LWN.net Weekly Edition for April 29, 2004

Debian: too free?

The Debian Project's social contract is that project's guiding philosophy. When the project considers a decision or an action, consistency with the social contract is one of the first requirements. Debian developers are also concerned with freedom, as witnessed by the endless battles over what should be done with the "non-free" repository. These two issues came together this month when the project's developers approved the first change to the contract since 1997. Where Version 1.0 read "Debian will remain 100% free software," the new version says, instead, "Debian will remain 100% free." The new wording requires that the Debian system and all its components conform to the Debian Free Software Guidelines. This change was clearly aimed at bits and pieces of non-free materials that have been present in Debian since the beginning: firmware in device drivers, GFDL-licensed manuals, etc.

Whether intended or not, the new wording has already claimed a big victim: the upcoming "sarge" release. The next major release of Debian is already far later than had been hoped - but that is not particularly surprising for a Debian release. What is surprising is that release manager Anthony Towns has let it be known that the new social contract will delay things further. The sarge release, as it stands now, does not conform to the newly-reworded social contract. Given the overt nature of the changes to the contract, Anthony does not believe he can just look the other way and release regardless. Most Debian developers would appear to agree with his interpretation of the contract.

In practical terms, this means that a lot of changes will have to be made to sarge before it can go out. The GFDL-licensed documentation (for small packages, like the C library) will have to be removed. Support for hardware requiring binary-only firmware downloads will be removed. The installer will have to be rewritten so that people who happen to have the firmware for their (otherwise unsupported) hardware can install the system. It has also been noted that a lot of fonts may have to be removed from Debian as well. All in all, Anthony figures that, with these changes, there is no chance that sarge will be released this year.

The Debian Project, in other words, is in a bit of a bind. The current Debian stable release is approaching a truly geriatric state; few users are much interested in GNOME 1.4, KDE 2.2, XFree86 4.1, Mozilla 1.0, Netscape 4.77 (!), gcc 3.0, or the 2.2 kernel at this point (though, in fairness, there are 2.4 kernels available for woody as well). This release has done its time; it should not be expected to last into 2005. Somehow, if Debian is to remain relevant to anybody beyond those using the (occasionally scary but always highly useful) unstable version, it is going to have to find a way around this problem and get a new release out.

One possibility is this new general resolution which is tentatively set for a vote in the second half of May. This resolution would create a "sarge exception" by revoking the social contract change - but only until the beginning of September, when the new language would, once again take effect. This resolution would enable the project to get a release out (and, incidentally, impose a deadline on that release) under the old rules. Subsequent distributions could then be purged of offending materials at relative leisure.

In the longer term, Debian is going to have to come to a conclusion about where its priorities truly lie. Despite the incredible progress made over the last 20 years, creating a 100% free system is still a very hard thing to do. Most of us will never have the source to the firmware running in our network controllers. Maybe someday we will have 100% free fonts, but that is not this day. There will always be disagreements over which licenses are truly free - as witnessed by the fact that Debian is fighting over documentation licenses that have passed muster with Richard Stallman. Any distribution which insists on 100% purity is going to have a hard time producing a system that is actually useful in the near future.

As Ted Ts'o puts it, this episode may be a fortunate thing in that it will force a debate over the project's goals. If Debian is really about making the best possible system, the developers will eventually get back to that task.

Others see things differently, however:

In other words, the social contract change, its aftermath, and the philisophical differences behind it risk creating a fork in the Debian distribution. One might argue that this fork has already happened; look at UserLinux, for example. Such a fork would be an unfortunate thing; the Debian Project has been a technological and philosophical leader of the community for many years. One can only hope that Debian will figure out how to reconcile its goals and continue in that role well into the future.

Comments (34 posted)

The 2004 Desktop Linux Summit

The 2nd annual Desktop Linux Summit was held at the Del Mar fairgrounds, North of San Diego, California on April 22 and 23, 2004. The event was sponsored by Lindows and several other companies. Attendance at the event was busy, but not overwhelming, the folks at Lindows said that there were over 1000 attendees, about twice the draw of the previous event. There were relatively few Linux-specific companies and organizations in the vendor booths, Lindows occupied many of the booths, and several vendor-neutral hardware companies were present.

As the conference's name implied, the focus was about the placement of Linux on the desktop, both in corporations and at home. During the event, there were several recurring ideas coming from the panel members and the audience. While many individuals and companies have been attempting to displace Microsoft from its position of dominance on the desktop, there was a growing feeling that doing so is an incredibly difficult task, especially in the US market. It is nonetheless, a task that many are still working hard at to accomplish.

A large percentage of individual and corporate computer users have been tied to the Microsoft way of doing things for a long time, and they are very resistant to change, even if it means saving a lot of money. Never underestimate user inertia, as a former co-worker of mine is fond of saying. It's hard to compete with the big guys on their own turf. Also, the perpetual inability to purchase both desktop and laptop computers with Linux pre-loaded was brought up frequently. This is a major factor that is slowing Linux adoption by the public sector.

Clay Christensen

A common theme in the event was that Linux has become a Disruptive Technology, that it may achieve world domination through a process other than replacing the Microsoft-based PC. The majority of the world's population has never had access to a computer (or a phone line, or a power grid). For people in this group who are just getting access to power and telecom resources, the choice between a secure, free (as in beer and as in freedom) operating system with tons of free applications, versus a virus-vulnerable, expensive, or pirated operating system is fairly easy to make. For third-world and emerging countries with little pre-existing technological infrastructure, Linux-based systems are a fairly appealing solution. Linux is also acting in a disruptive manner by entering in on the low end equipment such as PDAs and cell phones. Over time, these devices have begun to perform an ever-increasing share of the tasks formerly done by desktop computers.

Another observation is that Linux on the desktop has become fairly mature, reliable, and repeatable. Most of the basic components are already in place. The operating system is reliable, the basic desktop components such as browsers, mail clients, and office suites are available, and reliable. There is, on the other hand, a notable lack of financial applications for Linux, none of the major commercial software vendors have ported their applications to Linux.

Open file exchange formats were seen as both a strength and a weakness for Linux. For those dealing with Linux, the ability to use open file formats is a big plus, mainly because access to their own information will be possible for the foreseeable future. Lock-out due to changing proprietary file formats is not likely under Linux. The inability to reliably exchange files with the ever-changing proprietary formats from Microsoft was seen as a big obstacle in the adoption of Linux. That is also an obstacle to Microsoft's own customers, locking them in to a never-ending path of buying upgrades and having to convert older information forward. There is a notable shift in the browser arena, desktop browsers are rapidly losing ground to cell phone and PDA-based browsers. This is causing people who create web pages that are only viewable in Microsoft's Internet Explorer to lose viewers.

On the amusing side, one of the popular T-shirts at the conference referred to recent SCO actions with "So, Sue Me" in big letters. The gun show that was being held in the adjacent building was mentioned a few times.

Lastly, the current generation of PCs are increasingly being seen as being too fat for the desktop, both in hardware and software. Current PCs are power hungry devices that are loaded with multimedia equipment, giant hard drives, big memory, etc. Individual PCs now have hardware and software that is as complicated as the servers of just a few years ago, along with the associated systems administration requirements. There is a push toward making corporate desktop machines into simple, replaceable appliances. Of course, this may just be another swing of the pendulum in the oft-repeated cycle between centralized servers with dumb (X)terminals, and loaded desktops. The fully loaded multi-media boxes are increasingly headed for use as home entertainment centers. A number of different platforms were discussed as lightweight desktop appliances. Linux-based thin clients, diskless clients, Sun's Java desktop system, and laptops were all contenders for this space.

The Desktop Linux Summit presentations and panel sessions are covered in more detail. Take a look for coverage of the international expansion of desktop Linux, Ian Murdock's talk on Componentized Linux, Doc Searls on making Linux the Chevy Cavalier of operating systems, an analyst's view of the current state of Linux on the desktop, mainstreaming the Linux desktop, Nat Friedman on the evolution of the Linux desktop, and what Lindows is up to.

Comments (4 posted)

The JPEG patent

Just in case anyone needed further proof of the dangers of software patents, along comes Forgent trying to wring money out of users of the JPEG standard long after it has become entrenched. After two years of trying to wheedle licensing fees for JPEG, the company announced last week that it was suing 31 companies, including IBM, Apple, Xerox, Panasonic and Macromedia to name just a few, for infringement of U.S. Patent 4,698,672, entitled "Coding System for Reducing Redundancy."

The company has been trying to monetize the '672 patent since 2002, and has managed to extract licensing fees from more than 30 companies, including Sony, to the tune of $90 million for use of the JPEG format. Forgent isn't exactly modest in its claims. In its press release, Forgent claims to have:

While Forgent presses on with its claims, others have expressed doubt as to whether the patent claims would stand up. The JPEG committee has issued statement saying that the committee "believes that prior art exists in areas in which the patent might claim application to ISO/IEC 10918-1 [the JPEG standard] in its baseline form." The statement was issued back in 2002, when Forgent initially began asserting patent claims.

There seems to be some confusion over the actual expiration date of Forgent's patent as well. According to Forgent, the patent expires in October 2006. Others are saying that the patent is set to expire this October, seventeen years from the date the patent was granted. The U.S. Patent and Trademark Office's (USPTO) website seems to support Forgent's position. According to the USPTO FAQ, patents granted prior to June 8, 1995 "automatically have a term that is the greater of the twenty year term discussed above [from the application date] or seventeen years from the patent grant." The patent application was submitted October 27, 1986 and granted October 6, 1987 which gives Forgent a little more than two years to harass software companies making use of JPEG.

The Independent JPEG Group (IJG), responsible for widely-used JPEG library (libjpeg), makes no mention of the Forgent claims on its website. In fact, the IJG makes little mention of anything on its website, including valid contact information. The README that comes with the JPEG library says that the software avoids the arithmetic coding of the JPEG specification due to patents owned by IBM, AT&T and Mitsubishi. No mention is made of the '672 patent. However, IJG organizer Tom Lane was quoted two years ago as saying that Forgent's patent does not apply:

At the moment, open source developers do not seem to be in a rush to remove JPEG capability from their projects, but are instead taking a "wait-and-see" attitude. The topic has come up on Debian-legal, the Gimp-developer mailing list and other project lists. So far, no project has come out to say that they would be pulling JPEG support, much to this writer's relief. A quick count shows that more than 150 packages installed on my system depend on libjpeg.

Even if Forgent's claims amount to nothing more than a nuisance for a handful of proprietary software companies, they still highlight a problem for open source software. Companies will continue to press software patent claims so long as the legal system permits, and there's money to be made. It's only a matter of time before one of the suits has a serious impact on open source.

Comments (10 posted)

SCO Weekly News

Last week, we discussed BayStar's wish to reclaim its investment in the SCO Group. Some observers may have thought that this move was a sign that BayStar had figured out the true nature of the company it had invested in. That may, in fact, be true, but not quite in the way some people had imagined. BayStar's real problem, it would seem, is that SCO continues to maintain the pretense of having a Unix business; BayStar sees that as a distraction from the real "value" of the company: its lawsuits. To regain BayStar's good favor, SCO would need to dump the Unix business and replace its top management with people who know more about intellectual property litigation and, while they're at it, have better control over what they say in public. SCO seems unwilling to give in to those demands, but if BayStar looks like it will go to court, SCO's board may find itself in a more accommodating mood.

Groklaw has done some research into the background of Bert Young, SCO's new chief financial officer. Mr. Young, it seems, is not new to dishonest companies and legal action. He should, indeed, be a good fit for SCO.

In the IBM case, SCO has filed a new motion asking that IBM's copyright-oriented counterclaims be dismissed or, failing that, split into a separate trial. SCO claims that the copyright issue is "pending in litigation in Nevada" and need not be considered separately in Utah. The Nevada case is the AutoZone suit. Given that copyrights are an issue in the IBM case, the chances of it being put aside for the newly-filed AutoZone case seem pretty small.

...especially since AutoZone has filed a motion of its own stating that SCO's suit should be put on hold pending the outcomes of the IBM, Novell, and Red Hat cases. Since those cases touch on issues like the validity of SCO's claimed copyrights and whether Linux violates those copyrights, AutoZone seems to think that their outcome might have some relevance to the charges it is facing. It will also, no doubt, surprise readers to find out that AutoZone is having a little trouble figuring out exactly which copyrights it is being accused of violating:

One might conclude, from all of this, that AutoZone has been paying attention to what has transpired thus far and is not in a mood to settle.

DaimlerChrysler has filed a response to SCO's complaint (which, remember, is all about DaimlerChrysler's failure to provide the "certification" demanded by SCO). The text of that response is not yet available, though Groklaw may well have it by the time you read this. DaimlerChrysler has, evidently, raised a long list of affirmative defenses, and is asking for a summary dismissal of the case with prejudice.

Worth a quick note: according to the NASDAQ, there were almost 4 million shares of SCO stock sold short as of the middle of April - an all-time high. Despite the fact that the company's stock is pushing toward its lowest levels in almost a year, many people seem to expect it to go lower. LWN is not in the business of giving investment advice, and you would be well advised to ignore us if we were. But it is worth noting that, at current volume levels, it would take almost three weeks of trading to cover all of those short positions. That is a recipe for a "short squeeze" and a stock price spike. Be careful out there.

Comments (1 posted)

Page editor: Jonathan Corbet

Security

Review: Exploiting Software

The world is full of books on how to secure systems, how to write secure code, and how to deal with breakins. There are rather fewer books that go into details of how to compromise software and carry out breakins. That gap has now been filled by Exploiting Software: How To Break Code by Greg Hoglund and Gary McGraw. This book's purpose is not to help the crackers; those people, according to the authors, already know about the techniques described here. Instead, the authors wish to help programmers and system administrators achieve better security through an understanding of how security failures happen.

To that end, this book covers a number of ways of attacking software. Direct reverse engineering gets a full chapter, much of which is dedicated to things you can do with the Windows debugger. There is a chapter on server attacks; it looks at carefully crafted input, configuration attacks, filesystem browsing, poor authentication schemes, etc. The chapter on client-side attacks covers cross-site scripting, embedded control characters, and more. The creation of malicious input gets a chapter of its own, where issues of how to track what a server does with input, tricks with character encodings, and more are discussed; this chapter also looks at how to get malicious input past intrusion detection systems. Buffer overflows and format string vulnerabilities are discussed in detail; interestingly, the authors claim that format string vulnerabilities were known to the "black hats" for years before being more widely "discovered" and, mostly, fixed. The book finishes with a discussion of root kits.

If you are a cracker wannabe looking to learn the trade, this book might provide a good start - though you will still have to fill in a lot of the details yourself. This book is not a simple cookbook for crackers, though some of its advice ("Also, remember that a Web server will create log files of all injection activity, which tends to stick out like a sore thumb. If this pattern is used, clean the log files as soon as possible.") is not necessarily useful for anybody else. The coverage of the book is not entirely complete either; it has little space for kernel attacks, SQL injection, or exploit generation tools, for example. While Linux is often mentioned, the bulk of the discussion uses Windows for its examples (though almost all of the concepts discussed apply equally to either system). Even so, Exploiting Software is a worthwhile addition to the bookshelf of anybody interested in security issues - as most of us should be.

Comments (3 posted)

Quick review: Secure Architectures with OpenBSD

One other book that recently showed up in our mailbox is Secure Architectures With OpenBSD by Brandon Palmer and Jose Nazario. This book is, primarily, a system administration manual, but, since it's for OpenBSD, it is strongly oriented toward running secure systems. It covers all of the usual topics, though often a bit more superficially than one might like. The range of topics is wide, however, extending into firewalling, Kerberos, S/Key, IPSec, IPv6, intrusion detection, etc. If you're looking for a pure BSD administration manual, you may want to supplement this one with the Unix Administration Handbook or something similar. This book, however, is a good, thorough overview of how the OpenBSD variant of BSD is put together and how to keep it secure.

Comments (none posted)

New vulnerabilities

ident2 buffer overflow

Package(s):	ident2	CVE #(s):	CAN-2004-0408
Created:	April 22, 2004	Updated:	April 28, 2004
Description:	Jack <jack -AT- rapturesecurity.org> discovered a buffer overflow in ident2, an implementation of the ident protocol (RFC1413), where a buffer in the child_service function was slightly too small to hold all of the data which could be written into it. This vulnerability could be exploited by a remote attacker to execute arbitrary code with the privileges of the ident2 daemon (by default, the "identd" user).
Alerts:	Debian DSA-494-1 2004-04-21

Comments (none posted)

kernel - root exploit in MCAST_MSFILTER

Package(s):	kernel	CVE #(s):	CAN-2004-0424
Created:	April 22, 2004	Updated:	June 11, 2004
Description:	A locally exploitable integer overflow has been found the multicast code of the Linux kernel versions 2.4.22 to 2.4.25 and 2.6.1 - 2.6.3. A successful exploit could lead to full superuser privileges.
Alerts:	Whitebox WBSA-2004:183-01 2004-06-10 SuSE SuSE-SA:2004:010 2004-05-05 Slackware SSA:2004-119-01 2004-04-28 Mandrake MDKSA-2004:037 2004-04-27 Red Hat RHSA-2004:183-01 2004-04-22 Fedora FEDORA-2004-111 2004-04-22 Trustix TSLSA-2004-0022 2004-04-21

Comments (1 posted)

LCDproc: Buffer overflows and format string vulnerabilities

Package(s):	LCDproc	CVE #(s):
Created:	April 27, 2004	Updated:	April 28, 2004
Description:	Due to insufficient checking of client-supplied data, the LCDd server is susceptible to two buffer overflows and one string buffer vulnerability. If the server is configured to listen on all network interfaces (see the Bind parameter in LCDproc configuration), these vulnerabilities can be triggered remotely.
Alerts:	Gentoo 200404-19 2004-04-27

Comments (none posted)

racoon: denial of service vulnerability

Package(s):	ipsec-tools racoon iputils	CVE #(s):	CAN-2004-0403
Created:	April 26, 2004	Updated:	July 29, 2004
Description:	racoon does not check the length of ISAKMP headers. Attackers may be able to craft an ISAKMP header of sufficient length to consume all available system resources, causing a Denial of Service. This advisory contains additional details.
Alerts:	Red Hat RHSA-2004:308-01 2004-07-29 Mandrake MDKSA-2004:069 2004-07-14 Fedora FEDORA-2004-197 2004-06-28 Whitebox WBSA-2004:165-01 2004-06-10 Fedora FEDORA-2004-132 2004-05-19 Red Hat RHSA-2004:165-01 2004-05-11 Gentoo 200404-17 2004-04-24

Comments (none posted)

XFree86 minor DoS vulnerability

Package(s):	XFree86	CVE #(s):	CAN-2004-0093 CAN-2004-0094
Created:	April 22, 2004	Updated:	April 28, 2004
Description:	XFree86 is an implementation of the X Window System, providing the core graphical user interface and video drivers. Flaws in XFree86 4.1.0 allow local or remote attackers who are able to connect to the X server to cause a denial of service via an out-of-bounds array index or integer signedness error when using the GLX extension and Direct Rendering Infrastructure (DRI).
Alerts:	Red Hat RHSA-2004:152-01 2004-04-21

Comments (1 posted)

Updated vulnerabilities

apache - denial of service in mod_ssl

Package(s):	apache	CVE #(s):	CAN-2004-0113
Created:	April 13, 2004	Updated:	May 25, 2004
Description:	A memory leak has been discovered in mod_ssl that may be triggered by sending normal HTTP requests to the Apache HTTPS port. An attacker can exploit this vulnerability to consume all memory available in the server, thus causing a denial of service condition. This problem has been fixed in Apache 2.0.49.
Alerts:	Fedora FEDORA-2004-117 2004-05-25 Mandrake MDKSA-2004:043 2004-05-10 Red Hat RHSA-2004:182-01 2004-04-30 Conectiva CLA-2004:839 2004-04-13

Comments (none posted)

cvs: client-side file overwrite vulnerability

Package(s):	cvs	CVE #(s):	CAN-2004-0180
Created:	April 14, 2004	Updated:	May 18, 2004
Description:	The cvs client is vulnerable to a pathname vulnerability which can allow a hostile server to overwrite files on the local system. The cvs server is subject to a similar vulnerability which allows the checkout of RCS archives anywhere on the server system. Versions 1.11.15 and 1.12.7 fix the problem.
Alerts:	Fedora FEDORA-2004-110 2004-04-22 Whitebox WBSA-2004:153-01 2004-04-19 Slackware SSA:2004-108-02 2004-04-17 Netwosix NW-2004-0011 2004-04-18 Debian DSA-486-1 2004-04-16 Gentoo 200404-13 2004-04-14 OpenPKG OpenPKG-SA-2004.013 2004-04-14 Red Hat RHSA-2004:153-01 2004-04-14 Red Hat RHSA-2004:154-01 2004-04-14 SuSE SuSE-SA:2004:008 2004-04-14 Mandrake MDKSA-2004:028 2004-04-14

Comments (none posted)

ethereal - multiple vulnerabilities

Package(s):	ethereal	CVE #(s):	CAN-2004-0176 CAN-2004-0365 CAN-2004-0367
Created:	March 29, 2004	Updated:	June 2, 2004
Description:	There are multiple vulnerabilities in versions of Ethereal earlier than 0.10.3. More information can be found in this advisory from ethereal.com and in this Eye on Security advisory.
Alerts:	Debian DSA-511-1 2004-05-30 OpenPKG OpenPKG-SA-2004.015 2004-04-16 Red Hat RHSA-2004:137-01 2004-03-31 Mandrake MDKSA-2004:024 2004-03-30 Conectiva CLA-2004:835 2004-03-31 Red Hat RHSA-2004:136-01 2004-03-30 Netwosix NW-2004-0007 2004-03-29 Gentoo 200403-07 2004-03-28

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

iproute: local denial of service

Package(s):	iproute net-tools	CVE #(s):	CAN-2003-0856
Created:	November 25, 2003	Updated:	December 14, 2004
Description:	The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible.
Alerts:	Mandrake MDKSA-2004:148 2004-12-13 Fedora FEDORA-2004-154 2004-06-03 Fedora FEDORA-2004-115 2004-05-11 Debian DSA-492-1 2004-04-18 Gentoo 200404-10 2004-04-09 Red Hat RHSA-2003:316-01 2003-11-24

Comments (none posted)

racoon: failure to verify signatures

Package(s):	ipsec-tools racoon	CVE #(s):	CAN-2004-0155
Created:	April 7, 2004	Updated:	August 19, 2004
Description:	Versions of ipsec-tools prior to 0.2.5 contain a vulnerability wherein the racoon utility fails to verify digital signatures on some packets. This hole can lead to unauthorized connections or man-in-the-middle attacks. See this advisory for details.
Alerts:	Whitebox WBSA-2004:308-01 2004-08-19 Mandrake MDKSA-2004:027 2004-04-08 Gentoo 200404-05 2004-04-07

Comments (none posted)

kdelibs: cookie disclosure

Package(s):	kdelibs	CVE #(s):	CAN-2003-0592
Created:	March 10, 2004	Updated:	August 24, 2004
Description:	kdelibs (and, thus, Konqueror) has a vulnerability where a hostile server can force the disclosure of cookies that should not be presented to it. KDE versions 3.1.3 and later contain a fix.
Alerts:	Gentoo 200408-23 2004-08-24 Red Hat RHSA-2004:074-01 2004-03-10 Red Hat RHSA-2004:075-01 2004-03-10 Mandrake MDKSA-2004:022 2004-03-10 Debian DSA-459-1 2004-03-10

Comments (none posted)

kdepim: VCF file information reader vulnerability

Package(s):	kdepim	CVE #(s):	CAN-2003-0988
Created:	January 15, 2004	Updated:	May 26, 2004
Description:	KDE has issued a security advisory for all versions of kdepim as distributed with KDE versions 3.1.0 through 3.1.4 inclusive. A carefully crafted .VCF file potentially enables local attackers to compromise the privacy of a victim's data or execute arbitrary commands with the victim's privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0988 to this issue.
Alerts:	Fedora FEDORA-2004-133 2004-05-19 Gentoo 200404-02 2004-04-06 Whitebox WBSA-2004:005-01 2004-02-12 Conectiva CLA-2004:810 2004-01-20 Slackware SSA:2004-014-01 2004-01-14 Mandrake MDKSA-2004:003 2004-01-14 Red Hat RHSA-2004:006-01 2004-01-07

Comments (none posted)

kernel: symlink overflow in the iso9660 filessytem

Package(s):	kernel	CVE #(s):	CAN-2004-0109
Created:	April 14, 2004	Updated:	July 15, 2004
Description:	The 2.4 and 2.6 kernels contain a vulnerability in the iso9660 (CDROM) filesystem which can be used by a local attacker to obtain root privileges. The exploit requires creating a specially-crafted filesystem and getting the kernel to mount it. Many systems are configured to automatically mount CDs on insertion, however, so the possibility of this vulnerability being exploited by users with physical access to the system is real. The 2.4.26 kernel contains the fix, which will also be merged into the upcoming 2.6.6 release.
Alerts:	Conectiva CLA-2004:846 2004-07-15 Red Hat RHSA-2004:106-01 2004-04-21 Red Hat RHSA-2004:105-01 2004-04-21 Debian DSA-489-1 2004-04-17 Debian DSA-491-1 2004-04-17 Debian DSA-479-2 2004-04-14 SuSE SuSE-SA:2004:009 2004-04-14 Mandrake MDKSA-2004:029 2004-04-14 Fedora FEDORA-2004-101 2004-04-14 Debian DSA-482-1 2004-04-14 Debian DSA-481-1 2004-04-14 Debian DSA-480-1 2004-04-14 Debian DSA-479-1 2004-04-14

Comments (none posted)

kernel: ext3 information leak

Package(s):	kernel	CVE #(s):	CAN-2004-0177
Created:	April 21, 2004	Updated:	April 26, 2004
Description:	Solar Designer turned up a bug in the ext3 filesystem where blocks allocated to the journal file are not properly cleaned prior to use. This failure could expose some (random) kernel memory to an attacker, but only if that attacker can perform raw I/O to the device.
Alerts:	Debian DSA-495-1 2004-04-26 Red Hat RHSA-2004:166-01 2004-04-21 Trustix TSLSA-2004-0020 2004-04-15

Comments (1 posted)

Linux kernel 2.2.10 failing function and TLB flush vulnerability

Package(s):	kernel-source-2.2.10	CVE #(s):	CAN-2004-0077
Created:	March 18, 2004	Updated:	June 4, 2004
Description:	A local root exploit is possible due to early flushing of the TLB.
Alerts:	Debian DSA-514-1 2004-06-04 Debian DSA-466-1 2004-03-18

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):	libxml2	CVE #(s):	CAN-2004-0110
Created:	February 26, 2004	Updated:	August 19, 2009
Description:	Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:	Fedora FEDORA-2009-8594 2009-08-15 Fedora FEDORA-2009-8582 2009-08-15 Fedora-Legacy FLSA:1324 2004-07-19 Conectiva CLA-2004:836 2004-03-31 Gentoo 200403-01 2004-03-06 Trustix TSLSA-2004-0010 2004-03-05 OpenPKG OpenPKG-SA-2004.003 2004-03-05 Netwosix NW-2004-0004 2004-03-04 Debian DSA-455-1 2004-03-03 Mandrake MDKSA-2004:018 2004-03-03 Red Hat RHSA-2004:091-02 2004-03-03 Whitebox WBSA-2004:090-01 2004-03-01 Red Hat RHSA-2004:090-01 2004-02-26 Fedora FEDORA-2004-087 2004-02-25 Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

logcheck: symlink vulnerability

Package(s):	logcheck	CVE #(s):	CAN-2004-0404
Created:	April 21, 2004	Updated:	December 22, 2004
Description:	The logcheck utility handles temporary files in an unsafe way, possibly allowing local attackers to overwrite files.
Alerts:	Mandrake MDKSA-2004:155 2004-12-22 Debian DSA-488-1 2004-04-16

