Time to expand the DMCA?

Since it was enacted, the U.S. Digital Millennium Copyright Act (DMCA) has stifled security research, led to the arrest of visiting programmers, shut down fair use, prohibited the creation of free DVD players for Linux, and facilitated anti-competitive moves by manufacturers of printer cartridges and garage door openers, among others. The EFF and others have been pushing for a reform of the DMCA for some time, and the occasional member of Congress has tried to bring that about. The DMCA is a law which clearly needs fixing.

Now, there is a new attempt to amend the DMCA in the works; a copy of the DMCA with the proposed changes highlighted [PDF] is available for those who are interested. This proposal, however, would have the effect of making the DMCA significantly worse. Here are a few highlights:

• No longer content with criminalizing copyright infringement, the new law would make even attempted infringement illegal - with the same penalties. There would be no need to actually copy anything to violate the new DMCA.

• The new law authorizes the impounding of "records documenting the manufacture, sale, or receipt of items involved in such violation" Such records certainly will include Internet service provider logs.

• The penalty for copyright infringement will be raised to a maximum of ten years in prison - twenty for repeat offenses. In the future, rational criminals will not copy CDs; the potential penalty for simply stealing them will be lower. The new ten-year penalty will apply to those committing the heinous crime of recording a live concert as well.

• The use of wiretapping and similar techniques is authorized for investigations into criminal copyright infringement or recording of live performances.

• Criminal and civil forfeiture powers would be available to law enforcement agencies dealing with copyright cases.

The addition of forfeiture powers is, perhaps, the scariest part of this whole proposal. Civil forfeiture has long been a part of the U.S. "drug war," with the result that many law enforcement actions - often against innocent people - have been motivated primarily by the prospect of seizing valuable property. If this law goes through, any music player, laptop, or server deemed to have somehow participated in copyright infringement will be subject to seizure by the police - along with the houses they are found in. Anybody who thinks this power would not be abused has not been paying much attention.

As of this writing, the proposed legislation has not yet been formally introduced for consideration, but has been circulated among some members of the House of Representatives.

A different bill which, according to the EFF has been introduced is the "PERFORM act." This law can be thought of as a sort of broadcast flag for the net; it would require those broadcasting copyrighted material on the net to use DRM-afflicted formats. No more Vorbis or Theora streams - or even MP3. And, obviously, no way to tune into such streams using free software.

These bills make it clear that the powers behind the expansion of "intellectual property rights" are not yet satisfied and want more. This sort of thing will keep coming, and not just in the U.S. If we value our freedom, we must be prepared to keep fighting - and to work to push the pendulum in the other direction.

Comments (12 posted)

The JMRI Project and software patents

[Editor's note: The case of KAM Industries and the JMRI project is an important one; it is one of the first times where a free software developer has been directly attacked by a patent holder and held responsible for royalties for every downloaded copy. If we wish to be able to post software without risking hundreds of thousands of dollars (or more) in royalty demands, we must quickly put an end to this sort of thing. We asked Groklaw founder Pamela Jones to put together a summary of this case and what we can do about it; the following is her response.]

The Right to Create blog has a letter from the attorney, Victoria K. Hall, who is representing Robert Jacobsen, the man who was sent the bill for $203.000 for allegedly infringing patents with his open source model train software. He has struck first, filing a lawsuit himself, Jacobsen v. Katzer et al, charging that the patent was fraudulently obtained and hence is invalid and unenforceable. The complaint also says the patent is invalid on the grounds of obviousness and for failure to meet the written description requirement of 35 U.S.C. Sec. 112.

So, on one side we find an Open Source developer, and, on the other, a guy wielding questionable software patents. Of course, as in all litigation, it's important to keep in mind that nothing is proven by a complaint. It's just the opening salvo, and we haven't yet heard the defendants' side.

Hall is asking the community to look for prior art. Let me tell you a little bit about the case, from the materials in the complaint Jacobsen has filed. It may help you to more effectively find prior art. It will surely motivate you.

The lawsuit

The case is 5:2006cv01905, filed in the US District Court for the Northern District of California, San Francisco Division, for those of you with Pacer accounts. The plaintiff lives there and works at the Lawrence Berkeley National Laboratory of the University of California and he also teaches physics there. He's also a model train hobbyist who has written, with others, open source code called JMRI, or Java Model Railroad Interface, which allows you to control how model trains run on a track. He's the primary developer of the software through the JMRI Project.

Ms. Hall, although located in Maryland, is admitted to practice in California as well as in Maryland state courts and is a patent attorney admitted to practice before the USPTO. Interestingly, she worked in the chemical engineering and software industries for nine years before she went to law school.

The suit is an action for declaratory judgment that Katzer's patent, US Patent No. 6,530,329, called the '329 patent, is "invalid, unenforceable, void and/or not infringed by Plaintiff Jacobsen". What's a declaratory judgment?

Here's US Code Title 28, Ch 151, § 2201, the Declaratory Judgment Act. And here is a definition from Cornell's Legal Information Institute. If someone is threatening to sue you, but hasn't yet, in certain limited circumstances, you can take the initiative rather than waiting for the axe to fall, go to court and in essence say: "This person or this company is threatening to sue me and I need our respective rights with respect to this dispute settled, so this cloud over my or my company's head doesn't ruin my business."

The court doesn't have to hear a request for a declaratory judgment. It has discretion. It's an enabling statute, and your case has to fit into the confines of the Declaratory Judgment Act, namely you have to have an actual "controversy" in the constitutional sense. That means it isn't a hypothetical problem and it isn't moot, meaning, first, that you really have a realistic and reasonable apprehension of actually being sued, and second, that the court can settle your problem with a declaratory judgment. If the judge accepts the dispute, he can issue a declaratory judgment, in which he "declares" what each party's rights are, the idea being that if, for example, he declares that you aren't infringing your adversary's patent, then you can't be sued.

Mr. Jacobsen's complaint is also a complaint for "violation of federal antitrust laws, the Lanham Act, and California Unfair Competition Act and for libel." The Complaint asks for a decree that the defendants Katzer and his company "have attempted to monopolize the market for multi-train control systems software in the United States" in violation of Section 2 of the Sherman Act.

The defendants

The named defendants are Matthew Katzer, KAMIND Associates, Inc. d/b/a KAM Industries, and Kevin Russell. Katzer is a model train hobbyist who has written software code for controlling model trains and is an expert in the field. He has several patents, and the complaint states that Jacobsen believes there are more pending. KAM is Katzer's business, selling products embodying Katzer's patents.

Here's the surprising twist. The third defendant, Kevin Russell, is their lawyer. He works for a firm in Oregon, Chernoff, Vilhauer, McClung & Stenzel. He's now accused of libel, and the court is asked to find against the defendants, jointly and severally, to the tune of $50,000 plus punitive damages.

Russell filed a a request under the U.S. Freedom of Information Act, with the Lawrence Berkeley National Laboratory, not only accusing Jacobsen of patent infringement, but claiming that the Lab "had sponsored the allegedly infringing JMRI Project's activities." The DOE turned down the request in December of 2005, but not before Jacobsen was embarrassed and had to explain the whole "harassment story," as he describes it, to his boss and the DOE FOIA liaison. The complaint also says it interfered with his work, resulting in a loss of income. The FOIA request, Jacobsen says, caused him embarrassment, particularly because he's "a scientist whose work involves the creation of intellectual property." The complaint continues, saying that Russell knew that the Lab, which has a contract with the U.S. Department of Energy, which has nothing to do with the JMRI Project. The defendants made the allegation, says the complaint, "to effect Defendants' goal to embarrass Plaintiff Jacobsen and force him to shut down the JMRI Project and to pay royalties to Defendant KAM."

The patent

According to Jacobson, the basis for claiming that the patent is not valid is the defendant's history of applying for patents on what others invent without telling the patent office about the prior art. Another charge is that Katzer didn't tell the patent office that some of KAM's products "were in public use, published, offered for sale or sold more than 1 year before Defendant Katzer filed the '461 application," which would disqualify them for patent protection. The patent in question, '329, claims the benefit of earlier patent applications' filing dates, '461 being the earliest filed in the chain that '329 issues from.

The complaint lists prior art dating back to the 1986 that it says Katzer ought to have told the USPTO about, since the complaint alleges he knew about them. For example, in late March of 2002, the story continues, the JMRI Project software's client-server capabilities were described in a posting to a public mailing list, which Katzer is on. Then in April 14, 2002, the first version of JMRI with the new capabilities was released for public download and announced on several mailing lists and on the JMRI website. "Three days later, Defendant Katzer filed a patent application tailored to claim the capabilities of the JMRI Project software." Again, the Complaint says, Katzer didn't tell the patent examiner about the JMRI Project.

Jacobsen says he received a letter from KAM in March of 2005, offering to license for $19 per program installed on a computer, saying that JMRI was infringing claim 1 of the '329 patent. Jacobsen says he wrote a letter back asking exactly how he was infringing, and his answer was a letter in August, saying that he was infringing claim 1 and that they were now investigating to see if any other patents were infringed by JMRI. Oh, and the price to license was now $29. The letter also demanded $203,000 for the 7,000 copies already distributed. In October came a bill with finance charges, so the total had risen to more than $206,000. He's gotten bills roughly every month since.

Jacobsen is about to release a new version of his software, and that's why he's asking the Court to bring resolution to the matter, because he believes the defendants will sue him when he releases the new version. He's also asking for redress.

The request

Aside from the declaratory judgments, the antitrust decree, and the libel damages, the Plaintiff is asking for the following:

• An injunction ordering Defendant Katzer to identify all patents and patents applications filed in the United States and throughout the world, to produce to their respective patent offices all material references discovered through this litigation, and to request re-examination (or the nearest equivalent proceeding outside the U.S.) of any patents issuing from the patent applications.

• An award of treble damages for the loss of income and other property on the antitrust claim.
• A decree that Defendants Katzer and KAM have engaged in unlawful, unfair and/or fraudulent business practices in violation of the California Unfair Competition Act, California Business and Professions Code, and an order enjoining them from any future such conduct.

• An order finding that Katzer cybersquatted on the trademarked name, www.decoderpro.com in violation of the Lanham Act and requiring him to turn the domain name over to Plaintiff Jacobsen.

• An order enjoining Defendant Katzer and Defendant KAM, and all persons and entities under their direction or control, from engaging in or carrying out any further anti-competitive or bad faith conduct

• An order referring the matter to the U.S. Attorney's Office for investigation into antitrust violations, perjury, mail fraud, and cancellation proceedings against any patents involved in this litigation, and any related patents.

• An order awarding costs and attorney's fees as permitted by law, including 35 U.S.C. Section 285.

