LWN.net Weekly Edition for November 30, 2006
Who is being divisive?
On November 23, the OpenSUSE project announced the first 10.2 release candidate. In its usual way, LWN posted that announcement; we tend to have a relatively large number of readers who are interested in software of great novelty and questionable stability. This time, however, a recent LWN subscriber took exception to our having posted the announcement:
We got similar comments a few years ago when we continued to publish OpenLinux security alerts with all the others after SCO started its legal rampage. Now, as then, we do not intend to change our editorial policy.
In this context, a couple of other postings are worthy of merit. Shortly after the Novell/Microsoft deal was announced, Chris Dibona posted a weblog entry which reads, in its entirety:
The Google Engineering Staff and Open Source teams are hiring.
Comments posted on the site and elsewhere suggest that most readers found this entry to be topical and amusing.
On November 24, Ubuntu self-appointed benevolent dictator for life Mark Shuttleworth sounded off on the topic as well:
Unlike Chris's posting, however, Mark's missive was met with quite a bit of criticism. There was a fundamental difference between the two: Chris posted on his own weblog, while Mark chose to spam the OpenSUSE mailing list. Had Mark restricted his comments to his own, well-read weblog, he would likely have taken less grief.
Both people were, however, trying to do the same thing: attract developers away from the OpenSUSE project. We have also seen calls for direct boycotts of the SUSE/OpenSUSE distributions and, as mentioned above, people wishing that announcements from the OpenSUSE project would no longer be visible to the rest of the world. There is, it seems, a great deal of anger against Novell and a wish to marginalize its distributions in response. The petition posted by Bruce Perens states it clearly:
There are some problems with taking that approach at this time, however. Much of the concern in the community is about what will happen in the future - not what has happened so far. But predictions about the future are notoriously hard to get right, and things may not turn out the way people expect. In the mean time, however, we may have caused irreparable damage to our community.
The SUSE distribution is one of the oldest and highly respected available. SUSE has, over the course of many years, employed many free software developers and contributed heavily to the community. OpenSUSE is a free distribution which is slowly moving toward a more community-oriented model. There are many developers working on this distribution, and their work is worth as much now as it was last month. OpenSUSE is still a free-software distribution - especially if you avoid the proprietary add-ons disk.
As a bonus, OpenSUSE users are not beneficiaries of Novell's non-license, and, thus, get the full benefit of patent liability that they had before the deal was signed.
In addition, it is not yet clear what harm, if any, will be caused by Novell's deal with Microsoft. It could yet turn out as Novell says: more money for free software, more code, and no downsides. The fact that Novell chose to pay protection money to see off a potential bully does not necessarily make things harder for those who have not paid that money; if anything, Microsoft's attempt to start a new FUD campaign around this deal has backfired. Microsoft has now said, in public, that Novell did not acknowledge any patent problems - a statement which will make it harder for Microsoft to use Novell's protection money as a justification for shaking down other vendors.
Novell has been accused of trying to divide the Linux community. The truth of that accusation will (or will not) become clear over time. What is clear now is that calls to isolate SUSE and attempts to lure away its developer base are unquestionably divisive. Individual users and developers will certainly make their own decisions over time, and it could be that SUSE's run as a major distribution is nearing its end. Or, if things look bad enough, OpenSUSE might eventually fork away from its creator. But it is too soon for any of that to happen, and there is little benefit in trying to hurt a free software project like OpenSUSE. Companies which feel threatened by free software may well attempt to split up our community; there is, however, no sense in doing that work for them.
What is open source?
When the Open Source Initiative first set up shop, the plan was to obtain a trademark (in the US) for the term "Open Source," and to restrict use of that trademark to licenses which were deemed to uphold open source values. That plan came to an end when the trademark office turned down the application. Some time later, the OSI trademarked "OSI Certified" instead, but, by then, the momentum was gone. Use of the OSI Certified mark has been minimal. There is, it seems, little demand for a trademarked stamp of approval for open source licenses.
That situation could yet change, however, as a crop of relatively new
companies pushes the boundaries of the term "open source." At the top of
the list may well be SugarCRM,
which bills itself as "commercial open source." The company's web site
says "We thought there was better way. Why not write our product in
public and distribute it through an open source license?
" Despite
these words, the license created by this company, the SugarCRM
Public License (SPL), is not on the OSI list of open source licenses - and
it's not clear if it ever will be.
The SPL is based on the Mozilla Public License, but it includes (among other things) some text at the end:
These requirements on how the software is to be used are rather intrusive for what is supposed to be a free license; most open source licenses do not prescribe the layout of an application's windows. The folks at SugarCRM, suspecting that the OSI would not consider such requirements as being free, opted not to ask for OSI approval at all. But they call their license "open source" all the same.
SugarCRM's John Roberts makes no apologies for his license, stating that the attribution requirement is necessary to keep others from stealing his company's work. He goes on to say:
Attribution is here to stay. If you refuse to acknowledge it, you are trying to stop change, which will be very hard to do I believe.
Ross Mayfield, representing Socialtext, has also come out in favor of attribution requirements. He has submitted for discussion a general policy statement on attribution requirements and the form they can take. It supports a relatively restrained version of the requirement which might find broader acceptance.
Not everybody buys the argument that web-based applications have a need for attribution which did not exist for prior generations of free software. Michael Tiemann says:
So there are some decisions which will have to be made here. One is: to what extent are attribution requirements simply a form of proper credit for the creation of free software? And to what extent are they an attempt to exercise a sort of proprietary control over software which, as a result, is not truly free? The SPL requirements on the presence, positioning, and linkage of logos do not look all that different from the invariant section requirements in the GFDL - and those requirements are widely held to be non-free. A programmer who borrows even a single function from SugarCRM's code base must thereafter make his or her entire application "powered by SugarCRM," assuming the licenses are compatible at all. It would not be surprising to see a consensus build to the effect that this requirement makes the SPL a non-free license.
The bigger question which is being forced by this discussion, however, is: what does "open source" mean? When the term was first coined, there was concern that businesses would attempt to use it for licenses which were decidedly not open. That sort of abuse has not been much of a problem - so far. But now we are seeing businesses apply the term to code which, to some people in the community at least, is not open source. Problems often start small and grow from there; if some businesses are able to get away with calling licenses without OSI-approval "open source," others will do the same with much more restrictive licenses. There will always be somebody who is willing to test the limits.
What can be done about any future abuse of the term "open source" is not clear, however. There is no trademark, so there is no legal mechanism available to shut down such claims. The OSI could attempt to regain control of the term with a publicity campaign and a stronger effort to push the "OSI Certified" mark. But the OSI has been largely inactive and out of the public view for some time, and it is not generally seen as a representative body. So it is an organization with a relatively small mind share and relatively small moral authority. It's not clear what the OSI can do at this point.
(See also: David Berlind's long article which started the current round of discussion).
The GNOME Foundation board election
The GNOME Foundation aims to help the progress of the GNOME project by coordinating releases, representing the project to the rest of the world, producing documentation, and more. The board which directs the Foundation currently has seven open slots, to be filled by an election ending on December 16. There are eleven candidates for those seven slots. A look at some of the things the candidates are saying gives an interesting view into the issues which are driving the GNOME project this year.
Licenses, open standards, software patents, free competition, privacy, and freedom of choice are issues I care deeply for. Along with access to, and sharing of freedom, knowledge, and information.
That's one statement from each candidate (in no particular order). A few more quotes caught your editor's attention as highlighting other themes in this election:
Freedoms that you can't exercise are meaningless.
This is a massive, growing market, more open to newcomers than the desktop market (thanks to our favourite monopolist incumbents), and we have a bunch of fascinating advantages in this space. It's a huge opportunity to take Free Software to *vastly* more people, faster than we've done so far, and to spur further investment in our developer platform (there are already more developers contributing to our platform for embedded use than desktop use).
All GNOME Foundation members should have the information they need to vote. May the best candidates win.
Security
The Firefox password manager vulnerability
A commonly used convenience feature in Firefox is the password manager (PM) which can keep track of username/password pairs for sites that one visits and fills in when a new login is required. Unfortunately, as a recent bug report shows, PM can be too helpful and provide that information to other sites, invisibly to the user. As of this writing, the underlying browser problem has not been fixed, though MySpace (where the problem was originally discovered in the wild) has changed its filtering of user-supplied HTML to avoid the problem.
When visiting a site with a login form, Firefox checks its list of stored credentials to see if it has a set matching those requested by the page. How it makes that decision is the crux of the vulnerability. Currently, it looks at the domain name portion of the URL and the input field names in the login form to see if there is a match. If there is just one match, it automatically fills in the username and password and the user can just press the "Login" button to authenticate. If there are more matches, the username becomes a drop-down containing all of the possibilities. When a particular username is chosen, the associated password is filled in.
Under normal circumstances, this works fine, but attackers are always willing to alter the underlying assumptions; that is what has occurred here. For sites like MySpace that allow users to put HTML into their pages, someone with malicious intent can mimic the MySpace login page on their own page; Firefox will happily fill in the blanks on the spoofed page. Users might well believe that they had been logged off for some reason and press the login button which will then provide the credentials to whatever URL the ACTION attribute of the form points to. This new kind of attack has been called a Reverse Cross-site Request (RCSR) by Robert Chapin, who reported the Firefox bug.
