux, or just GNU.  The one name that you shouldn't omit is the
name given by the system's principal developer -- GNU.  It's not right
to leave out the principal developer and give all the credit to a
secondary contribution such as KDE, OpenOffice, Linux or Mozilla.

The shortest legitimate name for this system is "GNU".  I prefer to
call it "GNU/Linux", for three reasons:

* This system is not exactly the GNU system--it has a different
  kernel.  Calling it "GNU/Linux" helps distinguish it from GNU.

* It would be ungentlemanly to ask people to stop giving Linus
  Torvalds a share of the credit.  "GNU/Linux" gives him equal mention.

* People who have been taught that the system is "Linux" will see the
  name "GNU/Linux" and realize it has something to do with what they
  know about.  They may not recognize this if we call it just "GNU".

Comments (6 posted)

GNU & Linux???

From:	 Ron Johnson <ron.l.johnson@cox.net>
To:	 rms@gnu.org
Subject: GNU & Linux???
Date:	 25 May 2002 23:39:16 -0500
Cc:	 krooger@debian.org, letters@lwn.net

Mr. Stallman,

> It is not wrong to shorten the name GNU/Linux to GNU.  The system is
> basically GNU.  There are three reasons why I say "GNU/Linux":
> 
> * To distinguish it from GNU properly speaking, which uses the Hurd.
> 
> * To give Linus a share of the credit.  It would be ungentlemanly
> to ask people to stop giving him credit.

Gack!!  

Every night when you lay down to sleep, you should thank 
${DEITY} that Linus came along to spread the GNU utilities 
beyond academia.  

In the past 11 years, _at_least_ 100,000 man-hours of effort 
have gone into that kernel.  GNU has been working on Hurd since 
_way_ before Linux came out, and _still_ isn't at v1.0!  

For you then to say "It would be ungentlemanly to ask people 
to stop giving him credit" takes way more chutzpah than in all 
of NYC & Miami Beach combined.

-- 
+---------------------------------------------------------+
| Ron Johnson, Jr.        Home: ron.l.johnson@cox.net     |
| Jefferson, LA  USA      http://ronandheather.dhs.org:81 |
|                                                         |
| "I have created a government of whirled peas..."        |
|   Maharishi Mahesh Yogi, 12-May-2002,                   |
!   CNN, Larry King Live                                  |
+---------------------------------------------------------+

Comments (2 posted)

Re: GNU & Linux???

From:	 Richard Stallman <rms@gnu.org>
To:	 ron.l.johnson@cox.net
Subject: Re: GNU & Linux???
Date:	 Sun, 26 May 2002 19:50:20 -0600 (MDT)
Cc:	 krooger@debian.org, letters@lwn.net

    Every night when you lay down to sleep, you should thank 
    ${DEITY} that Linus came along to spread the GNU utilities 
    beyond academia.  

Describing the GNU system as "utilities" is quite an understatement.
GNU is not a set of utilities--GNU is an operating system.  The
GNU/Linux system is pretty much the same as GNU, but not entirely the
same, because it has Linux in it too.

I appreciate Torvalds' contribution to the GNU/Linux system.  I credit
Torvalds (not hypothetical gods) for this work, and that's one reason
I mention his contribution in the name of the operating system.

I also appreciate that Torvalds' kernel would have mattered little for
computer users' freedom, if not for the fact that we had already
produced most of a free operating system for it to fit in.
Giving him equal mention is more than fair.

Comments (4 posted)

Re: Open-Source Fight Flares at Pentagon (Washington Post)

From:	 Eric Smith <eric@brouhaha.com>
To:	 letters@lwn.net
Subject: Re: Open-Source Fight Flares at Pentagon (Washington Post)
Date:	 28 May 2002 14:10:25 -0000

Gentlemen,

On May 23, you referenced an article by Jonathan Krim in the Washington
Post regarding use of open-source software in the Defense Department.
There was an interesting statement in the last paragraph of that
article:

    ... the Defense Department is now prohibited from purchasing any
    software that has not undergone security testing by the NSA.

Perhaps more interesting is what the article did NOT say, which is that
free software does NOT need to be purchased.  While many people focus on
the "free speech" aspect of free software (and rightfully so), there are
definitely some circumstances in which the "free beer" aspect can be
important and useful.

I'm not trying to suggest that the Defense Department and NSA should not
conduct security testing of free software, but merely that procurement
regulations are a complete non-issue for it.

Comments (2 posted)

Page editor: Jonathan Corbet

Copyright © 2002, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds