The 2004
Ottawa Linux
Symposium is now history. OLS has, once again, proved itself to be one
of the leading development conferences worldwide. By many accounts, this
![[Ottawa lightshow]](/images/ns/lightshow-sm.jpg)
was one of the best years yet. This view is supported by the standing
ovation given to conference organizer Andrew Hutton at the end.
This year, OLS expanded to fill a larger part of the Ottawa Conference
Center, to good effect; the extra space was appreciated by all. AMD
sponsored an opening reception featuring a talk by author Jim Munroe;
unfortunately, in your editor's opinion, Mr. Munroe's speeches are not as
interesting as his books. He characterized Linux as being a response to
Microsoft, rather than something valuable in its own right, and he thought
that his audience, full of IBM, SGI, AMD, Intel, Novell, etc. employees,
would be interested in a lecture on the evils of corporate power. The
closing reception, held at the newly-expanded Black Thorn, was as
successful as ever - to the obvious regret of the crowd of hungover developers
on the airport shuttle the next morning.
Kernel developer Andrew Morton was this year's keynote speaker. He called
for unifying the kernels shipped by the distributions, and asked that
distributors work toward getting their patches into the mainline quickly. He
acknowledged that some distributors see kernel enhancements as part of the
value they can add, but asked those distributors to find some other way to
provide value to their customers. Fragmenting the kernel may be within the
rights granted by the license, he said, but he sees it as being bad for the
long-term future of Linux. He warned these distributors that he would
actively work to undermine that strategy.
Andrew spent much of his time on the advantages of having a community-run
platform upon which to build products, noting that "system software" is
often where free software is most successful. He urged developers working
on kernel code - drivers or new features - to get their code into the
kernel early, so that it can benefit from the community process. He also
acknowledged the community's debt to Richard Stallman.
Andrew finished by noting that, while Linux tends to enter companies from
the bottom, it does not stay there. And neither do the people who brought
in Linux in the first place. Some of them eventually get promoted into
management, which helps the process along. "World domination," says
Andrew, "is proceeding according to plan."
Along those lines, it is worth noting that the mix of attendees was a
little different this year. The core of developers which defines OLS was
as strong as ever, but, on the edges, one could see a fair number of
management types, representatives from technical companies worldwide, and
members of the press. The visibility of this conference, in other words,
is growing beyond the developer community that it serves.
(LWN's coverage from a few OLS talks can be found below. The slides from LWN editor Jonathan Corbet's
talk (on what to expect from kernel development in the next year) are
available for the curious.)
Comments (none posted)
Two sessions at the Ottawa Linux Symposium hosted by Keith Packard and Jim
Gettys combined to give a good overview
of where the X window system is going. This article is an attempt to pull
together the material covered in those talks. X, which, in Jim's words,
"just sat there for years with
nothing interesting happening," is now the focus of a flurry of activity.
Expect to see interesting things happening over the next year or two -
especially if a few more developers can be brought into the fold.
Keith Packard's talk had to do with separating the X server from the
hardware. X currently does all kinds of interesting things, from direct
programming of video modes through to remapping the PCI bus (to get around
interesting BIOS behavior), scary DMA operations from user mode, direct
interpretation of mouse events, and no end of user-space busy-waiting.
There are all kinds of unfortunate side effects from this behavior;
remapping the PCI bus and attempting DMA from user mode can bring down the
whole system without much trouble. X's busy-waiting behavior leads, among
other things, to poor interaction with the scheduler, which sees X as a CPU
hog process whose priority should be lowered. Things would improve greatly
if X did not get its hands quite so dirty with the hardware.
Interestingly, Keith blames himself for much of the current situation.
Very early X11 implementations dealt with the operating system for their
frame buffer access. Then Sun came out with a closed video adaptor which
required some user-space tweaking; Keith duly hacked this up. More closed
hardware came out, making the problem worse. Things led to the current
situation, where X knows all about the hardware, deals with it at a very
low level, and occasionally lets things go wrong in spectacular ways.
Things are, says Keith, starting to get better. The direct rendering
infrastructure (DRI) is "a glimmer of sanity"; it returns
DMA and interrupt handling to the kernel. The kernel frame buffer
subsystem has helped to move hardware detection and mode selection back
into the kernel. And /dev/input has gotten X out of the business
of directly interpreting mouse sequences and trying to figure out which
protocol is in use; the input subsystem also allows marking input events
with proper, accurate timestamps, which is important to many applications.
The input subsystem is still not perfect, however, especially on multi-head
systems: there is no easy way to associate input devices with specific
displays.
The process of separating X from the hardware needs to continue, however.
X is still often in the business of configuring video modes, which is a
complex and unforgiving task. "Everybody just hopes that X gets it right."
This task should be moved out of X, and into some appropriate combination
of kernel and user-space code.
Keith's vision goes beyond mode selection, though; he would eventually like
to see the X server using GL to speak with the hardware. Turning X into a
GL client would make proper 3D support easier, would further separate X
from the hardware, and would give hardware vendors a single set of drivers
to write.
A huge remaining issue with the hardware side of X is hotplug monitors.
The assumption that the available screens will never change is wired very
deeply into the X server, and will not be easy to root out. But this work
must be done; people are increasingly wanting to, for example, plug their
laptop into different projectors from one day to the next, and it would be nice if it
actually worked.
Jim Gettys's talk covered just about every aspect of the window system -
and most of those are currently in flux. The fork in X development, which
saw almost all of the XFree86 developers moving over to X.org, has
revitalized development in a number of ways. Many longstanding problems
are being addressed, and lots of new ideas are being kicked around.
Jim started with a list of current issues with X:
- The X font architecture, as originally designed, was terminally
broken.
- The internal 2D graphics engine was poor; the plan from the beginning
had been to replace it quickly. Once again, we see how "temporary"
code can stay with us for decades.
- For various reasons, screen magnifiers and other accessibility aids
are very hard to implement.
- X needs better "eye candy" support: translucent graphics, drop
shadows, etc. Competing window systems (OS X, Longhorn) are
raising the bar in this area, and X needs to stay up with them - if
not ahead.
- Three-dimensional graphics are increasingly commonplace, and must be
properly supported.
- Shared use of X (shared projector walls were an example that came up
repeatedly) is poorly supported currently.
Anybody who has worked with X in any depth knows that its font mechanism
has not aged well. What is happening now is that fonts are, increasingly,
the responsibility of the client; the centralized font engine model has
failed. This is, says Jim, the biggest single architectural change
happening with X. Putting font support in the clients allows quicker
distribution of new technologies; Jim notes that there have been five
generations of font formats so far during the lifetime of X, and there is
no reason to expect things to slow down. Any change which requires X
server support cannot expect to see widespread deployment for at least two
years; client-side changes can propagate much more quickly.
One of the reasons for putting font support in the X server initially was
to keep bandwidth usage down. As it turns out, moving font support into
the clients has left bandwidth usage almost unchanged, but has eliminated
about 1/4 of the round trips to the server during application startup.
Anybody who has ever run an X application over a high-latency link knows
that those round trips hurt; eliminating them can only be a good thing.
Jim noted some lessons which come from the font experience. One is that
downward compatibility is absolutely necessary. New technologies (such as
newer font schemes) only
became accepted when libraries were provided to make them work with older
servers. No developer is interested in adopting technologies which
restrict the distribution of their applications. It is also necessary to
solve the full problem; in the case of fonts, that means solving the
problem for printing as well. With that in place, "even OpenOffice" is
moving over to the new font code.
Next point: eye candy is important. To a great extent, "eye candy" means
translucent windows in one form or another. The real use for translucence
is likely to be in window managers; once the new capabilities become
available, Jim expects yet another round of window manager
experimentation. "Another thousand flowers will bloom; many of them will
stink." But what survives will enrich the graphical experience for all of
us.
Keith took the stage for one of his famous demonstrations. His desktop is
looking better all the time, with menus fading in and out and extensive
(some might say excessive) use of translucence everywhere. He pointed out
that translucence is a pixel-by-pixel property. He runs an xterm with a
translucent background, but the text is opaque, and casts solid shadows.
High bandwidth applications, such as full-motion video, run in a
translucent mode with no apparent performance problems - on a fast laptop,
anyway.
"Eye candy" also means tools like screen magnifiers (which keep up in real
time) for people who have a hard time reading the screen's contents.
"Thumbnailers" (such as those often used for virtual desktops) will also
benefit from this work. Animation needs better support, and X needs better
integration into three-dimensional environments. "We live in a 3D world,
perhaps our work environments should be 3D as well." Eliminating
"flashing" (making desktop updates look nice) is also an important goal.
All of this is happening, in classic computer science manner, through the
addition of another level of indirection. X applications have typically
rendered their graphics directly into the frame buffer, unless they made
explicit use of off-screen pixmaps. In the new world, all rendering will
happen into off-screen memory. A new "compositing manager," which
typically works in conjunction with the window manager, renders the
off-screen windows onto the display, perhaps transforming them along the
way. It is this process which, for example, causes a newly maximized
window to fade, fully rendered, onto the screen, rather than just flashing
up blank and being redrawn in place. The policy for when and how such
effects should be used lives entirely within the compositing manager.
To accomplish all of this, four new extensions have been added to the X
protocol. "XFixes" is a sort of repository for minor repairs for things
that were done wrong in the original protocol. Among other things, XFixes
promotes Regions to a first-class X protocol object. The "Damage"
extension allows X
clients to be notified when the contents of windows changes; it can be used
by the compositing manager, screen magnifiers, thumbnailers, and any other
process which needs to know when things happen. Interestingly, the Damage
extension actually shrinks the size of the X server; a sign, according to
Jim, of something that should have been done that way from the beginning.
The "Composite" extension
handles the off-screen rendering of windows and the interactions with the
compositing manager. And "Xevie" allows the
interception of input events; it is used both for compositing (where event
locations may have to be transformed on their way to the client) and for
accessibility functions.
The latency issue is on the X developers' minds. X client startup can be
slow, especially on high-latency links. This slowness is caused by the
large number of round trips required between the client and the server
during initialization. Client-side fonts eliminated 25% of those, but, for
a typical client, some 130 round trips still need to happen before any
actual work can get done. Jim believes that 90% of those can be
eliminated; some will be harder than others. One of the biggest remaining
offenders, it turns out, is X extensions; apparently an "Extension
extension" may be required to batch together extension information.
In the 2D world, the Cairo
library, by Carl Worth and Keith Packard, is
starting to come into use. This engine, says Jim, brings "world-class,
two-dimensional, anti-aliased graphics" to the free software world; it is
second to none. Along with top-quality graphics, Cairo turns printing into
a first-class citizen; the audience reacted to this statement with loud
applause. There is work left to be done with Cairo, including the addition
of more backends and, inevitably, optimization.
Security is another issue. Currently, the only rational way to use X
remotely is through an ssh tunnel, but that has its costs: extra processes
in the loop, more latency, etc. X clients need to be able to talk directly
with the server in a secure manner. Jim notes that X terminals are coming
back. Maintenance of desktop clients is costly, and the deployment of
simple X terminals can reduce those costs. But it has to be possible to
use them in a secure manner.
The other interesting security issue is access to shared resources. It
would be nice to be able to walk up to a projector wall with a laptop and
start making use of it. Handling of input devices also figures into this
equation; how does one connect a mouse to a wall screen? If this problem
could be solved, there is the potential to "explode the PC into its
component pieces" and create an interesting, dynamic world.
There are no security policy options in X for this
kind of shared use, however. Jim briefly mentioned some ideas involving
integration with SELinux as a way of addressing this area.
A related topic is mobility. Wouldn't it be nice, asks Jim, if you could
leave the office, go home, and pick up with your applications on your home
system? This is a hard problem, but it is being addressed; there is
prototype migration code in GTK now. There are security issues to deal
with, of course, along with little things like teaching Xlib to deal
gracefully with connection loss.
Other issues mentioned in passing include proper network audio support
("all of the current audio servers are lame; we need one good one"), better
color management (for things like printers too), and proper support for
compression in the X protocol. It seems that the bulk of X traffic,
anymore, is image data, and much of that data compresses very well.
Finally, there are the packaging and development issues. Work to split the
X distribution into its component pieces (server, libraries, applications,
fonts) continues; there will eventually be no "tarball from hell" to deal
with. Modern building tools are being adopted; imake is on its way out.
Much of this work is done, but some pieces remain.
On the community side, Jim notes that X.org is a very different place from
what it was a year ago. Most of the XFree86 developers have come over, and
it is clearly the focal point for X development.
Perhaps the most important part of Jim's talk was repeated several times:
the X developers have ambitious aims and a great deal of work that needs to
be done; they are actively looking for developers to take on pieces of it.
For anybody out there who is looking for a project to support, X.org
represents a major opportunity. X is the core, the kernel, as it were, of
the Linux graphical environment. The development effort is healthy again,
and it has no end of interesting and challenging tasks to address. It is
hard to imagine a better, more interesting, more visible, or more important
project to work with. If you are looking to do some hacking, X would be an
ideal place to do it.