This mechanism has much in common with standard phishing techniques, in that it tricks the user into sending their passwords to the attacker, but it has a few twists. A typical phishing site will not have a matching entry in the PM and therefore Firefox will not automatically fill in the form. In addition, there is no reason that the username and password fields need be visible for this attack to work; by using CSS or absolute positioning, the attacker may be able to hide the fields from the user but Firefox will happily fill them in anyway. The user will believe they are submitting a benign, unrelated form, when, in fact, they are providing their credentials to an attacker.
Other browsers are susceptible to this attack as well, but because of some user interface differences, the impact is lessened. Opera provides a 'magic wand' icon that a user can press when they want to provide their credentials to a matching site; IE7 requires one to choose the username from a drop-down (even if there is only one choice), unless the URL is exactly the same as the one stored with the password. These differences alleviate the problem with invisible form fields, but could still be used by login form mimics to trap the unwary.
The discussion of possible fixes in the bug report is instructive as there is no real panacea for this problem on the browser side. Several of the comments maintain that it is completely a server-side issue and that sites must take steps to insure that what they serve does not contain this kind of content. Unfortunately for Firefox users and developers, that simplistic approach will not suffice. The root of the problem lies in what portion of a URL is considered significant for identifying a specific site to attach credentials to in the PM.
It is interesting to note, while one is traversing the web, the different ways one can end up on a login page and the different URLs that lead to them. One way to ensure that RCSR cannot occur is to require that the URL stored with the password match exactly with the URL of the requesting page before filling in credentials. This test will break on a wide variety of web sites because they attach various parameters to the URL (navigation information for example) and doing that check would seriously degrade the usefulness of the PM. A less severe check could match the URL up to the start of any parameters, but there are some sites that use different hosts and paths for handling credentials and a user would have to store a password for each of these URLs. Checking the ACTION attribute of the form being submitted has been suggested as a potential solution, but javascript allows changing that attribute on the fly and that capability is used for legitimate reasons.
It is unclear what direction the Firefox team will take in fixing this problem, but it seems likely to require some user interface change (like Opera or IE7) so that some kind of user interaction is required before credentials are filled in. It may also include stricter checking of the page and/or action URLs before deciding to fill in credentials. Pop-up warnings for content that fails these checks has been suggested as a solution, but it is hard to envision users paying any more attention to a new warning than they have to any of the current ones. There is a delicate balance for the developers to maintain between security and convenience, especially when considering the behavior that users have come to expect.
It is hard to imagine that most users, when storing their passwords, would expect Firefox to send them off to phishing sites without any kind of user interaction and without providing any visual indication that it is doing so. Website operators should certainly be doing better filtering, but the browser is the agent that the user has entrusted with their passwords. Claiming that there is no browser issue is a serious misunderstanding of user expectations when they store passwords.
Brief items
Remote code execution vulnerability in ProFTPD
If any of you are still running ProFTPD: there is a new vulnerability which allows for execution of arbitrary code by a remote attacker - and an exploit is already in circulation. Upgrading to version 1.3.0a, which contains the fix, would be a very good idea. Click below for the advisory.
New vulnerabilities
apache-mod_auth_kerb: off-by-one error
| Package(s): | apache-mod_auth_kerb | CVE #(s): | CVE-2006-5989 | ||||||||||||||||||||
| Created: | November 24, 2006 | Updated: | January 23, 2007 | ||||||||||||||||||||
| Description: | An off-by-one error in the der_get_oid function in mod_auth_kerb 5.0 allows remote attackers to cause a denial of service (crash) via a crafted Kerberos message that triggers a heap-based buffer overflow in the component array. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
dovecot: index cache file handling error
| Package(s): | dovecot | CVE #(s): | CVE-2006-5973 | ||||||||||||||||
| Created: | November 29, 2006 | Updated: | May 8, 2007 | ||||||||||||||||
| Description: | The dovecot IMAP server has an error in its index cache file handling code which could be exploited by an authenticated user to execute arbitrary code. Only servers with the (non-default) mmap_disable=yes option setting are vulnerable. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
fvwm: fvwm-menu-directory command injection
| Package(s): | fvwm | CVE #(s): | CVE-2006-5969 | ||||
| Created: | November 24, 2006 | Updated: | November 29, 2006 | ||||
| Description: | Tavis Ormandy of the Gentoo Linux Security Audit Team discovered that fvwm-menu-directory does not sufficiently sanitize directory names prior to generating menus. A local attacker who can convince an fvwm-menu-directory user to browse a directory they control could cause fvwm commands to be executed with the privileges of the fvwm user. Fvwm commands can be used to execute arbitrary shell commands. | ||||||
| Alerts: |
| ||||||
imagemagick: buffer overflows
| Package(s): | imagemagick | CVE #(s): | CVE-2006-5868 | ||||||||||||
| Created: | November 28, 2006 | Updated: | February 16, 2007 | ||||||||||||
| Description: | Daniel Kobras discovered multiple buffer overflows in ImageMagick's SGI file format decoder. By tricking a user or an automated system into processing a specially crafted SGI image, this could be exploited to execute arbitrary code with the user's privileges. | ||||||||||||||
| Alerts: |
| ||||||||||||||
jbossas: arbitrary code execution
| Package(s): | jbossas | CVE #(s): | CVE-2006-5750 | ||||
| Created: | November 27, 2006 | Updated: | November 29, 2006 | ||||
| Description: | Symantec discovered a flaw in the DeploymentFileRepository class of the JBoss Application Server. A remote attacker who is able to access the console manager could read or write to files with the permissions of the JBoss user. This could potentially lead to arbitrary code execution as the jboss user. | ||||||
| Alerts: |
| ||||||
phpMyAdmin: several vulnerabilities
| Package(s): | phpMyAdmin | CVE #(s): | CVE-2006-3388 CVE-2006-5116 CVE-2006-5117 CVE-2006-5718 | ||||
| Created: | November 24, 2006 | Updated: | November 29, 2006 | ||||
| Description: | Several vulnerabilities have been fixed in phpMyAdmin version 2.9.1.1, including cross-site scripting and cross-site request forgery vulnerabilities. | ||||||
| Alerts: |
| ||||||
pstotext: insecure file name quoting
| Package(s): | pstotext | CVE #(s): | CVE-2006-5869 | ||||
| Created: | November 27, 2006 | Updated: | November 29, 2006 | ||||
| Description: | Brian May discovered that pstotext, a utility to extract plain text from Postscript and PDF files, performs insufficient quoting of file names, which allows execution of arbitrary shell commands. | ||||||
| Alerts: |
| ||||||
tar: symlink vulnerability
| Package(s): | tar | CVE #(s): | CVE-2006-6097 | ||||||||||||||||||||||||||||||||
| Created: | November 28, 2006 | Updated: | December 20, 2006 | ||||||||||||||||||||||||||||||||
| Description: | Teemu Salmela discovered that tar still handles the deprecated GNUTYPE_NAMES record type. This record type could be used to create symlinks that would be followed while unpacking a tar archive. If a user or an automated system were tricked into unpacking a specially crafted tar file, arbitrary files could be overwritten with user privileges. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
Page editor: Jonathan Corbet
Kernel development
Brief items
Kernel release status
The current stable 2.6 kernel is 2.6.19, released by Linus on November 29. Says Linus:
For those just tuning in, major user-visible changes in 2.6.19 include the parallel ATA driver subsystem, the GFS2 and ext4 filesystems, a long list of new drivers, eCryptfs, and more. See the LWN kernel API page for a list of internal API changes, and the KernelNewbies 2.6.19 page for vast amounts of detail.
The current -mm tree is 2.6.19-rc6-mm2. Recent changes to -mm include some driver core tweaks, suspend/resume support for a number of parallel ATA drivers, the file capabilities patch (see below), and a per-task I/O accounting feature.
For older 2.6 kernels: the current 2.6.18 kernel is 2.6.18.4, released on November 29. It contains a single fix for a buffer overflow in the network bridging code.
For 2.6.16 users, Adrian Bunk has released 2.6.16.33 and 2.6.16.34 with a number of fixes and (in .34) a few new drivers.
Kernel development news
Quote of the week
Workqueues get a rework
The workqueue mechanism allows kernel code to defer processing to a later time. Workqueues are characterized by the existence of one or more dedicated processes which execute queued jobs; since work is done in process context, it can sleep if need be. Workqueues can also delay the execution of specific jobs for a caller-specified period. They are used in many places throughout the kernel.David Howells recently took a look at workqueues and noticed that the work_struct structure, which describes a task to be executed, is rather large. It can be 96 bytes on 64-bit machines. That is fairly heavy for structures which can be used in reasonably large quantities. So he set out to find ways to make it smaller. He succeeded, but at the cost of some changes to the workqueue API.
The causes of bloat in struct work_struct are:
- The timer structure embedded in each one. Many users of workqueues
never need the delay feature, but every queued bit of work carries
along a timer_list structure, just in case.
- The private data pointer, which is passed to the actual work
function. Many work functions use that pointer, but it can often be
calculated from the work_struct pointer using
container_of().
- An entire word is used to store a single bit: the "pending" flag which indicates that a work_struct is currently in a queue waiting to be executed.
David addressed each of these issues. As a result, there are now two types of work structure (struct work_struct and struct delayed_work); the timer information has been removed from the former. The private data pointer is gone; work functions instead get a pointer to the associated work_struct (or delayed_work) structure. And some internal trickery was used to get rid of the word holding the "pending" bit.