What you can do

Ms. Hall in her letter asks that no one harass the defendants "through calls, letters, faxes, emails, etc. It does NOT advance the case in Mr. Jacobsen’s favor." What does help is to find prior art. Groklaw just published a basic tutorial on prior art, Prior Art and Its Uses - a Primer, by a patent attorney, Theodore C. McCullough. It might help you.

Here is what Ms. Hall is asking for:

Here's her contact information, if you do find prior art. Snail mail is the best, she says. I can't help but point out that had the Peer to Patent Project mentioned in McCullough's article been in place a few years ago, these patents might well have been blocked before they issued, and all this woe could have been prevented. If nothing else, this incident can help us to understand what patents project like that are designed to address.

So, there you have the information and the tools to get started searching for prior art. Happy hunting.

Comments (25 posted)

Learning the lesson: open content licensing

As the previous feature on open content noted, the need for an appropriate license was felt from the earliest days. Strangely, it was not Richard Stallman who filled this gap: even though the GNU General Public License dates back to 1984, it was only in 2000 that the corresponding GNU Free Documentation License was created. As a result, the honor for the creation of the first formal non-software open license goes to David Wiley.

In the summer of 1998, Wiley had joined the graduate program in Instructional Psychology and Technology at Brigham Young University, where he began doctoral work on “learning objects” - small-scale, reusable computer-based educational materials designed to be used in a variety of settings. This was just a couple of months after the term “open source” had been devised at the Freeware Summit, and Wiley realized that what was needed was a kind of open source for instructional content.

He contacted people like Richard Stallman and Eric Raymond to ask their advice, and drew up his first license in July 1998. Wiley decided to call his approach “open content” - a term which he seems to have been the first to use consistently. For Stallman, the idea of “open” as opposed to “free” is anathema, and he also refuses to refer to works as “content”, so ultimately he wanted nothing to do with this new “OpenContent License”, even though he and Wiley had previously worked together in an attempt to tweak the GNU GPL for content. Raymond, by contrast, was an important influence on the fledgling open content idea, as the following passage from the newly-created Opencontent.org site indicates:

More input was provided by Tim O'Reilly and Andy Oram, making the license more palatable to publishers so that online versions of printed books and journals could be distributed for free. The result was the Open Publication License (OPL), released in June 1999. Appropriately enough, Raymond's “Cathedral and the Bazaar” was released under the OPL (as was his “Brief History of Hackerdom”). A number of other books, mostly in the field of computing, adopted the license, including GTK+/Gnome Application Development by Havoc Pennington, and Grokking the GIMP, by Carey Bunks. It was also adopted for Bruce Perens' Open Source Series, published by Prentice Hall.

Although the OPL led to a modest increase in open content being made available, the license still had some problems. One was that it came in four versions – OPL, OPL-A, OPL-B and OPL-AB - according to which, if any, of two optional clauses were included. These dealt with the thorny issues of “substantively modified works” and whether the work or derivatives of it could be published in book form for commercial purposes. The combinations obviously made it harder to be sure what exactly an OPL license permitted, and meant that users were forced to refer to the license to find out what their rights were. What was needed was some legal input to produce a series of open content licenses that clearly delineated what could and could not be done with them.

Fortunately, in the second half of the 1990s, a group of lawyers were becoming increasingly interested in the interrelated issues of copyright, intellectual property, digital content and the public domain. Pioneers here include Pamela Samuelson, James Boyle and Yochai Benkler. But the person who has become most closely associated with this whole area is undoubtedly Larry Lessig.

He rose to prominence with his book “Code and other laws of Cyberspace”, which asserted that the Net's software codes necessarily implied legal codes. From this early interest in architectures and their growing power to affect everyday life, Lessig's focus gradually shifted back to the legal domain, where he sought to counter the threats posed by the music and film industries to the new creative possibilities opened up by the Net.

His first attempt at a solution was the creation of Copyright's Commons in 1999, “a coalition devoted to promoting the public availability of literature, art, music, and film.” Its principal instrument was the use of what it called “counter-copyright”, which “strips away the exclusivity that a copyright provides and allows others to use your work as a source or a foundation for their own creative ideas. The counter-copyright initiative is analogous to the idea of open source in the software context.”

When Copyright's Commons became involved in the Eldred vs. Ashcroft lawsuit – which tried to block the extension of US copyright by 20 years - it also pioneered what it called “openlaw”, where legal arguments were posted online for open discussion.

It was Lessig who argued the Eldred vs. Ashcroft case in court – and lost, much to his chagrin. A more positive outcome from this work was the creation of a second, more ambitious, organization called Creative Commons, and the drawing up of a series of formal open content licenses. Like Wiley's Open Publication license, these Creative Commons licenses allow several options. While this lends them great flexibility, it also means that there is now a confusing array of Creative Commons licenses. Indeed, Richard Stallman no longer supports the Creative Commons project because not all of these licenses meet his requirements for freedom.

Despite Stallman's concerns, there is no doubt that the Creative Commons licenses have transformed the open content scene. They offer creators a range of rigorous licenses that have been drawn up by lawyers with a deep understanding of the issues of copyright in the Net age. An important recent court case in the Netherlands has confirmed their legality, at least in that jurisdiction.

Wiley's original licenses were created for educational materials, and among the first applications of the Creative Commons licenses were two major open content projects in the field of what has come to be called open courseware, both funded by the Hewlett Foundation. Just as open source avoids re-inventing the wheel by building on existing code, so open courseware aims to save time, effort and money by making educational material freely available for others to re-use, extend and improve.

The first such project, Connexions, came from Rice University. It was the brainchild of Richard Baraniuk, professor of electrical engineering, who was directly inspired by the example of open source. Connexions uses a content creation platform called Rhaptos, which is released under the GNU GPL. The other major open courseware project came from MIT. One of the people behind the OpenCourseWare idea – which arose out of an earlier failed attempt to make money from selling MIT courses online – was Hal Abelson, who is also one of the founders of Creative Commons. This joint involvement simplified the issue of licensing, something that was a major issue for Rice initially, until it too adopted a Creative Commons license.

MIT does not use an open source platform, but David Wiley has started a project called eduCommons, based on Plone, that offers this facility. Another of his free software projects, called Open Learning Support, and now part of eduCommons, provides Rice's Connexions and MIT's OpenCourseWare with online discussion boards. Baraniuk, for his part, is working on a range of ancillary open source software, including systems to aid translation, and a rating system for courses. It is also worth mentioning the free software course management package Moodle, which is widely used around the world, and Sakai, a similar project, funded by the Hewlett Foundation.

Although both Connexions and OpenCourseWare allow course materials to be modified, they do not make any provision in their platforms for true collaborative development. The final article in this short series will explore how this issue has been addressed by open content projects.

Glyn Moody writes about open source and open content at opendotdotdot.

Comments (4 posted)

A flurry of kernel security fixes

Over the last month, there have been eleven separate releases in the 2.6.16 stable kernel series, seven of which were single-patch releases for security related issues. This flurry of security fixes would make one think that there was a concerted effort by an individual or organization to try and find kernel security problems, but that is not the case. It is entirely coincidental that all of these fixes came about at around the same time.

A chronological look at each of these fixes gives a nice picture of the diverse places that kernel developers are looking for bugs in general and security bugs in particular.

Roughly a week after the original 2.6.16 release, the 2.6.16.1 release contained 19 patches, including one that fixed CVE-2006-1242. Code had been put into the kernel in the 2.4 series to stop leaking information in the form of fragment IDs in TCP packets that did not require them. Packets that have the DF (don't fragment) bit set do not need a fragment ID and eliminating that information is a countermeasure to a technique called idle scanning. Unfortunately when the original change was made, the response to a certain kind of packet (a SYN-ACK packet) was missed and that was discovered in March.

The 2.6.16.2 release came out on 7 April and had a quite a few fixes including a change to the sysfs interface covered by LWN two weeks ago.

On the 11th and 12th of April, there were 3 releases, each of which included just one security fix. 2.6.16.3 is a fix for a bug that would allow a user to oops the kernel by passing invalid arguments to the keyctl utility (CVE-2006-1522). If the user specified a key as the target for an "add key" operation, rather than a keyring, a invalid dereference in the kernel would result.

A call to BUG_ON() in the __group_complete_signal() function (which is part of the RCU signal handling code) "has unknown impact and attack vectors" and was patched as 2.6.16.4. If a user process could cause the condition in the BUG_ON call, it could oops the kernel and lead to a denial of service. (CVE-2006-1523).

A difference in the way Intel and AMD 64-bit CPUs handle non-canonical return addresses led to the 2.6.16.5 release. The Intel CPU reports the exception on the SYSRET instruction which causes the kernel exception handler to run using the user stack. (CVE-2006-0744). Kernel processing using a user created stack would seem rife with opportunities for exploitation.

The 2.6.16.6 release came out a week later with another long list of patches, two of which have security implications. The m32r architecture had a bug in the get_user and put_user macros that did not check the address passed to them which would allow access outside of the process address space.

A more widespread issue was addressed with a patch in this release and then fixed in the 2.6.16.7 release later in the day. The MADV_REMOVE vulnerability (CVE-2006-1524) has been present in kernels since 2.4 and allows local users to potentially bypass the access restrictions on a read-only attachment of shared memory. The user process could call mprotect() and gain write permission on a piece of memory even though the memory was explicitly set to be read-only when shared via the shared memory IPC mechanism.

Prior to 2.6.16.8, the kernel was vulnerable to users causing a kernel panic by requesting a route for a multicast IP address (CVE-2006-1525). Using a simple 'ip' command from the shell would cause a null pointer dereference in ip_route_input and panic the kernel. This is another example of a local denial of service vulnerability.

2.6.16.9 patches a problem that affected both Linux and FreeBSD kernels running on AMD processors which would allow a malicious process running on the same CPU to determine portions of the state of floating point instructions in a target process. AMD had some comments on the bug and provided some background information on why they chose to implement the FXRSTOR and FXSAVE instructions differently than they are implemented in Intel processors. Essentially, these two instructions do not save and restore all of the same registers as Intel does and this allows information to leak from one process to another. The patch ensures that the floating point state is constant between context switches on affected processors. (CVE-2006-1056)

Last on our tour of kernel security fixes is a patch made in 2.6.16.11 and released on Monday that disallows backslashes in path components unless POSIX paths have been negotiated. This change is for the CIFS (aka Samba) filesystem code; one can only imagine the kinds of havoc one could cause by putting backslashes (the standard Windows path separator) into CIFS paths. This bug is CVE-2006-1863, but the CVE database just shows a placeholder page for that number at the time of this writing.

Observant readers will have noticed that we skipped over 2.6.16.10 as it was a release with quite a few patches, none of which were noted as being security related.