Comments (57 posted)
Harald Welte, the current netfilter maintainer, ran a session on dealing
with GPL violations. Harald has made a name for himself over the last year
by reaching settlements with several manufacturers who were shipping
products containing the netfilter code without complying with its licensing
requirements. In most cases, these settlements have been relatively easy
to reach, with the offending companies releasing their code and, in many
cases, making a donation to the FSF or a related worthy cause. Harald is
also the force behind the injunction in the Sitecom case, which just
received another court ruling that the GPL is valid and enforceable in
Germany.
Harald's approach differs from that of the Free Software Foundation. The
FSF tries to resolve GPL violations in the most quiet, friendly way
possible; in most cases, the wider world never even hears that there is a
problem. Harald found himself frustrated with this way of doing things; it
takes far too long (perhaps longer than the lifetime of the offending
product) and gives no real disincentive for companies considering ignoring
the GPL. So he took matters into his own hands; by bringing in lawyers
early, making violations public,
and threatening immediate damage to the offenders' bottom line, he
has gotten some real results.
Some interesting features of the German legal system have worked in
Harald's favor in this campaign. By (his lawyers' interpretation of)
German law, simple use of the netfilter/iptables internal API is a strong
indication of a derivative work. Since it is not a "standard" API, there
is no copyright boundary there; by this same reasoning, any binary-only
kernel module is a GPL violation. This interpretation of the GPL also
rules out putting GPL-licensed code onto hardware which only runs signed
binaries - unless the key is distributed with the source.
German law requires that any request for injunctive relief be filed within
four weeks of the discovery of the infringement. This is an inflexible,
externally-imposed deadline which forces companies to move quickly to
resolve the issue. When a company has received a cease-and-desist notice,
it knows that it cannot drag it issue out over time; it will, instead, find itself
in court in short order.
Harald was asked about the completeness of the code releases he has won so
far; apparently not all vendors have released kernels which actually can be
rebuilt into a working image - or which even compile. His response is that
his ability to compel code releases really only extends as far as his
copyrights in the netfilter code. If a vendor does not release a full
kernel, copyright holders in other parts of the system will have to get
involved.
The last part of the talk covered things developers can do to help make
copyright enforcement easier. They include:
- Don't fix spelling errors and typos, and leave strange messages
(example: "Rusty needs more caffeine") in place. The presence of this
sort of text in a binary image is an obvious sign of copying. The
removal of this text, instead, would be a clear sign of a willful
violation, which raises the stakes considerably.
- The copyright message needs to be in the binary as well.
- It is important to track the names of all contributors to the code, so
they can be found for enforcement actions or the distribution of any
sort of damages.
- When a violation is found, it should not be made public at the time,
as that can make getting injunctive relief harder. Instead, a lawyer
should be brought in to prepare and send the "cease and desist" note.
Expect to hear about more resolved violations in the near future. Harald
indicated that a couple of settlements have been reached, but the companies
involved have been given a grace period to prepare for the fallout once the
situation has been made public. Once that period has passed, the press
releases will go out.
Comments (35 posted)
Specifix, a company founded by a
number of early Red Hat developers, recently came out of hiding. At the
2004 Ottawa Linux Symposium, Eric Troan gave a presentation on Conary, the
company's system for package, repository, and distribution management. It
was a technical talk from the beginning to the end; Eric would not talk
about Specifix's business model even when asked (though he offered to do so
in private). If nothing else, he understands what the OLS crowd is looking
to hear.
Package management systems have come into use in almost every distribution
out there. They are a clear step up from what came before, but, as Eric
pointed out, significant problems have been building for years. These
include:
- Repositories are an afterthought. A typical repository is a simple
collection of files in whatever package format is being used, perhaps
with a bit of metadata.
- The version scheme used by most package managers follows a straight
line model; there is no provision for branches. That makes it hard,
for example, to determine which version of a package is appropriate
for a specific release of a given distribution.
- Packages contain scripts which handle parts of the installation and
removal process which go beyond the simple management of files. These
scripts tend to contain a lot of boilerplate, and are replicated in
every package file. Bugs, too, are replicated, and there is no one
place to go to fix them. The scripts are also not portable across
distributions (even those using the same package format) and cannot be
customized for an individual site's needs.
Conary was developed as a way of addressing the above limitations and to
make it possible for users to create their own, customized distributions in
an easy manner. In the simplest sense, one can think of Conary as a
package management system with a more consistent view of objects from the
repository level down to individual files, combined with a version
management scheme.
Conary treats files as "first class objects," which are managed by the
framework as a whole. Files have a unique ID and a version history; they
also have a set of attributes. One of those attributes is the file's
location in the filesystem; moving a file is a simple matter of changing
that attribute.
A "trove" is a container holding one or more files and other troves. Files
are contained by reference. A "component" is a collection of files, by
reference. Example components listed by Eric for the bzip2 package might
be bzip2:runtime (binary files to run the program),
bzip2:lib, bzip2:doc, and, of course,
bzip2:source. Components can be aggregated
together into packages. Both components and packages are considered to be
"troves," for what it's worth.
Version strings are hung onto everything; Specifix has added some
complexity to the versioning system, though. Each version string includes
the repository name, a namespace (think of it as a distribution name), a
branch name (for the creation of trees in the version space), the upstream
package version, and a two-part local revision number. Needless to say,
the version strings get long, but the system hides the full string most of
the time. Creating versions in this way allows the system to easily
determine which version of a package is the newest, which version of which
distribution is built for, and so on.
Branching is done by adding a branch name to the version string. Branching
allows the tracking of versions of packages which were shipped with a
specific distribution, along with updates to those packages. There is also
a special type of branch called a "shadow" which tracks changes to the
trunk it was branched from. Essentially, the shadow is automatically
merged with each new version of the trunk it is following. This feature
would be useful for somebody maintaining a derivative distribution; they
want to keep up with what the source distribution is doing without losing
track of their own changes. The only problem with shadows is that, like a
number of other Conary features, they are not actually implemented yet.
"Flavors" are another Conary feature; they seem to be patterned after
Gentoo's "USE flags." A flavor is a set of configuration options
describing how all packages are to be built. This feature is used for
multiple architecture support, or for building versions of distributions
with different feature sets (e.g. creating a distribution without PAM
support). Multiple flavors of a package can be installed on a system if
they don't conflict with each other; this allows, for example, the
installation of 32-bit libraries on x86-64 systems.
Then, there is the concept of "changesets." A changeset is a collection of
modifications to files (including attribute changes) and the troves which
contain them. A changeset is, essentially, a patch to a package or a
distribution. Changesets, which track only changes, can be much smaller
than the packages they describe, and can thus be an efficient way of
distributing updates. Changesets describe changes to configuration files
in diff format, which often allows them to be merged automatically
with local changes. A system administrator can also create a changeset
describing his or her local changes to the system; that changeset can then
be used for merging with updates, or replicating the system elsewhere.
Local changesets can also be used for version control and the tracking of
system changes.
"Tags" are Conary's answer to the package script problem (and, also, to the
complex set of interactions represented by the RPM "trigger" mechanism). A
tag is a file attribute describing the type of the file, be it "shared
library," "info file," or any of a long list of alternatives. Most files
can be tagged automatically by Conary. Tags have scripts associated with
them; there is, for example, a script which handles the installation of an
info file and updating the relevant directory. These scripts are
distributed separately; there is only one copy of them on the system. The
scripts are thus easily fixed when bugs turn up, and they can be customized
by the local administrator if need be. Separating out the management
scripts in this way should also make it easier to install packages from
other distributions.
A "fileset" is an arbitrary collection of files built from components in
the repository. Filesets seem to be intended to help in the creation of
small system images for embedded systems; they allow an easy picking and
choosing of an exact set of desired files. "Groups" are, instead, the
analog of the Debian "task" or Anaconda "component." They allow the
management of several packages as a unit, but they come with their own
local changesets so that local changes to the group are tracked properly.
The paper
from the OLS proceedings (PDF format) is worthwhile reading for anybody
wanting more details on how Conary works.
Interested parties can download an early Conary release from the Specifix web site.
Be warned, however, that a few features are still missing; they include
shadows, dependencies (an important issue that they "think" they know how
to implement), flavors, package signatures, and more. "Release early" is an
important part of the free software development process, however, and the
Specifix founders understand that process well. Conary's vaporware
features will, beyond doubt, be filled in soon. As that happens, expect
interest in this tool to increase; it truly does have the potential to
change the way we set up and manage our projects, distributions, and
systems.
Comments (24 posted)
Page editor: Rebecca Sobol
Security
Brief items
Most serious web sites post a privacy policy describing what the site's
owners will do with data collected from and about the site's users. For
users who are concerned about the spread of their personal information, a
strongly-written privacy policy can be a reassuring feature. A recent
court ruling, however, suggests that web privacy policies may not be worth
the paper they aren't printed on, at least some of the time.
Northwest Airlines was recently faced with a class-action lawsuit headed by
some of its customers, who were upset that the airline had provided
passenger name record (PNR) data to the U.S. government after the
September 11 attacks. The plaintiffs made several allegations,
including the violation of various laws and, crucially, breach of contract
as a result of Northwest's failure to live up to its privacy policy.
The policy reads, in part:
When you reserve or purchase travel services through Northwest
Airlines nwa.com Reservations, we provide only the relevant
information required by the car rental agency, hotel, or other
involved third party to ensure the successful fulfillment of your
travel arrangements.
There is nothing here about giving PNR data (which includes hotel and car
information, along with credit card numbers) to interested governmental
agencies. One might well conclude that the privacy policy has been
breached.
The court struck down the breach of contract claim, however. The reasoning
was:
The privacy statement on Northwest's website did not constitute a
unilateral contract. The language used vests discretion in
Northwest to determine when the information is "relevant" and which
"third parties" might need that information... Moreover, absent an
allegation that Plaintiffs actually read the privacy policy, not
merely the general allegation that Plaintiffs "relied on" the
policy, Plaintiffs have failed to allege an essential element of a
contract claim: that the alleged "offer" was accepted by
Plaintiffs.
The implications are clear: weasel words in a privacy statement can be used
against you. If you ever think you may want to take a site operator to
court for the violation of a privacy statement, you will, at a minimum,
have to be able to show that you read that statement before the violation
occurred. It seems unlikely that many potential plaintiffs in privacy
policy cases will be able to make that demonstration. Privacy policies,
thus, may not be worth a whole lot - at least, not in countries which lack
more general restrictions on the use of personal data.
(For the curious, the full ruling is available in PDF format).
Comments (3 posted)
Evans Data has sent out
a
press release about a Linux security survey done by the company.
"
Ninety two percent of survey respondents indicated that their Linux
systems have never been infected with a virus, according to Evans Data's
new Summer 2004 Linux Development Survey." The PR lacks an answer
for the most interesting question, however: what, exactly, happened to the
other 8%?
Comments (28 posted)
New vulnerabilities
courier: cross-site scripting vulnerability
| Package(s): | courier |
CVE #(s): | CAN-2004-0591
|
| Created: | July 23, 2004 |
Updated: | August 4, 2004 |
| Description: |
The sqwebmail application has a cross-site scripting vulnerability.