Comments (none posted)

mailman denial of service

Package(s):	mailman	CVE #(s):	CAN-2003-0991
Created:	February 9, 2004	Updated:	May 25, 2004
Description:	Matthew Galgoci of Red Hat discovered a Denial of Service (DoS) vulnerability in versions of Mailman prior to 2.1. An attacker could send a carefully-crafted message causing mailman to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0991 to this issue.
Alerts:	Conectiva CLA-2004:842 2004-05-25 Red Hat RHSA-2004:156-01 2004-04-14 Mandrake MDKSA-2004:013 2004-02-13 Red Hat RHSA-2004:019-01 2004-02-09

Comments (1 posted)

metamail: integer and buffer overflows

Package(s):	metamail	CVE #(s):	CAN-2004-0104 CAN-2004-0105
Created:	February 18, 2004	Updated:	May 21, 2004
Description:	Versions of metamail through 2.7 contain a set of integer and buffer overflows which are remotely exploitable via a properly crafted message.
Alerts:	Gentoo 200405-17 2004-05-21 Debian DSA-449-1 2004-02-24 Mandrake MDKSA-2004:014 2004-02-18 Slackware SSA:2004-049-02 2004-02-18 Red Hat RHSA-2004:073-01 2004-02-18

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mod_python: denial of service vulnerability

Package(s):	mod_python	CVE #(s):	CAN-2003-0973
Created:	January 27, 2004	Updated:	October 4, 2004
Description:	Apache's mod_python module could crash the httpd process if a specific, malformed query string was sent. The Apache Foundation has reported that mod_python may be prone to Denial of Service attacks when handling a malformed query. Mod_python 2.7.9 was released to fix the vulnerability, however, because the vulnerability has not been fully fixed, version 2.7.10 has been released. Users of mod_python 3.0.4 are not affected by this vulnerability.
Alerts:	Fedora-Legacy FLSA:1325 2004-10-03 Conectiva CLA-2004:837 2004-04-12 Whitebox WBSA-2004:058-01 2004-03-01 Debian DSA-452-1 2004-02-29 Red Hat RHSA-2004:058-01 2004-02-26 Red Hat RHSA-2004:063-01 2004-02-26 Gentoo 200401-03 2004-01-27

Comments (none posted)

mozilla: multiple vulnerabilties

Package(s):	mozilla	CVE #(s):	CAN-2003-0594 CAN-2003-0564
Created:	March 10, 2004	Updated:	August 19, 2004
Description:	Mozilla 1.4 contains a few vulnerabilities, including disclosure of cookies to the wrong server, a scripting vulnerability which can allow an attacker to run arbitrary code, and an S/MIME vulnerability which can lead to remote denial of service or code execution attacks.
Alerts:	Whitebox WBSA-2004:421-01 2004-08-19 Whitebox WBSA-2004:110-01 2004-03-29 Red Hat RHSA-2004:112-01 2004-03-17 Mandrake MDKSA-2004:021 2004-03-10

Comments (none posted)

mpg321: format string vulnerability

Package(s):	mpg321	CVE #(s):	CAN-2003-0969
Created:	January 6, 2004	Updated:	March 28, 2005
Description:	A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
Alerts:	Gentoo 200503-34 2005-03-28 Debian DSA-411-1 2004-01-05

Comments (none posted)

MySQL: temporary file vulnerabilities

Package(s):	mysql	CVE #(s):	CAN-2004-0381 CAN-2004-0388
Created:	April 14, 2004	Updated:	August 18, 2004
Description:	The mysqlbug and mysqld_multi scripts contain temporary file vulnerabilities which could be used by a local attacker to overwrite files on the system.
Alerts:	Gentoo 200405-20 2004-05-25 Mandrake MDKSA-2004:034 2004-04-19 OpenPKG OpenPKG-SA-2004.014 2004-04-14 Debian DSA-483-1 2004-04-14

Comments (none posted)

neon: format string vulnerabilities

Package(s):	neon	CVE #(s):	CAN-2004-0179
Created:	April 14, 2004	Updated:	May 18, 2004
Description:	The neon WebDAV library contains format string vulnerabilities which may be exploited by a hostile DAV server. This vulnerability exists in utilities which use neon, including cadaver and OpenOffice.org.
Alerts:	Fedora FEDORA-2004-103 2004-04-14 Gentoo 200405-04 2004-05-11 Gentoo 200405-01 2004-05-09 Red Hat RHSA-2004:163-01 2004-04-30 Whitebox WBSA-2004:160-01 2004-04-19 Mandrake MDKSA-2004:032 2004-04-19 Gentoo 200404-14 2004-04-19 OpenPKG OpenPKG-SA-2004.016 2004-04-16 Netwosix NW-2004-0012 2004-04-18 Debian DSA-487-1 2004-04-16 Red Hat RHSA-2004:159-01 2004-04-15 Red Hat RHSA-2004:160-01 2004-04-14 Red Hat RHSA-2004:157-01 2004-04-14 Red Hat RHSA-2004:158-01 2004-04-14

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

netpbm: insecure temporary files

Package(s):	netpbm	CVE #(s):	CAN-2003-0924
Created:	January 19, 2004	Updated:	December 29, 2004
Description:	netpbm is graphics conversion toolkit made up of a large number of single-purpose programs. Many of these programs were found to create temporary files in an insecure manner, which could allow a local attacker to overwrite files with the privileges of the user invoking a vulnerable netpbm tool.
Alerts:	Conectiva CLA-2004:909 2004-12-29 Gentoo 200410-02 2004-10-04 Mandrake MDKSA-2004:011-1 2004-09-27 Whitebox WBSA-2004:031-01 2004-02-12 Mandrake MDKSA-2004:011 2004-02-11 Red Hat RHSA-2004:030-01 2004-02-05 Fedora FEDORA-2004-068 2004-02-06 Red Hat RHSA-2004:031-01 2004-01-22 Debian DSA-426-1 2004-01-18

Comments (1 posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

OpenSSL: denial of service vulnerabilities

Package(s):	OpenSSL	CVE #(s):	CAN-2004-0081 CAN-2003-0851
Created:	March 17, 2004	Updated:	November 2, 2005
Description:	Versions 0.9.7a-c of the OpenSSL library suffer from two denial of service vulnerabilities; see the version 0.9.7d release announcement for details.
Alerts:	Red Hat RHSA-2005:830-00 2005-11-02 Red Hat RHSA-2005:829-00 2005-11-02 Fedora FEDORA-2005-1042 2005-10-31 Fedora-Legacy FLSA:1395 2004-05-08 Conectiva CLA-2004:834 2004-03-31 Whitebox WBSA-2004:084-01 2004-03-23 Red Hat RHSA-2004:084-01 2004-03-23 Fedora FEDORA-2004-095 2004-03-19 Whitebox WBSA-2004:120-01 2004-03-22 Trustix TSLSA-2004-0012 2004-03-17 Slackware SSA:2004-077-01 2004-03-17 Red Hat RHSA-2004:121-01 2004-03-17 OpenPKG OpenPKG-SA-2004.007 2004-03-18 Gentoo 200403-03 2004-03-17 Debian DSA-465-1 2004-03-17 Netwosix NW-2004-0005 2004-03-17 Mandrake MDKSA-2004:023 2004-03-17 SuSE SuSE-SA:2004:007 2004-03-17 Red Hat RHSA-2004:120-01 2004-03-17 Red Hat RHSA-2004:119-01 2004-03-17 EnGarde ESA-20040317-003 2004-03-17

Comments (1 posted)

perl information leak

Package(s):	perl	CVE #(s):	CAN-2003-0618
Created:	February 2, 2004	Updated:	April 21, 2004
Description:	Paul Szabo discovered a number of bugs in suidperl, a helper program to run perl scripts with setuid privileges. By exploiting these bugs, an attacker could abuse suidperl to discover information about files (such as testing for their existence and some of their permissions) that should not be accessible to unprivileged users.
Alerts:	Debian DSA-431-2 2004-04-16 Debian DSA-431-1 2004-02-01

Comments (none posted)

postfix: denial of service vulnerabilities

Package(s):	postfix	CVE #(s):	CAN-2003-0468 CAN-2003-0540
Created:	August 5, 2003	Updated:	May 27, 2004
Description:	The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:	Mandrake MDKA-2004:028 2004-05-26 Trustix 2003-0029 2003-08-04 Mandrake MDKSA-2003:081 2003-08-04 EnGarde ESA-20030804-019 2003-08-04 Conectiva CLA-2003:717 2003-08-04 SuSE SuSE-SA:2003:033 2003-08-04 Red Hat RHSA-2003:251-01 2003-08-04 Debian DSA-363-1 2003-08-03

Comments (none posted)

python: buffer overflow

Package(s):	python	CVE #(s):	CAN-2004-0150
Created:	March 10, 2004	Updated:	October 11, 2004
Description:	Python (versions 2.2 and 2.2.1 only) has a buffer overflow in the getaddrinfo() function which can be exploited by a malformed IPv6 address.
Alerts:	Debian DSA-458-3 2004-10-10 Gentoo 200409-03 2004-09-02 Debian DSA-458-2 2004-08-31 Mandrake MDKSA-2004:019 2004-03-09 Debian DSA-458-1 2004-03-09

Comments (none posted)

ssmtp format string vulnerability

Package(s):	ssmtp	CVE #(s):	CAN-2004-0156
Created:	April 15, 2004	Updated:	May 7, 2004
Description:	Max Vozeler discovered two format string vulnerabilities in ssmtp, a simple mail transport agent. Untrusted values in the functions die() and log_event() were passed to printf-like functions as format strings. These vulnerabilities could potentially be exploited by a remote mail relay to gain the privileges of the ssmtp process (including potentially root).
Alerts:	OpenPKG OpenPKG-SA-2004.020 2004-05-07 Gentoo 200404-18 2004-04-26 Debian DSA-485-1 2004-04-14

Comments (none posted)

sysstat: temporary file vulnerability

Package(s):	sysstat	CVE #(s):	CAN-2004-0107 CAN-2004-0108
Created:	March 10, 2004	Updated:	October 4, 2004
Description:	The sysstat utility has a temporary file vulnerability which can be exploited by a local attacker to overwrite system files.
Alerts:	Fedora-Legacy FLSA:1372 2004-10-03 Gentoo 200404-04 2004-04-06 Debian DSA-460-2 2004-04-03 Trustix TSLSA-2004-0011 2004-03-16 Whitebox WBSA-2004:053-01 2004-03-10 Red Hat RHSA-2004:053-01 2004-03-10 Red Hat RHSA-2004:093-01 2004-03-10 Debian DSA-460-1 2004-03-10

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 10, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tcpdump: ISAKMP payload handling denial-of-service vulnerabilities

Package(s):	tcpdump	CVE #(s):	CAN-2004-0183 CAN-2004-0184
Created:	March 30, 2004	Updated:	September 30, 2004
Description:	TCPDUMP v3.8.1 and earlier versions contain multiple flaws in the packet display functions for the ISAKMP protocol. Upon receiving specially crafted ISAKMP packets, TCPDUMP will try to read beyond the end of the packet capture buffer and crash. More information is available in this Rapid7 advisory.
Alerts:	Fedora-Legacy FLSA:1468 2004-09-29 Whitebox WBSA-2004:219-01 2004-06-10 Red Hat RHSA-2004:219-01 2004-05-26 Fedora FEDORA-2004-120 2004-05-13 Slackware SSA:2004-108-01 2004-04-17 Mandrake MDKSA-2004:030 2004-04-14 OpenPKG OpenPKG-SA-2004.010 2004-04-07 Debian DSA-478-1 2004-04-06 Trustix TSLSA-2004-0015 2004-03-30

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

utempter problems with symlink and strncpy

Package(s):	utempter	CVE #(s):	CAN-2004-0233
Created:	April 19, 2004	Updated:	June 11, 2004
Description:	Steve Grubb discovered two potential issues in the utempter program: If the path to the device contained /../ or /./ or //, the program was not exiting as it should. It would be possible to use something like /dev/../tmp/tty0, and then if /tmp/tty0 were deleted and symlinked to another important file, programs that have root privileges that do no further validation can then overwrite whatever the symlink pointed to. Several calls to strncpy without a manual termination of the string. This would most likely crash utempter.
Alerts:	Whitebox WBSA-2004:174-01 2004-06-10 Red Hat RHSA-2004:174-01 2004-05-26 Fedora-Legacy FLSA:1546 2004-05-18 Gentoo 200405-05 2004-05-13 Red Hat RHSA-2004:175-01 2004-04-30 Mandrake MDKSA-2004:031-1 2004-04-21 Fedora FEDORA-2004-108 2004-04-21 Slackware SSA:2004-110-01 2004-04-19 Mandrake MDKSA-2004:031 2004-04-19

Comments (none posted)

XChat 2.0.x SOCKS5 Vulnerability

Package(s):	xchat	CVE #(s):	CAN-2004-0409
Created:	April 19, 2004	Updated:	November 15, 2005
Description:	XChat is vulnerable to a stack overflow that may allow a remote attacker to run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a remote exploit. Users would have to be using XChat through a SOCKS 5 server, enable SOCKS 5 traversal which is disabled by default and also connect to an attacker's custom proxy server. This vulnerability may allow an attacker to run arbitrary code within the context of the user ID of the XChat client.
Alerts:	Fedora-Legacy FLSA:123013 2005-11-14 Red Hat RHSA-2004:585-01 2004-10-27 Netwosix NW-2004-0014 2004-05-01 Red Hat RHSA-2004:177-01 2004-04-30 Mandrake MDKSA-2004:036 2004-04-21 Debian DSA-493-1 2004-04-21 Gentoo 200404-15 2004-04-19

Comments (none posted)

xine-ui - insecure temporary file creation

Package(s):	xine-ui	CVE #(s):	CAN-2004-0372
Created:	April 6, 2004	Updated:	April 27, 2006
Description:	Shaun Colley discovered a problem in xine-ui, the xine video player user interface. A script contained in the package to possibly remedy a problem or report a bug does not create temporary files in a secure fashion. This could allow a local attacker to overwrite files with the privileges of the user invoking xine.
Alerts:	Gentoo 200404-20 2004-04-27 Slackware SSA:2004-111-01 2004-04-20 Mandrake MDKSA-2004:033 2004-04-19 Debian DSA-477-1 2004-04-06

Comments (none posted)

xonix fails to drop privileges

Package(s):	xonix	CVE #(s):	CAN-2004-0157
Created:	April 15, 2004	Updated:	April 21, 2004
Description:	Steve Kemp discovered a vulnerability in xonix, a game, where an external program was invoked while retaining setgid privileges. A local attacker could exploit this vulnerability to gain gid "games".
Alerts:	Debian DSA-484-1 2004-04-14

Comments (none posted)

zope: potential code execution

Package(s):	zope	CVE #(s):	CVE-2002-0688
Created:	April 21, 2004	Updated:	April 21, 2004
Description:	The ZCatalog component of the Zope application server can allow anonymous users and untrusted code to call arbitrary methods in the catalog indexes.
Alerts:	Debian DSA-490-1 2004-04-17

Comments (1 posted)

Page editor: Jonathan Corbet

Kernel development

Brief items

Kernel release status

The current 2.6 kernel is 2.6.6-rc3, which was announced by Linus on April 27. New patches this time around include an NTFS update, some generic snapshot support code for filesystems (taken from XFS), a CPU frequency control update, TCP "Vegas" congestion avoidance, a new single-threaded mode for workqueues, a CIFS update, various architecture updates, and lots of fixes. See the long-format changelog for the details.