As this laundry list of issues shows, there are a wide variety of places that kernel bugs can impact security, but the many eyes of kernel developers seem to be finding and fixing them. This process plays out in the open and that can give competitors ammunition to claim that Linux is less secure than certain proprietary systems. Reasonable people would more likely come to the conclusion that Linux developers are much more interested in finding these issues and fixing them. The kernel community has no interest in hiding vulnerabilities or playing games with security patch descriptions to make the OS look more secure. PR considerations just do not seem to be on the radar of the technical contributors and that is just as it should be.

Comments (2 posted)

abc2ps: buffer overflows

Package(s):	abc2ps abcmidi	CVE #(s):	CVE-2006-1513 CVE-2006-1514
Created:	April 25, 2006	Updated:	April 26, 2006
Description:	Erik Sjölund discovered that abc2ps, a translator for ABC music description files into PostScript, does not check the boundaries when reading in ABC music files resulting in buffer overflows. The abcmidi-yaps utility suffers from similar problems.
Alerts:	Debian DSA-1043-1 abcmidi 2006-04-26 Debian DSA-1041-1 abc2ps 2006-04-25

Comments (none posted)

beagle: command line injection

Package(s):	beagle	CVE #(s):
Created:	April 21, 2006	Updated:	April 26, 2006
Description:	Chris Evans discovered that while indexing, Beagle will build certain command lines in an insecure manner. When Beagle executes external helper applications, it is possible to cause beagle to execute arbitrary commands as the user running beagle.
Alerts:	Fedora FEDORA-2006-440 beagle 2006-04-21

Comments (none posted)

ethereal: multiple vulnerabilities

Package(s):	ethereal	CVE #(s):	CVE-2006-1937 CVE-2006-1933 CVE-2006-1932 CVE-2006-1935 CVE-2006-1934 CVE-2006-1938 CVE-2006-1939 CVE-2006-1940 CVE-2006-1936
Created:	April 25, 2006	Updated:	May 12, 2006
Description:	There are multiple vulnerabilities in Ethereal version up to 0.10.14, including various dissector crashes and an off-by-one error in the OID printing routine.
Alerts:	SuSE SUSE-SR:2006:010 opera, pdns, cpio, ethereal, clamav, apache 2006-05-12 Red Hat RHSA-2006:0420-01 Ethereal 2006-05-03 Debian DSA-1049-1 ethereal 2006-05-02 Gentoo 200604-17 ethereal 2006-04-27 Mandriva MDKSA-2006:077 ethereal 2006-04-25 Fedora FEDORA-2006-461 ethereal 2006-04-26 Fedora FEDORA-2006-456 ethereal 2006-04-25

Comments (none posted)

fbida: insecure temporary file creation

Package(s):	fbida	CVE #(s):	CVE-2006-1695
Created:	April 24, 2006	Updated:	May 22, 2006
Description:	The fbgs script in the fbi package 2.01-1.4, when the TMPDIR environment variable is not defined, allows local users to overwrite arbitrary files via a symlink attack on temporary files in /var/tmp/fbps-[PID].
Alerts:	Debian DSA-1068-1 fbi 2006-05-20 Gentoo 200604-13 fbida 2006-04-23

Comments (none posted)

kernel: multiple vulnerabilities

Package(s):	kernel	CVE #(s):	CVE-2006-1056 CVE-2006-1525 CVE-2006-1524 CVE-2006-0744 CVE-2006-1522 CVE-2006-1055
Created:	April 20, 2006	Updated:	May 4, 2006
Description:	Multiple kernel vulnerabilities have been fixed, including an x87 information leak between processes, an ip_route_input panic, a MADV_REMOVE vulnerability, an mprotect write permission problem, insecure MPBL0010 driver sysfs permissions, an x86_64 force IRET issue, RCU signal handling, a key addition oops, a sysfs write buffer issue and more.
Alerts:	SUSE SUSE-SU-2014:0446-1 Xen 2014-03-25 Ubuntu USN-281-1 linux-source-2.6.10, linux-source-2.6.12 2006-05-04 Trustix TSLSA-2006-0022 kernel 2006-04-21 Fedora FEDORA-2006-423 kernel 2006-04-20 Fedora FEDORA-2006-421 kernel 2006-04-19

Comments (none posted)

php: several vulnerabilities

Package(s):	php	CVE #(s):	CVE-2006-0996 CVE-2006-1494 CVE-2006-1608
Created:	April 25, 2006	Updated:	May 24, 2006
Description:	There are several vulnerabilities in PHP v5.1.2 and earlier. A cross-site scripting (XSS) vulnerability in phpinfo (info.c) allows remote attackers to inject arbitrary web script or HTML via long array variables. (CVE-2006-0996) A directory traversal vulnerability in file.c allows local users to bypass open_basedir restrictions and allows remote attackers to create files in arbitrary directories via the tempnam function. (CVE-2006-1494) The copy function in file.c allows local users to bypass safe mode and read arbitrary files via a source argument containing a compress.zlib:// URI. (CVE-2006-1608)
Alerts:	Red Hat RHSA-2006:0501-02 PHP 2006-05-23 Fedora FEDORA-2006-289 php 2006-05-16 Gentoo 200605-08 php 2006-05-08 SuSE SUSE-SA:2006:024 php4,php5 2006-05-05 Red Hat RHSA-2006:0276-01 PHP 2006-04-25 Mandriva MDKSA-2006:074 php 2006-04-24

Comments (none posted)

ruby1.8: denial of service

Package(s):	ruby1.8	CVE #(s):	CVE-2006-1931
Created:	April 24, 2006	Updated:	May 10, 2006
Description:	The HTTP/XMLRPC server in Ruby before 1.8.2 uses blocking sockets, which allows attackers to cause a denial of service (blocked connections) via a large amount of data.
Alerts:	Gentoo 200605-11 ruby 2006-05-10 Red Hat RHSA-2006:0427-01 ruby 2006-05-09 Mandriva MDKSA-2006:079 ruby 2006-04-25 Ubuntu USN-273-1 ruby1.8 2006-04-24

Comments (none posted)

xzgv: heap overflow

Package(s):	xzgv	CVE #(s):	CVE-2006-1060
Created:	April 21, 2006	Updated:	June 12, 2006
Description:	Andrea Barisani of Gentoo Linux discovered xzgv and zgv allocate insufficient memory when rendering images with more than 3 output components, such as images using the YCCK or CMYK colour space. When xzgv or zgv attempt to render the image, data from the image overruns a heap allocated buffer.
Alerts:	Gentoo 200604-10:02 zgv 2006-04-21 Debian DSA-1038-1 xzgv 2006-04-22 Debian DSA-1037-1 zgv 2006-04-21 Gentoo 200604-10 xzgv 2006-04-21

Comments (none posted)

Kernel release status

The current stable 2.6 kernel is 2.6.16.11, released on April 24. It is a single-patch release containing a fix for a CIFS filesystem vulnerability. 2.6.16.10, also released on the 24th, contained a larger set of important fixes.

The current 2.6 prepatch remains 2.6.17-rc2; there have been no -rc releases over the last week. Patches are accumulating in the mainline git repository, however; they are mostly fixes, but there is also trusted platform module (TPM) 1.2 support, multiple page size support for the PA-RISC architecture, and the vmsplice() system call (see below).

There have been no -mm tree releases over the last week.

Comments (1 posted)

The splice() weekly news

Jens Axboe sent around a note on the status of splice(). He notes that the splice() and tee() interfaces - on both the user and kernel side - should be stable now, with no further changes anticipated. The sendfile() system call has been reworked to use the splice() machinery, though that process will not be complete until after the 2.6.18 kernel cycle opens.

While splice() might be stable, things are still happening. In particular, Jens has added yet another system call:

    long vmsplice(int fd, void *buffer, size_t len, unsigned int flags);

While the regular splice() call will connect a pipe to a file, this call, instead, is designed to feed user-space memory directly into a pipe. So the memory range of len bytes starting at buffer will be pushed into the pipe represented by fd. The flags argument is not currently used.

Using vmsplice(), an application which generates data in a memory buffer can send that data on to its eventual destination in a zero-copy manner. With a suitably-sized buffer, the application can do easy double-buffering; half of the buffer can be under I/O with vmsplice() while the other half is being filled. If the buffer is big enough, the application need only call vmsplice() each time half of the buffer has been filled, and the rest will simply work with no need for multiple threads or complicated synchronization mechanisms.

Getting the buffer size right is important, however. If the buffer is at least twice as large as the maximum number of pages that the kernel will load into a pipe at an given time, a successful vmsplice() of half of the buffer can be safely interpreted by the application as meaning that the other half of the buffer is no longer under I/O. Since half of the buffer will completely fill the space available within a kernel pipe, that half can only be inserted when all other data has been consumed out of the pipe - in simple situations, anyway. So, after vmsplice() succeeds, the application can safely refill the second half with new data. If the application gets confused, however, it could find itself overwriting data which has not yet been consumed by the kernel.

Jens's patch adds a couple of fcntl() operations intended to help in this regard. The F_GETPSZ operation will return the maximum number of pages which can be inserted into a pipe buffer, which is also the maximum number of pages which can be under I/O from a vmsplice() operation. There is also F_SETPSZ for changing the maximum size, though that operation just returns EINVAL for now. Linus, however, worries that this information is not enough to know that a given page is no longer under I/O. In situations where there are other buffers in the kernel - perhaps just another pipe in series - the kernel could still have references to a page even after that page has been consumed out of the original pipe. Networking adds some challenges of its own: if a page has been vmsplice()ed to a TCP socket, it will not be reusable until the remote host has acknowledged the receipt of the data contained within that page. That acknowledgment will arrive long after the page has been consumed out of the pipe buffer.

What this all means is that the vmsplice() interface probably needs a bit more work. In particular, there may need to be yet another system call which will allow an application to know that the kernel is done with a specific page. The current vmsplice() implementation is also unable to connect an incoming pipe to user-space memory. Making the read side work is a rather more complicated affair, and may not happen anytime in the near future.

Comments (9 posted)

OpenVZ's live checkpointing

The OpenVZ project is a GPL-licensed subset of SWSoft's proprietary Virtuozzo offering. With OpenVZ, a Linux system can implement multiple "virtual environments", each of which appears, to the processes running within it, to be a separate, standalone system. Virtual environments can have their own IP addresses and be subjected to specific resource limits. They are, in other words, an implementation of the container concept, one of several for Linux. In recent times the various virtualization and container projects have shown a higher level of interest in getting at least some of their code merged into the mainline kernel, and OpenVZ is no exception. So the OpenVZ developers have been maintaining a higher profile on the kernel mailing lists.

The latest news from OpenVZ is this announcement of a new release with a major feature addition: live checkpointing and migration of virtual environments. An environment (being a container full of Linux processes) can be checkpointed to a file, allowing it to be restarted at some later time. But it is also possible to checkpoint a running virtual environment and move it to another system, with no interruption in service. This feature, clearly meant to be competitive with Xen's live migration capabilities, enables run-time load balancing across systems.

