linux.conf.au 2007

The seventh linux.conf.au, held in Sydney, has run its course. Your editor has written several articles based on what was discussed there, but they do not even begin to do justice to this event. In an attempt to fill in some of the gaps, this article will cover some of the remaining high points, from your editor's point of view.

One interesting talk was Jono Bacon's discussion of Jokosher, a relatively new entrant into the crowded field of audio recording and editing tools. Jono wanted a simple and useful tool to help in the creation of podcasts and his particular variety of frenetic metal music, but the currently-available studio tools were rather intimidating in their complexity. So he made a new one, giving a lot of thought in the process to how it might actually be used. Jokosher features a simpler waveform display, large buttons (easy to hit by a standing guitarist), tools which don't clutter the display when they are not relevant, etc. Version 0.2 is usable; there is a 0.9 release coming soon. Your editor has not yet had a chance to play with Jokosher, but it's on the list for that mythical day (always next month) when he has some free time.

Virtualization was a hot topic at the event - registrations for the associated miniconf exceeded those for the Debian miniconf, the first time Debian has ever been upstaged. During the main conference, Rusty Russell, Jeremy Fitzhardinge, Zachary Amsden, and Chris Wright all got together to present the Lguest, Xen, and VMI technologies. It was good to see that many developers from competing projects (competing for business as well as for developers and mindshare) having fun together on stage, even if the short time slot did not allow for the conveyance of a great deal of technical information. Given the level of interest in Lguest, it really should have had a session of its own. An unexpected lesson from this session concerned the hazards of leaving a popup-enabled IRC client running on a network-connected laptop during a presentation. One does not normally expect one's slides to turn into a real-time wiki. The audience is to be commended for its restrained and tasteful use of this new communication path.

The kernel miniconf was well attended - to the point that it displaced Debian from the largest room. Your editor attended a panel session where various topics of interest were discussed. On Xen: "crap is good - it shows you how not to do stuff." The ongoing maintenance of 2.6.16 was described as "mostly irrelevant" and "a nice try." The developers expressed their general happiness with the new development model, and Linus Torvalds claimed that there would only be a 2.7 kernel when some smart new hacker wrests control of the kernel away. David Miller noted that he does miss the old development kernels, however; it is harder now to make major changes which break things for long periods of time. There was also a session on suspend and resume where a couple of laptops were made to work - with Linus, at one point, getting up and jumping into the process.

Open Day

A true high point of the conference was "Open Day," a sort of exhibit populated by people doing truly interesting things with Linux and more. The event was open to the public, with the hope that children, in particular, would attend. The display of enthusiasm, ingenuity, and just plain fun was breathtaking; it was an expression of the spirit which infuses the entire conference. Open Day showed off games (TuxRacer, Stepmania, Wesnoth, etc.), a home-made Segway-like device, serious amateur rocketry, the Qtopia Green Phone, Blender, MythTV, and much more. RepRap was worth the price of admission by itself; RepRap is a 3D printer which can create its own parts - and which is powered by free software, of course.

The reaction from participants and attendees was strong - it is hard not to be swept away by that many people passionately doing amazing things. Open Day is a great addition to the LCA program; hopefully next year's conference will do it again.

Andi Kleen talked about the "generations" of kernel hackers and how well they work with the development process. The Janitor Generation does useful work, but there needs to be better ways of graduating janitors to more complex projects. The "login name tree" generation created a proliferation of specialized kernel trees - useful before the arrival of BitKeeper, when the patch submission process was much more lossy. The "Russian mathematician" generation will be familiar to anybody who watches the kernel lists; Andi suspects that some of them are actually a room full of hackers working under a single name. The "deadline generation" has been brought about by the new kernel development process: there is now significant pressure for maintainers to get their patches in during the brief merge window period. Andi complains that kernel development used to be more relaxed before the merge window came into existence. The "bugmaster generation," alas, does not exist yet; it's an opportunity for somebody to become famous.

The final keynote was presented by Kathy Sierra, who is, perhaps, better known in the Java community. She talked about how to create passionate users - those who will put free software on their desktops and get their friends to do it as well. The ideas presented are the sort which seem obvious after the fact (help users "suck less" at what they do, provide "levels" like games do to reward increasing expertise, make a supportive community), but, all together, they make a compelling picture of how we can develop more empathy for our users and bring more people in. The talk was well received, and rightly so.

Linux.conf.au hit some interesting milestones this time around. At some 800 attendees, it was by far the largest LCA event yet. Even more significant is the fact that a full 10% of those attendees were female. Any community which feels that 10% female participation is worthy of celebration clearly has some ground to cover yet, but that's where we stand. 10% is a step in the right direction and a base from which the community can work to fully include a group of people whose energy and perspective is sorely needed.

It is hard to imagine an event better suited to bringing people into our community in general. Your editor has attended quite a few Linux and free software events on a number of continents, but there are few which bring together the combination of serious technology, community, and flat-out fun found at LCA. The LCA formula, which involves a fresh group of volunteers running the show with guidance from past veterans, does well at preserving a successful model while bringing in new energy and ideas. The result is one of the most vibrant, vital, and (increasingly) important free software events anywhere on the planet. Your editor hopes to be lucky enough to report from LCA2008 (to be held in Melbourne) next year.