Linus hopes to have a final 2.6.6 release out by the end of the week.

Linus's BitKeeper tree contains, as of this writing, a set of XFS patches and a few other fixes.

The current prepatch from Andrew Morton is 2.6.6-rc2-mm2. Recent additions to -mm include a set of reiserfs patches (see below), some more ext3 block reservation work, a "tickless" timer mode for the S/390 architecture, hotplug CPU support for ia-64 systems, and lots of fixes.

The current 2.4 prepatch is 2.4.27-pre1, released by Marcelo on April 22. This prepatch merges the 2.6 serial ATA drivers, but otherwise restricts itself to fixes and small updates. According to Marcelo, the serial ATA update is the last big change that will go into 2.4.x.

Comments (5 posted)

Kernel development news

On reiserfs and external attributes

The patch seemed relatively straightforward; Chris Mason had sent out a set of reiserfs changes which include data=journal support, an improved block allocator, metadata readahead, and external attribute support. One of those changes, however, does not sit well with Hans Reiser, the original creator of reiserfs.

External attributes are just a way of attaching extra metadata to files; they are used for things like access control lists and SELinux context information. Most of the standard Linux filesystems support external attributes in 2.6, but reiserfs does not yet have that capability. Given that features like SELinux will not work without external attributes, adding this capability has been high on the wish lists of many users and developers.

When the external attribute patch was posted, however, Hans Reiser sent out a protest asking that the patch not be applied. Those who have followed Hans's work over the years will know what his objection is: external attributes live in their own name space. Hans has dedicated much effort to the task of moving everything into the filesystem name space; he says:

The upcoming Reiser4 filesystem implements Hans's vision of how external attributes should be implemented; essentially, each attribute just looks like a small file containing the attribute value. The solution is fast and elegant; it may well be the way things are done in the future. For the moment, however, there are a few problems:

• Reiser4 is still in beta testing, and has not yet been submitted for inclusion into the 2.6 kernel. Once it is submitted, it is not certain that it will be accepted quickly.

• The Reiser4 external attribute API is different from the API used in the 2.6 kernel. Applications, to use this API, will have to be rewritten to use the special-purpose reiser4() system call.

• Some users of reiserfs ("Reiser3") might be a little nervous about making an immediate jump to a completely new filesystem. They just might want to be able to continue using their existing filesystems and, simultaneously, make use of external attributes.

The solution seems reasonably clear: Reiser4, once it's ready, can be merged with its new ways of doing things. The existing reiserfs filesystem, meanwhile, can be augmented with the capabilities that its users would like to have now. This approach would seem to offer the best of both worlds. Mr. Reiser disagrees; he would rather not have (what he sees as) an inelegant hack grafted onto reiserfs to satisfy immediate needs. When code is released as free software, however, not even its creator can prevent its development in certain directions if that's what its users want.

Comments (6 posted)

Being honest with MODULE_LICENSE

MODULE_LICENSE() is a macro which allows loadable kernel modules to declare their license to the world. Its purpose is to let the kernel developers know when a non-free module has been inserted into a given kernel. If you submit an oops report showing a "tainted" kernel, chances you will be asked to reproduce the problem without the proprietary module loaded, or to talk to that module's vendor about the problem. In general, the kernel hackers want to hear about problems, but their interest drops remarkably when they cannot get at the source to diagnose or fix the problem.

The declared module license is also used to decide whether a given module can have access to the small number of "GPL-only" symbols in the kernel.

There is no central authority which checks license declarations; it is assumed that module authors will not want to lie about the license they are using. That assumption has generally proved to be valid, so people were surprised when Linuxant was found to have put a false module declaration into its binary-only "linmodem" driver. Or, if it's not false, it does cleverly manage to not tell the whole story.

The actual license string in the Linuxant driver reads:

The \0 is an ASCII NUL character, which, in C programs, terminates a string. Thus, while the above declaration would appear fairly clear to human eyes, the kernel only sees a license declaration of "GPL".

One might well wonder why Linuxant chose to do this. The driver in question does not use any GPL-only symbols, so it is not an attempt to get around the kernel's simplistic access control mechanism. According to Linuxant president Marc Boucher, they simply wanted to avoid bothering users with kernel warnings:

Most developers seem to have taken this explanation at face value, though some remain unhappy about the approach that was used. Possible solutions include putting the "kernel tainted" warning in the system logfile only, simply suppressing the warning after the first time, or having the Linuxant drivers manually set the "tainted" flag themselves at load time. Finding a way to achieve Linuxant's aim (provide a driver which enables hardware that does not otherwise work with Linux while avoiding upsetting users with lots of scary messages) should not be that hard to do.

Meanwhile, of course, there is also interest in making it harder for others to get past the kernel license check. Carl-Daniel Hailfinger, who originally pointed out the problem, also submitted a patch which would explicitly "blacklist" modules from Linuxant; any such module would taint the kernel regardless of its claimed license. Linus suggested that the license be stored as a counted string as a way of defeating the "NUL attack." Rusty Russell, instead, noted that any check that would be accepted into the kernel can be defeated by an even moderately motivated attacker. His patch includes a quick compile-time check to defeat Linuxant's technique, but it explicitly avoids getting into a real arms race with potential violators.

Chances are we will see this sort of behavior again - with, perhaps, a less benign intent. The nature of a free kernel makes it hard to shut out those who are unwilling to play by the rules. But, as Linus said:

Given that a number of free software hackers are increasingly unwilling to see their licenses ignored, anybody who wants to engage in this sort of behavior should, indeed, be talking to their lawyers.

Comments (19 posted)

The cost of inline functions

The kernel makes heavy use of inline functions. In many cases, inline expansion of functions is necessary; some of these functions employ various sorts of assembly language trickery that must be part of the calling function. In many other cases, though, inline functions are used as a way of improving performance. The thinking is that, by eliminating the overhead of performing actual function calls, inline functions can make things go faster.

The truth turns out not to be so simple. Consider, for example, this patch from Stephen Hemminger which removes the inline attribute from a set of functions for dealing with socket buffers ("SKBs", the structure used to represent network packets inside the kernel). Stephen ran some benchmarks after applying his patch; those benchmarks ran 3% faster than they did with the functions being expanded inline.

The problem with inline functions is that they replicate the function body every time they are called. Each use of an inline function thus makes the kernel executable bigger. A bigger executable means more cache misses, and that slows things down. The SKB functions are called in many places all over the networking code. Each one of those calls creates a new copy of the function; Denis Vlasenko recently discovered that many of them expand to over 100 bytes of code. The result is that, while many places in the kernel are calling the same function, each one is working with its own copy. And each copy takes space in the processor instruction cache. That cache usage hurts; each cache miss costs more than a function call.

Thus, the kernel hackers are taking a harder look at inline function declarations than they used to. An inline function may seem like it should be faster, but that is not necessarily the case. The notion of a "time/space tradeoff" which is taught in many computer science classes turns out, often, to not hold in the real world. Many times, smaller is also faster.

Comments (7 posted)

Ketchup with that?

Matt Mackall has released version 0.7 of his "ketchup" script. Ketchup can be thought of as a sort of apt-get for kernel trees; run "ketchup 2.6-bk" and it will go get the right combination of kernel tarballs and patch sets and put them together into a complete kernel tree. Several different trees are supported, including -mm, -tiny, and -mjb, and the script can string together a series of patches to get to the desired destination. If you find yourself playing with a number of different kernel trees, ketchup may prove to be a tasty condiment to add to your tool collection.

Comments (1 posted)

Single-threaded workqueues

The workqueue mechanism is the 2.6 kernel's replacement for task queues; a workqueue allows kernel code to defer work until some time in the future. Tasks submitted to work queues are run in the context of a special process, so they can sleep if need be. Workqueues go out of their way to keep work on the same processor by a dedicated worker thread for each processor on the system.

For many applications, one process per CPU is far more than is needed; a single worker process is plenty. There is a shared, generic workqueue which can be used in many of these situations. In others, however, use of that queue is not appropriate; perhaps the code in question performs long sleeps, or it may deadlock with another use of that queue. In these cases, there has been no alternative to paying the cost of all those worker threads.

As of 2.6.6, thanks to Rusty Russell, there will be a new function for creating workqueues:

    struct workqueue_struct *create_singlethread_workqueue(char *name);

As you might expect, this function creates a workqueue that relies on a single worker thread. Chances are, many of the current users of workqueues could switch over to the single-threaded variety.

Comments (none posted)

Patches and updates

Kernel trees

• Linus Torvalds: Linux 2.6.6-rc3. (April 28, 2004)

• Andrew Morton: 2.6.6-rc2-mm2. (April 26, 2004)

• Randy.Dunlap: 2.6.6-rc2 kernel-janitors patchset. (April 23, 2004)

• Marcelo Tosatti: Linux 2.4.27-pre1. (April 22, 2004)

• Eric Hustvedt: 2.4.26-lck1. (April 22, 2004)

Core kernel code

• Erik Jacobson: Process Aggregates (PAGG) support for the 2.6 kernel. (April 27, 2004)

Development tools

• Matt Mackall: ketchup 0.7. (April 24, 2004)

Device drivers

• Dmitry Torokhov: ALPS touchpad driver. (April 23, 2004)

• Jeff Garzik: libata update. (April 26, 2004)

• Jeff Garzik: new driver -- AHCI. (April 26, 2004)

Filesystems and block I/O

• Mingming Cao: Lazy discard ext3 reservation window patch. (April 22, 2004)

• Chris Mason: reiserfs v3 patches for 2.6.6-rc2. (April 23, 2004)

• Joern Engel: sys_copyfile. (April 26, 2004)

Memory management

• Hugh Dickins: rmap 14 i_shared_lock fixes. (April 28, 2004)

• Hugh Dickins: rmap 15 vma_adjust. (April 28, 2004)

• Hugh Dickins: rmap 16 pretend prio_tree. (April 28, 2004)

• Hugh Dickins: rmap 17 real prio_tree. (April 28, 2004)

• Hugh Dickins: rmap 18 i_mmap_nonlinear. (April 28, 2004)

• Hugh Dickins: rmap 19 arch prio_tree. (April 28, 2004)

Networking

• Stephen Hemminger: eliminate large inline's in skbuff. (April 28, 2004)

Architecture-specific

• Andi Kleen: New version of early CPU detect. (April 23, 2004)

Miscellaneous

• Guillaume Thouvenin: Enhanced Linux System Accounting - ELSA project. (April 22, 2004)

• christophe varoqui: multipath-tools-0.1.6. (April 27, 2004)

Page editor: Jonathan Corbet

Distributions

News and Editorials

Gentoo after DRobbins

The move surprised even the most ardent followers of the Gentoo Linux distribution. As the news about the resignation of Daniel Robbins (also known as "drobbins") from his position as Gentoo's Chief Architect quickly spread around the Internet, many users expressed utter surprise, even doubts about the future of what has become one of the fastest growing Linux distributions. Will our beloved Gentoo survive? Will we still be able to get fast security updates and keep our installations up-to-date with the latest software? Will we still be able to "emerge"? Yes, we will.

While the initial reaction of users is understandable, there is little need to panic. Let's look at the situation through a similar event in the history of another Linux distribution - Debian GNU/Linux. Debian's founder Ian Murdock created the project in 1993, and left the project some three years later, even before the first official Debian release, version 1.1, hit the FTP servers in June 1996. But despite the sudden absence of the project's founder, Debian did not collapse; instead it went on to become one of the most widely-used Linux distributions, with hundreds of developers and thousands of users in all corners of the world. Ironically, it was Murdock's second attempt at creating a Linux distribution that proved to be a failure: Progeny Linux, a commercial offspring of Debian, launched in early 2000, was discontinued 6 months later (although there is an ongoing effort to revive the product, thanks to Murdock's new development initiatives of grouping individual software packages into logical components).

Like Murdock, Daniel Robbins is one of the greatest contributors to the success of Linux that we are witnessing today. He first came into contact with Linux while working as a system administrator at the University of New Mexico, and it wasn't long before he was confident enough to join the development team of Stampede Linux, his preferred distribution at the time. This experience was later transposed into Daniel's own distribution, originally called Enoch Linux. Unfortunately, its development encountered a number of early setbacks and it wasn't until after a lengthy foray into the world of FreeBSD that this new project, now renamed to Gentoo Linux, began to take shape. Little by little, Gentoo was turning out to be a huge success. One of the main reasons for it was the fact that it incorporated several ideas from FreeBSD, notably the FreeBSD ports system (called "portage" in Gentoo) which provided users with sophisticated tools to compile all applications from source code, instead of installing precompiled binary packages. This gave Gentoo the innovative edge over most mainstream distributions, attracting many users who found Gentoo's ease of software installation and instant package availability highly appealing.