The OpenVZ patch, weighing at 2.2MB, is not for the faint of heart; it makes the price to be paid for these features quite clear. Much of what is contained within the patch has been discussed here before; for example, it contains the PID virtualization patches, and every bit of code within the kernel must be aware of whether it is working with "real" or "virtual" process IDs. A number of other kernel interfaces must be changed to support OpenVZ's virtualization features; among other things, many device drivers and filesystems require tweaks.

As might be expected, the checkpointing code is on the long and complicated side. The checkpoint process starts by putting the target process(es) on hold, in a manner similar to what the software suspend code does. Then it comes down to a long series of routines which serialize and write out every data structure and bit of memory associated with a virtual environment. The obvious things are saved: process memory, open files, etc. But the code must also save the full state of each TCP socket (including the backlog of sk_buff structures waiting to be processed), connection tracking information, signal handling status, SYSV IPC information, file descriptors obtained via Unix-domain sockets, asynchronous I/O operations, memory mappings, filesystem namespaces, data in tmpfs files, tty settings, file locks, epoll() file descriptors, accounting information, and more.

For each of the objects to be saved, an in-file version of the kernel data structure must be created. Each dump routine then serializes one or more data structures into the proper format for writing to the checkpoint file. It all apparently works, but it has the look of a highly brittle system - almost any change to the kernel's data structures seems guaranteed to break the checkpoint and restore code. Even if the checkpoint and restore code were merged into the mainline, getting kernel developers to understand (and care about) that code would be a challenge. Keeping it working must be be an ongoing hassle, whether or not the code is in the mainline tree.

None of the above should be interpreted to say that OpenVZ's features are not worth the cost. Virtual environments, checkpointing, and live migration are powerful and useful features. But the virtualization of everything within the kernel will lead to a higher level of internal complexity and higher maintenance costs. The decision process which draws the line determining which features are merged and which are not will be interesting to watch.

Comments (3 posted)

The AppArmor debate begins

Novell announced the release of the AppArmor security module last January. Then everything went quiet; in particular, no attempt was made to get the AppArmor code merged into the mainline kernel. The silence was broken last week, however, as a result of the discussion on the possible removal of the Linux security module (LSM) API. The submission of the AppArmor code has had the desired short-term effect: the discussion has moved away from removal of the LSM interface and toward the merits of AppArmor. The AppArmor developers may not see that shift as a blessing at the moment, however.

As expected, AppArmor has taken a fair amount of criticism. The largest complaint is the fact that AppArmor uses pathnames for its security policies. Using AppArmor, a system administrator can provide a list of files accessible by a given application; anything not on the list becomes inaccessible. Other things - such as capabilities - are also configurable, but there is no controversy over that aspect of the system. It is the use of path names which raises the red flags.

The sticking point is that a given file name is not the file itself. So, while /etc/shadow might identify the shadow password file, that name is not the shadow password file. If an attacker is able to create another name for that file (through the use of links or namespaces, perhaps), that other name could become a way for the attacker to access the shadow password file. So, even if AppArmor forbids access to /etc/shadow for a given application, that application might still have access to other pathnames which could be made to refer to the same file.

AppArmor thus differs from the SELinux approach, which attaches labels to objects and enforces access control rules based on the labels. With SELinux, the shadow password file has the same label (and, thus, the same access rules) regardless of the name by which it is accessed. So SELinux lacks a possible failure mode (rule bypass through different file names) that exists in AppArmor. Of course, as any SELinux administrator knows, maintaining file labels in a consistent and correct state poses challenges of its own.

The other problem with the AppArmor approach is that the LSM API is not well suited to pathname-based security policies. As a result, AppArmor must often go through a fair amount of (potentially expensive) pain to obtain the names corresponding to files. The impedance mismatch between AppArmor and LSM is not generally seen as a reason to keep AppArmor out of the kernel, but it has led to suggestions that the AppArmor developers should either extend LSM for pathname-based policies or just add their own patches and drop LSM altogether. If AppArmor gets past the other objections, some work will almost certainly have to be done in this area.

At this point, how any decision will be made on merging AppArmor is far from clear. It has not escaped notice that some of the strongest criticism of AppArmor is coming from the SELinux camp; SELinux developer Stephen Smalley has defended that criticism this way:

The proponents of AppArmor claim that the approach is sound. Unlike SELinux, AppArmor does not attempt to be the ultimate security solution for all situations. Instead, it simply puts a lid on applications which might be compromised by an attacker. AppArmor raises the bar by limiting what a broken application might do; it does not attempt to regulate the interactions between every application and every object in the system. This approach is, it is claimed, enough to significantly raise the security of a system while maintaining an administrative interface which is accessible to mere mortals. And, for AppArmor's goals, a pathname-based access control mechanism is said to be good enough. It will probably be some time before we will see whether the kernel development community agrees with that claim.

(See also: this detailed criticism of pathname-based access control by Joshua Brindle).

Comments (29 posted)

The future of Kubuntu

Mark Shuttleworth has issued an invitation for the Kubuntu and KDE community to meet at LinuxTag in Wiesbaden, Germany on May 6, 2006.

During its relatively short existence Kubuntu has been perceived as a second class citizen, never getting quite as much attention or polish as its GNOME counterpart. This meeting will, hopefully, be the beginning of a real change in that status.

There are some lofty goals for this meeting. Developing a partnership with the KDE project. Nominating a Kubuntu leadership team and forming additional teams to work on artwork, documentation, quality assurance, translation, marketing and distribution.

Eventually, if Kubuntu seems sufficiently popular, we may have Kubuntu releases timed with KDE releases, just as Ubuntu releases are currently timed with GNOME releases.

Mark doesn't say so, but it sounds like there could be Canonical employment for a KDE hacker, or two.

Comments (2 posted)

Ubuntu 6.06 LTS beta released

The beta release of the distribution now known as "Ubuntu 6.06 LTS" is available. "LTS" stands for "long-term support," and, presumably, sounds more professional than "Dapper Drake." Among other things, this release includes a "desktop CD" which can be used in both live and install modes.

Update: The 6.06 LTS beta is available for Kubuntu and Edubuntu, with additional 6.06 beta versions for Xubuntu and as ports for UltraSparc, IA64 and HPPA (1.1 and later) CPUs.

Full Story (comments: 1)

SUSE Linux 10.1 RC2 Release

SUSE Linux 10.1 RC2 has been released (click below for the announcement). According to this schedule update RC3 should be out soon.

Full Story (comments: none)

Owl for x86-64; Owl 2.0-stable

Openwall GNU/Linux (Owl) has made several announcements. First Owl has been ported to the x86-64 architecture (also known as AMD64 and Intel EM64T). The Owl 2.0-stable branch is now available under /pub/Owl/2.0-stable on the FTP mirrors. John the Ripper 1.7.0.2 has been released. Click below for details on these and other announcements.

Full Story (comments: none)

Eagle Linux Releases v2.3.0

Eagle Linux is an educational, distributed as a how-to manual that walks the user through the steps necessary to create a customized live CD distribution. It is also available as an ISO image. Click below for the 2.3 release announcement.

Full Story (comments: none)

Debian From Scratch 0.99.0

Debian From Scratch (DFS) is a single, full rescue CD capable of working with all major filesystems, LVM and software RAID. It also supports compiling a new kernel. The DFS ISO images contain a small Debian mirror subset that lets you use cdebootstrap, along with the other utilities on the CD, to perform a manual, "Gentoo-like" installation. Click below for the 0.99.0 release announcement.

Full Story (comments: none)

Distro Quickies: Tomahawk, QiLinux, Arabian and Kubuntu (KDE.News)

KDE.News takes a quick look at some recent releases from KDE-centric distributions. ""Tomahawk Desktop is an advanced multimedia centric KDE desktop". *** QiLinux 2.0rc1 free edition was released with KDE 3.5.2, "QiLinux is a KDE-centric distribution for desktop and server made completely from scratch". *** Arabian Linux has released version 0.6, "It's the first Arabic live distribution using KDE as the default GUI and the first to have the Arabic language enabled in consoles". *** Finally Kubuntu 6.06 LTS Beta was announced with the promise of Long Term Support."

Comments (none posted)

Bits from the DPL

Newly elected Debian Project Leader Anthony Towns has sent out his first "bits from the DPL" posting. Among other things, he is creating a "second-in-charge" position to which some of the project leader's responsibilities will be delegated.

Full Story (comments: none)

Fedora Project Board meeting summary

A summary of the recent Fedora board meeting has been posted. You can find general information about the board here. Meeting schedules and summaries can be found here.

Full Story (comments: none)

Gentoo QA Proposal v3

Mark Loeser has made a proposal for a Gentoo quality assurance team, now in the third version. This team would be responsible for the overall quality of the distribution which could include removing unmaintained and broken packages, fixing typos, keeping documentation up-to-date and maintaining a list of current "QA Standards". Click below for a text version of the proposal, which has now been converted to GLEP (Gentoo Linux Enhancement Proposal) format here.

Full Story (comments: none)

Linspire announces the 'Freespire' edition

Linspire, Inc. has announced plans for a no-cost version of their operating system called Freespire. "Freespire is venturing into new territory by offering a free community Linux operating system that includes the option for legally licensed proprietary software pieces in the core distribution. The Freespire community project and Web site are now live at http://www.freespire.org, with the first beta release of the operating system to be made available for download in August."

Comments (49 posted)

Ubuntu to Participate in Google Summer of Code

Ubuntu is once again participating in the Google Summer of Code, and plans to make as many projects as possible available for students to work on. "It is a great opportunity to expose new students to the wonderful world of Ubuntu, get some exciting projects off the ground and get good exposure for the projects, students and organisations alike."

Full Story (comments: none)

Debian Weekly News

The Debian Weekly News for April 25, 2006 looks at the Debian Live Initiative, a how-to on using Alioth for packaging, Google Summer of Code 2006, an upgrade conflict, proper closing of old, resolved bug reports, removing Mozilla, and several other topics.

Full Story (comments: none)

Fedora Weekly News Issue 43

The Fedora Weekly News for April 24, 2006 covers Red Hat Magazine | April 2006, Fedora Project Board meeting summary, Fedora Sponsored Media Program, Fedora Core 5 CD/DVD Art, FISL: See you next year!, and more.

Comments (none posted)

Gentoo Weekly Newsletter

The Gentoo Weekly Newsletter for the week of April 24, 2006 covers OpenLDAP 2.3 on its way into Portage, call for comments on new subforums and several other topics.

Comments (none posted)

Mandriva Community Newsletter #119

Here's the latest Mandriva Community Newsletter. Topics include Mandriva Kiosk Lite in beta testing for Club members, Linux training through Mandriva Club, Mandriva to take part in major European IT management project, and more.