The result of these changes is that almost every part of the workqueue API has changed. There are now two ways of declaring a workqueue entry:
typedef void (*work_func_t)(struct work_struct *work);
DECLARE_WORK(name, func);
DECLARE_DELAYED_WORK(name, func);
The prototype for the work function has changed; it is now a pointer to the relevant work queue entry. Note that a work_struct pointer is always passed, even in the case of delayed work. It would appear that the programmer is expected to count on the fact that struct work_struct is the first field of struct delayed_work, so container_of() should work as expected. As long as nobody rearranges struct delayed_work, anyway.
For work structures which must be set up at run time, the initialization macros now look like this:
INIT_WORK(struct work_struct work, work_func_t func);
PREPARE_WORK(struct work_struct work, work_func_t func);
INIT_DELAYED_WORK(struct delayed_work work, work_func_t func);
PREPARE_DELAYED_WORK(struct delayed_work work, work_func_t func);
The INIT_* versions initialize the entire structure; they must be used the first time a structure is initialized. Thereafter, the PREPARE_* versions, which are slightly faster, can be used.
The functions for adding entries to workqueues (and canceling them) now look like this:
int queue_work(struct workqueue_struct *queue,
struct work_struct *work);
int queue_delayed_work(struct workqueue_struct *queue,
struct delayed_work *work);
int queue_delayed_work_on(int cpu,
struct workqueue_struct *queue,
struct delayed_work *work);
int cancel_delayed_work(struct delayed_work *work);
int cancel_rearming_delayed_work(struct delayed_work *work);
Interestingly, David has added a variant on the workqueue declaration and initialization macros:
DECLARE_WORK_NAR(name, func);
DECLARE_DELAYED_WORK_NAR(name, func);
INIT_WORK_NAR(name, func);
INIT_DELAYED_WORK_NAR(name, func);
PREPARE_WORK_NAR(name, func);
PREPARE_DELAYED_WORK_NAR(name, func);
The "NAR" stands for "non-auto-release." Normally, the workqueue subsystem resets a work entry's pending flag prior to calling the work function; that action, among other things, allows the function to resubmit itself if need be. If the entry is initialized with one of the above macros, however, this reset will not happen, and the work function is expected to reset the flag itself (with a call to work_release()). The stated purpose is to prevent the workqueue entry from being released before the work function is done with it - but there is nothing in the clearing of the pending bit which would cause that release to happen. Perhaps that is why there are no users of the _NAR variants in David's patch. It may be that somebody is thinking about implementing reference-counted workqueue structures in the future.
Meanwhile, these changes require a lot of fixes throughout the kernel tree; that drew a complaint from Andrew Morton, who was unable to make those changes mesh with all of the other patches queued up for the opening of the 2.6.20 merge window. Andrew suggested that the workqueue patches could be merged after 2.6.20-rc1 comes out, as was done with the interrupt handler function prototype in 2.6.19. But Linus, who likes the workqueue patches, would rather get them in sooner:
So it seems that, somehow, all of the pieces will be made to fit and the workqueue API will change in 2.6.20.
Avoiding - and fixing - memory fragmentation
Memory fragmentation is a kernel programming issue with a long history. As a system runs, pages are allocated for a variety of tasks with the result that memory fragments over time. A busy system with a long uptime may have very few blocks of pages which are physically-contiguous. Since Linux is a virtual memory system, fragmentation normally is not a problem; physically scattered memory can be made virtually contiguous by way of the page tables.But there are a few situations where physically-contiguous memory is absolutely required. These include large kernel data structures (except those created with vmalloc()) and any memory which must appear contiguous to peripheral devices. DMA buffers for low-end devices (those which cannot do scatter/gather I/O) are a classic example. If a large ("high order") block of memory is not available when needed, something will fail and yet another user will start to consider switching to BSD.
Over the years, a number of approaches to the memory fragmentation problem have been considered, but none have been merged. Adding any sort of overhead to the core memory management code tends to be a hard sell. But this resistance does not mean that people stop trying. One of the most persistent in this area has been Mel Gorman, who has been working on an anti-fragmentation patch set for some years. Mel is back with version 27 of his patch, now rebranded "page clustering." This version appears to have attracted some interest, and may yet get into the mainline.
The core observation in Mel's patch set remains that some types of memory are more easily reclaimed than others. A page which is backed up on a filesystem somewhere can be readily discarded and reused, for example, while a page holding a process's task structure is pretty well nailed down. One stubborn page is all it takes to keep an entire large block of memory from being consolidated and reused as a physically-contiguous whole. But if all of the easily-reclaimable pages could be kept together, with the non-reclaimable pages grouped into a separate region of memory, it should be much easier to create larger blocks of free memory.
So Mel's patch divides each memory zone into three types of blocks: non-reclaimable, easily reclaimable, and movable. The "movable" type is a new feature in this patch set; it is used for pages which can be easily shifted elsewhere using the kernel's page migration mechanism. In many cases, moving a page might be easier than reclaiming it, since there is no need to involve a backing store device. Grouping pages in this way should also make the creation of larger blocks "just happen" when a process is migrated from one NUMA node to another.
So, in this patch, movable pages (those marked with __GFP_MOVABLE) are generally those belonging to user-space processes. Moving a user-space page is just a matter of copying the data and changing the page table entry, so it is a relatively easy thing to do. Reclaimable pages (__GFP_RECLAIMABLE), instead, usually belong to the kernel. They are either allocations which are expected to be short-lived (some kinds of DMA buffers, for example, which only exist for the duration of an I/O operation) or can be discarded if needed (various types of caches). Everything else is expected to be hard to reclaim.
By simply grouping different types of allocation in this way, Mel was able to get some pretty good results:
Linus has, in the past, been generally opposed to efforts to reduce memory fragmentation. His comments this time around have been much more detail-oriented, however: should allocations be considered movable or non-movable by default? The answer would appear to be "non-movable," since somebody always has to make some effort to ensure that a specific allocation can be moved. Since the discussion is now happening at this level, some sort of fragmentation avoidance might just find its way into the kernel.
A related approach to fragmentation is the lumpy reclaim mechanism posted by Andy Whitcroft but originally by Peter Zijlstra. Memory reclaim in Linux is normally done by way of a least-recently-used (LRU) list; the hope is that, if a page must be discarded, going after the least recently used page will minimize the chances of throwing out a page which will be needed soon. This mechanism will tend to free pages which are scattered randomly in the physical address space, however, making it hard to create larger blocks of free memory.
The lumpy reclaim patch tries to address this problem by modifying the LRU algorithm slightly. When memory is needed, the next victim is chosen from the LRU list as before. The reclaim code then looks at the surrounding pages (enough of them to form a higher-order block) and tries to free them as well. If it succeeds, lumpy reclaim will quickly create a larger free block while reclaiming a minimal number of pages.
Clearly, this approach will work better if the surrounding pages can be freed. As a result, it combines well with a clustering mechanism like Mel Gorman's. The distortion of the LRU approach could have performance implications, since the neighboring pages may be under heavy use when the lumpy reclaim code goes after them. In an attempt to minimize this effect, lumpy reclaim only happens when the kernel is having trouble satisfying a request for a larger block of memory.
If - and when - these patches may be merged is yet to be seen. Core memory management patches tend to inspire a high level of caution; they can easily create chaos when exposed to real-world workloads. The problem doesn't go away by itself, however, so something is likely to happen, sooner or later.
File-based capabilities
The capability model has some real appeal. It replaces the "all or nothing" security model inherent in the root account with a set of fine-grained permissions describing exactly what a given process can do. Linux has supported capabilities for years, but this feature has seen little use for a number of reasons; see this article from last September for more general discussion of capabilities.The fact that capabilities have not been used much has not stopped developers from trying to improve the feature. The latest attempt is the file capabilities patch by Serge Hallyn. This patch allows a system administrator to add specific capabilities to an executable file; when that file is executed, the process's capability masks will be set to the capabilities associated with the file. This feature thus functions somewhat like the file setuid bit, but with finer control.
On the kernel side, file-based capabilities work through the extended attribute mechanism. Capabilities are added to a file by setting a attribute named security.capability; the value of the attribute will be this structure:
struct vfs_cap_data_disk {
__le32 version;
__le32 effective;
__le32 permitted;
__le32 inheritable;
};
The version field holds the current capability version; the other three hold the expected capability masks.
There are a few interesting features of this implementation:
- One might wonder what keeps the user from just setting an extended
attribute and obtaining whatever capabilities might be desired. While
setting extended attributes is not a privileged operation, setting
attributes whose name starts with "security." is. So, unless
the user has root privileges, he or she will not be able to set
capability attributes. (For the curious, the other restricted
attributes are trusted.*, which only root can query or
change, and user.*, which, in some situations, can only be
changed by the owner of the file).
- The capability masks stored with the file completely overwrite the
process's current capabilities. So, if the root user executes a file
with capabilities set, it may run with fewer capabilities than
it would have otherwise had.
- The setting of capabilities is done outside of the check for filesystems mounted with the nosuid option. This behaviour would appear to open the system up to attacks via a removable filesystem created on a different system.
A set of user-space tools exists for working with file-based capability masks; see the filesystem capabilities page for downloads, documentation, and examples.