Up until recently, the development of Gentoo Linux was largely determined by its fearless leader, but this model is about to change. The work will be taken over by Gentoo Foundation, Inc, a new Not For Profit (NFP) organization, or more precisely, by the foundation's Board of Trustees: "The purpose of this foundation is to hold the intellectual property of the Gentoo free software project. It will have a Board of Trustees. This not-for-profit will be an open membership trade association." Originally Daniel Robbins intended to become a member of the Board of Trustees, at least during the initial period, but changed his mind later. The board will have around 20 members.

The resignation of Gentoo's founder wasn't the only news coming out from Albuquerque this week, as the Gentoo project also announced a new release of Gentoo Linux, version 2004.1. To many, this was far more reassuring news, especially since unlike most previous Gentoo releases, this one came out on schedule. What's new in the latest version? Besides the usual package updates, security and bug fixes, some of the more visible changes include newly introduced GPG signatures for online listing of packages, availability of "LiveCD" and "PackageCD" sets for every architecture, and substantial improvements in Catalyst, the Gentoo tool for generating stage installation tarballs and LiveCDs. Gentoo Linux is now fully compatible with kernel 2.6, version 2.6.5 of which is included as an option on the Universal LiveCD, together with kernel 2.4.26.

The events this week prompted some users to revisit Zynot, a high-profile attempt of an unsatisfied Gentoo developer to fork Gentoo Linux in June 2003. Long on idealistic writing reminiscent of naïve revolutionaries of yesteryear, the founder of Zynot went on explaining how the new fork would soon become the best thing since sliced bread. Unfortunately, 10 months later the project has little to show for its work. With a poorly designed web site, inactive user forums and a broken Wiki, Zynot has a long way to go before it starts delivering on those ideals, let alone becomes a viable alternative to Gentoo Linux.

The current changes within the management structure of Gentoo Linux represent a natural evolution of a highly successful project and won't have any major impact on the users of the distribution. With 200 active developers and a well-defined development framework firmly in place, there is no reason to believe that the project will suddenly disappear. Instead, Gentoo Linux will become a more democratic institution, perhaps with some inevitable political bickering on occasions, but definitely a better place to further advance the already excellent product.

Comments (5 posted)

Distribution News

Conectiva Linux 10 Release Candidate 1 now available

Conectiva Linux 10 Release Candidate 1 is now available. Click below for download links and release notes.

Full Story (comments: none)

Fedora Core

The third and final test release of Fedora Core 2 is now available. Some of the changes in this release include: SELinux disabled by default, the 'CD1 won't boot' issue appears to be resolved, Anaconda now installs in 31 languages. Get it, test it, report those bugs.

The 10th issue of the Fedora News Updates has been released. This issue looks at the fedora-desktop-list, new documentation, SELinux, configuration tools and yum testing are needed, and several other topics.

Packages of the latest unstable Evolution release (1.5.7) are available. "Works for me (I'm using it to send this email), though this is built from an UNSTABLE tarball, so expect it to crash, eat your mail, and do other Bad Things from time to time. You have been Warned!"

Here's a reminder of the mailing lists for the Fedora Project. There are a growing number of these lists, targeted towards various Fedora topics including: SELinux, Fedora Legacy, translation efforts, and more.

Comments (none posted)

TurboLinux announces Turbolinux 10 F

TurboLinux has announced "Turbolinux 10 F", a new Linux operating system designed for home computer users. Turbolinux 10F ships with a media player capable of streaming pure Windows Media format audio and video. 10F is based on Turbolinux 10 Desktop.

Full Story (comments: none)

Debian GNU/Linux

The Debian Weekly News for April 27, 2004 is out. Topics include splitting binary firmware blobs of the Linux kernel, a new release of the linda policy checker, a report of the Linux User & Developer Expo, kernel security support for Sarge, and much more.

There is less than a month left until the fifth DebConf. The registration period is almost over and those who have registered should be receiving a confirmation email.

Comments (none posted)

Gentoo Weekly Newsletter - Volume 3, Issue 17

The Gentoo Weekly Newsletter for the week of April 26, 2004 is out. This week's topics include the new apache maintainer and public mailing list, the search for a new squid maintainer, and several others.

Full Story (comments: 3)

SUSE Linux

SUSE Linux 9.1 is now registered with the OpenGroup, as conforming to the LSB Runtime Environment for IA32 version 1.3 product standard.

Full Story (comments: 1)

Lindows Introduces Lsongs

Lindows, Inc. has announced Lsongs, an all-in-one music management and playback software program for Linspire users.

Comments (1 posted)

Slackware Linux

Many KDE packages have been upgraded this week, along with joe, gaim, slacktrack, syslinux, automake, and several other packages. Updated 2.4.26 kernels with security fixes are available for slackware-stable and slackware-current. GCC 3.4.0 has landed in testing. As always, check the slackware-current changelog for complete details.

Comments (3 posted)

Trustix Secure Linux

Trustix has a feature update to the TSL 1.5 kernel, to bring it up-to-date with the newest kernel in the 2.2 series. Click below for more infomation.

Full Story (comments: none)

New Distributions

SmartPeer

SmartPeer is a free, open source load balancing solution that runs from a single bootable CD-ROM (based on Morphix). SmartPeer allows you to balance your web traffic to distribute the load across multiple servers and also gives you an easy way to keep your website running while individual web servers are removed from production for maintenance, replacement, or due to failure. SmartPeer joins the list at version 0.0.2, released April 26, 2004.

Comments (none posted)

Minor distribution updates

AGNULA/DeMuDi 1.1.1 Live released

A special version of the AGNULA/DeMuDi distribution for audio and video applications has been released for the Linux Audio Conference. Version 1.1.1 is a live CD distribution, based on Knoppix, but heavily tweaked for multimedia work. Click below for details and download information.

Full Story (comments: none)

Compact Flash Linux Project

The Compact Flash Linux Project has released v0.1.4-pre2 with minor feature enhancements. "Changes: Upgraded to use Linux 2.4.26, and other drivers. Most of the software included is up-to-date. FreeSWAN is now included in the distribution."

Comments (none posted)

dyne:bolic GNU/Linux

dyne:bolic GNU/Linux has released v1.3 with major feature enhancements. "Changes: The audio streaming applications now all have integrated support for the Ogg/Vorbis codec, meaning 100% free technology for network radios. An important bug in the nesting mechanism was fixed. Some relevant updates were made to recent versions of audio and video software."

Comments (none posted)

Inside Security Rescue Toolkit

INSERT has released v1.2.8 with minor feature enhancements. "Changes: This version updates ntfsutils, clamav, rkhunter, and the virus database, and adds telnet, smbmount, ettercap, fwlogwatch, and two keyboard layouts (fr and ch)."

Comments (none posted)

Linux Embedded Appliance Firewall

LEAF has released Bering-uClibc 2.1.1 with minor bugfixes. "Changes: This release adds RAID modules. Minor bugs have been fixed. Shorewall has been updated to version 1.4.10.e, SuperFreeS/WAN to Openswan 1.0.3, and busybox to 1.0pre10."

Comments (none posted)

LinuxTLE Gnome 2.6 Thai LiveCD!! (GnomeDesktop)

Footnotes reports the release of LinuxTLE 5.5 LiveCD (with GNOME 2.6) with Thai support and customizations.

Comments (none posted)

Openwall Linux

Here's a note (click below) from Solar Designer, about the latest OWL kernels. Linux 2.4.26-ow1, 2.0.40-ow1; new Owl ISO; Owl 1.1-stable have been updated with the latest security patches.

Full Story (comments: none)

Pingwinek GNU/Linux

Pingwinek GNU/Linux has released v1.0rc2 with minor feature enhancements. "Changes: LiveCD is now fully separated from other CDs. The kernel is 2.6.5. The authors have switched from XFree86 to the X.Org implementation with freedesktop XLIBS. Many bugs have been fixed and many improvements have been added."

Comments (none posted)

PLD Live CD

PLD Live CD has released v0.90 with major feature enhancements. "Changes: There are several package updates (KDE 3.2.1, GNOME2.6, and others). The packages celestia, tuxracer, and foobilard have been added. NVidia drivers are included and automatically used if necessary. It boots into graphical mode (can be turned off) by default. There is greatly improved support for mounting home from various devices (disks, pen drives, etc.). The kernel has been switched to uni-processor (SMP caused too many problems). Eagle (DSL) drivers should work now. There are numerous other bugfixes and improvements."

Comments (none posted)

Concurrent releases RedHawk Linux 2.1

Concurrent has announced the availability of Red Hawk Real-Time Linux 2.1. "Concurrent's refinements include kernel-level priority inheritance support, a Frequency Based Scheduler (FBS), process and IRQ shielding extensions, user-level real-time Hyper-Treading control for Intel Xeon platforms, user-level spin locks, significant real-time performance tuning and many additional improvements." We have sent them a query as to when they will release source for their kernel enhancements - which certainly fall under the GPL - but have not yet received a response.

Comments (4 posted)

RxLinux

RxLinux has released v1.7.0 with minor feature enhancements. "Changes: added support for usb flash added support for I810-815 fbdev added support for SIS fbdev"

Comments (none posted)

ThinTUX

ThinTUX has released v0.14 with minor feature enhancements. "Changes: This release added support for all USB host controllers and updated the installation guide."

Comments (none posted)

Webfish Linux

Webfish Linux has released v2.0pre3 with major feature enhancements. "Changes: Appropriate changes have been made for using kernel 2.6.x. Packaging has been tidied up. Webfish workstation has been brought up to date with bleeding-edge multimedia software and KDE 3.2.1. There are many other little bits and pieces. nALFS profiles are now online."

Comments (none posted)

Distribution reviews

Cobind Desktop: Linux Done Right (OS News)

OS News reviews Cobind Desktop. "One of the big plusses of Cobind was the crispness and polished look and feel. With anti-aliased fonts (via XFce), the OS is clean and beautiful. With a bunch of icon sets and more window themes than you could fathom (again, via the massive XFce library), a system can be super customized in a few clicks without a single download. I found the default appearance of Cobind to be very attractive."

Comments (none posted)

Page editor: Rebecca Sobol

Development

The Gnu Compiler Collection, Version 3.4

The GCC team announced the release of the 3.4 version of the popular Gnu Compiler Collection last week. A list of changes is available here.

As with other releases, this GCC series may cause compilation errors with code that previously built without problems. Many users have been reporting build problems against the new version for some time now, in the hope of having compilation issues addressed prior to the release. Bleeding edge Gentoo users, for example, have been tracking packages and notifying the upstream authors for months. But plenty of issues will continue to go unnoticed, creating hurdles for users to deal with after performing the upgrade.

This release does provide some much anticipated improvements. The C/Objective C/C++ compilers now support precompiled headers (PCH), these can speed up compilation time. The new feature is still considered a technology preview; open source projects with notoriously long compile times, however, are quite eager for the speed boost. One condition, however, stands out in the manual:

This condition implies that a source file which includes multiple header files will only benefit from the precompiled support for exactly one of those headers. The workaround for this is to create a monolithic header file which includes all other header files, and use only this header file from within the source. The dependency chain becomes more complicated as a result. While this condition is not ideal, authors may find that the compilation speed improvements are worth the time to change the source.

Also of note for this release: A new compilation scheme, called unit-at-a-time, has been introduced. With this system, the code in a file is parsed first, then optimized later. This allows for better performance by removing unused variables and reordering functions. The changes page notes a 1.3% improvement for the SPECint2000 benchmark on the i386 architecture. Some programs, especially those with inline assembly, may run into problems with this optimizer, some modification to the source code may be required.

Other notable changes in GCC 3.4 include many bug fixes, and enhancements for the Ada, Java, and Fortran front ends. The release also includes improvements for non x86 architectures, and changes to G++ which bring it significantly closer to the ISO/ANSI C++ standard.

Very informal compilation tests were conducted on packages known for their lengthy compilation times to observe what kind of "out-of-the-box" performance enhancements could be seen. The tests were performed on a 2.6GHz P4 running Linux 2.6.4 kernel, the compiler optimization level was set to -O2.

Package	GCC 3.3.3	GCC 3.4.0 (without PCH)	GCC 3.4.0 (with PCH)
kdelibs-3.2.2	47:21	44:39	no data
qt-3.3.2	47:05	43:53	34:40
perl-5.8.4	2:19	2:20	no data
gtk+-2.4.0	4:45	4:15	no data

The test results indicate that GCC 3.4 usually provides a significantly faster compile time, particularly when used with PCH support.

Whether the constraint of one PCH per source file continues is up for debate due to the complexity of further implementation and alternatives that have been proposed. It is clear, though, that between optimizations, bugfixes, and PCH support, the GCC team has brought us another great release.

Comments (6 posted)

System Applications

Audio Projects

Planet CCRMA Changes

The latest changes from the Planet CCRMA audio utility packaging project include a new release of the Planet CCRMA CD ISO images with support for the Red Hat 9.0 and Fedora Core 1 distributions. New versions of Freqtweak, Cheesetracker, and JACK are also available.

Comments (none posted)

JACK Release 0.98.0

Version 0.98.0 of JACK, the low-latency audio server, is available. Changes include bug fixes, new JACK API functions, a new server auto-start capability, an OSS JACK driver, several new command line options, and more.

Full Story (comments: none)

JACK 0.98.1 released

Version 0.98.1 of JACK was released to fix some minor bugs.

Full Story (comments: none)

Speex 1.1.5 Released

Version 1.1.5 of Speex, an audio codec, is out. "The main change in this release is that the 1.1.5 API and ABI are now compatible with 1.0.x. The versions of the functions taking a short* now have an "_int" suffix, as in speex_encode_int()."

Comments (none posted)

Database Software

Gentle.NET 1.0.2 released (SourceForge)

Version 1.0.2 of Gentle.NET has been announced. "Gentle.NET is an RDBMS independent object persistence framework. It features automatic SQL generation and object construction, an SQL factory for creating custom queries, DataView construction helpers, excellent performance and reasonably complete docs. This release adds support for the OracleODP provider. New features include support for paging result sets, optional dynamic tablename associations, and the ability to soft delete (mark) objects. This release also contains a number of minor enhancements and several bugfixes." Gentle.NET works with the Mono project.