Full Story (comments: none)

DistroWatch Weekly, Issue 148

The DistroWatch Weekly for April 24, 2006 is out. "A flurry of distribution releases and related announcements were the highlights of the past week. The Ubuntu project has released the complete set of betas of all their derivatives, including the newly added Xubuntu, and also made an initial announcement concerning the development of Edgy Eft, the code name of its next release. Similarly, the Fedora project has announced an estimated release schedule for the development of Fedora Core 6. Also in this issue: updates on the status of Mandriva's Cooker repository, new minor release by Linspire, a comparison of journalled files system on Debian, and an interesting interview with the lead developer of Elive. In the First Look series we share our first impressions of CCux Linux 0.9.8. Finally, a little statistical titbit: with the recent addition of Xubuntu, the DistroWatch database now contains exactly 500 distributions."

Comments (none posted)

Fedora updates

Updates for Fedora Core 5: gnome-pilot (bug fix), tzdata (upstream 2006d), procps (bug fixes), procinfo (bug fix), gnome-user-share (patched), cscope (inverted overflow fix), foomatic (preparing for CUPS 1.2), gimp (bug fixes), gimp-help (update to version 2-0.10), autofs (bug fixes), anthy (new upstream release), setools (bump for FC5), rhythmbox (update to 0.9.4), gnome-menus (update to 2.14.0), file-roller (update to 2.14.2), gnome-utils (bug fixes), selinux-policy (bump for FC5), nut (update to 2.0.3).

Updates for Fedora Core 4: gnome-pilot (bug fix), qt (bug fix), tzdata (upstream 2006d), jwhois (update to 3.2.3), gimp (bug fixes), system-config-date (use pam system-auth), gimp-help (update to version 2-0.10), autofs (bug fixes), nut (bug fixes).

Comments (none posted)

Slackware updates

Slackware changes for this week include upgrades to slocate, udev, mysql, guile (which may be removed soon), several alsa packages, ImageMagick, mozilla (which probably won't be included in the next release) and more. Plus linux-2.6.16.9 kernel packages in testing and some hotplug patching. Click below for details.

Full Story (comments: none)

Trustix updates

Trustix has issued a bug fix advisory covering various bug fixes in jwhois, mrtg, perl-dbd-mysql and perl-dbd-pg for TSL 2.2 & 3.0.

Full Story (comments: none)

SUSE 10.1 "really cool and solid" (DesktopLinux)

Steven J. Vaughan-Nichols looks at SUSE 10.1 RC1. "This is one really, really cool and solid distribution. OK, before I go any further I should point out that SUSE 10.1 (code name: Agama Lizard) isn't actually released yet. I've been kicking the tires of the first SUSE 10.1 "Release Candidate.""

Comments (none posted)

Using OpenBSD on the desktop (NewsForge)

NewsForge looks at OpenBSD on the desktop. "Over the years, OpenBSD has built a reputation for integrated security and reliability, but most people think of it as an operating system suitable only for firewalls and servers. The truth is that OpenBSD also works well as a desktop system; in fact, I use it on an IBM ThinkPad R50e notebook as my main system."

Comments (none posted)

My desktop OS: FreeBSD 6.0-STABLE (NewsForge)

NewsForge looks at FreeBSD on the desktop. "I recently installed FreeBSD 6 on a new notebook computer. The installation went quickly; I got a terminal screen in less than 40 minutes. The only packages I wanted from the installation disk were Lynx, a Web browser, and cvsup-without-gui, a tool with which you can upgrade your sources from a FreeBSD mirror. With only the base system at its disposal, FreeBSD can give you a hands-on experience from hour zero: it has a compiler (gcc), a download utility (fetch), an editor (vi), and a bunch of other tools (OpenSSH, SendMail, Revision Control System) that can help or entertain you during the rest of the installation."

Comments (none posted)

Voice over IP with Ekiga

Vox Libertas

Voice over IP (VoIP) telephony has seen an enormous boom recently. Saving costs by routing calls via the Internet or by using software-based solutions instead of expensive hardware has been the driving factor for the adoption of VoIP. Ekiga, the application formerly known as GnomeMeeting, is the free software community's answer to these needs. In contrast to GnomeMeeting, Ekiga supports the Session Initiation Protocol (SIP) as well as H.323. Ekiga can also handle multiple H.323 and SIP accounts at the same time.

There are several different protocols in the VoIP arena. The oldest is H.323, which was developed by the International Telecommunication Union (ITU). The protocol isn't especially firewall-friendly due to the use of multiple dynamically-chosen port numbers. SIP is slightly better in this respect and it is used in many hardware VoIP phones. Another interesting protocol is IAX2, developed by the Asterisk project, since it communicates only over a single UDP port. However, very few clients support it. Also worth mentioning is the proprietary Skype protocol, which has some serious security implications, according to what researchers presented (PDF) at the Black Hat Europe 2006 conference. Skype clients can be abused for the purpose of port scanning, distributed Denial of Service (dDoS) attacks and other unpleasant things.

To circumvent the problems faced when dealing with Network Address Translation (NAT), a Simple Traversal of UDP over NATs (STUN) server can be used. However, this won't work in a properly firewalled environment. In this case, you usually end up with running a separate H.323 or SIP proxy.

Since the first release of Ekiga came out only a few weeks ago, very few GNU/Linux distributions include binary packages. However, the project itself offers packages for every major Linux distribution. If you decide to use one of them, make sure that you have installed the latest libraries needed by Ekiga, or you will run into trouble.

When Ekiga is launched for the first time, it asks the user a few questions and then shows the main window. From there, you can make outgoing calls or specify how to react to incoming calls. Ekiga supports the transferring of calls immediately, or after a certain delay.

The default behavior is to display a pop-up window when an incoming call is received. Unfortunately, the window is active immediately, meaning you can erroneously accept or reject a call depending on what you are typing or where you are clicking when the call comes in. Clearly, this is an area of the code that needs some attention.

Ekiga supports both audio and video communication. Setting up video devices is trivially easy if the device is supported by the Video4Linux drivers. Participation in conferences is possible, but requires an additional Multipoint Control Unit (MCU). MCUs are available as hardware or software, the OpenH323 project offers a free implementation called OpenMCU.

Even though extensions to H.323 and SIP allow encryption of calls, Ekiga currently does not support that feature. Ekiga does include a text chat function.

In contrast to many other VoIP suites, Ekiga can register with several different SIP registrars and H.323 gatekeepers at the same time. These services provide a mapping from SIP and H.323 URLs (the equivalent of a phone number) to the IP address of a particular user. To find out someone's SIP or H.323 URL, Ekiga can ask LDAP and ILS servers.

In summary, Ekiga should serve all your VoIP needs. And with the widespread adoption of VoIP, you can expect it to become even better over time.

Comments (5 posted)

Release 2.0.5 of Linux-HA is available

Release 2.0.5 of Linux-HA, a cluster management application, is out with a long list of enhancements. "2.0.5 has significant bug fixes and enhancements making it a worthwhile upgrade for anyone running R2 CRM-style configurations, or who want to. I just tried the 2.0.5 GUI, and it's really cool. You can definitely put it through its paces with the GUI."

Full Story (comments: none)

MySQL 5.0.20a has been released

Version 5.0.20a of the MySQL database is out. "This is a bugfix release for the current production release family. It replaces 5.0.20, published last week. For the benefit of all those who did not download and install, I repeat the 5.0.20 news in this announcement, while mentioning the differences between 5.0.20 and 5.0.20a in a separate paragraph."

Full Story (comments: none)

PostgreSQL Weekly News

The April 24, 2006 edition of the PostgreSQL Weekly News is online with the latest PostgreSQL database articles and resources.

Full Story (comments: none)

Database Connection Pooling with Tomcat (O'ReillyNet)

Kunal Jaggi discusses Database Connection Pooling with Tomcat on O'Reilly. "You know how to open and use database connections for each user, but what about optimizing for many concurrent users? Rather than creating and destroying connections over and over again, established practice calls for use of a pool of connections that can be reused. Kunal Jaggi shows how to implement this strategy in Tomcat."

Comments (none posted)

Samba 3.0.23pre1 Available for Download

Version 3.0.23pre1 of Samba has been announced. "This is a preview release of the Samba 3.0.23 code base and is provided for testing only. This release is *not* intended for production servers. There has been a substantial amount of development since the 3.0.21 series of stable releases. We would like to ask the Samba community for help in testing these changes as we work towards the next significant production upgrade Samba 3.0 release. There has been a substantial amount of cleanup work done during this development cycle. Two weeks of development time was dedicated to fixing bugs reported by the Coverity source code scans."

Full Story (comments: none)

PowerDNS Recursor 3.0 released

Version 3.0 of PowerDNS Recursor, an internet name server, has been announced. "We consider this version of the PowerDNS recursor to be the most advanced resolver publicly available. Given current levels of spam, phishing and other forms of internet crime we think no recursor should offer less than the best in spoofing protection. We urge all operators of resolvers without proper spoofing countermeasures to consider PowerDNS, as it is a Better Internet Nameserver Daemon. As mentioned previously, the new recursor is at least 64000 times harder to spoof than previous releases."

Comments (none posted)

CUPS 1.2rc3 is available

Version 1.2 rc 3 of the CUPS printing system has been announced, it includes many bug fixes and more. "The third release candidate of CUPS 1.2 is now available for download from the CUPS web site. We are also providing binary packages for Red Hat Enterprise Linux 4 (32-bit + 64-bit Intel), Fedora Core 4 (32-bit Intel), and MacOS X 10.4 (32-bit PowerPC + Intel) for your convenience."

Comments (none posted)

ESP Ghostscript 8.15.2 is out

ESP Ghostscript version 8.15.2 has been announced. "ESP Ghostscript 8.15.2 is the second stable release based on GPL Ghostscript 8.15 which adds enhanced CUPS raster support for CUPS 1.2, improves the Open Printing Vector API driver, updates the CID font support files, and fixes several bugs that were reported against 8.15.1."

Comments (none posted)

Sussen 0.19 released

Version 0.19 of Sussen, a vulnerability checker, is out. "This release is mostly bugfixes to the OVAL interpreter."

Full Story (comments: none)

Midgard 1.7.5 released

Version 1.7.5 of the Midgard content management framework is available. "Midgard's 1.7 branch is a major overhaul of the whole Content Management System. Besides the stable and mature Content Management features of first generation Midgard, it also ships a preview version of second generation Midgard capabilities, allowing developers to have a glimpse at the new day of Midgard2. 1.7.5 is maintenance and bugfix release."

Full Story (comments: none)

Putting REST on Rails (O'Reilly)

Dan Kubb introduces RESTful Rails in an O'Reilly article. "This article introduces a very simple application that uses the RESTful Rails plugin. It will provide an introduction to dispatching to different handlers based on the HTTP method used in a request. If you plan on following along you should already have the latest version of Rails installed (1.1.1 at the time of writing), along with a database of your choice."