An attacker can inject and execute a web mail script via an
email message. |
| Alerts: |
|
Comments (none posted)
mailreader: directory traversal vulnerability
| Package(s): | mailreader |
CVE #(s): | CAN-2002-1581
|
| Created: | July 23, 2004 |
Updated: | July 28, 2004 |
| Description: |
Mailreader has a directory traversal vulnerability. A remote attacker can
view arbitrary files with the privileges of the nph-mr.cgi process. |
| Alerts: |
|
Comments (none posted)
Pavuk: Digest authentication helper buffer overflow
| Package(s): | pavuk |
CVE #(s): | |
| Created: | July 26, 2004 |
Updated: | July 28, 2004 |
| Description: |
Pavuk contains several buffer overflow vulnerabilities in the code
handling digest authentication. An attacker could cause a buffer overflow,
leading to arbitrary code execution with the rights of the user running
Pavuk. These vulnerabilities have been fixed in pavuk-0.9.28-r3. |
| Alerts: |
|
Comments (none posted)
samba: potential buffer overruns
| Package(s): | samba |
CVE #(s): | CAN-2004-0600
CAN-2004-0686
|
| Created: | July 22, 2004 |
Updated: | September 2, 2004 |
| Description: |
According to this Samba advisory, Evgeny
Demidov discovered that the Samba SMB/CIFS server has a buffer overflow bug
in the Samba Web Administration Tool (SWAT) on decoding Base64 data during
HTTP Basic Authentication. Samba versions between 3.0.2 through 3.0.4 are
affected. (CAN-2004-0600)
Another buffer overflow bug has been located in the Samba code used to
support the "mangling method = hash" functionality. The default setting for
this parameter is "mangling method = hash2" and therefore Samba is not
vulnerable by default. Samba versions between 2.2.0 through 2.2.9 and 3.0.0
through 3.0.4 are affected. (CAN-2004-0686) |
| Alerts: |
|
Comments (1 posted)
sox: buffer overflow
| Package(s): | sox |
CVE #(s): | CAN-2004-0557
|
| Created: | July 28, 2004 |
Updated: | February 21, 2005 |
| Description: |
Sox suffers from buffer overflows in its WAV file handling; these overflows could conceivably be exploited by way of a malicious sound file. |
| Alerts: |
|
Comments (none posted)
subversion: access control bypass
| Package(s): | subversion |
CVE #(s): | |
| Created: | July 23, 2004 |
Updated: | July 28, 2004 |
| Description: |
Subversion has a vulnerability in the mod_authz_svn Apache
authentication module that can allow a local user to bypass
read restrictions in the repository. |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
Apache mod_proxy: denial of service
| Package(s): | apache |
CVE #(s): | CAN-2004-0492
|
| Created: | June 11, 2004 |
Updated: | October 14, 2004 |
| Description: |
A buffer overflow vulnerability in the apache mod_proxy module
can be exploited to create a denial of service. |
| Alerts: |
|
Comments (none posted)
apache2: stack-based buffer overflow in ssl_util.c
| Package(s): | apache2 |
CVE #(s): | CAN-2004-0488
|
| Created: | June 1, 2004 |
Updated: | October 14, 2004 |
| Description: |
A stack-based buffer overflow exists in the ssl_util_uuencode_binary
function in ssl_util.c in Apache. When mod_ssl is configured to trust the
issuing CA, a remote attacker may be able to execute arbitrary code via a
client certificate with a long subject DN. |
| Alerts: |
|
Comments (none posted)
apache mod_ssl format string vulnerability
| Package(s): | apache mod_ssl |
CVE #(s): | |
| Created: | July 16, 2004 |
Updated: | August 6, 2004 |
| Description: |
Triggered by a report to Packet Storm from Virulent, a format string
vulnerability was found in mod_ssl, the Apache SSL/TLS interface to
OpenSSL, version (up to and including) 2.8.18 for Apache 1.3. The mod_ssl
in Apache 2.x is not affected. The vulnerability could be exploitable if
Apache is used as a proxy for HTTPS URLs and the attacker established a own
specially prepared DNS and origin server environment. |
| Alerts: |
|
Comments (none posted)
aspell: bounds checking problem
| Package(s): | aspell |
CVE #(s): | CAN-2004-0548
|
| Created: | June 17, 2004 |
Updated: | December 20, 2004 |
| Description: |
Aspell's word-list-compress utility fails to properly check bounds
when dealing with words that are more than 256 bytes long.
This can lead to arbitrary code execution by an attacker. |
| Alerts: |
|
Comments (none posted)
Ethereal: Multiple security problems
| Package(s): | ethereal |
CVE #(s): | CAN-2004-0633
CAN-2004-0634
CAN-2004-0635
|
| Created: | July 9, 2004 |
Updated: | August 19, 2004 |
| Description: |
There are multiple vulnerabilities in versions of Ethereal earlier than
0.10.5, including:
* In some cases the iSNS dissector could cause Ethereal to abort.
* If there was no policy name for a handle for SMB SID snooping it
could cause a crash.
* A malformed or missing community string could cause the SNMP
dissector to crash.
See this
advisory for more information. |
| Alerts: |
|
Comments (none posted)
Filename disclosure vulnerability in fam
| Package(s): | fam |
CVE #(s): | CAN-2002-0875
|
| Created: | August 19, 2002 |
Updated: | January 5, 2005 |
| Description: |
"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible. |
| Alerts: |
|
Comments (none posted)
flim: insecure file creation
| Package(s): | flim |
CVE #(s): | CAN-2004-0422
|
| Created: | May 5, 2004 |
Updated: | December 16, 2004 |
| Description: |
The emacs "flim" mode creates temporary files in an insecure fashion, possibly allowing a local attacker to overwrite files. |
| Alerts: |
|
Comments (none posted)
gtkhtml: malformed messages cause crash
| Package(s): | gtkhtml |
CVE #(s): | CAN-2003-0133
CAN-2003-0541
|
| Created: | April 14, 2003 |
Updated: | April 18, 2005 |
| Description: |
GtkHTML is the HTML rendering widget used by the Evolution mail reader.
GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug
when handling HTML messages. Alan Cox discovered that certain malformed
messages could cause the Evolution mail component to crash. |
| Alerts: |
|
Comments (none posted)
Horde-IMP: improper input validation
| Package(s): | Horde-IMP |
CVE #(s): | |
| Created: | June 16, 2004 |
Updated: | August 10, 2004 |
| Description: |
An input validation error exists in Horde-IMP through version 3.2.4; a specially crafted message could be used to run scripts in the context of the target's browser. |
| Alerts: |
|
Comments (none posted)
iproute: local denial of service
| Package(s): | iproute net-tools |
CVE #(s): | CAN-2003-0856
|
| Created: | November 25, 2003 |
Updated: | December 14, 2004 |
| Description: |
The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible. |
| Alerts: |
|
Comments (none posted)
racoon: failure to verify signatures
| Package(s): | ipsec-tools racoon |
CVE #(s): | CAN-2004-0155
|
| Created: | April 7, 2004 |
Updated: | August 19, 2004 |
| Description: |
Versions of ipsec-tools prior to 0.2.5 contain a vulnerability wherein the racoon utility fails to verify digital signatures on some packets. This hole can lead to unauthorized connections or man-in-the-middle attacks. See this advisory for details. |
| Alerts: |
|
Comments (none posted)
racoon: denial of service vulnerability
| Package(s): | ipsec-tools racoon iputils |
CVE #(s): | CAN-2004-0403
|
| Created: | April 26, 2004 |
Updated: | July 29, 2004 |
| Description: |
racoon does not check the length of ISAKMP headers. Attackers may be able
to craft an ISAKMP header of sufficient length to consume all available
system resources, causing a Denial of Service. This advisory contains additional
details. |
| Alerts: |
|
Comments (none posted)
kdelibs: cookie disclosure
| Package(s): | kdelibs |
CVE #(s): | CAN-2003-0592
|
| Created: | March 10, 2004 |
Updated: | August 24, 2004 |
| Description: |
kdelibs (and, thus, Konqueror) has a vulnerability where a hostile server can force the disclosure of cookies that should not be presented to it. KDE versions 3.1.3 and later contain a fix. |
| Alerts: |
|
Comments (none posted)
kernel allows unauthorized changes to the group ID
| Package(s): | kernel |
CVE #(s): | CAN-2004-0497
|
| Created: | July 2, 2004 |
Updated: | September 27, 2004 |
| Description: |
During an audit of the Linux kernel, SUSE discovered a flaw that allowed
a user to make unauthorized changes to the group ID of files in certain
circumstances - such as when the files are exported via NFS. |
| Alerts: |
|
Comments (none posted)
kernel: netfilter denial of service
| Package(s): | kernel |
CVE #(s): | |
| Created: | June 30, 2004 |
Updated: | July 28, 2004 |
| Description: |
The netfilter code in 2.6 kernels through 2.6.7 is vulnerable to a remote denial of service attack - but only if filtering on the TCP options field has been enabled. See this advisory for details. |
| Alerts: |
|
Comments (none posted)
kernel-utils: setuid vulnerability
| Package(s): | kernel-utils |
CVE #(s): | CAN-2003-0019
|
| Created: | February 7, 2003 |
Updated: | January 21, 2005 |
| Description: |
The kernel-utils package contains several utilities that can be used to
control the kernel or machine hardware. In Red Hat Linux 8.0 this package
contains user mode linux (UML) utilities.
The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was
incorrectly shipped setuid root. This could allow local users to control
certain network interfaces, add and remove arp entries and routes, and put
interfaces in and out of promiscuous mode.
All users of the kernel-utils package should update to these packages that
contain a version of uml_net that is not setuid root.
Alternatively, as a work-around to this vulnerability issue the following
command as root:
chmod -s /usr/bin/uml_net |
| Alerts: |
|
Comments (none posted)
l2tpd buffer overflow
| Package(s): | l2tpd |
CVE #(s): | CAN-2004-0649
|
| Created: | July 19, 2004 |
Updated: | July 22, 2004 |
| Description: |
Thomas Walpuski reported a buffer overflow in l2tpd, an implementation
of the layer 2 tunneling protocol, whereby a remote attacker could
potentially cause arbitrary code to be executed by transmitting a
specially crafted packet. The exploitability of this vulnerability
has not been verified. |
| Alerts: |
|
Comments (none posted)
libxml2 - arbitrary code execution
| Package(s): | libxml2 |
CVE #(s): | CAN-2004-0110
|
| Created: | February 26, 2004 |
Updated: | August 19, 2009 |
| Description: |
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml2 uses special
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that
parses remote resources and allows them to influence the URL, then this
flaw could be used to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
logcheck: symlink vulnerability
| Package(s): | logcheck |
CVE #(s): | CAN-2004-0404
|
| Created: | April 21, 2004 |
Updated: | December 22, 2004 |
| Description: |
The logcheck utility handles temporary files in an unsafe way, possibly allowing local attackers to overwrite files. |
| Alerts: |
|
Comments (none posted)
mailman: password disclosure
| Package(s): | mailman |
CVE #(s): | CAN-2004-0412
|
| Created: | May 27, 2004 |
Updated: | July 20, 2004 |
| Description: |
In mailman versions above 2.1, third parties can retrieve
member passwords from the server. |
| Alerts: |
|
Comments (none posted)
mikmod: buffer overflow
| Package(s): | mikmod |
CVE #(s): | CAN-2003-0427
|
| Created: | June 16, 2003 |
Updated: | June 16, 2005 |
| Description: |
Ingo Saitz discovered a bug in mikmod whereby a long filename inside
an archive file can overflow a buffer when the archive is being read
by mikmod. |
| Alerts: |
|
Comments (none posted)
mod_python: denial of service vulnerability
| Package(s): | mod_python |
CVE #(s): | CAN-2003-0973
|
| Created: | January 27, 2004 |
Updated: | October 4, 2004 |
| Description: |
Apache's mod_python module could crash the httpd process if a specific,
malformed query string was sent.
The Apache Foundation has reported that mod_python may be prone to
Denial of Service attacks when handling a malformed query. Mod_python
2.7.9 was released to fix the vulnerability, however, because the
vulnerability has not been fully fixed, version 2.7.10 has been released.
Users of mod_python 3.0.4 are not affected by this vulnerability. |
| Alerts: |
|
Comments (none posted)
MoinMoin Group ACL Bypass
| Package(s): | moinmoin |
CVE #(s): | |
| Created: | July 12, 2004 |
Updated: | August 26, 2004 |
| Description: |
MoinMoin contains a flaw that may allow a malicious user to gain access to
unauthorized privileges. The issue is triggered when an attacker creates a
user with the same name as an administrative group. This flaw may lead to a
loss of integrity. See this osvdb
entry for additional information. |
| Alerts: |
|
Comments (none posted)
mozilla: multiple vulnerabilties
| Package(s): | mozilla |
CVE #(s): | CAN-2003-0594
CAN-2003-0564
|
| Created: | March 10, 2004 |
Updated: | August 19, 2004 |
| Description: |
Mozilla 1.4 contains a few vulnerabilities, including disclosure of cookies to the wrong server, a scripting vulnerability which can allow an attacker to run arbitrary code, and an S/MIME vulnerability which can lead to remote denial of service or code execution attacks. |
| Alerts: |
|
Comments (none posted)
mpg321: format string vulnerability
| Package(s): | mpg321 |
CVE #(s): | CAN-2003-0969
|
| Created: | January 6, 2004 |
Updated: | March 28, 2005 |
| Description: |
A vulnerability was discovered in mpg321, a command-line mp3 player,
whereby user-supplied strings were passed to printf(3) unsafely. This
vulnerability could be exploited by a remote attacker to overwrite
memory, and possibly execute arbitrary code. In order for this
vulnerability to be exploited, mpg321 would need to play a malicious
mp3 file (including via HTTP streaming). |
| Alerts: |
|
Comments (none posted)
MySQL: temporary file vulnerabilities
| Package(s): | mysql |
CVE #(s): | CAN-2004-0381
CAN-2004-0388
|
| Created: | April 14, 2004 |
Updated: | August 18, 2004 |
| Description: |
The mysqlbug and mysqld_multi scripts contain temporary file vulnerabilities which could be used by a local attacker to overwrite files on the system. |
| Alerts: |
|
Comments (none posted)
neon: buffer overflow
| Package(s): | neon |
CVE #(s): | CAN-2004-0398
|
| Created: | May 19, 2004 |
Updated: | September 30, 2004 |
| Description: |
The neon library (through version 0.24.5) contains a buffer overflow in its date parsing code, allowing arbitrary code execution when connecting to a hostile server. See this advisory for details. This vulnerability also affects related applications (such as cadaver). |
| Alerts: |
|
Comments (none posted)
Nessus NASL scripting engine security issues
| Package(s): | nessus |
CVE #(s): | |
| Created: | May 27, 2003 |
Updated: | August 12, 2004 |
| Description: |
Some some vulnerabilities exsist in the Nessus NASL scripting engine. To
exploit these flaws, an attacker would need to have a valid Nessus account
as well as the ability to upload arbitrary Nessus plugins in the Nessus
server (this option is disabled by default) or he/she would need to trick a
user somehow into running a specially crafted nasl script. Read the full
advisory for additional information. |
| Alerts: |
|
Comments (none posted)
netkit-telnet-ssl format string vulnerability
| Package(s): | netkit-telnet-ssl |
CVE #(s): | CAN-2004-0640
|
| Created: | July 19, 2004 |
Updated: | July 21, 2004 |
| Description: |
b0f discovered a format string vulnerability in netkit-telnet-ssl
which could potentially allow a remote attacker to cause the execution
of arbitrary code with the privileges of the telnet daemon (the
'telnetd' user by default). |
| Alerts: |
|
Comments (none posted)
netpbm: insecure temporary files
| Package(s): | netpbm |
CVE #(s): | CAN-2003-0924
|
| Created: | January 19, 2004 |
Updated: | December 29, 2004 |
| Description: |
netpbm is graphics conversion toolkit made up of a large number of
single-purpose programs. Many of these programs were found to create
temporary files in an insecure manner, which could allow a local
attacker to overwrite files with the privileges of the user invoking a
vulnerable netpbm tool. |
| Alerts: |
|
Comments (1 posted)
openssh: timing attack leads to information disclosure
| Package(s): | openssh |
CVE #(s): | CAN-2003-0190
|
| Created: | May 2, 2003 |
Updated: | November 30, 2004 |
| Description: |
From the advisory:
"During a pen-test we stumbled across a nasty bug in OpenSSH-portable
with PAM support enabled (via the --with-pam configure script switch). This
bug allows a remote attacker to identify valid users on vulnerable systems,
through a simple timing attack. The vulnerability is easy to exploit and
may have high severity, if combined with poor password policies and other
security problems that allow local privilege escalation." |
| Alerts: |
|
Comments (1 posted)
OpenSSL: denial of service vulnerabilities
Comments (1 posted)
Opera: Multiple spoofing vulnerabilities
| Package(s): | opera |
CVE #(s): | |
| Created: | July 20, 2004 |
Updated: | July 21, 2004 |
| Description: |
Opera fails to remove illegal characters from an URI of a link and to check
that the target frame of a link belongs to the same website as the
link. Opera also updates the address bar before loading a page.