Comments (none posted)

libgda/libgnomedb 1.1.2 released

Version 1.1.2 of libgda/libgnomedb, a database development framework, is out. "This is another development release in the road to 1.2, which will be the next stable release, and which shows a preview of the new features getting into the 1.2 final release. It is not intended for production use, but by people wanting to experiment with the new features and to help on the development."

Full Story (comments: none)

phpMyAdmin 2.6.0-alpha is released (SourceForge)

Version 2.6.0 alpha of phpMyAdmin, a web-based database administration tool, is available. "Because of significant changes inside the database connection methods and major improvements to the MySQL 4.1 compatibility, the team decided to release this alpha version from phpMyAdmin's current development code. Supporting the new improved MySQL extension of php5 (MySQLi), phpMyAdmin has made a giant step towards the upcoming PHP and MySQL versions."

Comments (none posted)

PostgreSQL Weekly News

The April 19, 2004 edition of the PostgreSQL Weekly News is out with the latest PostgreSQL database news and information.

Full Story (comments: none)

PostgreSQL Weekly News

The April 26, 2004 edition of the PostgreSQL Weekly News is out with more PostgreSQL database news. "Another rousing week of development as we move closer to 7.5. With several of the big items under development, we had a lot of discussion about issues people would like to see addressed including contrib vs. gborg packaging and case folding, among others. Still, it is the little things that add up to make a release what it is, and we had a good share this week."

Full Story (comments: none)

Mail Software

Two releases of DSPAM announced

Stable version 2.10.6 and development version 3.0.0alpha6 of DSPAM have been announced. "DSPAM is a server-side anti-spam agent for UNIX email servers. It masquerades as the email server's local delivery agent and filters/learns SPAM using a Bayesian statistical approach which provides an administratively maintenance-free, self-learning anti-spam service."

Comments (none posted)

Printing

CUPS Driver Development Kit 1.0 is out

Following a recent beta release, version 1.0 of the CUPS printer system driver development kit has been announced. "The CUPS Driver Development Kit (DDK) provides a suite of standard drivers, a PPD file compiler, and other utilities that can be used to develop printer drivers for CUPS and other printing environments. "

Comments (none posted)

ppmtomd driver 1.3 is out

Version 1.3 of the ppmtomd driver is available from LinuxPrinting.org "Most of the MicroDry printers work "Perfectly" now."

Comments (none posted)

Web Site Development

CherryPy-0.10 released

Version 0.10 of CherryPy, a Python based web development toolkit, it out. Changes include a new project wiki, threa-safe operation, restored Jython compatibility, bug fixes, and new documentation.

Full Story (comments: none)

Profiling LAMP Applications with Apache's Blackbox Logs (O'ReillyNet)

Chris Josephes writes about Apache logfile analysis on O'Reilly. "Benchmarking LAMP sites can be tricky; how do you know which pages or applications need tuning? Fortunately, you can easily tune your Apache logs to provide more useful profiling information. Chris Josephes explains a Blackbox log format for Apache httpd."

Comments (none posted)

Rapid Web Application Deployment with Maypole (O'Reilly)

Simon Cozens writes about the Maypole project on O'Reilly. "You have a database. You have a web server. You have a deadline. Whether it's bringing up an e-commerce storefront for a new venture, implementing a new front-end to HR's employee database, or even providing a neat way to track citations for U.S. English slang terms, it's always the same story -- and the deadline is always yesterday. For this month of April, I'm working on a Perl Foundation sponsorship to develop a project of mine called Maypole, which enables Perl programmers to get web front-ends to databases, as well as complex web-based applications, up and running quickly."

Comments (none posted)

ZopeMag Weekly News

Issue #29 of the ZopeMag Weekly News is out with a collection of new Zope articles.

Comments (none posted)

Miscellaneous

Ganymede 1.0.12 released

Version 1.0.12 of Ganymede, a metadirectory system, is out. "Ganymede allows large groups of administrators to share administrative control over designated portions of a master network directory database, and provides transactional reliability and intelligent constraint management to keep network directories consistent."

"This is a rather long delayed maintenance release of the Ganymede directory management software. The biggest bug fixes relate to infrequently encountered (by us) stability issues in the Ganymede server, particularly the Ganymede scheduler's exception handling."

Full Story (comments: none)

realtime-lsm 0.1.0 available

Version 0.1.0 of the Realtime Linux Security Module is out. "The Realtime Linux Security Module (LSM) is a loadable extension for Linux 2.6 kernels. It selectively grants realtime permissions to specific user groups or applications. There are only a few small differences between this release and the realtime-0.0.4 version released back in March. If that was working satisfactorily, there is no need to upgrade. The main purpose of this release is to take advantage of the services provided by SourceForge."

Full Story (comments: none)

Desktop Applications

Audio Applications

Rhythmbox 0.8.1 released

Version 0.8.1 of Rhythmbox, a music management system, is out. "Rhythmbox 0.8.1 brings a few important fixes and some updated translations."

Full Story (comments: none)

Data Visualization

PyX 0.6.3 was released

Version 0.6.3 of PyX, the Python Graphics Package has been announced. Several bug fixes are listed in the change log.

Comments (none posted)

Desktop Environments

COnfigurator for Gnome 0.7.0

Version 0.7.0 of COnfigurator for Gnome, a GNOME settings editor, is out with improved settings control for Nautilus, Epiphany, Metacity, and more.

Full Story (comments: none)

GNOME Keyring Manager, a new gnome-love project (GnomeDesktop)

The GNOME Keyring Manager has a new GNOME love mailing list, according to this article. The GNOME Keyring Manager is described thusly: "It is an interface to create, delete and modify keyrings, as well as items inside them. The main application window will show available keyrings and its info (if it is locked, if it will lock on idle, that idle time, and the last modification/change time). You should be able to open a keyring, in a new window, show each item on it, and add/remove/modify items in it."

Comments (none posted)

gnome-gpg 0.3: "not what you think"

Version 0.3, the initial release, of gnome-gpg is out. "What gnome-gpg is is a simple command-line wrapper around gpg that makes it store its passphrase in gnome-keyring. It is a direct competitor to (the unmaintained) quintuple-agent. Plus leverages the GNOME authentication dialogs for a much nicer UI."

Full Story (comments: none)

gnome-pkgview 1.0.5 released

Version 1.0.6 of gnome-pkgview has been the released. The project "displays the version of desktop components installed, and makes a stab at your overall GNOME version". This version features bug fixes and new translations.

Full Story (comments: none)

GNOME themes extras 0.7 released

Version 0.7 of GNOME themes extras has been released. "The GNOME-themes-extras package contains themes using SVG graphics to theme your applications, file system icons and menu's in GNOME." New themes and translations are included.

Full Story (comments: none)

Bag of Software (GnomeDesktop)

GnomeDesktop.org has a multiple announcement for new GNOME software. "New releases of GRAMPS, Gaim, Cantus and gtk-cpuspeedy are now available..."

Comments (none posted)

KDE-CVS-Digest (KDE.News)

The April 23, 2004 KDE CVS-Digest is online. Here's the content summary: "KPresenter can save to Sony memory chips for use with Sony projectors. KOrganizer implements recurring todos. KPilot implements auto-detection of devices. KDE now supports relocation of installation directories. Work continues on KDevelop documentation browser, allowing documentation search from cursor. KJSEmbed adds more signals and examples."

Comments (none posted)

Konstructing a New KDE Desktop (KDE.News)

KDE.News points to a new tutorial on Konstruct, the KDE build utility.

Comments (none posted)

Electronics

GerbMerge 0.6

The Open Collector site mentions a printed circuit CAD utility called GerbMerge. "GerbMerge is a panelizer for Gerber RS274X and Excellon files created by the EAGLE CAD program. It can merge multiple, different jobs or copies of the same job. Jobs can also be rotated by 90 degrees."

In the new version: "Support was added for the PCB layout program as well as Orcad and the newest Eagle version 4.11r2. A few minor improvements were made."

Comments (none posted)

Imaging Applications

A new gimp-perl module pre-release is available

Pre-release version 2.0 of the gimp-perl module is available. "This fixes problems with the 'make test', as well as running scripts from the commandline (without a Perl-Server running). See the ChangeLog for more details. This release requires GIMP-2.0."

Comments (none posted)

gThumb 2.3.3 released (GnomeDesktop)

Development version 2.3.3 of gThumb, an image viewer and browser for GNOME, has been announced. This version features bug fixes and more.

Comments (none posted)

Instant Messaging

More Info on Gaim-vv (GnomeDesktop)

GnomeDesktop covers recent Gaim developments. "Lots of fuss lately about the "friendly" fork of Gaim to Gaim-vv which enables webcam and voice on popular IM protocols. Tim Ringenbach wrote OSNews with some more info and a preliminary screenshot from their early stages of the project. Also in Gaim related news, Festival-Gaim 0.77 has been released. Festival-Gaim is a gain plugin which allows you to hear your incoming IMs using the popular speach synthesis program festival."

Comments (none posted)

Gossip 0.7.5 released

Version 0.7.5 of Gossip, an instant messaging client for GNOME, is out. This version adds SSL support when registering, a private chat through group chat feature, bug fixes, and improved translations.

Full Story (comments: none)

Gnome Jabber 0.4 Released! (GnomeDesktop)

Version 0.4 of Gnome Jabber has been announced. "I have done this release mainly because people were commenting on bugs which had been fixed for a while in CVS but not been in a release."

Comments (none posted)

Silky 0.5.1 released (GnomeDesktop)

Version 0.5.1 of Silky has been announced. "Silky is a secure chat client using the SILC protocol. It's written in C and uses the GTK toolkit." This version includes new GUI features, bug fixes, and more.

Comments (none posted)

Music Applications

Latest release of FreqTweak

Version 0.6.0 of FreqTweak is available. "New in this release are spectral filter Modulators, which can animate and modulate any of the filters automatically in several ways. If you thought FreqTweak was fun before, be prepared for hours of audio mayhem."

Full Story (comments: none)

sfront 0.86 04/24/04 released

Version 0.86 04/24/04 of sfront is out with new MIDI support. "Sfront compiles MPEG 4 Structured Audio (MP4-SA) bitstreams into efficient C programs that generate audio when executed. MP4-SA is a standard for normative algorithmic sound, that combines an audio signal processing language (SAOL) with score languages (SASL, and the legacy MIDI File Format)."

Full Story (comments: none)

Office Suites

OpenOffice.org 1.1.1 with KDE NWF and KDE Icons (KDE.News)

KDE.News covers the release of a version of OpenOffice.org 1.1.1 which has been refitted with KDE widgets and icons. "OpenOffice.org 1.1.1 with KDE Native Widget Framework and KDE Crystal icon set is now available for download. If you are interested in screenshots, you can have a look at pictures of OOo Writer, OOo Calc or at a KDE desktop running OOo."

Comments (none posted)

OpenOffice.org Newsletter

The April OpenOffice.org newsletter is out. This one looks at the 2004 OOo conference, various OOo success stories, and much more.

Full Story (comments: none)

Web Browsers

Mozilla 1.7 RC 1 Released (MozillaZine)

MozillaZine announces the first release candidate of Mozilla 1.7. This version reintroduces the Talkback crash reporting system, has better GTK2 support and new popup blocking and other features.

Comments (none posted)

Independent Status Reports (MozillaZine)

The April 25, 2004 Mozilla Independent Status Reports are available. "The latest set of status reports includes updates from LookAhead, Dictionary Search, OneClick, Optimoz Mouse Gestures, DownloadWith, QuickReply and Launchy."

Comments (none posted)

Word Processors

AbiWord 2.1.2 Released (GnomeDesktop)

Version 2.1.2 of the AbiWord word processor has been announced. "The AbiWord development team is pleased to announce the release of AbiWord v2.1.2. This release is a development snapshot release, and is therefore dubbed "unstable". However, if you are interested in what AbiWord 2.2 will look like or if you want to give us a hand, we encourage you to try out this release."

Comments (none posted)

Miscellaneous

Evolution 1.5.7 released (GnomeDesktop)

Unstable release 1.5.7 of Evolution, a personal and workgroup information management application, has been announced. "A new unstable release of Evolution is now available. Features include a new contact editor, better error dialogs, improved drag-n-drop, more instant apply goodness, and much more".

Comments (none posted)

Languages and Tools

Caml

Caml Weekly News

The Caml Weekly News for April 20-27, 2004 is out with the latest Caml language developments.

Full Story (comments: none)

JSP

JSP 2.0: The New Deal, Part 3 (O'Reilly)

Hans Bergsten continues his series on JSP with part three, which covers XML issues under JSP.

Comments (none posted)

Lisp

Emacs Common Lisp

The Emacs Common Lisp project has been launched. "Emacs Common Lisp is a new implementation of Common Lisp, written in Emacs Lisp. It's not like Emacs' "CL" package as it does not intend to extend Emacs Lisp with Common Lisp functionality; however, Common Lisp functions compile to standard byte code functions, so Emacs Lisp functions can call Common Lisp functions and vice versa."

Full Story (comments: 3)

SBCL 0.8.10 released

Version 0.8.10 of SBCL (Steel Bank Common Lisp) is available. "Besides the usual bug fixes, this version provides better support for xBSD, an improved manual converted to Texinfo format, and new documentation tools."

Full Story (comments: none)

Perl

perl 5.8.4 released (use Perl)

Version 5.8.4 of Perl has been announced. "5.8.4 is a maintenance release for perl 5.8, incorporating various minor bugfixes and optimisations. This release updates Perl to the Unicode Character Database, Version 4.0.1, and fixes some minor errors in Perl's UTF8 handling. It provides optimisations for Unicode case conversion functions, map and sort, and on most platforms now provides protection against memory wrapping attacks."

Comments (none posted)

This Week on perl5-porters (use Perl)

The April 19-25, 2004 edition of This Week on perl5-porters is out. Here's the summary: "The rhythm of maintenance releases is now well established, and this week saw the release of perl 5.8.4, as expected. Meanwhile, the usual stream of bugs and patches continued."

Comments (none posted)

This Fortnight on Perl 6

This Fortnight on Perl 6 for the week ending on April 18, 2004 is online with a new round of Perl 6 topics.