Before celebrating the arrival of file capabilities, it is worth asking whether system administrators really need another 31 (at last count) permission bits - multiplied by three separate capability masks - to manage on every executable file on the system. It can be hard to keep file permissions bits in proper order even without capabilities. A full capability-based system would approach SELinux in complexity, and may thus be beyond the ability of most people to manage. But one could use this feature to assign restricted capabilities to programs which currently run setuid root. In many cases, root privilege is only need to bind to a low-numbered socket, adjust the system time, or perform raw I/O. Restricting a program to its needed capabilities should reduce the changes of that program being used to do something unexpected.
Patches and updates
Kernel trees
Architecture-specific
Core kernel code
Development tools
Device drivers
Documentation
Filesystems and block I/O
Memory management
Networking
Security-related
Virtualization and containers
Page editor: Jonathan Corbet
Distributions
News and Editorials
Perl/Linux
Lately it seems that people have been very seriously concerned about a great many things. Is OpenSUSE really free as in freedom? (Yes it is.) Is Fedora really a community project? (Yes and getting better at it all the time). Well, it's time to lighten up and look at something completely tongue in cheek. It's not new, or finished or even maintained at this point, but it is creative.Perl fans have probably known about it for a while. Yes, it's Perl/Linux, a Linux distribution where all the programs are written in perl.
Actually, if you look at Jay Kominek's list of Perl/Linux software you'll see that some functionality is currently missing. Still, the possibility is there.
Seriously, though we are looking for guest authors to supply some occasional content for this page. Why not get published and write about your favorite distribution for LWN.net? Please have a look at our author guide if you are interested.
New Releases
YDL v5.0 for the PS3 launches
Terra Soft Solutions has announced the availability of Yellow Dog Linux v5.0 for PlayStation3 via YDL.net Enhanced accounts.Xandros Desktop - Professional v4.0 released
Xandros has announced the release of "Xandros Desktop - Professional" version 4, featuring advanced 3D desktop graphics effects, Bluetooth wireless support, desktop search and ISV support and much more.openSUSE 10.2 RC1
The first release candidate of openSUSE 10.2 (codename Basilisk Lizard) is available. For those who have been beta testing, delta ISOs are available. According to the announcement we can expect the final version in two weeks.First French Version of Linspire Released
Linspire, Inc. has announced the immediate release and availability of Linspire 5 French edition.GNUSTEP CD 1.0 released
The GNUstep Live CD project has released version 1.0. This Debian-based distribution includes a GNUstep development environment with some classic games and plenty of network, system recovery and administration tools.BLAG50003 released
BLAG Linux and GNU has released BLAG50003, a third update to it's Fedora Core 5 based distribution.64 Studio 1.0 'Olympic' released
64 Studio, a distribution for x86-64 systems, has released version 1.0. This distribution, based on Debian, is aimed at "digital content creation," and, thus, emphasizes multimedia applications. "The CD image will install Debian with X.org, the Gnome 2.14 desktop, Linux kernel 2.6.17 with realtime preemption patches (a realtime SMP kernel for AMD64 dual core and multi-processor machines is available on the 64-bit CD) and a selection of creative applications. These applications cover audio and music, video, 2D and 3D graphics, publishing for the web or print, and the internet and office tools a creative user is likely to need for their daily work."
Distribution News
Fedora considers user metrics
Back in October, LWN covered Fedora's need for metrics on how many people are using the distribution. The project has now put up a page on possible data collection techniques with a request for comments. Quite a few different approaches are being considered. "The fact is that metrics are important for anyone trying to do something with limited resources. It allows us to put what little resources we do have to better use. If the developers spend 20% of their time debugging PPC and our metrics show that they are 1% of our install base, the argument could be made that less time needs to be spent on PPC."
Debian announcements
The sixth Debian Miniconf will be held at linux.conf.au 2007 in January. Here's the call for participation.
Fabian Fagerholm reports on behalf of the
the Cyrus SASL packaging team, that cyrus-sasl2 has been upgraded to a new
upstream version. "This new package is a major change compared to
the old version. Therefore, we want people to test it as much as
possible!
"
Andreas Barth looks at autobuilds and non-free packages.
Jamey Sharp reports that XCB packages (xcb-proto 1.0, libxcb 1.0, and libx11 1.1) from freedesktop.org are now in experimental. These packages will not be in etch, they will wait for etch+1 aka Lenny.
New Distributions
mEDUXa 1.0 Ready to Take Over the Canary Islands (KDE.News)
KDE.News introduces the 1.0 release of mEDUXa, a distribution from the Education, Culture and Sports Department of the Spanish Canary Island's regional government. "mEDUXa is a Free Software GNU/Linux distribution developed for educational purposes based on Kubuntu. It will be deployed on 35,000 computers in 1100 schools, which represents 325,000 possible users (25,000 teachers and 300,000 students) in the Canary Islands state schools."
Distribution Newsletters
Debian Weekly News - November 28th, 2006
The Debian Weekly News for November 28, 2006 looks at why DWN is not weekly anymore, evaluating Sarge to Etch upgrades, GNOME 2.14 in Etch, DebConf7 registration and call for papers, the Debian Installer release candidate, Etch release update, Debian FAQ call for help, a new Sparc development machine, and several other topics.Fedora Weekly News Issue 68
The Fedora Weekly News for November 27, 2006 covers Fedora 7 Artwork Proposals, Peace In Our Time, VanLUG Report, SCALE Readies 'Non-Commercial' Open Source Conference, FC6 reviews and more.Gentoo Weekly Newsletter
The Gentoo Weekly Newsletter for November 20, 2006 covers a new Bugzilla bug tracker, gentoo-user summaries, gentoo-cluster information about a 5,832 CPU cluster and much more.Ubuntu Weekly News #22
The Ubuntu Weekly Newsletter for the week of November 18, 2006 covers Feisty on the Schedule, New LoCo teams announced, New Ubuntu Customization Kit release, Ubuntu-based PBX announced, Ubuntu-uk holds children's auction, Changes in Feisty, and several other topics.Ubuntu Weekly News #23
The Ubuntu Weekly Newsletter for the week of November 25, 2006 covers mEDUXa Released, Jono Bacon Interview, Free Geek Burgled, Free Poster for Quiz Winner, LoCo Team News and several other topics.DistroWatch Weekly, Issue 179
The DistroWatch Weekly for November 27, 2006 is out. "With the end of the year 2006 approaching fast, many developers are hard at work preparing their latest product releases. A new version of Xandros Desktop, the subject of our first look review, will be announced later this week, while SabayonLinux 3.2 and the PlayStation edition of Yellow Dog Linux 5.0 are also expected shortly. Debian GNU/Linux 4.0 is about to enter its hard-freeze period, while the recent release candidate for openSUSE 10.2 is reportedly shaping up into a highly polished distribution. Many other projects have been making steady progress towards their future releases - Freespire has launched its development process which will lead to a stable version 2.0 in the first quarter of 2007 and many far-reaching changes are also planned for the next release of Fedora Core."
Package updates
Fedora updates
Updates for Fedora Core 6: m17n-db (bug fix), k3b (update to 0.12.17), tcpdump (bug fixes), sysstat (update NFS mount statistic patch), util-linux (bug fixes), nss (update to 3.11.4), gaim (gaim-2.0.0 beta5 plus several additional fixes from Debian and upstream), vnc (bug fix), mc (update to new CVS snapshot), tzdata (patch for Western Australia DST trial), iscsi-initiator-utils (rebase to upstream open-iscsi-2.0-742), iscsi-initiator-utils (bug fixes), pygobject2 (update to 2.12.3), evolution-data-server (bug fix), system-config-httpd (lots of bugfixes), gnome-panel (bug fixes), gtk2 (bug fix), rhythmbox (bug fix), totem (update to 2.16.3), gstreamer (bug fix and cleanup), gstreamer-plugins-base (update to 0.10.10), hwbrowser (bug fixes), gnome-pilot (update to 2.0.14), mlocate (update to mlocate-0.15), m17n-db (bug fixes), pango (update to 1.14.8), openssl (bug fix), gnome-pilot-conduits (update to 2.0.14), system-config-soundcard (updated translations, cleanup), SDL (bug fix), gmp (bug fix), policycoreutils (fixes for the gui), system-config-printer (bug fixes), spamassassin (update to 3.1.7), traceroute (upgrade to new upstream version), m17n-db (bug fix), vnc (bug fix), jpilot (add KeyRing plugin), nfs-utils (bug fix), planner (bug fixes), selinux-policy (bug fixes), setroubleshoot (new icon and translations), iscsi-initiator-utils (rebase to upstream open-iscsi-2.0-747), tzdata (upstream 2006p), gnome-power-manager (screensaver bug fix).Updates for Fedora Core 5: nspr (update to 4.6.4), nss (update to 3.11.4), tzdata (patch for Western Australia DST trial), system-config-httpd (lots of bugfixes), xterm (bug fixes), mc (update to new CVS snapshot), spamassassin (update to 3.1.7), traceroute (upgrade to new upstream version), iscsi-initiator-utils (rebase to upstream open-iscsi-2.0-747), tzdata (upstream 2006p).