Additionally, Opera contains a certificate verification problem.
These vulnerabilities could allow an attacker to impersonate legitimate
websites to steal sensitive information from users. This could be done by
obfuscating the real URI of a link or by injecting a malicious frame into
an arbitrary frame of another browser window. |
| Alerts: |
|
Comments (none posted)
pavuk: buffer overflow
| Package(s): | pavuk |
CVE #(s): | CAN-2004-0456
|
| Created: | June 30, 2004 |
Updated: | November 11, 2004 |
| Description: |
Versions of the pavuk web spider through 0.9.28-r1 contain a buffer overflow which could be exploited by a hostile server. |
| Alerts: |
|
Comments (none posted)
php: remotely exploitable memory errors
| Package(s): | php |
CVE #(s): | CAN-2004-0594
|
| Created: | July 14, 2004 |
Updated: | February 7, 2005 |
| Description: |
Stefan Esser has issued an advisory regarding a
remotely exploitable hole in PHP (through version 4.3.7). If the
memory_limit feature is in use (as it should be, to prevent denial
of service attacks), allocation failures can be forced at highly
inopportune times, and those failures can be exploited to execute arbitrary
code. The exploit is described as "quite easy," and it can be done
regardless of whether Apache1 or Apache2 is in use. Upgrading to PHP 4.3.8 fixes the
problem; yesterday's PHP 5.0 release also contains the fix (but the
final release candidate did not). |
| Alerts: |
|
Comments (none posted)
postgresql buffer overflow in ODBC driver
| Package(s): | postgresql |
CVE #(s): | |
| Created: | June 7, 2004 |
Updated: | July 28, 2004 |
| Description: |
A buffer overflow has been discovered in the ODBC driver of PostgreSQL,
an object-relational SQL database, descended from POSTGRES. It possible
to exploit this problem and crash the surrounding application. Hence, a
PHP script using php4-odbc can be utilized to crash the surrounding
Apache webserver. Other parts of postgresql are not affected. |
| Alerts: |
|
Comments (none posted)
python: buffer overflow
| Package(s): | python |
CVE #(s): | CAN-2004-0150
|
| Created: | March 10, 2004 |
Updated: | October 11, 2004 |
| Description: |
Python (versions 2.2 and 2.2.1 only) has a buffer overflow in the getaddrinfo() function which can be exploited by a malformed IPv6 address. |
| Alerts: |
|
Comments (none posted)
squid: buffer overflow
| Package(s): | squid |
CVE #(s): | CAN-2004-0541
|
| Created: | June 9, 2004 |
Updated: | September 30, 2004 |
| Description: |
The NTLM authentication helper used by the squid proxy contains a buffer overflow vulnerability; an overly-long password may be used to run arbitrary code. Sites not using NTLM authentication are not vulnerable. |
| Alerts: |
|
Comments (none posted)
SquirrelMail cross site scripting vulnerabilities
| Package(s): | squirrelmail |
CVE #(s): | CAN-2004-0519
CAN-2004-0520
CAN-2004-0521
|
| Created: | May 21, 2004 |
Updated: | October 4, 2004 |
| Description: |
Several unspecified cross-site scripting (XSS) vulnerabilities and a well
hidden SQL injection vulnerability were found in SquirrelMail versions
1.4.2 and lower. An XSS attack allows an attacker to insert malicious code
into a web-based application. SquirrelMail does not check for code when
parsing variables received via the URL query string. |
| Alerts: |
|
Comments (none posted)
Subversion: Remote heap overflow
| Package(s): | subversion |
CVE #(s): | CAN-2004-0413
|
| Created: | June 11, 2004 |
Updated: | March 7, 2005 |
| Description: |
Subversion has a remote Denial of Service vulnerability
that may allow a server that runs svnserve to execute
arbitrary code. See this advisory for more information. |
| Alerts: |
|
Comments (none posted)
sysstat: temporary file vulnerability
| Package(s): | sysstat |
CVE #(s): | CAN-2004-0107
CAN-2004-0108
|
| Created: | March 10, 2004 |
Updated: | October 4, 2004 |
| Description: |
The sysstat utility has a temporary file vulnerability which can be exploited by a local attacker to overwrite system files. |
| Alerts: |
|
Comments (none posted)
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip |
CVE #(s): | CAN-2001-1267
CAN-2001-1268
CAN-2001-1269
CAN-2002-0399
|
| Created: | October 1, 2002 |
Updated: | April 10, 2006 |
| Description: |
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability. |
| Alerts: |
|
Comments (1 posted)
tcpdump: ISAKMP payload handling denial-of-service vulnerabilities
| Package(s): | tcpdump |
CVE #(s): | CAN-2004-0183
CAN-2004-0184
|
| Created: | March 30, 2004 |
Updated: | September 30, 2004 |
| Description: |
TCPDUMP v3.8.1 and earlier versions contain multiple flaws in the packet
display functions for the ISAKMP protocol. Upon receiving specially
crafted ISAKMP packets, TCPDUMP will try to read beyond the end of the
packet capture buffer and crash. More information is available in this Rapid7 advisory. |
| Alerts: |
|
Comments (none posted)
Multiple vendor telnetd vulnerability
| Package(s): | telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5 |
CVE #(s): | |
| Created: | May 21, 2002 |
Updated: | October 5, 2004 |
| Description: |
This vulnerability,
originally thought to be confined to BSD-derived systems, was first covered
in the July 26th Security
Summary. It is now known that Linux telnet daemons are vulnerable as
well.
|
| Alerts: |
|
Comments (none posted)
ut2003: Unreal Tournament 2003/2004 buffer overflow in 'secure' queries
| Package(s): | ut2003 |
CVE #(s): | |
| Created: | July 19, 2004 |
Updated: | July 21, 2004 |
| Description: |
The Unreal-based game servers support a specific type of query called
'secure'. Part of the Gamespy protocol, this query is used to ask if the
game server is able to calculate an exact response using a provided
string. Luigi Auriemma found that sending a long 'secure' query triggers a
buffer overflow in the game server. By sending a malicious UDP-based
'secure' query, an attacker could execute arbitrary code on the game
server. |
| Alerts: |
|
Comments (none posted)
webmin: denial of service
| Package(s): | webmin |
CVE #(s): | CAN-2004-0582
CAN-2004-0583
|
| Created: | June 16, 2004 |
Updated: | July 28, 2004 |
| Description: |
Versions of webmin prior to 1.150 suffer from denial of service and information disclosure vulnerabilities. See advisories for the disclosure and lockout problems for more information. |
| Alerts: |
|
Comments (none posted)
wv: buffer overflow
| Package(s): | wv |
CVE #(s): | CAN-2004-0645
|
| Created: | July 14, 2004 |
Updated: | February 10, 2005 |
| Description: |
wv, a viewer for MS Word files, contains a buffer overflow which may be exploited by a suitably-crafted file. Version 1.0.0-r1 fixes the problem. |
| Alerts: |
|
Comments (none posted)
XChat 2.0.x SOCKS5 Vulnerability
| Package(s): | xchat |
CVE #(s): | CAN-2004-0409
|
| Created: | April 19, 2004 |
Updated: | November 15, 2005 |
| Description: |
XChat is vulnerable to a stack overflow that may allow a remote attacker to
run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a
remote exploit. Users would have to be using XChat through a SOCKS 5
server, enable SOCKS 5 traversal which is disabled by default and also
connect to an attacker's custom proxy server. This vulnerability may allow
an attacker to run arbitrary code within the context of the user ID of the
XChat client. |
| Alerts: |
|
Comments (none posted)
XFree86, X.org: XDM ignores requestPort setting
| Package(s): | XFree86 X.org |
CVE #(s): | CAN-2004-0419
|
| Created: | July 5, 2004 |
Updated: | July 28, 2004 |
| Description: |
XDM will open TCP sockets for its chooser, even if the
DisplayManager.requestPort setting is set to 0. This may allow
authorized users to access a machine remotely via X, even if the
administrator has configured XDM to refuse such connections. See this XFree86 bug report. |
| Alerts: |
|
Comments (none posted)
xine-ui - insecure temporary file creation
| Package(s): | xine-ui |
CVE #(s): | CAN-2004-0372
|
| Created: | April 6, 2004 |
Updated: | April 27, 2006 |
| Description: |
Shaun Colley discovered a problem in xine-ui, the xine video player
user interface. A script contained in the package to possibly remedy
a problem or report a bug does not create temporary files in a secure
fashion. This could allow a local attacker to overwrite files with
the privileges of the user invoking xine. |
| Alerts: |
|
Comments (none posted)
Page editor: Rebecca Sobol
Kernel development
Brief items
The current 2.6 prepatch remains 2.6.8-rc2; no new prepatches have
been released over the last week.
Linus has been committing patches to his BitKeeper repository, however;
they include lots more code annotations and fixups, various networking
fixes, some NX improvements for old binary support, and a number of other
fixes. Things appear to be stabilizing for the real 2.6.8 release.
The current prepatch from Andrew Morton is 2.6.8-rc2-mm1. Recent additions to -mm include
the pmdisk/swsusp merge (covered here last
week), some performance counter tweaks (enables inheritance of settings
across fork() and exec()), some scheduling domains
cleanup work, various latency reductions, and a large number of other fixes.
The current 2.4 prepatch is 2.4.27-rc3 and has been since
July 3.
Comments (none posted)
Kernel development news
Discussions held at OLS, on the mailing lists, and elsewhere have made it
clear that a certain degree of confusion still exists regarding the new
kernel development process and what has really changed. In an attempt to
clear things up, we'll take one more look at what was decided at this
year's kernel summit.
The old process, in use since the 1.0 kernel release, worked with two major
forks. The even-numbered fork was the "stable" series, managed in a way
which (most of the time) attempted to keep the number of changes to a
minimum. The odd-numbered fork, instead, was the development series, where
anything goes. The idea was that most users would use the stable kernels,
and that those kernels could be expected to be as bug-free as possible.
This mechanism has been made to work, but it has a number of problems which
have been noticed over the years. These include:
- The stable and development trees diverge from each other quickly,
especially since big API changes have tended to be saved for early in
the development series. This divergence makes it hard to port code
between the two trees. As a result, backporting new features into the
stable series is hard, and forward-porting fixes is also a challenge.
2.6.0 came out with a number of bugs which had long been fixed in 2.4.
- The stable tree, after a short while, lacks fixes, features, and
improvements which have been added to the development tree. That code
may well have proved itself stable in the development series, but it
often does not make it into a stable kernel for years. The kernels
that people are told to use can run far behind the state of the art.
- The stable kernels are often very heavily patched by the
distributors. These patches include necessary fixes, backports of
development kernel features, and more. As a result, stock
distribution kernels diverge significantly from the mainline, and from
each other. Distributor kernels sometimes are shipped with early
implementations of features which evolve significantly before
appearing in an official stable kernel, leading to compatibility
problems for users.
The focus on keeping changes out of the stable kernel tree is now seen as
being a bit misdirected. Well-tested patches can be safely merged, most of
the time. Blocking patches, instead, creates an immense "patch pressure"
which leads to divergent kernels and a major destabilizing flood whenever
the door is opened a little.