Comments (none posted)

PHP

PHP 5 Release Candidate 2 Released!

Release Candidate 2 of PHP 5 has been announced. "This mostly bug fix release improves PHP 5's stability and irons out some of the remaining issues before PHP 5 can be deemed release quality. Note that it is still not recommended for mission-critical use but people are encouraged to start playing with it and report any problems."

Comments (none posted)

User-Friendly Form Validation with PHP and CSS (O'ReillyNet)

Jeff Cogswell explains form validation with PHP on O'Reilly. "Any non-trivial web application processes form data, and every secure web application has to validate that data on the server. Balancing security with user-friendliness can be tricky."

Comments (none posted)

PostScript

epstool 3.05 release

Version 3.05 of epstool has been announced. "This adds and removes previews from Encapsulated PostScript files." A few enhancements and bug fixes are included.

Comments (none posted)

Python

Python in Systems Administration: Part II -- Step up from Shell (Unix Review)

Cameron Laird has put together part two in a Unix Review series on Python for systems administration. "What kinds of problems are suited to Python? As a first approximation, think of Python the way you do Perl. Although far more Unix systems administrators currently work in Perl, the two languages are roughly comparable, for our purposes. Many of the differences between them are subjective, in the sense that experienced programmers simply find the features of one or the other fit their own habits of thinking better, although they're equally capable or provide the same formal functionality. This second installment in my series on "Python in Systems Administration" explains the parallels, then spotlights instances where Python might serve you better."

Comments (none posted)

This week's Python-URL

Dr. Dobb's Python-URL for April 28 is out; it looks at Python's competition, application-level configuration, SciPy 0.3, and more.

Full Story (comments: none)

Tcl/Tk

Dr. Dobb's Tcl-URL!

The April 23, 2004 edition of Dr. Dobb's Tcl-URL! is available with the latest Tcl/Tk articles.

Full Story (comments: none)

Dr. Dobb's Tcl-URL!

The April 26, 2004 edition of Dr. Dobb's Tcl-URL! is available with another round of Tcl/Tk articles.

Full Story (comments: none)

XML

The State of XML (O'Reilly)

Edd Dumbill looks at the current state of XML on O'Reilly. "This article is based on the closing keynote speech that Edd Dumbill delivered to the XML Europe 2004 conference in Amsterdam."

Comments (none posted)

Editors

GHex 2.6.0 is out

Version 2.6.0 of GHex, a binary editor for GNOME, has been released.

Full Story (comments: none)

Miscellaneous

PMD 1.7 released (SourceForge)

Version 1.7 of PMD, a Java source code analyzer, is out. "PMD 1.7 has been released, providing several bug fixes, a new Ant property name, and the ability to use the default platform character set encoding (vs plain ASCII)."

Comments (none posted)

Page editor: Forrest Cook

Linux in the news

Recommended Reading

Windows vs Linux - Which is easier to install?

Dave Fancella experiments with an "average idiot user" as she installs Windows 2000 and Mandrakelinux 9.2 for the first time. "The average 'idiot' user is someone who will characteristically describe themselves as an 'idiot with computers'. They don't know what a kernel is, they frequently think that 3.5" floppy disks are 'hard disks', they don't know what the 'internet' is (although they know how to check and send email), and they don't know a whole lot of things. Windows has abstracted most things so that people don't *have* to know about computers to use them. This is bad, but is a subject for another article entirely."

Comments (37 posted)

Application Suggestions for Gnome 3.0 (OS News)

OSNews presents a wishlist for GNOME 3.0. "Gnome needs an integrated (with Nautilus, Evolution and other apps) multi-protocol instant messaging application. It needs to be doing Jabber, AIM/iChat/ICQ, MSN, Y! and maybe IRC (X-Chat will always be available as a third party app to fill up any IRC voids). More over, the application will need to support video and audio conferencing for the above protocols." (Found on Footnotes)

Comments (11 posted)

Free Software's killer applications (NewsForge)

NewsForge takes a quick look at a few free software "killer apps". "While GNU/Linux has gained popularity as an operating system, many criticize it for lacking "killer applications" capable of competing with their Windows and Mac OS X proprietary counterparts. Some killer applications, however, haven't received the recognition they deserve. Here's a short overview of some professional-quality Free Software applications that run under Linux."

Comments (7 posted)

Trade Shows and Conferences

Linux User and Developer Expo 2004, Floor Report and Award (KDE.News)

KDE.News covers the 2004 Linux User and Developer Expo in London. "The main highlight of the day, however, was the prize giving ceremony that evening. Only Richard Moore was able to attend, but he picked up the prize for category "Best Desktop Environment" - beating Sun Java Desktop and Ximian Gnome!"

Comments (none posted)

The SCO Problem

BayStar: SCO needs new management (ZDNet)

ZDNet talked with BayStar about why it is trying to pull its money from SCO. It seems BayStar wants SCO to dump Darl McBride and concentrate full time on the lawsuit business. "BayStar asserts SCO's Unix products business doesn't hold long-term value for shareholders, [BayStar spokesman Bob] McGrath said. SCO reported $9.7 million in Unix products revenue and $1.6 million in Unix services revenue in its quarter ended Jan. 31. 'We think there are limited prospects of that business ever generating growing and significant revenue,' McGrath said. 'And we believe it is diverting resources from going where they would have the most value--the intellectual property process'."

Comments (28 posted)

Who Shot Darl McBride? (ZDNet)

ZDNet UK comments on BayStar's moves. "It's almost certainly too late to fix SCO, but by killing its management and keeping the IP claims on life support, something may be retrieved -- even if it's only face, an invaluable commodity in the venture-capital community. That it would be forced to make this move in public, a sanction that is indistinguishable to SCO from the threat of a massive legal fine and the judicial removal of its officers, marks an exceptional moment in modern capitalism."

Comments (7 posted)

BayStar, Bert Young, and marchFIRST (Groklaw)

Groklaw has done some research into the history of Bert Young, SCO's new chief financial officer. "Perhaps it will be news to you there were some significant financial issues at marchFIRST, which went bankrupt, and which have resulted in lawsuits with Mr. Young named as one of the defendants, charged with corporate waste and breach of fiduciary duty, among other things. The lawsuits are ongoing."

Comments (3 posted)

Double whammy for SCO (Salt Lake Tribune)

The Salt Lake Tribune has a lengthy article for people who haven't been keeping up with SCO; judging from the picture, Darl McBride hasn't been sleeping well recently. "'I'm not sure I see the sense in what they are doing. They have yet to prove their claims, and yet have moved forward' with lawsuits and a largely ignored global campaign to sell Linux licenses, said Dan Kusnetzky of IDC. 'The assessment I have seems fairly bleak. And as they continue this particular avenue, the prospects are more and more bleak,' he said."

Comments (3 posted)

Companies

Open Sourcerers get UK trade body (Register)

The Register covers the launch of Zope UK, in London. "According to the founders of the Zope UK Association, the hope is that with one body to present the views of the open source community to government and other organisations, the technology will make further inroads into the business world."

Comments (none posted)

Sun announces new free support for open source server companies (NewsForge)

NewsForge reports on the latest Java news from Sun. "Representatives from open source server leaders JBoss, Apache Software Foundation, and Europe's ObjectWeb consortium were on hand Monday in San Francisco in a show of marketing support for the updated J2EE platform, mostly because Sun has loosened up its open-source-connected licensing terms in recent weeks."

Comments (none posted)

Legal

GPL gains clout in German legal case (News.com)

News.com takes a look at the netfilter case in Germany. ""This would be the first reported decision I'm aware of that interprets the GPL," said Brian Kelly, an intellectual-property attorney with Manatt, Phelps & Phillips. "Case law interpreting the GPL is both inevitable and useful, because parties are going to end up fighting over ambiguities in the license.""

Comments (6 posted)

Interviews

Interview with Miguel de Icaza (Netcraft)

Netcraft News interviews Miguel de Icaza. "We cannot choose one desktop over the other - Gnome or KDE - because there's users for both code bases.... Gnome and KDE are basically the shells, but then there are higher-level applications like the office suite. We're making the decision it's going to be OpenOffice, the browser it's going to be Mozilla, the email client it's going to be Evolution, the IM client it's going to be Gaim. So we basically have to pick successful open source projects and put them together."

Comments (12 posted)

An Interview with Harald Welte (OrangeCrate)

OrangeCrate.com has done an interview with Netfilter maintainer Harald Welte. "I'd much rather prefer spending my time developing software and not dealing with legal issues at all. But I am developing this software for the freedom of the users - and I am determined to make use of legal means against any party who wants to prevent users from exercising their freedoms."

Comments (none posted)

The People Behind KDE : Alexander Kellett (KDE.News)

KDE.News introduces this week's People Behind KDE interview with Alexander Kellett. "In what ways do you make a contribution to KDE?
A number of improvements to bookmarking in Konqueror, KEditBookmarks, some DCOP related stuff, very minor stuff to KSVG, and as of late polishing the QtRuby and Korundum projects with some example code and test cases."

Comments (none posted)

Interview with Barth Netterfield about kst

Tom Chance interviews astrophysicist Barth Netterfield, author of Kst, a data plotting application for KDE. "The Free Software community is constantly inundated with interesting new projects, but occasionally something crops up which is really special. Kst is just such a project. Started by Barth Netterfield, an astrophysicist, as a personal project to plot data from his experiments, it has now taken on a life of its own, being used in academic projects including BLAST, Boomerang and Planck. It is finding widespread use in Universities and in the European Space Agency, and its development is funded by the Canadian Space Agency."

Comments (none posted)

Resources

Linux Productivity Magazine April 2004

The April issue of Linux Productivity Magazine is out. This month the magazine helps you take advantage of free software when upgrading to a new computer.

Comments (none posted)

Installing and Configuring Nessus (O'ReillyNet)

Here's an O'ReillyNet how-to on installing and configuring Nessus, an open source network vulnerability scanner. "Why Nessus? You just can't beat free. There are commercial vulnerability scanners available and they may be useful in their own right, but consider that Nessus is comparable to some commercial scanners that can cost hundreds of thousands of dollars. In addition Nessus is open source, and its source is published under the GPL."

Comments (7 posted)

Reviews

Metrowerks tool supports entire embedded Linux dev cycle (LinuxDevices)

Linux Devices covers a new version of Metrowerks' embedded Linux development suite meant to support the entire device development cycle. "Metrowerks claims its Platform Edition suites provide several unique capabilities not supported by other "end-to-end" Linux tools providers."

Comments (none posted)

Open-Source Bug Tracking with Bugzilla (Linux Journal)

Linux Journal takes a look at Bugzilla. "This article provides an overview of how introducing Bugzilla can help your team work together and communicate more efficiently. Bugzilla uses the term bug, so I will stay with this notation throughout the article, but don't forget, it's not only about bugs, You can use Bugzilla for any task you need to track."

Comments (none posted)

OSDL doubling membership, seizing China chance (NewsForge)

NewsForge looks at OSDL's membership drive. "With an eye on pumping up its desktop initiative and customer advisory councils in the U.S. and Europe, as well as riding a swell of Linux and open source adoption in Asia, the Open Source Development Lab (OSDL) is on track to double its membership by year's end, OSDL Chief Executive Officer Stuart Cohen told NewsForge last week."

Comments (none posted)

Scribus 1.1.6 Reviewed (Mad Penguin)

Mad Penguin reviews the latest version of Scribus. "Scribus is a desktop publishing program for Unix and Linux. It is built with the Qt libraries and is run natively in the KDE desktop environment. Scribus is published under the Gpl and is similar to similar to Adobe PageMaker, QuarkXPress or Adobe InDesign. Scribus has an unusually small development team and is mostly the work of a German programmer called Franz Schmid. The Scribus team are positioning the program as an easy to use DTP publishing program for the Linux and Unix operating systems with support available for professional publishing features." (Found on KDE.News)

Comments (6 posted)

Miscellaneous

The Rise of Interface Elegance in Open Source Software

"Acts of Volition" has posted an article on user interfaces in free software. "While it may be that I'm attracted to projects that tend towards elegance in interface and design, I suspect that the examples I've cited here are not exceptions. Rather, I see them as part of a larger trend in open source software - one where simplicity and elegance in interface design is held in the same respect as elegance in code and engineering has been all along."

Comments (3 posted)

Opening Up E-Voting (O'ReillyNet)

O'Reilly looks at open source e-voting. "The politics of e-voting may be controversial, but the technologies used for e-voting are not exceptionally complicated or difficult to understand. Now, two initiatives have opened e-voting systems to public examination and varying degrees of tranparency and verification. The Open Voting Consortium demonstrated an e-voting system called evm, built from commodity hardware running GPL'd software last April 1. A few days later, VoteHere opened the source to its proprietary VTHi e-voting software to public inspection."

Comments (1 posted)

Page editor: Forrest Cook

Announcements

Non-Commercial announcements

AMD joins OSDL

The Open Source Development Labs (OSDL) has announced that AMD has joined OSDL and will participate in OSDL's Data Center Linux and Carrier Grade Linux working groups.

Full Story (comments: 5)

Commercial announcements

Lindows Partners With Questar to Offer Linspire in Italy

Lindows, Inc. has announced that the company has signed a joint agreement with Questar to provide Italian citizens with Linspire.

Comments (none posted)

TransGaming and Lindows Partner to Bring Games to Linspire

TransGaming and Lindows have announced that they will be partnering to bring PC games to the Linspire distribution.

Full Story (comments: none)

Mandrakesoft: half-year results ending March

MandrakeSoft has released its half-year results ending March 31. Of note is a 20% increase in revenue and 37% increase in gross profits as compared the comparable period last year.

Comments (8 posted)

Metrowerks CodeWarrior development studios

Metrowerks has announced availability of two new CodeWarrior development studios for Linux.

Full Story (comments: none)

MontaVista Software gets another $7 million

MontaVista Software has announced equity investments from Siemens, Infineon, Samsung, and the China Development Industrial bank totaling $7 million. The total amount of equity investments in this embedded Linux company now exceeds $72 million.