Mandriva updates
Updates for Mandriva Linux 2007.0: dbus (bug fix), audacity (bug fix for French locale).rPath updates
Updates for rPath Linux 1: conary, conary-build, conary-repository (Conary 1.0.39 maintenance release).Ubuntu updates
Updates for Ubuntu 6.10: lvm2 2.02.06-2ubuntu3.1 (bug fix)Updates for Ubuntu 6.06 LTS: lvm2 2.02.02-1ubuntu1.1 (bug fix), maxima 5.9.2-2ubuntu2 (rebuild with new gcl)
Newsletters and articles of interest
As Etch progresses, Debian's release manager talks turkey (Linux.com)
Linux.com talks with Andreas Barth. "Release managers are not mentioned in the Debian Constitution, yet few positions in Debian are more influential, especially in the final stages of preparation for a release. Recently, Andreas Barth, who shares the release manager position with Steve Langasek, took time from his efforts coordinating the Etch release -- tentatively scheduled for early December -- to talk about the stages in the release process, the goals for the upcoming release, and the short- and long-range problems that he faces in his role. Contrary to some predictions of disaster, he presents a picture of a distribution that is continuing to evolve without sacrificing the openness for which it is often admired."
Live CD Linux distro borrows Ubuntu, Knoppix bits (DesktopLinux)
DesktopLinux takes a look at X-Evian. "X-Evian, a Linux distribution in English and Spanish that draws from Ubuntu and Knoppix code, last month released a live CD -- version 0.7 -- that features a 2.6.17 kernel and the XFce desktop environment. X-Evian is a compilation which has been carefully chosen and configured for activist users, for liberated cultural, technological and social production, the Spain-based project team said. It is the team's first new release since 2003 -- it was originally built upon Debian GNU/Linux and Knoppix, the team said."
Tips for new Gentoo users (Linux.com)
Linux.com has some tips for new Gentoo users. "Gentoo is one of the most difficult distributions to learn, though veteran Gentoo users might point out that its friendly community and extensive documentation can help new users. Here are some tips that might make Gentoo easier for anyone who wants to give it a try."
Japan's Vine Linux 4.0 hits the web (DesktopLinux)
DesktopLinux looks at Vine Linux 4.0. "Japan's Vine Linux project team, whose distribution features an integrated Japanese or English environment for desktop PCs and notebooks, today released its version 4.0 for i386 and PowerPC processors. The distro features a 2.6.16 kernel and the GNOME 2.14.2 desktop environment."
Distribution reviews
Xandros Linux conquers a hostile Sony laptop (Register)
The Register has this review of Xandros. "My personal favourite, SuSE, won't run on it without a tiring vi session, trying to edit xorg.conf to get a screen to appear. But Xandros Home Edition Premium ran fine right out of the box. Indeed, it has turned out more functional on this Linux-hating computer than even a vanilla Windows installation, which is not something one expects."
Page editor: Rebecca Sobol
Development
Control instrumentation devices with PyVISA
PyVISA is a cross-platform Python package that has been written by Torsten Bronger:
PyVISA is used to interface with electronic devices that adhere to the VISA specification. VISA is defined by the Interchangeable Virtual Instrument (IVI) Foundation, and is used to create a standardized interface to a variety of instrumentation control buses. Electronic devices such as voltmeters, oscilloscopes, temperature sensors, power supplies, motors and much more can be accessed by VISA.
PyVISA includes the vpp43 VISA library implementation, which deals with the low-level VISA functions. PyVISA can work with a number of adapters such as those from National Instruments, Agilent, and Tektronix.
Assuming one has the required hardware and driver installed, the software appears to be fairly easy to use. The PyVISA manual has some simple and more complex examples for performing data acquisition from Python. More complex applications, such as pyvLab, an open-source instrumentation control and display program, have been built around PyVISA.
Version 1.1 of PyVISA
was recently announced:
"Yesterday I released version 1.1, which works much better together
with older VISA implementations. Moreover, we finally have reports
from Linux users. They successfully used PyVISA with Linux +
NI/Tektronix GPIB hardware.
"
PyVISA looks to be an important tool for those who wish to perform instrumentation control functions from a Linux machine.
System Applications
Audio Projects
Rivendell 0.9.76 announced
Version 0.9.76 of Rivendell has been released, it includes many new features. "Rivendell is a full-featured radio automation system targeted for use in professional broadcast environments."
Database Software
MySQL 4.1.22 has been released
Version 4.1.22 of the MySQL DBMS is available. "This is the final planned binary bugfix release for the MySQL 4.1 production family. Per the MySQL Product Life Cycle policy, active support of version 4.1 will end on December 31, 2006."
PostgreSQL 8.2 release candidate 1 announced
Release candidate 1 of the PostgreSQL 8.2 DBMS is out for testing. "This is the last chance to find bugs before our release next week. Please test 8.2 now, especially any exotic functionality, and test porting your applications to it. It's your efforts that make PostgreSQL bulletproof."
PostgreSQL Weekly News
The November 26 2006 edition of the PostgreSQL Weekly News is online with the latest PostgreSQL DBMS articles and resources.
Libraries
Cairo snapshot 1.3.4 now available
Snapshot 1.3.4 of Cairo, a 2D graphics library with support for multiple output devices, has been announced. "This is the second development snapshot in the 1.3 series. It comes one week after the 1.3.2 snapshot. This snapshot has a couple of significant performance improvements, and also adds new support for producing multi-page SVG output, (when targeting SVG 1.2)---thanks to Emmanuel Pacaud."
libX11 1.1 announced
Version 1.1 of libX11 has been announced. "It's not pinin', it's passed on! This library is no more! It has ceased to be! It's expired and gone to meet its maker! This is a late library! It's a stiff! Bereft of life, it rests in peace! If you hadn't nailed it to the perch it would be pushing up the daisies! It's rung down the curtain and joined the choir invisible! This is an X-lib! After two candidate releases, the XCB developers have nailed libX11 1.1 to the perch. This release includes the Xlib/XCB work, which uses XCB as the Xlib transport layer, and allows a client to use both Xlib and XCB on the same connection. This allows clients to transition from Xlib to XCB incrementally."
XCB 1.0 now available
Version 1.0 of XCB, the replacement for the Xlib X Window System interface, is out. "Now that XCB has received widespread testing via three release candidates, we have provided a 1.0 release to form a stable base on which to build other software. All future versions of libxcb will preserve compatibility with libxcb 1.0."
libpthread-stubs 0.1 announced
Initial version 0.1 of libpthread-stubs has been released by the XCB developers. "This library provides weak aliases for pthread functions not provided in libc or otherwise available by default. Libraries like libxcb rely on pthread stubs to use pthreads optionally, becoming thread-safe when linked to libpthread, while avoiding any performance hit when running single-threaded."
Telecom
1bizCom 0.8.0.0 beta released (SourceForge)
Version 0.8.0.0 beta of 1bizCom has been announced. "1bizCom is next generation web-based, multi-tenant, distributed, mul[ti]-lingual, inbound, outbound Video enabled VoIP & VVoIP call/ contact center solution for Asterisk with Built-in phone, IVR, CRM, Predictive dialer, ACD, Chat, Mail, Fax, Video and other features. 1bC 0.8.0.0 beta is now available that includes major outbound call center software features."
Virtualization Software
Virtualization and the POWER5 Architecture (O'Reilly)
Ken Milberg discusses virtualization on the IBM POWER5 architecture in an O'Reilly article. "Unlike the other RISC-based hardware vendors (Sun and HP), IBM has fully implemented most of the features of its most powerful architecture into its Linux support. This is largely due to the recent developments of the Linux 2.6 kernel, which has brought Linux into the forefront. IBM added its own code to the SUSE and Red Hat kernels to provide support to the POWER5."
Web Site Development
Zope 2.10.1 released
Version 2.10.1 of the Zope web development platform has been announced. The change list includes: A ZPT implementation based on Zope 3, experimental WSGI and Twisted integration, Zope 3.3 and Five 1.5 integration, a new clock server, minor improvements and fixes and the replacement of several Zope 2 modules with their sister implementation of Zope 3.Caching Dynamic Content with Apache httpd (O'Reilly)
Rich Bowen works with mod_cache on O'Reilly. "You know that part of your website that you never update? Sure, it's "dynamic"--the content rests in a database and gets loaded with every request--but you haven't updated it since last Christmas. Yet every time someone loads that page, it hits the database, and it's slow. One thing you may not have known about your Apache web server is that it can fix that problem for you. Content that never changes shouldn't require CPU cycles to generate. mod_cache has been around for a while, but there are some new features in it that can help you make better use of your server's resources. Although people have traditionally used the caching capabilities of mod_cache with proxied content, that isn't its only feature. You can also cache your dynamic content and serve it as rapidly as on-disk files."
Miscellaneous
ZybaCafe 4.0.3 Beta 2 released
Version 4.0.3 Beta 2 of ZybaCafe is available. "ZybaCafe (formerly DireqCafe) is a next-generation free and open-source internet cafe management suite. ZybaCafe comprises a server-side administration suite, as well as clients to manage time-control on machines. The standard version uses postgresql as an RDBMS but porting it to other database systems should not be very difficult. ZybaCafe has a powerful plugin architecture allowing for easy extensibility and integration with other tools such as accounting packages and CRM systems."
Desktop Applications
Audio Applications
ghostess 20061127 released
Version 20061127 of ghostess, a lightweight Gtk+ host for DSSI audio plugins, has been released. Changes include patch list export capabilities for Freewheeling, support for the latest version of JACK, MIDI blinking lights, bug fixes and more.jack_oscrolloscope 0.1 announced
Version 0.1 of jack_oscrolloscope, a realtime waveform viewer that works with the JACK Audio Connection Kit, is out. This is the initial release.