So how have things changed? The "new" process is really just an
acknowledgment of how things have been done since the 2.6.0 release - or,
perhaps, a little before. It looks like this:
- New patches which appear to be nearing prime-time readiness are
added to Andrew Morton's -mm tree. This addition can be done by
Andrew himself, or by way of a growing number of BitKeeper
repositories which are automatically merged into -mm.
- Each patch lives in -mm and is tested, commented on, refined, etc.
Eventually, if the patch proves to be both useful and stable, it is
forwarded on to Linus for merging into the mainline. If, instead, it
causes problems or does not bring significant benefit, the patch will
eventually be dropped from -mm.
The -mm tree has proved to be a truly novel addition to the development
process. Each patch
in this tree continues to be tracked as an independent contribution; it can
be changed or removed at any time. The ability to drop patches is the real
change; patches merged into the mainline lose their identity and become
difficult to revert. The -mm tree provides a sort of proving ground which
the kernel process has never quite had before. Alan Cox's -ac trees were
similar, but they (1) were less experimental than -mm (distributors
often merged -ac almost directly into their stock kernels), and
(2) -mm does a much better job of tracking each patch independently.
In essence, -mm has become the new kernel development tree. The old
process created a hard fork and was not designed to merge changes back into
the "old" stable tree. -mm is much more dynamic; it exists as a set of
patches to the mainline, and any individual patch can move over to the
mainline at any time. New features get the testing they need, then
graduate to the mainline when they are ready. New developments move into
the stable kernel quickly, the development kernel benefits from all fixes
made to the stable branch, and the whole process moves in a much faster and
smoother way.
More than one observer in Ottawa made this ironic observation: it would
appear that Andrew Morton is now in charge of the development kernel, while
Linus manages the stable kernel. That is not quite how things were
expected to turn out, but it seems to be working. Consider some of the
changes which have been merged since 2.6.0:
- 4K kernel stacks
- NX page protection and ia32e architecture support
- The NUMA API
- Laptop mode
- The lightweight auditing framework
- The CFQ disk I/O scheduler
- Netpoll
- Cryptoloop, snapshot, and mirroring in the device mapper
- Scheduling domains
- The object-based reverse mapping VM
Some of these changes are truly significant, and things have not stopped
there: new patches are going into the kernel at a rate of about 10MB/month. Yet
2.6.7 was, arguably, the most stable 2.6 kernel yet. It contains many of
the latest features, has few performance problems, and the number of bug
reports has been quite small. The new process is yielding some good
results.
Naturally, there are some issues to resolve. One of those is the
deprecation of features, which used to be tied to the timing of the old
process. The new plan, it seems, is to give users a one-year notice,
including a printk() warning in the kernel. The first features to
be removed by this path are likely to be devfs and cryptoloop. There is
also the question of changes which are simply too disruptive to merge
anytime soon. Page clustering, if it is merged, could be one of those.
When such a feature comes along, we may yet see the creation of a 2.7 tree
to host it. Even then, however, 2.7 will track 2.6 as closely as possible,
and it may go away when the feature which drove its existence becomes ready
to go into the mainline.
This change to the development process is significant. It is not
particularly new, however. The actual change happened the better part of a year
ago; it was simply hidden in plain sight. All that has really happened in
Ottawa is that the developers have acknowledged that the process is working
well. One can easily argue, in fact, that the kernel development process
has never functioned better than it does now. So, rather than break such a
successful model, the developers are going to let it run.
Comments (16 posted)
Ingo Molnar's voluntary preemption work, described here
two weeks ago, has continued to progress.
Indeed, since Mr. Molnar did not attend the kernel summit or OLS, this
could well have been the fastest-moving kernel project over the last week.
The
2.6.8-rc1-L2 version of the patch,
released on July 27, claims a maximum 100μs latency - almost good
enough, says Ingo, for hard real-time work. One of the methods used may
raise some eyebrows, however.
The core of the voluntary preemption patch stays true to its original
intent: it adds scheduling points in places where the kernel may hold onto
the CPU for overly long periods. As kernel testers report problems, Ingo
has been going in and breaking up the offending bits of code. Ingo has
also added a new knob to control the maximum number of sectors the block
I/O subsystem will try to transfer at once; if block operations get too
big, the IDE completion routines can take too long to perform their
cleanup.
That change pointed at a larger problem, however: some interrupt handlers
can, despite conventions to the contrary, occupy the processor for a long
time. While an interrupt handler is running, high-priority processes
cannot run. Ingo decided to address this problem head on: he has moved
hardware interrupt handling into process context.
To do this, he had to change the core kernel interrupt dispatcher. That
code now checks to see if the interrupt comes from the timer; if so, it is
handled immediately, in the traditional manner. Otherwise, the IRQ number
is added to a per-CPU list of pending hardware interrupts, and control
returns to the scheduler without having actually serviced the interrupt.
Calling the real interrupt handler falls to the ksoftirqd process
(which has been renamed irqd). Once it is scheduled, it simply
iterates through the list of pending interrupts and calls all of the
registered handlers for each. Due to the change in context, the
pt_regs structure is no longer available to the handler, but,
since almost no interrupt handlers ever use that argument, that will not be
a problem.
The irqd process runs at a high priority, but a high-priority,
real-time process can still preempt it. While it is dispatching an
interrupt to its handler(s), irqd goes into a simulated interrupt
mode and cannot be preempted. It drops out of that mode between
interrupts, however, making scheduling possible. It is also possible for
an interrupt handler to enable preemption at a given point with a call to
cond_resched_hardirq() (or one of its variants). Without such a
call, hardware interrupt handlers will not be put to sleep.
There are no such calls in drivers in Ingo's current patch - at least, not
directly. Ingo has also added a new version of
end_that_request_first() (the function used to indicate partial
completion of a block I/O request) which allows preemption. The IDE
completion handler calls the new version, which makes it preemptable - even
though it is an interrupt handler.
Ingo claims some very good results from this work. The software latencies
are now all very small. It would be interesting to see whether the
redirecting of hardware interrupts has any effect on interrupt response
latency, however. It remains to be seen whether a change of this magnitude
will be accepted - especially since (involuntary) kernel preemption is
supposed to be the real solution to latency problems. Building trust in
involuntary preemption is an ongoing process, while the voluntary approach
appears to have solved the problem now. In the end, that is likely to
count for something.
(Coincidentally, Scott Wood has posted a
different patch moving interrupt handlers into process context. His
patch creates a separate thread for each interrupt, which allows the
priority of each interrupt handler to be set independently. There is also
an SA_NOTHREAD flag to request_irq() which allows a driver
to request the old, IRQ-context mode. Ingo has said that he is likely to
adopt the multi-thread approach for his patch as well).
Comments (none posted)
As Linux desktop implementations become more sophisticated, they
increasingly need to know about what is going on in the kernel. The
desktop code would like to be able to respond properly to events like
"disc inserted," "disk full," "processor overheating," "printer on fire,"
and so on. So far, much of this functionality has been implemented by
polling devices and
/proc files and looking for changes. That
solution is, to say the least, inelegant.
As a way of improving things, Robert Love has posted a patch (since updated) adding a kernel event notification.
This patch, initially by Arjan van de Ven, uses the netlink mechanism to
broadcast events out to interested user-space processes. The intent is for
the events to be further redistributed using D-BUS, but other uses are possible.
Within the kernel, events are created with a call to
send_kevent():
int send_kevent(enum kevent type,
const char *object,
const char *signal,
const char *fmt, ...);
The type argument gives the broad class of the event; current
options are KEVENT_GENERAL, KEVENT_STORAGE,
KEVENT_POWER, KEVENT_FS, and KEVENT_HOTPLUG.
The object is a unique string giving the source of the event; it
is derived from the location of the source file in the kernel tree. The
signal says what is actually happening, and the rest of the
arguments are a printk()-style format string and arguments giving
further information. The patch only adds one set of calls, for noting CPU
temperature transitions; they look like:
send_kevent(KEVENT_GENERAL,
"/org/kernel/arch/kernel/cpu/temperature", "high",
"Cpu: %d\n", cpu);
The patch as a whole is not particularly controversial, but there are some
concerns about the "object" namespace. Some developers would like to see
the mechanism more closely tied into the device model, so that the object
as represented here is related to an object in the sysfs hierarchy. Some
have asked whether this mechanism should replace the current hotplug
interface; that is not the intent, however. There has also been a call for
some wrappers to ensure that, for example, device drivers all generate the
same sort of event for the same kind of situation.
This is all detail work; chances are that the event code will find its way
into the mainline in some form. Then there is the little issue of making
the desktop actually respond to these events in a useful way. But that, of
course, is just a user-space problem.
Comments (2 posted)
Patches and updates
Kernel trees
Core kernel code
Development tools
Device drivers
Documentation
Memory management
Networking
Architecture-specific
Security-related
Miscellaneous
Page editor: Forrest Cook
Distributions
News and Editorials
The Progeny Debian 2.0 Developer Edition beta has been out for a little while now, long enough for this writer to whip it onto a laptop and take it for a spin.
There's a lot to like in the latest release. Though it's not quite bug free, it is looking much more polished, and good enough for day to day usage if one doesn't mind a few rough edges. For example, the installer set the mouse pointer to "/dev/input/mice" rather than "/dev/psaux" -- which caused X to come to an abrupt halt until this was corrected. Sound was not detected or correctly configured, though my wireless network card was automatically recognized.
Users are given the choice of desktop, workstation, server or custom installation. While the installer worked flawlessly, it seemed to take quite a long while to copy over packages. This isn't a major issue, but one hopes that the installation will be optimized by a final release for users who have to perform multiple installs. In all, the install closely resembles a Fedora Core install, so users who have some experience with Anaconda will feel right at home.
By default, this release installs the 2.6.6 Linux kernel. A 2.4 kernel is available as a component -- though some components are non-functional in the beta, so it's not entirely clear whether the 2.4 kernel component can be installed.
Speaking of components, it would be negligent not to mention that this release is "a showcase of Progeny's Componentized Linux technology," and not just any Linux distribution. (Interested users can find the entire list of available components here.) From the end user's perspective, it's nice to be able to install a single package rather than picking a slew of packages that are necessary to run a program. Even with apt's wonderful dependency system, it is often necessary to install several packages to arrive at one functional program.
Unfortunately, the beta's "sources.list" is strictly for loading packages off of CD-ROM. Users who have become used to using apt to install packages anywhere they happen to have a network connection will not be pleased with needing to cart CDs with them. It's not immediately obvious how to add Progeny's componentized package lists to the "sources.list," which has confused a number of the beta testers. Of course, packages from Debian testing seem to work quite well in absence of a Progeny network package source.
In all, the release shows a lot of promise. While it's not quite yet ready for prime time, the Progeny folks have made a lot of progress since the alpha release back in April.
Comments (3 posted)
Distribution News
Xandros has announced the release of version 2.5 of the Xandros Desktop OS,
with CrossOver Office 3.0.1, Linux kernel 2.4.24 and version 1.6 of the
Mozilla communications suite.
Full Story (comments: none)
The
Debian Weekly News for July 27, 2004 is
out. This issue looks at a Debian 11th birthday party in Brazil; the
Dictator Test for new licenses; a Java in Main update; the continuing AMD64
saga; debtags become an Alioth Project; and more.
Steve Langasek reports on the status of the
sarge release. A hard-freeze of base+standard is now scheduled for July
31, 2004.
Comments (none posted)
The Gentoo Weekly Newsletter for the week of July 26, 2004 covers the
retirement of .net-www; a call for volunteers to help organize a meeting in
the UK; meet Stephen Becker, the featured Developer of the Week; and more.
Full Story (comments: none)
Fedora Legacy has announced that
support for Red Hat Linux 7.2 and 8.0 has been dropped due to a lack of
community participation. (Thanks to Troels Arvin)
Comments (none posted)
OpenPKG has announced that older versions of the distribution (OpenPKG 1.0,
1.1, 1.2 and 1.3) are no longer maintained. Security advisories and
updated SRPMs will be provided for OpenPKG 2.0 and 2.1.
Full Story (comments: none)
Linux Netwosix has announced that a
Bugzilla software bugtracking system is now available for Netwosix users.
Full Story (comments: none)
Here's a
press release from Turbolinux and CyberLink Corp. announcing the
inclusion of CyberLink's PowerDVD player with the multimedia version of
Turbolinux 10D.
Comments (1 posted)
Fedora Core 2 updates:
Comments (none posted)
Mandrakelinux has updated libneon packages that fix issues with the
compression interface.
Full Story (comments: none)
The
slackware-current
changelog shows a variety of updates this week. Upgrades include
koffice-1.3.2, xsane-0.94, gimp-2.0.3, totem-0.99.15.1, xfce-4.0.6,
xine-lib-1-rc5, xine-ui-0.99.2, getmail-4.0.0, gtk+-2.4.4, glib-2.4.4,
doxygen-1.3.8, distcc-2.16, gimp-print-4.2.7, xchat-2.0.10,
ImageMagick-6.0.3-5, ncftp-3.1.8, getmail-4.0.1, dnsmasq-2.10,
galeon-1.3.16 and perl-5.8.5. PHP 5.0.0 and gcc 3.4.1 are in testing.