Comments (none posted)

New Fluendo mp3 decoder and mpegdemuxer releases

New releases of the Fluendo mp3 decoder and mpeg demuxer have been announced. "We have released version 0.10.2 of the Fluendo mp3 sourcecode and version 0.10.4 of the Fluendo mpegdemuxer sourcecode. Both releases are minor bugfix releases with various small fixes, check the ChangLog for details."

Full Story (comments: none)

jackEQ-0.4.1 released

Version 0.4.1 of jackEQ is out with a djEQ plugin bug fix. "jackEQ is a tool for routing and manipulating audio from/to multiple input/output sources. It runs in the JACK Audio Connection Kit, and uses LADSPA for its backend DSP work, specifically the DJ EQ swh plugin created by Steve Harris, one of jackEQ's main authors. jackEQ is intended to provide an accessible method for tweaking the treble, mid and bass of any JACK aware applications output."

Full Story (comments: none)

soniK 1.0 beta 2 announced

Version 1.0 beta 2 of soniK, an audio editor for the KDE environment, is out with a number of bug fixes. Testers are needed.

Full Story (comments: none)

PyScript 0.6 announced

Version 0.6 of PyScript, a Python module that generates PostScript graphics, is out. According to the change log: "The major change in this release has been the complete rewrite of the Talk and Poster classes inside the presentation library. Associated with this are the usual bug fixes, documentation additions and minor other changes."

Comments (none posted)

Dropline GNOME 2.14.1 is out (GnomeDesktop)

Dropline GNOME version 2.14.1 has been announced. "After many hours of work getting the bugs out, 2.14.1 is finally available for download. We’ve really outdone ourselves this time, with a lot of new art from Silvestre Herrera (aka ertz) including the awesome new Yasis icon theme, along with the latest versions of all of the included applications, and a few our users suggested be included in this release."

Comments (none posted)

GNOME Software Announcements

The following new GNOME software has been announced this week:

• Alacarte 0.9 (new features and other improvements)
• Beagle 0.2.5 (bug fixes)
• cairo snapshot 1.1.2 (new features and bug fixes)
• Dia 0.95 (new features and bug fixes)
• Evolution 2.7.1 and related (new features)
• Eye of GNOME 2.15.1 (new features, bug fixes and translation work)
• gcalctool 5.8.8 (bug fixes)
• gcalctool 5.8.9 (minor improvements)
• GDM2 2.14.3 (bug fixes and translation work)
• GDM2 2.14.4 (translation work)
• glade-3 2.91.1 (new features, bug fixes and translation work)
• gnome-games 2.15.1 (new features and bug fixes)
• gnome-games-extra-data 2.14.0 (new themes)
• gnome-icon-theme 2.15.1 (Conforms to new Icon Naming Spec)
• GNOME Power Manager 2.15.1 (new features, bug fixes, translation and documentation work)
• GNOME Power Manager 2.14.2 (bug fixes)
• GnomePython 2.15.1 (unstable testing release)
• GnomePythonDesktop 2.15.1 (unstable testing release)
• gnome-themes 2.15.1 (new features)
• Gnome-utils 2.15.0 (new features, bug fixes and translation work)
• Gotmail 0.8.9 (bug fixes)
• kiwi 1.9.8 (new features and bug fixes)
• Metacity 2.15.0 (new features, bug fixes and translation work)
• Metacity 2.15.1 (bug fix)
• Metacity 2.15.2 (bug fix)
• Orca 0.2.3 (new features and bug fixes)
• Pango 1.13.0 (unstable development release)
• vte 0.13.0 (unstable bug fix release)
• Yelp 2.15.1 (bug fixes and translation work)
• Zenity 2.15.1 (new features, bug fixes and translation work)

You can find more new GNOME software releases at gnomefiles.org.

Comments (none posted)

The GNOME Journal, April Edition (GnomeDesktop)

GnomeDesktop.org has announced a new edition of the GNOME Journal. "It features insights into the Portland Project which were gained from a conversation with one of its lead architects, Waldo Bastian, an introduction to GNOME's new deskbar, an interview with Elijah Newren, GNOME's release manager, and three simple tips for designing application interfaces you should know. Writers in this edition are Sri Ramakrishna, Davyd Madeley, Lucas Rocha, and Claus Schwarm, respectively."

Comments (none posted)

KDE Software Announcements

The following new KDE software has been announced this week:

• 2mobile 0.1a (initial release)
• kdesvn 0.8.2 (new features, bug fixes and translation work)
• KGuitarTMP 0.0.6 (new features and bug fixes)
• KlamAV 0.37 (bug fixes and translation work)
• KMPlayer 0.9.2 (new features and bug fixes)
• KPowersave 0.6.0 (stable release)
• ktexteditor-yankbuffer 0.2 (unspecified)
• KTouch 1.6.0 (unspecified)
• peagle 0.1.0 (early development release)
• peagle 0.2.0 (new features)
• Remote Kommander 0.1a (initial release)
• Tellico 1.1.5 (new features, bug fixes and translation work)

You can find more new KDE software releases at kde-apps.org.

Comments (none posted)

KDE 3: All About the Apps - Part 2 (KDE.News)

KDE.News is running part two in a series on KDE 3.5. "Two weeks ago, you read about several apps which keep KDE 3.5 alive. Today's issue of the mini-series provides even more reasons to love KDE. Covered applications include Krita, the image and painting application, Guidance, a configuration tool, frontends to Beagle and finally Scribus, the Qt-based DTP application."

Comments (1 posted)

KDE Commit-Digest for 23rd April 2006 (KDE.News)

KDE.News has announced a new version of the KDE Commit-Digest. "In this week's KDE Commit-Digest: KDE 4 porting continues at great pace, with more applications able to be compiled with CMake daily. Portability fixes for non-X11 platforms. KDiskManager, a KDE 4 application for disk management -- based on Solid -- is imported into KDE SVN."

Comments (none posted)

Kicad 2006-04-24 released

Version 2006-04-24 of Kicad, an electronic schematic/printed circuit board CAD system, is out with bug fixes, the ability to select a PDF browser, and more.

Comments (none posted)

pcb 20060422 snapshot announced

Snapshot 20060422 of PCB, a printed circuit CAD application, has been announced. "I've made a new snapshot of pcb. I made this one so quickly after the previous partly because of the continued outage of the anonymous CVS server which has prevented interested users from tracking CVS sources. Also this snapshot fixes a couple of big bugs (load layout menu didn't do anything)."

Comments (none posted)

Atlas-C++ 0.6.0 released

Version 0.6.0 of Atlas-C++ has been announced, it features RPM spec file improvements and other minor changes. "Atlas-C++ is the standard implementation of the WorldForge Atlas protocol. This release is functionaly identical to the second release candidate for 0.6.0 and is the first release in the new 0.6 series. This release is primarilly aimed at developers and users who want to build the WorldForge system for themselves."

Comments (none posted)

Security and Stability Updates for Thunderbird Released (MozillaZine)

MozillaZine reports that Thunderbird 1.5.0.2 and Thunderbird 1.0.8 have been released. These updates contain several security and stability fixes.

Comments (none posted)

MirrorMed Subverted (LinuxMedNews)

LinuxMedNews reports that MirrorMed, an open-source Electronic Health Record and practice management system written in PHP, is being managed with subversion. "MirrorMed development can be now tracked via subversion at the MirrorMed subversion repository at sourceforge. Further MirrorMed is now the first project that has a published guide to becoming a MirrorMed Developer. Watch the forums for dicsussion about how best to use subversion."

Comments (none posted)

Democracy Player for Linux

The first Linux release of Democracy Player is available. "Democracy Player is a cross-platform video rss downloader and viewer. It is free, open-source software developed by the Participatory Culture Foundation, a 501c3 non-profit organization."

Full Story (comments: none)

SeaMonkey 1.0.1 Released (MozillaZine)

MozillaZine reports on the SeaMonkey 1.0.1 release, which fixes multiple security issues and several critical bugs. See the release notes for more information.

Comments (none posted)

HyperMammut project announced

Paul N. has announced the initial release of HyperMammut. "I released today an experimental software that allows you to process the sound/image as a single FFT (and other) transforms. Also, the program can transform sound to images and vice-versa. Because of this, you can apply a blurring or swirling effect to sound, or revereberation/flange effect to images ;-) Many effects sounds/looks very strange (in my opinion theese are the strangest sounds I ever heard - hard to describe in words - better listen them)."

Full Story (comments: none)

Caml Weekly News

The April 18-25, 2006 edition of the Caml Weekly News is out with new Caml language articles.

Full Story (comments: none)

Dr. Dobb's Python-URL!

The April 24, 2006 edition of Dr. Dobb's Python-URL! is online with a new collection of Python article links.

Full Story (comments: none)

Dr. Dobb's Tcl-URL!

The April 24, 2006 edition of Dr. Dobb's Tcl-URL! is online with new Tcl/Tk articles and resources.

Full Story (comments: none)

SDCC migrated from CVS to Subversion

The SDCC cross compiler has been migrated to the Subversion version control system. "SDCC is a Freeware, retargettable, optimizing ANSI - C compiler that targets the Intel 8051, Maxim 80DS390 and the Zilog Z80 based MCUs. Work is in progress on supporting the Motorola 68HC08 as well as Microchip PIC16 and PIC18 series. The entire source code for the compiler is distributed under GPL."

Comments (none posted)

Linux team tells VMware and Xen to get their acts together (Register)

Here's an article in The Register about the process of getting virtualization technology into the Linux kernel. "Xen, by contrast, wants to make the most of its open source ties and create the tightest possible bonds with Linux. Behind closed doors, some Xen backers say that Sun, Microsoft and Novell will refuse to support VMI. Such political manoeuvering shows how seriously Xen backers take this debate."

Comments (7 posted)

Congress readies broad new digital copyright bill (News.com)

Here's a News.com report on the latest attempt to expand copyright law in the U.S. "Jessica Litman, who teaches copyright law at Wayne State University, views the DMCA expansion as more than just a minor change. 'If Sony had decided to stand on its rights and either McAfee or Norton Antivirus had tried to remove the rootkit from my hard drive, we'd all be violating this expanded definition,' Litman said." The law would also bring civil forfeiture to copyright enforcement.

Comments (7 posted)

Day one at the Desktop Linux Summit (NewsForge)

Joe Barr reports on the Desktop Linux Summit. "The Desktop Linux Summit (DLS) 2006 kicked off yesterday in the Manchester Grand Hyatt in downtown San Diego. The summit, now in its fourth year, was created by Linspire, but it has outgrown its uni-distro roots, with sponsors and speakers coming from competing Linux vendors such as Mandriva, Novell, Red Hat, and Ubuntu. An opening day crowd of more than 600 attendees heard a range of speakers reflecting that diversity."