Comments (none posted)

Opera Version 7.50 Beta 1 Released on all Desktop Platforms

Opera Software has released the beta 1 of version 7.50 of the Opera browser, redesigned from the bottom up for all platforms, including Linux and FreeBSD.

Full Story (comments: none)

VideoPropulsion announces Linux support for PCI HIPPI NIC

VideoPropulsion has announced support for HFP-866 PCI HIPPI Network Interface Controller (NIC) on systems using the Linux operating system.

Full Story (comments: none)

xDMS Xandros Desktop Management Server in Enterprise Testing

Xandros has announced enterprise trials of xDMS (Xandros Desktop Management Server), which offers remote management capabilities.

Full Story (comments: none)

New Books

GNOME 2 Developer's Guide

The Official GNOME 2 Developers Guide has been published by No Starch Press. "Last week, No Starch Press and the GNOME Foundation announced the release of _The Official GNOME 2 Developers Guide_, the first English-language book about developing with GNOME 2. Written by Matthias Warkus in German, the book was translated by Brian Ward and given a technically polish by Michael Meeks. The forward is by Miguel de Icaza. This book was a long time in the making."

Full Story (comments: none)

Prentice Hall releases Linux Programming By Example: The Fundamentals

Prentice Hall PTR has announced the publication of Linux Programming By Example: The Fundamentals.

Full Story (comments: none)

"High Performance MySQL" Released by O'Reilly

O'Reilly has publishe the book High Performance MySQL by Jeremy D. Zawodny and Derek J. Balling

Full Story (comments: none)

WarDriving: Drive, Detect, Defend published

Syngress Publishing has published the book WarDriving: Drive, Detect, Defend by Chris Hurley, Frank Thornton, Michael Puchol, and Russ Rogers.

Full Story (comments: none)

Wi-Fi Guide, Second Edition Published

Paraglyph Press has published the second edition of Jeff Duntemann's Wi-Fi Guide.

Full Story (comments: none)

Resources

Austin Group Minutes for April 22, 2004

The minutes are available for the April 22, 2004 Austin Group teleconference.

Full Story (comments: none)

GNOME Foundation / Mozilla Foundation Meeting (GnomeDesktop)

GnomeDesktop.org has the minutes from a joint meeting between the GNOME Foundation and some Mozilla Foundation members. "We had a meeting with some representatives of the Mozilla Foundation about how we could collaborate a little closer in future."

You can read more about the meeting in this MozillaZine article.

Comments (none posted)

LDP Weekly News

The April 28, 2004 edition of the Linux Documentation Project Weekly News is available with the latest documentation releases.

Full Story (comments: none)

The Native-Lang Newsletter

The April 1, 2004 edition of the OpenOffice.org Native-Language newsletter is available. "This newletter will keep you updated on what's going on inside the Native-Lang Confederation of OpenOffice.org We'll try to collect every piece of interesting news inside the Native-Lang projects, at the level of the Confederation and we'll also provide some insights on localizations, marketing, development, etc..."

Full Story (comments: none)

Real World Linux Slides Online (KDE.News)

George Staikos has announced the availability of slides from his talk at the Real World Linux conference. "This month I had the opportunity to speak about KDE, what KDE is doing to move into the enterprise, and present a case study of a company who moved from a Microsoft Windows platform to Linux and KDE. The presentation was at Real World Linux in Toronto, and Robert Brodie of Display Works Inc. joined me to talk about their migration experiences. The slides are finally available online, both mine and Robert's. In addition, the original OOImpress document of my slides is online."

Comments (none posted)

Contests and Awards

2004 MySQL Awards announced

The winners of the 2004 MySQL Application of the Year and MySQL Partner of the Year awards have been announced. "Presented at last week’s MySQL Users Conference & Expo, the MySQL Application of the Year and Partner of the Year awards recognize select MySQL users and partners whose applications, products or services are models for how MySQL can be used in major computing systems to bring dramatic cost savings, performance and reliability benefits to organizations and end-users."

Comments (none posted)

OpenOffice.org School Mascot Competition: Winner Announced

The winner of the OpenOffice.org mascot competition has been selected. "The happy winner is Andrea Maggioni, whose cheerful drawing, of a fun-looking seagull holding a fish, plays on the "OOo" shorthand of OpenOffice.org and was chosen democratically out of dozens of submissions by students throughout the world."

Full Story (comments: none)

2004 ICFP Programming Contest Announcement

The 2004 ICFP Programming Contest will take place from June 4-7, 2004. "We are pleased to announce the Seventh ICFP Programming Contest to be held in conjunction with the 2004 International Conference on Functional Programming (ICFP 2004). All programmers are invited to enter the contest, either individually or in teams; we especially encourage students to enter. You may use any programming language (or combination of languages) to show your skill."

Full Story (comments: none)

Ludum Dare 48 Hour Competition 4

A new Ludum Dare 48 Hour game writing competition has been announced. "The Ludum Dare Competition is a 48 hour solo endurance game design/programming community competition. The goal is to explore unique, innovative, and wacky game design ideas, without the commitment of a regular length game project. Given a community decided theme, each entrant builds a game from scratch over the period of 2 days. For a sense of competetion, the entrants vote and score the entered games, but there are no prizes."

Comments (none posted)

Event Reports

SambaXP 2004 A Success

The Samba Site covers the recent SambaXP conference. "SambaXP, held in Göttingen, Germany April 5-7, was a success and a good time for all involved. Thirteen Samba Team members were present, leading ten talks and tutorials over the three days."

Comments (none posted)

Upcoming Events

2nd international Linux Audio Conference update

The second international Linux Audio Conference starts on April 29 in Karlsruhe, Germany. "We have a number of very interesting presentations, all of which will be streamed out live, for the unlucky folks who can't be here in person. additionally, you will be able to download the presentation slides in advance should you wish to follow a lecture. there will be feedback channels on IRC, operated by folks who are in the lecture rooms. they will relay questions from you to the live audience."

Full Story (comments: none)

EuroPython News Update

A news update has been published for the EuroPython European Python and Zope Conference. The event will take place in Sweden on June 7-9, 2004.

Full Story (comments: none)

Reminder: YAPC::Europe submission deadline (use Perl)

Use Perl has posted a reminder that proposals are due soon for YAPC::Europe.

Comments (none posted)

Windows NT4 Migration to Samba-3 Seminars in Australia

The AUUG has announced a series of Australian seminars on the migration from Windows NT4 to Samba-3. The events will be held in Sydney, Melbourne and Canberra through May.

Full Story (comments: none)

Events: April 29 - June 24, 2004

Date	Event	Location
April 29 - May 2, 2004	2nd Linux Audio Developers Conference	(Institute for Music and Acoustics)Karlsruhe, Germany
May 3 - 5, 2004	International PHP Conference 2004 Spring Edition	Amsterdam, Netherlands
May 6 - 8, 2004	TheServerSide Java Symposium	(The Venetian)Las Vegas, NV
May 6 - 8, 2004	Web.It 2004	Padova, Italy
May 11 - 12, 2004	LinuxWorld Conference & Expo	(Hotel Istana)Kuala Lumpur, Malaysia
May 16 - 18, 2004	European Firebird Conference 2004	Fulda, Germany
May 17 - 20, 2004	Fifth LCI International Conference on Linux Clusters	(University of Texas)Austin, TX
May 17 - 19, 2004	Enterprise Software Summit	(The Palace Hotel)San Francisco, CA
May 17 - 20, 2004	Black Hat Briefings Europe 2004	(Grand Hotel Krasnapolsky)Amsterdam, the Netherlands
May 17 - 21, 2004	Apache Boot Camp	Atlanta, GA
May 20 - 22, 2004	Austrian Perl Workshop	Vienna, Austria
May 24 - 26, 2004	GridToday 2004	(Philadelphia Convention Center)Philadelphia, PA
May 25 - 26, 2004	LinuxWorld Conference & Expo	(Suntec)Singapore
May 26 - June 6, 2004	DebConf4	Porto Alegre, Brazil
May 26 - 29, 2004	2nd International Symposium on Computer Music Modeling and Retrieval	Esbjerg, Denmark
June 2 - 4, 2004	2004 GCC and GNU Toolchain Developer's Summit	(Ottawa Congress Centre)Ottawa, Canada
June 3 - 4, 2004	Web.It 2004	Milano, Italy
June 6 - 7, 2004	French Perl Workshop	Paris, France
June 7 - 9, 2004	EuroPython	(Chalmers University of Technology)Göteborg, Sweden
June 13, 2004	1st European Lisp and Scheme Workshop	Oslo, Norway
June 14 - 18, 2004	18th European Conference on Object-Oriented Programming(ECOOP-2004)	(The University of Oslo)Oslo, Norway
June 16 - 18, 2004	Yet Another Perl Conference(YAPC::NA::2004)	(University at Buffalo)Buffalo, NY
June 16 - 18, 2004	YAPC::NA 2004	(University at Buffalo)Buffalo, NY

Comments (none posted)

Mailing Lists

Boston GNOME list formed

A new Boston area GNOME mailing list has been formed. "Since there are a lot of GNOME contributors now living in and around the Boston metropolitan area, we're setting up a list for announcing informal social events."

Full Story (comments: none)

Web sites

HylaFAX Wiki site launched

A new HylaFAX Wiki has been launched to support the HylaFAX fax modem project. "The HylaFAX Wiki is under construction. Please add to it, and watch it grow!"

Comments (none posted)

LinuxQuestions.org Adds a Linux User Groups Forum

LinuxQuestions.org has added a new forum for Linux User Groups. "The LUG forum will allow members of Linux User Groups around the world to post announcements, attract more members, coordinate meetings and communicate with other LUGs. It also provides a resource for people who are interested in joining a local LUG, making it easier to find one in their area."

Full Story (comments: none)

LinuxQuestions.org Adds an Enterprise Linux Forum

LinuxQuestions.org has announced a new forum on Enterprise Linux. "The LinuxQuestions.org Enterprise Linux forum will offer a place to get free, community-based help to enterprise users who are running Linux, migrating to Linux or researching the viability of a Linux implementation. As Linux moves into the enterprise, it is increasingly important to have a community resource to leverage when addressing smaller problems or searching for quick tips that a traditional support contract may not cover."

Full Story (comments: none)

Software announcements

This week's software announcements

Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:

• Sorted alphabetically,
• Sorted by license.

Comments (none posted)

Page editor: Forrest Cook

Letters to the editor

Information Week Article on Linux and Sound

From:		"Marty Ferguson" <marty-AT-rtmx.net>
To:		authors-AT-lwn.net
Subject:		FW: [TriLUG] Information Week Article on Linux and Sound
Date:		Thu, 22 Apr 2004 16:11:11 -0500

Fred Langa,
CC: Triangle Linux Users Group

I read and enjoyed your efforts to get sound working on Linux with
mainstream Intel hardware.  Particularly, where you could go all the way
back to Win95.  Your intrepid efforts are valiant, and demonstrate great
skill in diagnosis and problem solving.

A possiblity exists that Intel never tested new revisions of this
mainboard/sound processor combination with Linux, yet still intend to
provide (limited) compatiblity.  But, based on the results of your thorough
testing, I doubt that this is the case.

LOADLIN has been used for several years to conquer the specific sound card
problem you've encountered.  Loadlin is a windows based utility that allows
users to boot (or springboard) Linux once WINxx is up and running.  This
problem boils down to the single issue of closed interface architectures
versus open interface architectures.

The Intel integrated sound system on your computer is a programmable
device, perhaps (and very likely) it is "Sound Blaster Compatible"; yet
still it is a closed-technology Intel-proprietary device.  It may well
never be "Linux supported" directly from _within_ the Linux community,
because it would be a violation of license agreements to do so.  At a
minimum, it would be a violation of Intel's copyright protection over thier
sound card chip(s/set) for a Linux kernel contributor to reverse-engineer
the binary object code that is downloaded into this device without formal
approval from Intel.

Only Intel can provide a solution.  They must contribute an open source
module which downloads the binary code to the chip.  Clearly, Intel has
decided not to follow this path, prefering to protect their sound system
through mantaining trade secrecy in their technology. Any other choice on
Intel's part could be a potential compromise of their proprietary
technology.  So it is quite justifiable and well within Intel's rights to
protect their intellectual property.

Here is your key question: "And if the hardware was to blame, how could XP
handle it out of the box, with no special drivers or setup?" And the key
answer is, of course, that hardware vendors write their proprietary drivers
and provide the code directly to Microsoft.  These drivers provide the
interface between the OS and the layers of abstraction (Hardware
Abstraction Layer) see http://hal.freedesktop.org/ for a description of the
nascent efforts in this arena) Based on a quick skim of your recent article
on Microsoft's Virtual PC product, it comes to me as no surprise that it
would not solve your sound card interface problem.  The abstraction layer
would be no different, would it?

So here is how Loadlin solves the problem:
1 - Boot into Windows.
2 - Windows downloads the proprietary code into the sound device(s)
   a -  e.g., perhaps Digital Signal Processor (DSP) microcode,
   b -  e.g., and some SoundBlaster emulation mode interface routines
C - Run Loadlin. Loadlin starts up Linux
D - Linux probes hardware, and sees what looks like a
    sound-blaster/compatible interface.
E - Sound works under Linux as expected.

As an aside, in the SCSI disk adapter world, similar issues used to arise
in Mylex versus Adaptec.  Mylex opened their interfaces many years ago,
making it much easier to design, test, probe and integrate their products.
At that time, it provided Mylex with a distinct competitive advantage over
Adaptec in the Linux server world.

In summary:
(1) Caveat Emptor.
(2) Apparently Intel Inside doesn't necessarily indicate open architecture
    compatibility.
(3) Look for the Linux friendly Tux the Penguin on your retail packaging.

Respectfully,
Marty Ferguson, RHCE, RHCX, LPI-1 Certified

--
TriLUG mailing list        : http://www.trilug.org/mailman/listinfo/trilug
TriLUG Organizational FAQ  : http://trilug.org/faq/
TriLUG Member Services FAQ : http://members.trilug.org/services_faq/
TriLUG PGP Keyring         : http://trilug.org/~chrish/trilug.asc

Comments (4 posted)

Page editor: Jonathan Corbet