Comments (none posted)
New Distributions
Catux-USB
is a distribution created by the GNU/LINUX User Association from central
Catalonia, that boots and runs from USB devices such as Pendrives. It is
useful with Pendrives with 128 MB or 256 MB, but it can be resized to other
capacities. It is Debian-based, with Knoppix scripts to autodetect
hardware. It includes XFree86, some email clients, Web clients, etc., but
using apt-get you can install or remove packages. It uses the e2compr patch
to write to Pendrives more efficiently. The initial release of Catux-USB,
version 0.0.1, is dated July 23, 2004.
Comments (none posted)
PHP
Solutions Live is a bootable Linux distribution, created for people who
want to run and test scripts in a new environment without modifying the
current platform. PHP Solutions Live joins the list at version 1.2.0
released July 23, 2004.
Comments (none posted)
Minor distribution updates
Astaro Security Linux has released
v5.016
with minor bugfixes. "
Changes: This Up2Date fixes two bugs in the
transparent POP3 Proxy that occurred on malformed email messages."
Comments (none posted)
Compact Flash Linux Project has
released
v0.1.4
with minor feature enhancements. "
Changes: The SNMP daemon now runs
as the unprivileged "snmp" user. The rp-l2tp and poptop packages have been
added to cflinux."
Comments (none posted)
Coyote Linux has released
v2.12
with minor feature enhancements. "
Changes:
This release adds some new statistics output and configuration options to
the Web administrator."
Comments (none posted)
Damn Small Linux has released
v0.7.3
with minor feature enhancements. "
Changes: This release boots
directly into an enhanced X desktop at 1024x768x32 and the mouse is
auto-detected when the default video mode is used. New boot time options
were implemented along with the ability to mount and umount the .ci
extensions via the myDSL button. cardmgr was updated to 3.2.2, nfs-common
was removed from startup, a .wgetrc was added, and permissions on
/dev/cdrom were corrected to let users play audio CDs."
Comments (none posted)
Feather Linux has released
v0.5.4
with minor feature enhancements. "
Changes: This release adds a
script to download Apache, MySQL, and PHP4, includes lrzsz and rdesktop,
and fixes various bugs involving permissions, readability, and corrupted
files. The XFCE script is now also more economical with memory
usage."
Comments (none posted)
Hiweed GNU/Linux has released
v0.3
with minor bugfixes. "
Changes: This version fixed a
root-path-loosing bug, added gcc and make, added three Debian documents
(the Debian reference, apt-howto, and dselect beginner's guide). removed
unrar and zip, and upgraded all packages to Debian sid's last
version."
Comments (none posted)
Linux Live has released
v4.2.0
with major bugfixes. "
Changes: This release modifies the dir2img
script to properly handle a third parameter. The size of initrd has changed
to 9999 KB. Non-existing EXT3, NTFS, or ReiserFS kernel modules no longer
cause fatal errors (during livecd_create)."
Comments (none posted)
SLAX-Live CD has released
v4.1.3
with major feature enhancements. "
Changes: This release adds kernel
2.4.27-pre3 with SATA support, aslax-install script, and a "GUI" boot
option to skip textmode login and autostart X with KDE. There is also a
DEVELOPMENT module, allowing sourcecode to be compiled. XFree was replaced
by X.org."
Comments (none posted)
Distribution reviews
NewsForge
reviews
OpenBSD 3.5. "
OpenBSD is secure by default; that means that it
does not start any services or daemons without your telling it to. It
installs nothing secretly and does not leave any opening for a local or
remote attack. The downside to this cautious approach is that you must
configure and enable all of the features and services that you need. This
is an ideal learning opportunity for beginners who are learning how to
configure a server, and a more secure approach than that of most operating
systems, which enable a lot of services and servers by default and then
expect administrators to disable what isn't needed. While hotshot sysadmins
might prefer the latter method to get a server set up more quickly, less
experienced people will derive much more benefit from the result of the
secure by default philosophy. This is not to imply that OpenBSD is meant
only for beginners, but it is designed so that you don't need to be a
security expert to properly administer your system."
Comments (none posted)
The Register
reports
that Novell plans to release a slimmed-down version SUSE Linux.
"
SuSE Linux 9.1 Professional, the latest version of the desktop OS,
comes with 3,000 packages and seven web browsers, according to
Novell. Steve Brown, Novell's European VP, said there was a danger of the
OS becoming too "top heavy". In response, Novell is working a version of
SuSE Linux occupying a smaller footprint and supporting only one Web
browser. This approach would make it easier to roll out standardised Linux
deployments across an enterprise. With a simpler, less diverse set-up
companies would benefit from a lower variety of support questions, or so
the idea goes."
Comments (none posted)
Page editor: Rebecca Sobol
Development
gputils
is a set of open-source cross-platform tools for developing code for the
Microchip
PIC processors. PIC processors are inexpensive stand-alone
micro-controller chips that feature a RISC architecture, several
data path widths, and a variety of memory and I/O port configurations.
Over 250 PIC processor types are supported by gputils.
The project was started in 1997 by James Bowman as an effort
to build a complete set of open-source replacements for the
Microchip utilities. Numerous other developers have contributed
to the project.
gputils consists of the following components:
- gpal: An Ada-like high level language compiler.
- gpasm: The PIC assembler.
- gplink: The PIC linker for joining object files.
- gplib: A tool for building and maintaining COFF library archives.
- gpdasm: A dis-assembler for converting hex files into assembly instructions.
- gpvc: A .cod symbol file viewer for analyzing the assembler output.
- gpvo: A COFF object file viewer for analyzing object files.
Several companion projects are available for gputils, including the
gpsim
PIC software simulator, the
xgpasm GUI front end for gpasm, and
PiKdev, a PIC IDE.
PikDev allows the developer to
connect
to the PIC processor, via a serial or parallel interface, and
download the code.
Building gputils is very straightforward, it involves the
standard configure, make, and make install steps.
The code is run in the manner of typical UNIX command line utilities.
The build worked the first time for your editor.
Version 0.12.3 of gputils was recently released, it adds support for
more processors in the ever-expanding line of PICs, it also includes
bug fixes. The code is available for download
here.
The Support
section of the gputils site has all of the available documentation.
Apparently gputils does not yet support the new
PIC10F chips, these are possibly the smallest micro-controller chips
available, featuring a tiny 6 pin SOT-23 package. Hopefully PIC10F support
is being considered for future releases of gputils.
Comments (2 posted)
System Applications
Audio Projects
The
latest changes from the
Planet CCRMA audio utility packaging project include the inclusion
of the latest versions of Ardour, MusE, Alsa Modular Synth, Lilypond,
Jackmix, and Fltk.
Comments (none posted)
Version 1.0.4 of
Speex,
an open-source speech CODEC, is out.
Changes include pseudo-gapless playback, bug fixes, and more.
Comments (none posted)
Database Software
Version 1.1.5 of libgda/libgnomedb, a database framework for GNOME,
is out.
"
This is another development release in the road to 1.2, which will be
the next stable release, and which shows a preview of the new features
getting into the 1.2 final release. It is not intended for production
use, but by people wanting to experiment with the new features and to
help on the development."
Full Story (comments: none)
Embedded Systems
Version 1.0.0-rc2 of
BusyBox, a collection of command line
utilities for embedded systems, is out. See the
Change Log
for release details.
Comments (none posted)
Interoperability
Two new security related releases of Samba, versions
2.2.10 and 3.0.5,
are available.
Also, a new
Samba security page
has been created to help track security issues.
Comments (none posted)
Printing
Version 1.19 beta of the PyKota printing quota system
is available
with numerous improvements and bug fixes.
Comments (none posted)
Web Site Development
Version 1.3.0 beta 5 of MediaWiki, the collaborative editing software,
is out.
Here are the changes:
"
Accumulated bug fixes since the last beta. Hopefully this
should resolve most
major upgrade and installation issues (missing user_real_name field, PEAR
error with bad temp dir)."
Comments (none posted)
Matt Cashner
works with POE
on O'Reilly.
"
Earlier, we talked about the fundamental principles of application design with POE. Now it's time to put my money where my mouth is and build some actual working code.
To make life a bit easier, let's lay out a very simple problem. Let's say we would like accept and parse data that resembles CGI query strings."
Comments (none posted)
Desktop Applications
Desktop Environments
The GNOME 2.7.4 development release is out; click below for the details.
The big change this time around is the replacement of the MIME subsystem
with the shared FreeDesktop.org version. That will be the last change for
a bit; GNOME 2.7 has gone into a feature freeze as of this release.
Full Story (comments: 5)
The beta 2 version of KDE 3.3
has been announced.
"
As another step towards the aKademy in late August, this release is
named Kollege. This beta release shows astonishing stability, so the KDE team
asks everyone to try the version and give feedback through the bug tracking
system."
Comments (none posted)
The schedules for the KDE Community World Summit ("aKademy") have now been
posted. The Summit will be a lengthy affair, with separate developer and user conferences, and a week of tutorials in between. It's all happening in
Ludwigsburg, Germany, starting August 21.
Comments (none posted)
KDE.News
reports that
Trolltech and the KDE Free Qt Foundation have signed an updated agreement.
"
The revised Agreement continues to honour the original purposes of
the Foundation. In particular, should Trolltech ever discontinue making
regular releases of the Qt Free Edition for any reason - including a buyout
or merger of Trolltech or the liquidation of Trolltech - the Qt Free
Edition will be released under the BSD license and optionally under one or
more other Open Source Licenses designated by the Board of the
Foundation."
Comments (21 posted)
Games
Version 0.3 of Buttonmasher
has been released on the Pygame site.
"
Button Masher is a simple tool to help you analyze and improve your execution of fighting game moves, combos, etc. It's similar to the input display in the practice modes of various fighters."
Comments (none posted)
Issue #2 of the
WorldForge Weekly News is online with the latest news from the
WorldForge game project.
"
The news of the week has been a steady succession of releases from all over the project culminating in the meta-release of Mason 0.2 on Thursday. First to make it out the door was sear 0.5.0 by Simon Goodall, followed by a succession of library releases comprising wfmath released by Ron Steinke, and Atlas-C++ and Mercator released by myself. A stable release of cyphesis 0.3.1 followed."
Comments (none posted)
GUI Packages
The latest new software for
FLTK, the Fast, Light ToolKit,
includes version 1.0.10 of Fl_PlotXY, version 0.6.1 of vtkFLTK,
and more.
Comments (none posted)
Unstable version 2.3.94 of PyGTK, the Python language bindings to
GTK, is out with bug fixes and other minor changes.
Full Story (comments: none)
Instant Messaging
Version 1.8.7 of CWirc, an application that transmits Morse code
over IRC channels,
has been announced. Here are the changes:
"
A section was added in the README to explain how to use CWirc with the aRts daemon. The DTR line is now explicitely set so that CWirc can read back the state of the Morse key contact(s), even if another program left the serial port in a bad state."
Comments (none posted)
Interoperability
Issue #132 of
Wine Traffic is online with the latest Wine project development news.
Also,
last week's Wine Traffic came out after our publication deadline.
Comments (none posted)
News Readers
Version 0.5.2 of Liferea, the Linux Feed Reader, has been announced.
This release adds several new GUI features, bug fixes, and more.
"
Liferea (Linux Feed Reader) is a fast, easy to use, and easy to install
GNOME news aggregator for online news feeds. It supports a number of
different feed formats including RSS/RDF, CDF, Atom, OCS, and OPML."
Version 0.5.2b
was also announced
this week, it features one bug fix.
Full Story (comments: none)
Office Applications
Version 1.3.1 of the Gnumeric spreadsheet has been announced.
"
Fixes and improvements are everywhere. Some of the most noteworthy
are: improved xls graph import, initial support for rich text,
better xls evaluation compatibility for operators, and improved
accuracy for lots of statistical and financial functions."
Full Story (comments: none)
Peer to Peer
Version 1.7.4 of Further, a P2P music client,
has been announced.
"
Unlike many P2P's, Furthur specializes in lossless,
CD-quality audio and video. Version 1.7.4 adds support for FLAC-encoded
filesets at 16 and 24 bits (joining SHN, OGG, MP3, MPEG, DVD, DIVX, VCD, SVCD
and other formats), fixes some problems caused by the Apple JRE, polishes up
the user interface, and removed some irritating little bugs that no one liked
anyway."
Comments (none posted)
Web Browsers
MozillaZine
mentions the availability of a new
Firefox browser status report by Ben Goodger.
"
The decision has been made to call the next
release "Firefox 1.0 Preview Release" externally, and 0.10 internally. Ben
also goes into detail on what extension authors can do to ensure
compatibility with this next release."
Comments (none posted)
The minutes are available for the July 12, 2004 Mozilla.org staff
meeting.
"
Issues discussed include Mozilla 1.8a2, Firefox 1.0,
Thunderbird, modified versions of logos, the localisation trademark policy,
Webstats and more."
Comments (none posted)
Miscellaneous
Version 0.2.1 of the GNOME CPU Frequency Scaling Monitor
is out with bug fixes and installation improvements.