Comments (none posted)

Beyond Plug & Play (Linux Journal)

Doc Searls writes about his talk at the Desktop Linux Summit. "When I gave the organizers that title [Plug & Pray], I was still laboring under the assumption that Linux was still a little bit behind in the desktop area. Since then I have been assured by Kernel Hackers of the First Water that this is not so -- that in fact this assumption belongs among the collection of myths and lies about Linux (which Greg Kroah-Hartman will detail at the July 2006 Linux Symposium in Ottowa)."

Comments (none posted)

MySQL CEO offers mixed view of Oracle (ZDNet)

ZDNet covers a talk by Martin Mickos at the MySQL Users Conference, with an emphasis on his comments about Oracle. " The InnoDB 'storage engine,' which remains open-source software, is firmly in Mickos' plus column. 'We renewed our contract with Oracle for several years,' he said. In the minus column are the no-cost database products such as Oracle's Express Edition or IBM's DB2 Community Edition, which Mickos labeled as 'crippleware,' designed to hook customers on full-featured but expensive versions."

Comments (4 posted)

Group plots Desktop Linux printing improvements (DesktopLinux.com)

DesktopLinux.com covers the recent Desktop Linux Printing Summit. "The meeting was attended by about 40 developers from printer vendors, such as Hewlett-Packard, Lanier, and Lexmark; to operating system distributors like Apple Computer, Debian, and Novell; to those two Linux desktop powers, GNOME and KDE; and more. Their job? To nail down exactly what's wrong with printing and Linux, and to work out ways to resolve these problems once and for all." See Kurt Pfeifle's report on LWN for more information.

Comments (none posted)

Scott McNealy steps down as Sun CEO (Mercury News)

Mercury News covers a change in Sun leadership. "Sun Microsystems announced Monday that its longtime chief executive Scott McNealy is stepping down from the helm and will be succeeded by the struggling computer and software company's No. 2 executive, Jonathan Scwhartz." (Thanks to Biju Chacko)

Comments (25 posted)

Software's 'stack wars' (ZDNet)

ZDNet considers the latest corporate buzz, providing "stacks" of software that include the operating system, middleware and user applications. "Just this week, Oracle CEO Larry Ellison told the Financial Times that he would "like to have a complete stack." Oracle makes billions of dollars selling databases and business applications. In recent years, the company has bought up many other companies, including rivals like PeopleSoft and Siebel Systems. "We're missing an operating system. You could argue that it makes a lot of sense for us to look at distributing and supporting Linux," Ellison told the newspaper."

Comments (8 posted)

Linux in China to grow five-fold (iTWire)

iTWire reports on the expected expansion of the Chinese Linux market. "According to technology research group IDC's latest research, China Linux 2006-2010 Forecast and Analysis, China's Linux market revenue reached just $11.8 million in 2005, up 27.1% over 2004. However, 2005 saw a steady growth in the China Linux market, brought about mainly by the huge volume of government procurements and large-scale SCO Unix replacement by major banks and industrial projects such as Telecommunication and Internet cafes. Along with the growing acceptance of Linux in the China market, IDC also noted that Linux servers were adopted for high-end, mission critical support applications in some industries and Linux desktops were able to withstand the competition of pirated Windows to hold its market share."

Comments (none posted)

Italian provinces seek international FOSS partners (NewsForge)

NewsForge covers Free Software in Rome and throughout Italy. "The plan of the province of Rome is ambitious. Time will tell how much of it will be implemented and become the norm in all of Italy. However, digital innovation has already proved to be a successful factor of local development, which, just like FLOSS, starts small but eventually arrives inside national administrations. Again like FLOSS, direct cooperation among among cities, even of different countries, can lead to far-reaching, unexpected results."

Comments (none posted)

People Behind KDE: Frans Englich (KDE.News)

KDE.News introduces this People Behind KDE interview with Frans Englich. "In what ways do you make a contribution to KDE? As with most other KDE developers I do a little bit of each. I try to help the KDE-artists with technical issues, have been involved with Free Desktop's icon naming spec (seconded by the Tango project), and written parts of kdelibs' KUtils library, for example. Occasionally, I stir the water with an article or two."

Comments (none posted)

Canonical's Jane Silber says upcoming Ubuntu Linux to be enterprise-ready (ComputerWorld)

ComputerWorld talks with Jane Silber, chief operating officer at Canonical. "Our mantra throughout this development cycle was 'rigid and boring.' Someone would say, 'This feature is really shiny and cool; let's put it in,' and I'd say, 'Nope, we need to be rigid and boring.'"

Comments (3 posted)

Danger: Authenticating e-mail can break it (ZDNet)

ZDNet looks at the ups and downs of authenticating email systems. "There are two main ways of authenticating e-mail: Sender ID and DomainKeys Identified Mail, or DKIM. Backed by Yahoo and Cisco Systems, DKIM relies on public key cryptography. It attaches a digital signature to outgoing e-mail, so recipients can verify that the message comes from its claimed source. Sender ID is further along in adoption than DKIM. It requires Internet service providers, companies and other Internet domain holders to publish SPF (Sender Policy Framework) records to identify their mail servers. This usually does not require new hardware or software; the most arduous part is doing an inventory of mail servers and the subsequent maintenance of that record."

Comments (4 posted)

Test It Out: Early Access Book Programs (Linux Journal)

Linux Journal takes a look at some beta book programs. "I've been working with technical books for quite a while now, as a reader, a reviewer and an author. I've also been working with Linux and other free software for a long time. Often, I've wondered how publishers could take advantage of the testing that software receives as it goes through alpha and beta cycles. Recently, several publishers have begun to take advantage of that testing cycle for their books. Here, I take a look at how they're doing. I'm not involved in any of these books, so what follows is completely an outsider's view."

Comments (2 posted)

Network your music with DAAP for Linux (Linux.com)

Linux.com looks at Linux digital audio access protocol (DAAP) implementations. "The more music you have, and the more computers you use, the bigger the hassle it becomes to try to synchronize everything. Without a simple sharing solution like DAAP, the easiest way to manage a centralized music collection for multiple PCs is keep all the files together on a central server, shared through Samba or NFS. DAAP accomplishes the same goal with far less administrative overhead, and provides interesting features like smart playlists at no extra cost."

Comments (1 posted)

Filesystems (ext3, reiser, xfs, jfs) comparison on Debian Etch (Debian Administration)

Debian Administration has a comparison of filesystems running on Debian Etch. "There are a lot of Linux filesystems comparisons available but most of them are anecdotal, based on artificial tasks or completed under older kernels. This benchmark essay is based on 11 real-world tasks appropriate for a file server with older generation hardware (Pentium II/III, EIDE hard-drive)."

Comments (77 posted)

How to configure a low-cost load-balanced LAMP cluster (Linux.com)

Linux.com has a howto article on setting up a load-balanced LAMP cluster. "The ubiquitous Linux, Apache, MySQL, and PHP/Perl/Python (LAMP) combination powers many interactive Web sites and projects. It's not at all unusual for demand to exceed the capacity of a single LAMP-powered server over time. You can take load off by moving your database to a second server, but when demand exceeds a two-server solution, it's time to think cluster."

Comments (none posted)

Linux System Administration: First Tasks (Linux Journal)

Linux Journal looks at Linux system administration in different environments. "Regardless of your environment, you will find that some tasks are common to all system administration functions. For example, monitoring system services and starting and stopping them takes on a role of its own. Your Linux box might appear to be running smoothly while one or more processes have stopped. A Linux server might seem happy on the outside, for example, while the database serving Web pages has failed."

Comments (none posted)

Running .Net applications on Linux with Mono (Linux.com)

Linux.com looks at running .Net applications on Linux using Mono. "With Mono, Monodevelop, and XSP in place, you can throw away Microsoft Visual Studio and you can throw away Windows, and you don't have to throw away the valued experience of your .Net programmers."

Comments (5 posted)

My sysadmin toolbox (Linux.com)

Linux.com presents another edition of the toolbox with a focus on networking tools. "Tripwire is a great tool for checking to see whether files have been created, deleted, or modified. Tripwire stores a snapshot of your files in its database, and you can compare your files against the snapshot to discover any changes that might indicate a compromise. Tripwire's main feature is file integrity checking, and it's capable of checking VFAT filesystems and verifying installed RPMs."

Comments (6 posted)

Optimizing DSPAM + MySQL 4.1 (HowtoForge)

HowtoForge shows how to optimize mail setups that use DSPAM and MySQL 4.1. "DSPAM is a scalable and open-source content-based spam filter designed for multi-user enterprise systems. It's great at filtering out spam but on busy mailservers the pruning of the MySQL databases takes way too long time ... The default purge-4.1.sql script provided with DSPAM can be heavily optimized by adding indexes to the database and using the indexes properly when pruning."

Comments (none posted)

Use Thunderbird like a pro (NewsForge)

Dmitri Popov explains some Thunderbird mail client tricks in a NewsForge article. "Even if you use Thunderbird on a daily basis, you probably don't know it inside out. There are still quite a few 'hidden' features not covered in the online help that can significantly improve your emailing habits. And since Thunderbird's functionality can be expanded via extensions, you can add some clever features to it too."

Comments (21 posted)

LSB 3.1 unifies Linux desktop standards (Linux-Watch)

Linux-Watch looks at the upcoming Linux Standard Base 3.1 release with desktop application support. "The first LSB 3.1 certified desktop distribution is expected to come from Xandros, on May 1st. Other major Linux distributors such as Red Hat, Novell, Ubuntu, the DCC Alliance members, and others also plan to certify their versions of Linux to LSB 3.1, [Free Standards Group] added."

Comments (none posted)

OpenDocument group 'optimistic' on certification (ZDNet)

The OpenDocument Format may become an ISO standard, according to this article on ZDNet. ""The ODF Alliance is now actively supporting adoption of the OpenDocument Format as a worldwide standard of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC)," the group said in a statement. "The ODF Alliance and its members have contacted various national voting entities recommending approval and are optimistic of a positive outcome.""

Comments (2 posted)

KDE at the Cambodian New Year Parade (KDE.News)

KDE.News covers the KDE demonstration at the Long Beach, California Cambodian New Year Day celebration. "The day started out with Aaron Johnson bringing the equipment and Daniel Dotsenko setting up the booth. This being the first time that a Free Software booth was setup in Long Beach, there was bound to be glitches. The main problem was that the organisers were not able to provide the power that was promised in order to run the computers. That left the fallback of providing software and flyers. On hand were some Kubuntu install and Knoppix live CDs. However, there were not enough and within two hours, all the CDs were gone, as were the flyers."

Comments (none posted)

KDE's core library - Qt - included in new LSB desktop standard

KDE has announced that its core library Qt® from Trolltech® is part of the Linux Standard Base (LSB) Final Release 3.1 standards specification document. The new LSB desktop standard includes the Qt 3.3 libraries and the tools required to create Qt-based applications, both of which are the foundation of KDE. An additional standard includes Qt 4, the next generation technology which will be used in the upcoming KDE 4 release.