Desktop Environments
GNOME 2.16.2 Released
Version 2.16.2 of the GNOME desktop environment is out. "This is the second release in a series of point releases for the 2.16 branch. Come and see all the bug fixing, all the new translations and all the updated documentations brought to you by the wonderful team of GNOME contributors! While development continues on the GNOME 2.17/2.18 road, we didn't forget about making a new release that is rock solid. And simply better than the previous one."
GARNOME 2.16.2 released
Version 2.16.2 of GARNOME, the bleeding edge GNOME distribution, is out. "This release incorporates the GNOME 2.16.2 Desktop and Developer Platform, fine-tuned and updated with love by the GARNOME Team. As usual it includes updates and fixes after the official GNOME freeze, together with a host of third-party GNOME packages, Bindings and the Mono(tm) Platform -- this is the third release of the current stable GNOME branch, ironing out yet-more bugs, hopefully adding yet-more stability, definitely including a bunch of security fixes and ships with the latest and greatest stable releases."
GNOME Software Announcements
The following new GNOME software has been announced this week:- F-Spot 0.3.0 (new features, bug fixes and documentation work)
- GAlbum 0.1 (early prototype)
- Gazpacho 0.7.0 (new features and bug fixes)
- GDM2 2.16.3 (new features, bug fixes and translation work)
- gnome-pilot 2.0.15 (bug fixes)
- gtranslator-1.1.7 (new features, bug fixes and translation work)
- Planner 0.14.2 (bug fixes)
- Tomboy 0.5.1 (new features and bug fixes)
KDE Software Announcements
The following new KDE software has been announced this week:- digikam 0.9.0-rc1 (new features and bug fixes)
- K3b 1.0 beta1 (new features and bug fixes)
- KTorrent 2.1beta1 (new features and bug fixes)
KDE Commit-Digest (KDE.News)
The November 26, 2006 edition of the KDE Commit-Digest has been announced. The content summary says: "Dolphin, an alternative file manager, is imported into KDE SVN. Work on session management in Kontact becomes visible with the implementation of state remembering for tabs in aKregator. Mailody gets a better SMTP implementation, with authentication support. Many functionality improvements in Okular. An experimental generic API for integration of more online music store services (following the example of the Magnatune implementation) is proposed and developed in Amarok. Continued speed and memory optimisations in KOffice and KDE 4 (via. kdelibs)."
Xorg Software Announcements
The following new Xorg software has been announced this week:- randrproto 1.2.0 (new features)
- rendercheck 1.2 (new features and bug fixes)
- xf86-video-s3 0.5.0 (bug fix)
Encryption Software
GnuPG 2.0.1 released
Stable version 2.0.1 of GNU Privacy Guard (GnuPG) has been released. "This is maintenance release to fix build problems found after the release of 2.0.0 and to fix a buffer overflow in gpg2". LWN recently looked at the new features in GnuPG 2.0.0.
Dirmngr 1.0.0 released
Dirmngr version 1.0.0 is out with bug fixes. "Dirmngr is a server for managing and downloading certificate revocation lists (CRLs) for X.509 certificates and for downloading the certificates themselves. Dirmngr also handles OCSP requests as an alternative to CRLs. Dirmngr is either invoked internally by gpgsm (from GnuPG-2) or when running as a system daemon through the dirmngr-client tool."
Financial Applications
SQL-Ledger 2.6.20 released
Version 2.6.20 of SQL-Ledger, a web-based accounting package, is out with several bug fixes. See the What's New document for change details.
Games
News on The Saga of Ryzom and Nevrax going into receivership
Quim Rovira has sent in news on the creation of the Free Ryzom Project. "A pro-opensource user community has started an initiative targeting to set one of the most popular MMORPGs free under the terms of the General Public License. It started when the company behind The Saga of Ryzom, and service provider for the online game, called Nevrax, announced on Monday 20th November on ryzom.com official web page that they are entering a liquidation process, entering negotiations with interested companies whom might take over the current project. Facing this situation, players, some old nevrax team members and other opensource sympathisers have positioned in favor of a free software alternative for the game."
Frozen-Bubble 2.1.0 released
Version 2.1.0 of the game Frozen-Bubble has been announced. "Frozen-Bubble 2.1.0 is released to fix all the bugs encountered in 2.0.0 (all reported aborts should be fixed) and add a few interesting small features."
Graphics
pycairo 1.2.6 released
Version 1.2.6 of pycairo, a set of Python bindings for Cairo graphics library, has been announced, it features bug and build fixes and a few method changes.
GUI Packages
pyFltk 1.1.1 announced
Version 1.1.1 of pyFltk, the Python language interface to the Fast Light ToolKit, has been announced. "This is a maintenance release, containing various bug fixes, improved memory management, and the fixing of several compilation issues."
Imaging Applications
giv 0.3.16 released
Version 0.3.16 of giv, the G(reat|tk|NU) Image Viewer, is out with bug fixes and other improvements. See the change log for more information.
Interoperability
Wine 0.9.26 released
Version 0.9.26 of Wine has been announced. Changes include: Better support for Unix locale settings, Improved X11 keyboard support, Various MSI fixes, Winecfg improvements and Lots of bug fixes.
Music Applications
Jackbeat 0.6 announced
Version 0.6 of Jackbeat, an audio sequencer, is out. Changes include improvements to the drum machine interface, improvements to the JACK realtime thread, completion of the OS X port, and bug fixes.
Office Suites
First KOffice 1.6 Maintenance Release Available (KDE.News)
KDE.News has posted an announcement for the first KOffice 1.6 maintenance release. "Many bugs in Kexi and Krita as well as in most other components were fixed, thanks to the helpful input of our users. We also have updated languages packs."
Video Applications
ARToolKit 2.72 released (SourceForge)
Version 2.72 of the Augmented Reality Tool Kit (ARToolKit), a video capture toolkit, is out. "ARToolKit 2.72 contains a number of improvements over previous releases, with several of these focussed on the video capture libraries. Wayne Piekarski and Hartmut Seichter have substantially updated the Linux video input and added Pointgrey and Gstreamer video capture."
Schrodinger 0.3.0 released
Stable version 0.3.0 of Schrodinger has been announced. "Schrodinger is an implementation of the Dirac video codec, a modern wavelet-based video codec. It features both an encoder and a decoder and GStreamer plugins. Mappings have also been developed for putting Dirac into both the Ogg container format and the MPEG Transport stream container format."
Miscellaneous
gMobileMedia 0.1.2 released
Version 0.1.2 of gMobileMedia is out with usability improvements. "gMobileMedia is a simple gtk application used to browse and handle a mobile phone filesystem, it can handle phones with more than one memory area (thanks to gammu)." gMobileMedia is primarily targeted at Nokia cell phones.
OmegaT 1.6.1 released (SourceForge)
Version 1.6.1 of OmegaT has been announced. "OmegaT is a free and open source multiplatform Computer Assisted Translation tool with fuzzy matching, translation memory, keyword search, glossaries, and translation leveraging into updated projects. Didier Briel kindly contributed a file filter for HTML Help Compiler files. That, together with an important bug fix and a couple minor enhancements, gave us enough reason to get another release out, so here's OmegaT version 1.6.1."
Languages and Tools
Caml
Caml Weekly News
The November 28, 2006 edition of the Caml Weekly News is out with new Caml language articles.
Haskell
Haskell Weekly News
The November 22, 2006 edition of the Haskell Weekly News is online. This week a new release of the Haskell XML Toolbox, and details for the inaugural Haskell Hackathon are announced. And the HWN half century of issues is on the board!Haskell Weekly News
The November 28, 2006 edition of the Haskell Weekly News is online. Automated testing fever strikes the Haskell camp, with three new QuickCheck-related libraries and tools released.
Perl
This week on the Perl 6 mailing lists (O'Reilly)
The November 19-25, 2006 edition of the Weekly Perl 6 mailing list summary is out with coverage of the latest Perl 6 developments.
Python
Dr. Dobb's Python-URL!
The November 27, 2006 edition of Dr. Dobb's Python-URL! is online with a new collection of Python article links.python-dev Summary
The python-dev Summary is out with coverage of the python-dev mailing list for the period of October 16-31, 2006.python-dev Summary
The python-dev Summary is out with coverage of the python-dev mailing list for the period of November 1-15, 2006.The Python Papers
Volume 1, Issue 1 of The Python Papers is available for free download. "This issue covers Python programming idioms and MontyLingua, an integral part of ConceptNet which is currently the largest commonsense knowledge base."
Tcl/Tk
Dr. Dobb's Tcl-URL!
The November 28, 2006 edition of Dr. Dobb's Tcl-URL! is online with new Tcl/Tk articles and resources.
Build Tools
CMake 2.4.4 available
Version 2.4.4 of CMake, a cross-platform version of Make, is out with a long list of new capabilities and bug fixes.
IDEs
JasperSoft Integrates iReport into Eclipse (SourceForge)
JasperSoft Corporation has announced the integration of the iReport Plug-in with the Eclipse platform. iReport includes: "a graphical report designer that lets developers using Eclipse quickly add sophisticated reports to their applications. JasperSoft's new Eclipse plug-in, as well as the iReport designer application and the JasperReports reporting libraries are all freely available for download and use under open source licenses."