Full Story (comments: none)
Version 0.9.1 of Devhelp, a GNOME API documentation browser, is out.
is out.
Changes include Mozilla 1.7 support, translation work, and more.
Comments (none posted)
Languages and Tools
Caml
The July 27, 2004 edition of the Caml Weekly News is available
with a number of new Caml language articles.
Full Story (comments: none)
Java
Don Schwarz continues his series on Java attribute-oriented programming with
part two.
"
In the previous article in this series, "Peeking Inside the Box, Part 1," I introduced the concepts of Attribute-Oriented Programming, Java 1.5 annotations, and bytecode instrumentation. I used these concepts to provide a JStatusBar GUI component that reports on the progress of an application without any explicit code. In this article I will introduce a completely different implementation of the same JStatusBar that uses thread sampling rather than bytecode instrumentation. I will then combine the two practices to develop a solution that has the best features of each."
Comments (none posted)
IBM's developerWorks is running
an introduction to the AUIML Toolkit.
"
The Abstract User Interface Markup Language toolkit is a rapid-development tool to assist developers in writing GUIs to run as either Swing applications or on the Web -- without any changes. Toolkit creators Andy Arhelger, Andy Hanson, and Tony Erwin take you on a tour of their technology, detailing where to get it, how to install it, and how to use it in this step-by-step article."
Comments (none posted)
Lisp
Version 2.6.3 of GCL (GNU Common Lisp) has been announced.
"
This version,
the latest in the `stable' series, fixes some issues discovered after
2.6.2 was released. Among the highlights of 2.6.2 are a compiler
stress test suite, performance improvements to the compiler, native
support for FreeBSD, OpenBSD, and MacOSX, support of AMD64, and more."
Full Story (comments: none)
Version 0.8.13 of Steel Bank Common Lisp is out.
"
This
version features package locks, a new way of loading shared libraries,
the SB-PROF module working on most non-x86 architectures, some
performance optimizations, and more."
Full Story (comments: none)
Perl
Project Ponie is intended
to bridge Perl 5 into Perl 6.
"
The Perl 5 interpreter will be rewritten to run on Parrot, the Perl 6 virtual machine. This will ensure the future of the millions of lines of Perl 5 code at thousands of companies around the world."
The third snapshot of Ponie
has been announced.
"
The purpose of this release is to make sure this approach keeps on working with the XS modules available on CPAN and to let people test with their own source code."
Comments (none posted)
These Weeks on perl5-porters are available for for July 28, 2004.
"
This week's summary actually covers two weeks. Anyway, with OSCON,
vacations and all that stuff, those are quiet weeks."
Comments (none posted)
The July 23, 2004 edition of
This Week on Perl 6 is available with the latest Perl 6 news.
Comments (none posted)
PHP
The
PHP Weekly Summary for July 19, 2004 is out. Topics include:
Hash table copy, file_get_contents(), alloca() revisited, test roll, threaded bcmath, PHP 5.0.0, PHP 4.3.8, HTTP_AUTH, commit policy for HEAD, load-order dependencies, TRUE, FALSE, NULL, exslt support on win32.
Comments (none posted)
The
PHP Weekly Summary for July 26, 2004 is out. Topics include:
empty_string deleted, memory leak (again), html_entity_decode(), reflection test suite needed, new array functions, PHP-GTK revival, stream functions, realpath() caching, full gif support, and fp guru required.
Comments (none posted)
Python
This week's Dr. Dobb's Python-URL! is out with another collection
of Python language articles.
Full Story (comments: none)
The June 16-30, 2004 edition of the
Python-dev Summary is available with the latest Python language
development news.
Comments (none posted)
Initial version 0.1 of the Durus object database has been announced.
"
I am happy to announce the first public release of the Durus
object database. Durus offers an easy way to maintain a consistent
persistent collection of Python object instances used by one or more
processes."
Full Story (comments: none)
Ruby
O'Reilly has published
part two of an introduction to Ruby.
"
In
part one
of this series, Chris Roach introduced you to programming basics
in Ruby, and in the process, created the back end for the GUI we're working
on. Here, he spends some time with the Tk library."
Part three of the series is also available.
Comments (none posted)
Tcl/Tk
The July 26, 2004 edition of Dr. Dobb's Tcl-URL!
is available with the latest Tcl/Tk article links.
Full Story (comments: none)
XML
Initial version 1.0.0 of Vex, a CSS-styled XML editor based on the Eclipse
platform,
has been announced.
"
It provides a word processor-like interface for document-style XML
documents such as DocBook and xhtml."
Comments (none posted)
Martin Klang
introduces o:XML on O'Reilly.
"
So what is o:XML? Well, it's a dynamically typed, general-purpose object-oriented programming language. It's got threads, exception handling, regular expressions, namespaces, and all the other things you would expect from a modern language. And it's expressed entirely in XML. Maybe o:XML is a bit like Python crossed with XML."
Comments (1 posted)
Mark Pilgrim
explores the problems with XML on the web.
"
The other apparent success of XML is the rise of syndicated feeds, in a range of XML vocabularies like CDF, RSS, and now Atom. There are feed directories; there are feed search engines; there are feed validators. Every major blogging tool -- from freeware like Blogger to commercial software like Movable Type to open source software like WordPress -- every tool publishes at least one of these XML formats.
Syndicated feeds are wildly popular, but they're not a success for XML. XML on the Web has failed: miserably, utterly, and completely."
Comments (none posted)
Dare Obasanjo
covers XML versioning techniques on O'Reilly.
"
This article explores some of the points to consider when versioning XML formats as well as some approaches to designing extensible XML formats in a manner compatible with existing XML technologies."
Comments (none posted)
Elena Litani and Michael Glavassevich
show how to write XML with an emphasis on performance on
IBM's developerWorks.
"
Write your application to get the best possible performance, plus learn which SAX or DOM operations and features affect application performance. In this first of a three-part article, authors Elena Litani and Michael Glavassevich describe best practices for writing XML apps and documents, and for developing applications with the standard SAX and DOM APIs."
Comments (none posted)
Edd Dumbill wraps up his series on open-source project documentation and
XML with
part four.
"
In this installment of XML Watch, Edd Dumbill concludes the development of a vocabulary for describing open source software projects, exploring the documentation, tools, and community that are required for the successful launch of the DOAP vocabulary. The steps taken are drawn from the author's experience with both open source projects and vocabularies such as FOAF and RSS."
Comments (none posted)
IDEs
Stable version 3.2.4 of
DrPython,
a Python language IDE, has been released.
The
changes include bug fixes, code cleanup, and more.
Version 3.2.5 was also released this week, if fixes several bugs.
Comments (none posted)
Page editor: Forrest Cook
Linux in the news
Recommended Reading
Vnunet
interviews Carol
Stafford about her work with IBM and Linux. "
How did you
first get involved with Linux?
I have been working in Linux and especially Linux on the mainframe since
1997. It was very exciting. I was working with the IBM engineers in Germany
and they were running Linux on the mainframe without any operating system
underneath it and developing it from there."
Comments (1 posted)
This NewsForge
article
touches on the process of selecting an open source license. "
There
isn't one answer for all open source projects, according to Lawrence Rosen,
the founding partner of Rosenlaw and Einschlag, general counsel for OSI and
author of a new book Open Source Licensing: Software Freedom and
Intellectual Property Law. "I say, 'Tell me about your software.' There are
companies that want to open source some of their [code] and not all of it,"
says Rosen. In order to advise them, "I have to understand what their
product is.""
Comments (30 posted)
Trade Shows and Conferences
NewsForge has
an OLS
report from David 'cdlu' Graham. "
Dan Aloni started the first
presentation in Room B on the subject of a project called Cooperative
Linux, a project similar to user-mode Linux (UML) except designed to run a
Linux kernel on top of Windows as well as within Linux."
Comments (2 posted)
NewsForge
covers sessions on CKRM, Perl 6, and Linux on Laptops from day two
of the Ottawa Linux Symposium.
"
Day 2 of the four-day Linux symposium here was a highly technical one. It began with Rik van Riel of kernelnewbies.org and Red Hat and a host of other members of the CKRM kernel resource management project explaining how it works."
Comments (none posted)
NewsForge
continues reporting from OLS. "
Michael Meeks of Ximian, now owned by Novell, gave a presentation called the 'Wonderful World of OpenOffice.org'.
OpenOffice.org, he said, needs more developers. Stop working on GNOME and KDE Office, he implored, they served their purposes, there is now a viable open source office suite -- and it's OpenOffice.org."
Comments (18 posted)
NewsForge
wraps up
its OLS coverage. "
The Ottawa Linux Symposium wrapped up its
busy 4 days with a 6-hour long bar party at the Black Thorn Café across the
street from the American Embassy in Ottawa. And for some, it was that
social aspect that they came for. For most attendees, though, stable Linux
kernel maintainer Andrew Morton's keynote address was the highlight of the
day."
Comments (3 posted)
NewsForge
covers
OSCON 2004. "
Other Monday sessions included: "Stop Spamming Me,"
featuring Matt Sergeant of Message labs; "Real-world Xforms;"
cross-platform, Rendezvous programming; and a "Presentation Aikido" from
Damian Conway of Monash University. This course covered preparation,
content selection, delivery techniques, handling questions, and also
provided an in-depth tutorial on improving presentations' look and
feel."
O'ReillyNet shows
pictures taken on Day One at the O'Reilly Open Source Convention.
Comments (none posted)
NewsForge
attends
Penguin Day. "
The intent of the event, hosted by a group of
Portland computer reuse raiders known as FreeGeek, was to find how
nonprofits such as Multiple Sclerosis Society, Child Aid, Water Watch, and
others can benefit from open source software and how the programming
community and provider community can join their efforts, which are similar
in ethos and economy."
Comments (1 posted)
The SCO Problem
Groklaw has
compiled
some reactions to yesterday's ruling in the DaimlerChrysler case.
"
That Seattle newspaper had grave difficulty absorbing the news of
the defeat. My all-time favorite intro to any of the stories was theirs:
"A Michigan judge on Wednesday dismissed most parts of a lawsuit that
sought to force auto giant DaimlerChrysler AG to comply with copyright laws
and software agreements with a Utah-based software company.""
Comments (1 posted)
Companies
The Register
runs an
article by Robin Bloor of Bloor Research. "
However, there can be
little doubt that the jewel in the mainframe crown is Linux in combination
with the mainframe's architecture, which delivers an unmatched
virtualization capability. The Linux contribution is twofold. It provides
applications (and after all its applications that sell computers) and it
can act as a useful capability for consolidation projects."
Comments (1 posted)
For a bit of Friday afternoon amusement, take a look at the latest
animated advertisement from Lindows.com,
as reported on NewsForge. Macromedia Flash 7 is required for viewing.
"
Linspire President Kevin Carmony, a former music industry executive and no stranger to parodied song with the previous single "Lindows Rock" (ala Chubby Checker's "Limbo Rock") under his belt, said while he came up with the lyrics, Linspire engineer Clifford Beshers suggested the use of the Doors' top hit, "Light My Fire."
"It's good fun," Carmony said. "Hopefully, Microsoft will appreciate the humor.""
Comments (9 posted)
DigiTimes.com
carries the news of the beta 1.0 release of Asianux.
"
China-based Red Flag Software and Miracle Linux of Japan officially launched their beta version of Asianux 1.0 at Oracle OpenWorld, a technology seminar held in Shanghai from July 20-22. Asianux is a standardized Linux operating environment developed specially for enterprises in Asia. Oracle, a supporter of Asianux, has decided to put the Linux-based operating system on its "unbreakable" support program."
Comments (none posted)
Linux Adoption
Tom Adelstein and Sam Hiser
explain why switching from Microsoft to Linux makes good
business sense.
"
Add to Microsoft's security woes an under-reported challenge enterprises will face in making the transition to Microsoft's next version of Windows. The next version of Windows produces an equally disruptive effect on Microsoft's installed base. Microsoft's technologies place as much if not more demands on an enterprise IT departments as a full-house transition to Linux, which wouldn't be required given the cross-platform nature of open-source software."
Comments (5 posted)
LinuxMedNews
reports that the Newfoundland and Labrador Medical Association (NLMA)
has announced its intention to develop its provincial electronic medical
record (EMR) using open source software. "
NeLL, as the EMR project
is known, will network all the province's 1,000 physicians. In its first
phase, NeLL will include electronic prescribing, billing, and
charting. NeLL will run on a Linux desktop, which will be the default and
only supported operating system on PCs shipped with NeLL."
Comments (none posted)
Linux at Work
News.com
covers the latest big Linux cluster deployment. "
With
an eventual 10,240 processors, the Space Exploration Simulator will be among
the world's largest supercomputers based on the Linux operating system, [SGI] said."
Comments (none posted)
Interviews
Vnunet
interviews
William Weinberg, newly appointed architecture specialist at the Open
Source Development Labs (OSDL). "
We're seeing big-name companies
joining OSDL. What are their expectations?