Full Story (comments: 27)

Arkeia fully supports the latest version of MySQL

Arkeia Software has announced full support for MySQL Version 5.0 by its MySQL hot backup module. "The widely used Arkeia Software hot backup module for MySQL allows users to develop a flexible backup strategy that protects data without interruption. Utilizing Arkeia's convenient GUI navigator, the module performs incremental, differential or full MySQL backup while data is online, live and accessible."

Full Story (comments: none)

Continuent Announces New m/cluster for MySQL

Continuent, Inc. announced their Continuent m/cluster 2006 product at the MySQL Users Conference. "This newest version of Continuent's m/cluster software provides the highest levels of availability and scalability for applications built using the MySQL database, and includes support for MySQL 5.0. Continuent m/cluster is part of a suite of Continuent products that deliver high availability for virtually any database environment."

Full Story (comments: none)

GoDaddy to support Ruby on Rails web sites

GoDaddy.com has announced support for web sites that use Ruby on Rails. "Ruby on Rails is an open-source framework which lets developers easily assemble rich and dynamic Web sites. Programming with Rails allows a Web designer to wrap applications easily around a database. It has been widely acclaimed in Web development and software engineering circles as a new standard for ease of development and speed of delivery. "Our customers are finding Ruby on Rails to be incredibly valuable in shaping their online presence," said Bob Parsons, GoDaddy.com CEO and Founder. "We are pleased to be able to offer support for a framework that increases the utility of the sites we host.""

Comments (none posted)

HP Extends Open Source Services to MySQL Software

Hewlett Packard will offer new services for the MySQL database. "As part of an agreement, HP will provide consulting, integration and support services for customers implementing MySQL Network database software into their technology environments. HP and its channel partners also will resell MySQL Network subscription services. HP plans to sell the services directly beginning in May and via channel partners in June. MySQL will train HP Services professionals on its products so HP can provide its MySQL Network customers with support."

Comments (none posted)

Laszlo Systems and the Dojo Foundation Announce Strategic Partnership

Laszlo Systems, Inc. has announced a partnership with the Dojo Foundation. "Laszlo Systems, the corporate sponsor of the open source advanced Ajax application development platform, OpenLaszlo, today announced a strategic technical partnership agreement with the Dojo Foundation, the popular community-driven open source project behind the Ajax software library, the Dojo Toolkit. Under this agreement, the Dojo Toolkit will be licensed for use in Laszlo's open source projects and Laszlo, in turn, will contribute libraries to the Dojo Foundation, thereby furthering the advancement of the growing Ajax and open source communities at large."

Comments (none posted)

Myricom and Fujitsu Demonstrate 10-Gigabit Performance

Fujitsu Computer Products of America, Inc. has announced the successful testing of a joint 10-Gigabit Ethernet networking solution with Myricom, Inc. "Addressing the demands of HPC environments seeking broader interoperability and of enterprises requiring HPC-caliber performance in media, storage, and other intensive applications, Myricom and Fujitsu demonstrated interoperability and near-wire-speed user-level throughput in combined tests of both companies' latest 10-Gigabit products."

Comments (none posted)

Open-Xchange Announces Feature Upgrade for Community Edition

Open-Xchange, Inc. has released Open-Xchange Server 0.8.2, a comprehensive feature update for the community edition of Open-Xchange Server.

Full Story (comments: none)

Opera 9 Beta goes public

The first public Beta of the Opera 9 browser is out with some unique capabilities. "This version includes Widgets, small Web programs running in their own windows that are fun, easy-to-use and live on users' desktops. The Opera 9 Beta also features support for BitTorrent, a popular file downloading technology, in addition to an easy-to-use content blocker and thumbnail previews of tabbed sites. And yes, Opera remains available free of charge."

Full Story (comments: none)

RealNetworks granted fundamental streaming media patent

RealNetworks, Inc. has announced the reception of a fundamental patent for streaming media technology and applications. "The recently-issued patent (U.S. Patent No. 6,985,932, "Click-to-Stream") covers the core methods used when consumers select links to stream audio-visual media via web browsers and other media players. Reflecting Real's role as the pioneer of streaming media, the patent covers innovations going back to November 30, 1994, more than four months before Real introduced the groundbreaking RealAudio(R), which transformed the Web by bringing streaming audio to the Internet for the first time."

Comments (none posted)

Reuters Partners With Novell

Novell, Inc. has announced a partnership with Reuters that will involve supporting the Reuters Market Data System (RMDS) on SUSE Linux. "The move will allow Reuters clients to take the market standard data platform RMDS and run it on SUSE Linux Enterprise Server, which is becoming increasingly popular within the financial services industry. In addition, Reuters has joined Novell's PartnerNet(R) program and has certified RMDS on SUSE Linux Enterprise Server to help ensure the future success of joint financial services customers."

Comments (none posted)

SRC Open Sources Geocoder for Enterprise

SRC, a developer of geographic business intelligence software, has announced the release of its Explorer geocoder technology to the open source community. "SRC's Explorer is the industry's first open sourced geocoder that is data and country independent, enabling developers to integrate digital address databases in any country to support geocoding processes."

Full Story (comments: none)

MySQL Stored Procedure Programming - New from O'Reilly

O'Reilly has published the book MySQL Stored Procedure Programming by Guy Harrison with Steven Feuerstein.

Full Story (comments: none)

LPI Testing at LinuxWorld and NetworkWorld Canada

The Linux Professional Institute will hold Linux certification testing at the LinuxWorld and NetworkWorld Canada Conference & Expo. The event will take place on April 24-26, 2006 in Toronto, Canada.

Full Story (comments: none)

New training course for the SRA Silver Certification test

A new PostgreSQL database course has been announced. has been announced. "The Powergres/PostgreSQL development group of SRA OSS is pleased to announce a new PostgreSQL course. This intensive 3 day hands-on course is for new and junior level DBAs who are pursuing the PostgreSQL CE (PostgreSQL Certified Engineer) qualification certification system. The course is designed to prepare the DBA for the PostgreSQL Silver test, http://www.vue.com/sra/ where he will learn how to install, configure, administrate and execute queries for both the 7.4.x and 8.x versions of PostgreSQL."

Comments (none posted)

PHP at FrOSCon CFP

A call for papers has gone out for PHP at FrOSCon. The event will be held in Bonn, Germany on June 24-25, 2006, submissions are due by May 31.

Comments (none posted)

NLUUG fall conference Call for Papers

A Call for Papers has gone out for the NLUUG fall conference. The event is being held on September 14, 2006 in Gelderland, the Netherlands. Submissions are due by May 7.

Full Story (comments: none)

The First Global db4o User Conference

The first db4o User Conference (dUC) will take place in London, England on July 10 and 11, 2006. "The list of speakers includes Ted Neward and Andrew Cowie, renown individuals in the Java/.NET and Java/Linux communities, respectively, Stefan Edlich and Jim Paterson, authors of the upcoming book "The Definitive Guide to db4o", as well as db4objects' own Carl Rosenberger and Christof Wittig."

Full Story (comments: none)

Commerce and Creativity at OSCON 2006

O'Reilly has sent out an announcement for the 2006 O'Reilly Open Source Convention (OSCON 2006). "This year, OSCON will focus on the connections between business and open source. As OSCON program chair Nat Torkington explains, "The growth in stability and scope of open source has been part of this evolving symbiotic relationship between commerce and creativity. If you're a business, you're probably struggling to understand how decisions are made in the chaotic world of open source. If you're an open source project, you're probably wondering how to get taken seriously by the businesses you want to work with. We're tackling law, marketing, public relations, engineering, and the overall issue of governance."" The event will take place on July 24-28, 2006 in Portland, Oregon.

Full Story (comments: none)

Events: April 27 - June 22, 2006

Date	Event	Location
April 27 - 30, 2006	Linux Audio Conference(LAC2006)	(ZKM)Karlsruhe, Germany
April 27, 2006	MySQL Users Conference	Santa Clara, CA
April 27 - 28, 2006	php|tek 2006	(Orlando Airport Marriott Hotel)Orlando, FL
April 29, 2006	Linuxfest Northwest 2006	Bellingham, WA
April 29 - 30, 2006	European Common Lisp Meeting 2006	Hamburg, Germany
May 1 - 6, 2006	DallasCon 2006	(Richardson Hotel)Dallas, TX
May 3 - 6, 2006	LinuxTag 2006	(Rhein-Main-Hallen)Wiesbaden, Germany
May 4, 2006	openSUSE Day at LinuxTag 2006	Wiesbaden, Germany
May 6 - 7, 2006	WebTech 2006	Sofia, Bulgaria
May 8 - 18, 2006	LinuxWorld on Tour Conference and Expo 2006(LOT2006)	Montreal Ottawa Calgary Vancouver
May 12 - 13, 2006	BSDCan 2006	(University of Ottawa)Ottawa Canada
May 13, 2006	DebianDay	Oaxtepec, Mexico
May 14 - 22, 2006	DebConf 6	Oaxtepec, Mexico
May 26 - 27, 2006	FreedomHEC	Seattle, WA
May 30 - June 3, 2006	2006 USENIX Annual Technical Conference	(Boston Marriott Copley Place)Boston, MA
June 13 - 14, 2006	Where 2.0 Conference	(Fairmont Hotel San Jose)San Jose, CA
June 13 - 14, 2006	Gartner Open Source Summit 2006	(Palau de Congressos de Catalunya)Barcelona, Spain
June 14 - 16, 2006	New York PHP Conference and Expo 2006	(New Yorker Hotel)New York, NY
June 16 - 18, 2006	Recon 2006	(Plaza Hotel Centre-Ville)Montreal, Canada

Comments (none posted)

Women in Open Source and Emergent Gaming Behavior (O'ReillyNet)

O'Reilly has announced two new podcast releases. "How do we go about attracting more women to write open source code? Danese Cooper has been looking at different models that work and is trying to spread the word. We also continue our conversation with Jane McGonigal about super gaming. This week she talks about the community that surrounds some of her games and some of the emerging patterns that she has noted."

Comments (none posted)

LAC 2006 Live Streams

Audio and video streaming media will be broadcast from the 2006 Linux Audio Conference. "The linux audio conference 2006, which takes place at the zkm in karlsruhe/germany from april 27 to april 30, will be streamed live for your convenience, inspiration and enjoyment."

Full Story (comments: none)

Stallman's autograph gets auctioned in Brazil

Here's a report from FISL (Internacional Free Software Forum) in Brazil, where Richard Stallman was selling autographs. "There's nothing inherently wrong with charging for someone to use your image or your calligraphy, but it makes you think, huh?"

Full Story (comments: 2)