Page editor: Forrest Cook
Linux in the news
Recommended Reading
Why We Need an Open Source Second Life (Linux Journal)
Glyn Moody writes about the game Second Life, on Linux Journal. "Unless you have been living under a rock for the six months, you will have noticed that the virtual world Second Life is much in the news. According to its home page, there are currently around 1,700,000 residents, who are spending $600,000 - that's real, not virtual, money - in the world each day. These figures are a little deceptive - there are typically only 10,000 to 15,000 residents online at any one time, and the money flow is not a rigorous measurement of economic activity - but there is no doubt that Second Life is growing very rapidly; moreover, we are beginning to see it enter the mainstream in a way that has close parallels with the arrival of the Web ten years ago."
Novell CEO gives behind-the-scenes account of deal with Microsoft (ComputerWorld)
ComputerWorld talks with Novell CEO Ron Hovsepian. "We never changed our position. All I cared about was, I lost a deal with a large retailer to Microsoft for the first time about 12 or 18 months ago. It was going to be an all-Linux deal, and I lost it because they were unduly influenced, in my opinion, to be fearful of these [IP and indemnity issues]. From my point of view that was really too bad, because Linux lost. Then I watched it happen three more times."
IBM sees Novell/MS deal benefiting Linux (Linux-Watch)
Linux-Watch talks with Scott Handy, IBM's Vice President of Worldwide Linux and Open Source, about the Novell/Microsoft patent agreement. "Handy put it more strongly, though. From where he sits, Microsoft's Novell deal indicates that "Microsoft is coming to terms with the fact that Linux is an unstoppable force in the marketplace." Rosenthal continued, "Unfortunately, embedded in Microsoft's recent endorsement of Linux are claims regarding customers' needing protection from patent attack. Those claims are baseless."
Trade Shows and Conferences
Mobility, web services, and kernel development: open source innovations at the FOSS.in conference (LinuxWorld.com)
LinuxWorld.com covers FOSS.in, India's premiere Free and Open Source Software conference. "The FOSS.in conference, since its 2001 launch, has been scaling up to tap into some of the best tech presentations from across the globe, as also the growing Indian digirati scattered worldwide. Sirtaj Singh Kang, who is of Indian origin and now based in Australia, is back to FOSS.in for the sixth time. Commented corporate computing strategist Atul Chitnis, "He is the closest we have in India to having a FOSS superstar..." The initials FOSS stand for "Free and Open Source Software.""
Software patent conference outlines problems, possible solutions (NewsForge)
NewsForge covers the "Software Patents: A Time for Change?" conference. "On November 17, Boston University Law School and Massachusetts Institute of Technology hosted the "Software Patents: A Time for Change?" conference. A unique gathering of geeks and lawyers, the 10-hour conference consisted of a series of panels ranging from the perceived problems with software patents to possible solutions."
Linux Adoption
French parliament dumping Windows for Linux (ZDNet)
ZDNet reports that the French parliament is about to put Linux on its desktops. "The project, backed by parliament members Richard Cazenave and Bernard Carayon of the Union for a Popular Movement party, will see 1,154 French parliamentary workstations running on Linux, with OpenOffice.org productivity software, the Firefox Web browser and an open-source e-mail client."
Linux at Work
More than a toy, PlayStation 3 does Linux (InfoWorld)
InfoWorld reports on efforts to run Fedora Core 5 on the Sony PlayStation 3 platform. "If you're one of the fortunate few to have scooped up a Sony PlayStation 3 (and not gotten mugged in the process), and you're looking for a tax break, I have some good news: You might be able to count your new "toy" as a business expense. Seems that Sony was good enough to make available a download called Open Platform for PlayStation 3, which enables users to install third-party apps on their PS3s. Some Linux enthusiasts are already taking advantage of it by loading their shiny new systems with Fedora Core 5 OS."
Legal
Attribution may matter (in open source licensing) (ZDNet)
Here's a fairly long ZDNet weblog entry by David Berlind on the problem of "open source" licenses which lack OSI approval. "When it originally avoided the OSI's process for certifying the authenticity of its license, SugarCRM set a precedent that others have already followed. If the trend continues (and it shows no signs of abating), the total number of unblessed licenses will at some point out-number the number of blessed ones. If the SPL takes an inch... another unblessed license that takes a mile, or maybe even two will eventually turn up. Sooner or later, 'open source' will become nothing more than a meaningless catch-all phrase that, by virtue of standing for all sorts of licenses (blessed and unblessed), actually ends up standing for none of them."
Kurdish Ubuntu under investigation in Turkey
It would appear that an effort to localize the Ubuntu distribution for the Kurdish language has come under investigation in Turkey. Relatively vague press reports can be found on Wikinews and Kurdish Info. "The Diyarbakir Chief Public Prosecutor's Office yesterday launched an investigation into Sur Mayor Abdullah Demirbas who commissioned a Kurdish language version of a widely used computer program." There is also an article in Turkish which is said to cover the situation.
SPI set to settle long-standing domain name dispute (Linux.com)
Linux.com looks at Software in the Public Interest (SPI). "Software in the Public Interest (SPI) is a non-profit organization dedicated to further the interests of free hardware and software. It is best-known as the public face of Debian. However, after several years of relative inactivity, SPI is getting its affairs in order and expanding to include other projects. At its November meeting yesterday, the SPI board of directors discussed a wide range of topics, from the status of talks with potential member projects, the removal of an apparently defunct project, and the issue of the Debian trademark in Spain. Most importantly, the board resolved to settle at its next meeting a domain name dispute with the Open Source Initiative (OSI) that dates backs to 1998."
Interviews
Another 15 years of Java: JBoss' Fleury on the GPL, IBM, patents and Microsoft (LinuxWorld.com)
LinuxWorld.com talks with Marc Fleury, the founder and leader of the JBoss Division of Red Hat. "From the point of view of the free software movement "it is very good news that Java has been GPL'd, because it creates a protection in terms of intellectual property around the Java Virtual Machine [JVM]." Fleury believes that JVM will evolve more rapidly under the influence of the open source community, but that Sun will benefit by retaining control of the branding "and that's a good thing" for JBoss, for the developers, and for the open source community."
Resources
BluWiki Vendors page
BluWiki has a new vendors wiki page that contains information on computer hardware. The site includes information on the availability of open-source drivers, FOSS friendliness and more. (Thanks to Fred.)New online class teaches basic Linux for free (DesktopLinux.com)
DesktopLinux.com reports on the availability of the free online course An Introduction to Linux Basics. "LinuxBasic.org, an online community devoted to helping people learn to install and run Linux, has announced its second free Linux class. "An Introduction to Linux Basics" aims to instill a basic understanding about Linux for beginners who want to know more about how the system works, according to the site. Advanced Linux users will find an opportunity to dig deeper into some areas they always wanted to know more about or to fill gaps in their knowledge, according to Stefan Waidele of the LinuxBasic.org team."
Anatomy of Postfix (Linux Journal)
Ralf Hildebrandt and Patrick Koetter present an excerpt from The Book of Postfix in a Linux Journal article. "Developed with security and speed in mind, Postfix has become a popular alternative to Sendmail. The Book of Postfix published by No Starch Press is a complete guide to Postfix whether used by the home user, as a mailrelay or virus scanning gateway, or as a company mailserver. Practical examples show how to deal with daily challenges like protecting mail users from SPAM and viruses, managing multiple domains, and offering roaming access. The following is chapter 5 from "The Book of Postfix"."
Miscellaneous
Behind the scenes at GNOME's Web site revision (Linux.com)
Linux.com looks at GNOME project web site rejuvenation. "Like any large organisation, the GNOME Project faces a formidable challenge in maintaining an effective Web site. Trying the balance the demands of promotion, documentation, and community coordination is made all the more difficult when you only have volunteers to do the work. But over the past year the GNOME community has developed and begun to execute a well-defined process to refocus and rejuvenate its much-neglected Web presence."
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
Open letter to Novell
Bruce Perens has written an open letter to Novell and is collecting signatures (more than 1500 so far). "The Open Source community would find little to criticize in your agreement with Microsoft, had it remained a strictly financial and technical agreement. As the agreement stands today, it betrays the authors of the software you re-market and their users worldwide for Novell's sole commercial benefit."
ODF Alliance Hails Brazil, India, Italy, and Poland for Recognizing ODF
The OpenDocument Format Alliance has commends Brazil, India, Italy, and Poland for adopting the OpenDocument Format. "(ODF Alliance), a broad cross-section of organizations, academia and industry dedicated to improving access to electronic government documents, today applauded Brazil's decision to recommend ODF as the government's preferred format; India's decision to use ODF at a major state government agency; and Italy's decision to recognize ODF as national standard."
Commercial announcements
Acronis Joins Red Hat ISV Partner Program
Acronis, Inc. has announced its joining with the Red Hat ISV Partner Program. "The original Linux disk imaging and bare-metal restore solution on the market, Acronis True Image Server for Linux provides locally managed online server backup, server disk imaging and bare-metal restore solution for servers running Red Hat Enterprise Linux, as well as other Linux distributions."
Agitar Software Establishes Research Fellowship Program
Agitar Software, Inc. announced the Agitar Research Fellowship program. "The program aims to provide financial sponsorship and other forms of support to researchers and open-source contributors working on software testing technology. The initiative will be carried out by AgitarLabs, Agitar's recently established division for research and advanced development. The Agitar Research Fellowship program is open to advanced Ph.D. students and independent researchers working in the areas of software testing and program analysis."