What the OSDL is most about today is the three initiatives we have
established. The one that's best established is the carrier grade
initiative. [Then there's] the data centre initiative and the newest one is
the desktop initiative. The goal of these initiatives is to limit the
inhibitors to Linux adoption and to accelerate Linux adoption in the
enterprise. Each initiative has a marketing working group and a technical
working group."
Comments (none posted)
Resources
O'ReillyNet
shows excerpts from the
Eclipse Cookbook. "
Although
Eclipse provides a host of automatic syntax and problem-checking features,
sometimes those features can be annoying. Fortunately, Eclipse is almost
endlessly customizable."
Comments (none posted)
Don Parker
explains packet filtering techniques on O'Reilly.
"
In an effort to put the usage of these filters into context I will explain a normal day in the life of a network security analyst. This day will focus on the usage of building and further explaining some complex examples. To clarify our example, I assume that the make-believe network has all packets that are flagged by the intrusion detection system logged to a central database. I mention this stipulation because not every real network operates in this fashion."
Comments (none posted)
IBM developerWorks
looks
at Gnuplot 4.0. "
Gnuplot is a freely distributed plotting tool
with ports available for nearly every major platform. It can be operated in
one of two modes: when you need to adjust and prettify a graph to "get it
just right," you can operate it in interactive mode by issuing commands at
the gnuplot prompt. Alternately, gnuplot can read commands from a file and
produce graphs in batch mode."
Comments (4 posted)
Linux Journal
takes a look at
page styles in OpenOffice. "
Page styles are one of
OpenOffice.org's strongest innovations. Together with text frames and
integration with Draw, these features nudge OOo Writer out of the word
processor category and into the lower reaches of desktop
publishing."
Comments (none posted)
David Murphy
writes about yum, the Yellow Dog Updater, Modified, on Linux.com.
"
Yum is a powerful tool that greatly improves package handling on RPM-based Linux distributions. This tutorial explains how to create a local yum repository, configure your machine to use this repository, and customise a yum RPM to automatically use this repository."
Comments (none posted)
Linux Journal
has a tutorial
on using Pygame for game development. "
Python is an excellent
language for rapid application development and prototyping. With Pygame, a
wrapper built around SDL, the same can be true for games. In addition,
because its built on top of Python and SDL, Pygame is highly
portable."
Comments (1 posted)
Robert Bernier
shows how to search through your email in an O'Reilly article.
"
Searching your corpus of email should be easy, but with a mishmash of text
and binary attachments, it can be difficult. If you're clever, though, you
can build a system to translate Microsoft Word documents into searchable,
indexable text. Robert Bernier demonstrates building custom email queries
with DBMail, PostgreSQL, IMAP, and a little Unix magic."
Comments (none posted)
Miscellaneous
KDE.News
looks at the G System.
"
Ever dreamed of a nice piece of software that actually tries to simulate the
evolution of an universe? Ever thought it would be possible? Now after a long
time of planning and writing of some source code a small group of developers
goes public with their innovative project: the G System."
Comments (none posted)
OSnews is carrying
a
list of complaints about the X desktop which appears to have been
inspired by last year's distributions. "
Please support the Y Window
System. There's no fixing X11 that doesn't involve superhuman genius
hackery. Workaround after workaround will only make it more big and
bloated. X11 must be retired. Y Windows is a natural choice since the
project plans X11 compatibility to ease migration." (Thanks to Jay
R. Ashworth).
Comments (21 posted)
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
The Free Software Foundation Europe has sent out a press
release concerning its participation in an EC case involving
Microsoft.
"
After having participated as third party in the antitrust case before,
the Free Software Foundation Europe has participated to the
preliminary hearing on Tuesday 27th of July 2004 to enter court in
order to defend the decision of the European Commission and the
freedom to use Free Software SAMBA."
Full Story (comments: none)
Commercial announcements
If you're looking for a cheap way to deploy Linux desktops,
this announcement from Devon IT may point the way forward: X terminals are back. The "NTA Virtual Office" terminal runs Linux, has no moving parts, and starts at $149.
Comments (5 posted)
The Open Source Developers Network, host to Slashdot, NewsForge, SourceForge, etc., has gone through a makeover and is now the
Open Source Technology Group. The company's web sites have been fixed up "
...to deliver more in-depth articles and resources to help our forward-thinking audience make critical business and purchasing decisions."
Comments (2 posted)
ActiveState has announced Komodo 3.0, the latest release of its IDE for
dynamic languages. The announcement, made at the O'Reilly Open Source
Conference, details Komodo's new capabilities.
Full Story (comments: none)
Big Nerd Ranch will be holding another PostgreSQL Bootcamp in
Atlanta, GA on October 4-8, 2004.
Full Story (comments: none)
The SCO Group has sent out
a press release stating that it has registered the stock to be used in paying off BayStar, and that it considers the whole issue to be closed. However... "
BayStar has notified SCO that it is BayStar's position that the repurchase transaction has not closed, pending resolution of claims by BayStar that SCO's recent public statements regarding SCOsource licensing opportunities are inconsistent with statements previously made by SCO to representatives of BayStar.... BayStar has also claimed that it will not consider the repurchase transaction closed until SCO provides BayStar with confidential information supporting the accuracy of SCO's recent public disclosures regarding its SCOsource business. SCO has declined to provide the SCOsource information requested by BayStar in order to protect the confidential and proprietary nature of the information and the names of the companies engaged in SCOsource licensing discussions and to avoid fostering speculation regarding its SCOsource business." Looks like SCO may have another lawsuit in the works.
Comments (4 posted)
The Eclipse Foundation has launched a new Web Tools Platform Project.
"
The Web Tools Platform project is an exciting new expansion of both the
Eclipse technology portfolio and our community of developers," said Mike
Milinkovich, executive director of Eclipse. "ObjectWeb's support was
instrumental in establishing the project and we look forward to
continuing to work with them in the future."
Full Story (comments: none)
Mandrakesoft has
announced its quarterly results. "
During the quarter, the
company registered an operating income of 0.17 M euro (0.04 euro per share)
compared to an operating loss of 0.47 M euro during the same period of the
previous fiscal year. The net income increased to 0.19 M euro (0.04 euro
per share) compared to a net loss of 0.37 M euro during the previous fiscal
year."
Comments (none posted)
Seagate Technology and Linspire, Inc. have
announced
an extension of their agreement to offer the LinspireEspanol desktop
pre-loaded on Seagate Barracuda hard drives for emerging markets. This
package will enable computer manufacturers to offer affordable Spanish
language Linux desktop computers to their customers in Latin America.
Comments (3 posted)
Versata has
announced Edition 3.2 of its Versata Logic Suite for the JBoss
Application Server.
"
With Versata, developers replace tedious Java programming with a
declarative, model-based approach to application development based on
business rules and data models. This automated approach dramatically
reduces development time and eliminates the need for expensive and
error-prone Java programming of service components."
Comments (none posted)
Enfobridge has
announced a new support site for OpenOffice.org users.
"
Enfobridge this week announced
DownloadOpenOffice.org, a new website that offers free downloads and support
for OpenOffice.org software. For the first time ever, downloaders have access
to a professional online support staff free of charge."
Comments (none posted)
New Books
Use Perl has
an announcement for the book
XML Publishing with AxKit by Kip Hampton.
"
Using the power of Perl (and mod_perl) to transform the Apache Web server
into a fully-featured XML publishing and application enviroment, Apache AxKit
is one of the Perl-XML community's flagship projects. This book covers the
spectrum from the basics of XML-based site development to the details of
writing your own custom AxKit extensions (in Perl, natch)."
Comments (none posted)
Resources
Use Perl has
an announcement for a new Perl magazine.
"
brian_d_foy writes "The first print issue of The Perl Review is coming off
the presses now. I'll be sending it out to subscribers as soon as I can, and
I will have a bunch at OSCON too."
Comments (none posted)
The latest new documentation releases are available from the
Linux Documentation Project, read all about them on the July 28, 2004
edition of the LDP Weekly News.
Full Story (comments: none)
Contests and Awards
LinuxWorld has sent out a PR naming the finalists for its "product
excellence awards." As one might expect, it is a celebration of
proprietary offerings, but it does include a strange category called "best open
source solution." The contenders are Firefox, Ingres, SUSE Linux
enterprise server 9, and Gentoo Linux 2004.2.
Full Story (comments: none)
Event Reports
Harald Welte has posted his best photos from the 2004 Linux
Kernel Summit.
Full Story (comments: none)
Roger Leigh has posted a summary of the
LSM Free Software Printing Summit in Bordeaux.
"
What we worked on
will have an impact on the Debian printing infrastructure in the
medium to long term, and this will affect a potentially large number
of printing packages, and so I have also CC'd the maintainers of the
relevant packages."
Full Story (comments: none)
Upcoming Events
A press release has been posted for the 2004 KDE
Community World Summit.
"
The aKademy Team announces the schedules for the KDE
Community World Summit 2004, code-named "aKademy", taking place in
Ludwigsburg, Germany from August 21st to 29th. Featuring speakers from IBM,
Novell, SuSE, Connectiva, Trolltech, HP and many community hackers and
activists, it promises to be a highlight of the Free Software calendar."
Full Story (comments: none)
A
call for participation has gone out for the ApacheCon 2004 US
conference. The event will take place on November 14-17, 2004 in
Las Vegas, Nevada. The submission deadline is August 2, 2004.
Comments (none posted)
Volunteer help
has been requested for the OSCON Perl booth.
"
The Perl Foundation will have a booth at the O'Reilly Open Source Convention again this year, and we need volunteers to staff the booth. No special experience or abilities are needed, other than a willingness to talk with interested people about Perl and TPF."
Comments (none posted)
IDG World Expo has sent out a press release about LinuxWorld Conference
& Expo, coming next week to San Francisco's Moscone Center.
Full Story (comments: none)
Two FSF Seminars on the GPL
will be held at Stanford University Law School on August 24 and 25,
2004, according to a notice on Groklaw.
"
I
would recommend it to anyone wanting to know how the GPL works, including
coders and journalists and executives, and I'm living proof that you don't
need to be a lawyer to get something out of it. There are no pop quizzes.
And you don't have to do anything but listen and learn. If your boss is in
the fearful "The Company Shalt Not Use GPL" category, he or she needs to go
to find out how a company can get set up to appropriately benefit from GPL
software."
Comments (none posted)
The 2004 SANE (System Administration and Network Engineering) conference
will take place in Amsterdam, the Netherlands on September 27 - October
1.
Full Story (comments: none)
The SANE Conference will feature a Free Software Bazaar with a
lecture by Richard Stallman.
"
Wednesday evening is reserved for the Free Software Bazaar. You will
have a chance to discuss the latest developments in Free and Open Source
Software with members of the many groups that will present their work. A
highlight of the Bazaar will be a lecture given by Richard M. Stallman.
Admission to the Bazaar is free."
Full Story (comments: none)
Jon Erickson and Andrew bunnie Huang will appear at the
DEFCON 12 underground hacking event on July 30 - August 1, 2004 in
Las Vegas, NV.
Full Story (comments: none)
| Date | Event | Location |
| July 29 - 30, 2004 | O'Reilly Open Source Software Convention 2004(OSCON) | Portland, OR |
| July 29 - 30, 2004 | IBM pSeries Technical Conference | Cairns, Australia |
| July 31 - August 2, 2004 | Vancouver Python Workshop | Vancouver, Canada |
| August 2 - 5, 2004 | LinuxWorld Conference & Expo | (Moscone Center)San Francisco, California |
| August 5 - 8, 2004 | UKUUG 2004 Linux Technical Conference | Leeds, England |
| August 21 - 29, 2004 | KDE Community World Summit 2004(aKademy) | (Filmakademie Ludwigsburg)Ludwigsburg (Stuttgart Region), Germany |
| September 2 - 3, 2004 | Python for Scientific Computing(SciPy) | (CalTech)Pasadena, CA |
| September 2 - 4, 2004 | 2nd Swiss Unix Conference | (Technopark)Zurich, Switzerland |
| September 9 - 10, 2004 | Linux Expo Shanghai | (Shanghai Exhibition Center)Shanghai, China |
| September 13 - 16, 2004 | Embedded Systems Conference | (Hynes Convention Center)Boston, MA |
| September 15 - 17, 2004 | YAPC::Europe 2004 | Belfast, Northern Ireland |
| September 20 - 23, 2004 | New Security Paradigms Workshop(NSPW) | (White Point Beach Resort)Nova Scotia |
| September 20 - 22, 2004 | Plone Conference 2004 | Vienna, Austria. |
| September 22 - 24, 2004 | OpenOffice.org Conference(OOoCon 2004) | (Humboldt University)Berlin, Germany |
| September 22 - 24, 2004 | php|works 2004 | (Holiday Inn Yorkdale Hotel & Conference Centre)Toronto, Canada |
Comments (none posted)
Web sites
MozillaZine
has announced a new nvu forum.
"
NvuDev.org, the development site for Nvu, has launched a set of forums for
those wanting to discuss the standalone version of Mozilla Composer. There
are seven forums, including one that allows anonyomous posting."
Comments (none posted)
Software announcements
Here are the software announcements, courtesy of
Freshmeat.net. They are available in
two formats:
Comments (none posted)
Page editor: Forrest Cook