Linspire partners with Business International
Linspire, Inc. has announced a partnership with Business International. "Linspire, Inc., developer of the commercial desktop Linux operating system of the same name announced a strategic partnership today with Business International to bring Linspire's desktop Linux operating system to the Middle East and African markets. The partnership announcement between Linspire and Business International was made at this years GITEX Dubai 2006 Trade Show, one of the world's top three IT exhibitions. former Microsoft ME Executive, Mohamad Jarrar, Business International is positioned to bring desktop Linux to the growing emerging markets in the Middle East and African countries."
Novell launches 'Desktop-to-Data Center' management solutions
Novell, Inc. has announced its desktop-to-data center management initiative. "Novell today announced the first offerings of its desktop-to-data center management initiative, including the availability of a comprehensive set of solutions which orchestrate the management of virtual machines, high-performance computing and other IT resources. Following the agreement with Microsoft* earlier this month, these offerings are the next steps in Novell's plan to deliver on its vision of interoperable, cross-platform management solutions."
OSDL Mobile Linux Initiative Gains Another Heavy Hitter
Open Source Development Labs has announced its latest MLI member, Datang Mobile. OSDL "... today announced that Chinese handset manufacturer Datang Mobile will join OSDL as an active member of the Mobile Linux Initiative (MLI). Datang Mobile is a leading communication equipment provider in China and in markets around the globe. "Linux is being deployed on mobile devices shipped in China at a much higher rate than in any other region," said Stuart Cohen, CEO of OSDL. "Datang Mobile will bring increased representation from one of the most active and dynamic markets in the world, and its technical and business expertise will accelerate the adoption of Mobile Linux.""
Rivet Software to Open Source Dragon View XBRL Viewer
Rivet Software has announced plans to release its Dragon View XBRL viewer application as open-source software. "Dragon View is the first commercially available client-based application that allows business professionals to easily review XBRL taxonomy and financial document information. Rivet plans to release its source code to the open source community in Q1 of 2007 to encourage the establishment of new communities for open source development of XBRL technology."
New Books
Addison-Wesley Professional publishes The Ruby Way, 2nd Edition
Addison-Wesley Professional has announced the publication of The Ruby Way, 2nd Edition by Hal Fulton.Sams Announces New Ajax/Python Books
Sams Publishing has published the books Ajax for Web Application Developers by Kris Hadlock and Python Phrasebook (Essential Code and Commands) by Brad Dayley.
Contests and Awards
LPI creates voucher contest for LPIC-3 volunteers
The Linux Professional Institute has announced a voucher contest for LPIC-3 certification exam contributors. "The Linux Professional Institute invites all Linux professionals to participate in the creation of their enterprise level LPIC-3 certification. The contest asks for IT professionals to complete a Job Task Analysis survey which will assist in the creation of a psychometrically-valid certification program. The Job Task Analysis (JTA) survey asks participants to determine how often a specific task is peformed as an IT professional (or understanding of the same) and how important it is to know the specific task or concept." Selected contributors will win a free LPIC-3 exam voucher.
Nokia Foundation Award to Marten Mickos
Nokia has announced the winning of a EUR 10,000 Nokia Foundation Award by Marten Mickos. "Marten Mickos has strong merits in the leadership positions of international high-tech companies. Since 2001, he has been CEO of the Open Source company, MySQL. Mickos is known as a strong advocate of the Open Source community and MySQL has been at the forefront of developing successful business around open source."
Calls for Presentations
Debian Miniconf at linux.conf.au 2007
A call for participation has gone out for the sixth Debian Miniconf, the event will be held in conjunction with the linux.conf.au 2007 on January 15-20, 2007 in Sydney, Australia.MySQL MiniConf at linux.conf.au 2007 cfp
A call for participation has gone out for the second MySQL Miniconf, the event will take place in Sydney, Australia on January 15 prior to linux.conf.au 2007.Make Art 2007 - call for participation
A call for participation has gone out for Make Art 2007, submissions are due by December 9. "Make Art is an international festival dedicated to the integration of free/libre and open source software in electronic arts. The second edition of Make Art will take place in Poitiers (FR), from the 2nd to the 8th of April 2007. Make Art offers performances, exhibitions, lectures and workshops, focused on the blurred line between art and software programming. The event is dedicated to artists who create their own tools, and apply the same rules to art as to free software development. We're currently seeking new, innovative FLOSS based works and projects: performances, lectures, software presentations, installations..."
Ruby and Python Conference 2007
The Ruby & Python Conference 2007 will take place on April 14 and 15, 2007 in Poznan, Poland. "... the idea behind it is to put together experts with young programmers and to support a good communication channel for East-West exchange of prospective ideas. If you think you have something interesting to present or some ideas to share with other enthusiasts, we would be more then happy to welcome you as a Speaker."
SCALE Call for papers (LinuxMedNews)
LinuxMedNews has announced a call for papers for the Open Source Health Care Summit, which will be part of the Southern California Linux Exposition (SCALE). SCALE will take place on February 9, 2007 in Los Angeles, CA, abstracts are due by December 29. "Generally we are interested in seeing solid presentations of the application of Free and Open Source Software to the healthcare environment. If you are doing something innovative that the world needs to know about, this is your opportunity!"
Upcoming Events
Countdown to linux.conf.au 2007
The 48 day countdown to linux.conf.au has been posted. "We've been leaping out of our skins to reveal our first keynote speaker, and now we can! He's a scholar and a gentleman, and leads a double life as a kernel hacker extraordinaire. Without this man, we may have missed an entire generation of kernel hackers, and certainly wouldn't have had a penguin to go with our GNU -- that's right... We're going to make you click through to find out who!"
Linux Installfest workshop in Davis, CA
The next LUGOD Linux Installfest workshop will be held in Davis, California on December 2, 2006.North America Mtn Summit announced
The North America Mtn Summit will take place on February 5-11 2007 in Mountain View, CA. "Okay, time to just go for it. I hereby declare that Mtn Summit 2007, North American edition, will be held February 5-11 in Mountain View. Be there or... don't be there. But you'll totally be missing out on balmy California weather, seeing core monotone developers scribbling madly on whiteboards, and the famous Google Cafeteria!"
PHP Conference Brasil
PHP Conference Brasil will take place in Sao Paulo, Brazil on December 1-2, 2006.Ruby Related Conference Announcements (Linux Journal)
Linux Journal has announced two new Ruby conferences. QCon will take place in London, England on March 12-16, 2006 and the first MountainWest RubyConf will be held on March 16 and 17, 2007.Events: December 7, 2006 to February 5, 2007
The following event listing is taken from the LWN.net Calendar.
| Date(s) | Event | Location |
|---|---|---|
| December 3 December 8 |
Large Installation System Administration Conference | Washington, D.C. |
| December 5 December 8 |
Open Source Developers' Conference 2006 | Melbourne, Australia |
| December 7 December 8 |
Desktop Architects Meeting | Portland, OR, USA |
| December 9 | London Perl Workshop | London, England |
| December 12 December 19 |
Virtual Congress UnInet Meeting UMeet'2006 | irc.uninet.edu, #linux |
| December 27 December 30 |
23rd Chaos Communication Congress 2006 | Berlin, Germany |
| January 11 January 12 |
Foundations of Open Media Software | Sydney, Australia |
| January 15 January 20 |
linux.conf.au 2007 | Sydney, Australia |
| January 20 January 26 |
Cell Hack-a-thon | Loveland, CO, USA |
| January 23 January 26 |
Open Source Meets Business | Nürnberg, Germany |
| January 24 | European Patent Conference | Brussels, Belgium |
| January 30 February 1 |
Solutions Linux Expo | Paris, France |
| February 1 February 2 |
LinuxDays Luxembourg | Luxembourg, Luxembourg |
| February 2 | FUDCon Boston 2007 | Boston, MA, USA |
If your event does not appear here, please tell us about it.
Event Reports
Transcripts of recent GPLv3 conference are online
Transcripts from GPLv3 conference speeches by Richard Stallman and Ciaran O'Riordan have been published.
Audio and Video programs
Watch Eben Moglen's Plone Conference Keynote Address
FSF General Counsel Eben Moglen's Plone Conference Keynote Address is available online. "In front of a standing-room-only crowd of over 350 Plone users and developers, Eben delivered an inspiring and wide-ranging talk that traced the connections between the free software movement, the One Laptop Per Child project, and the past three hundred years of modern industrial economic development, and placed our work into the larger context of the ongoing journey towards freedom and equality for all people."
RubyConf*MI Videos Now on the Web (Linux Journal)
Pat Eyler has announced the videos from the summer 2006 RubyConf*MI event. "Well, this is some news I've been wanting to share for a while, but I've had to wait until everything was ready. During the summer, I spoke at RubyConf*MI, one of the first regional Ruby Conferences (I think San Diego held the only one earlier than the Michigan folks). At the time, they filmed all the presentations."
Share groups across Active Directory and Linux (Network World)
Network World presents an mp3 podcast with Gerald Carter. "With the latest Samba, you can populate one group on a Linux system with some members from the local system, others from Microsoft Active Directory. Since it works a lot like local groups in Microsoft Windows, now Linux and Windows administrators will be able to share the task of managing users and groups. Gerald (Jerry) Carter covers some techniques that he'll be explaining at the upcoming LinuxWorld Open Solutions Summit in New York City."
Page editor: Forrest Cook