[Postscript: one of the standout performances in this nearly flawlessly run conference is the group, led by Silvia Pfeiffer, which recorded the presentations. Recordings hit the web site while the conference was still open, and the rest are being added quickly. See the program page to view the talks - in free formats, of course.]

Comments (4 posted)

LCA: Andrew Tanenbaum on creating reliable systems

Andrew Tanenbaum is a huge figure in the field of computer science; developers who work in the area of operating systems tend to have at least one of his books on their shelf. Linus Torvalds also occupies a prominent position. But when these two people are discussed together, the topic is almost always the famous debate between the two which happened early in the history of Linux. Mr. Tanenbaum called Linux "obsolete," and made it clear that he would not have been proud to have Mr. Torvalds as a student; Linus made some choice comments of his own in return.

So it was pleasant to see Andrew Tanenbaum introduced in Sydney by none other than Linus Torvalds. According to Linus, Andrew introduced him to Unix by way of Minix. Minix also convinced Linus (wrongly, he says) that writing an operating system was not hard. The similarities between the two, he said, far outweigh any differences they may have had.

The talk began with a quoting of Myhrvold's laws: (1) software is a gas which expands to fill its container, and (2) software is getting slower faster than hardware is getting faster. Software bloat, he says, is a huge problem. He discussed the size of various Windows releases, ending up with Windows XP at 60 million lines. Nobody, he says, understands XP. That leads to situations where people - even those well educated in computer science, do not understand their systems and cannot fix them.

The way things should be, instead, is described by the "TV model." Generally, one buys a television, plugs it in, and it just works for ten years. The computer model, instead, goes something like this: buy the computer, plug it in, install the service packs, install the security patches, install the device drivers, install the anti-virus application, install the anti-spyware system, and reboot...

...and it doesn't work. So call the helpdesk, wait on hold, and be told to reinstall Windows. A recent article in the New York Times reported that 25% of computer users have become so upset with their systems that they have hit them.

So what we want to do is to build more reliable systems. The working definition of a reliable system is this: a typical heavy user never experiences a single failure, and does not know anybody who has ever experienced a failure. Some systems which can meet this definition now include televisions, stereos, DVD players, cellular phones (though some in the audience have had different experiences), and automobiles (at least, with regard to the software systems they run). Reliability is possible, and it is necessary: "Just ask Grandma."

As an aside, Mr. Tanenbaum asked whether Linux was more reliable than Windows. His answer was "probably," based mainly on the fact that the kernel is much smaller. Even so, doing some quick back-of-the-envelope calculations, he concluded that there must be about 10,000 bugs in the Linux kernel. So Linux has not yet achieved the level of reliability he is looking for.

Is reliability achievable? It was noted that there are systems which can survive hardware failures; RAID arrays and ECC memory were the examples given. TCP/IP can survive lost packets, and CDROMs can handle all kinds of read failures. What we need is a way to survive software failures too. We'll have succeeded, he says, when no computer comes equipped with a reset button.

It is time, says Mr. Tanenbaum, to rethink operating systems. Linux, for how good it is, is really a better version of Multics, a system which dates from the 1960's. It is time to refocus, bearing in mind that the environment has changed. We have "nearly infinite" hardware, but we have filled it with software weighed down with tons of useless features. This software is slow, bloated, and buggy; it is a bad direction to have taken. To achieve the TV model we need to build software which is small, modular, and self-healing. In particular, it needs to be able to replace crashed modules on the fly.

So we get into Andrew Tanenbaum's notion of "intelligent design," as applied to software. The core rules are:

• Isolate components from each other so that they cannot interfere with each other - or even communicate unless there is a reason to do so.

• Stick to the "principle of least authority"; no component should have more privilege than it needs to get its job done.

• The failure of one component should not cause others to fail.

• The health of components should be monitored; if one stops operating properly, the system should know about it.

• One must be prepared to replace components in a running system.

There is a series of steps to take to apply these principles. The first is to move all loadable modules out of the kernel; these include drivers, filesystems, and more. Each should run as a separate process with limited authority. He pointed out that this is beginning to happen with Linux with the interest in user-space drivers - though it is not clear how far Linux will go in that direction.

Then it's time to isolate I/O devices. One key to reliability is to do away with memory-mapped I/O; it just brings too many race conditions and opportunities for trouble. Access to devices is through I/O ports, and that is strictly limited; device drivers can only work with the ports they have been specifically authorized to use. Finally, DMA operations should be constrained to memory areas which the driver has been authorized to access; this requires a higher level of support from the hardware, however.

The third step is minimizing privileges to the greatest extent possible. Kernel calls should be limited to those which are needed to get a job done; device drivers, for example, should not be able to create new processes. Communication between processes should be limited to those which truly need to talk to each other. And, when dealing with communications, a faulty receiver should never be able to block the sender.

Mr. Tanenbaum (with students) has set out to implement all of this in Minix. He has had trouble with people continually asking for new features, but, he has been "keeping it simple waiting for the messiah." That remark was accompanied with a picture of Richard Stallman in full St. Ignucious attire. Minix 3 has been completely redesigned with reliability in mind; the current version does not have all of the features described, but 3.1.3 (due around March) will.

Minix is a microkernel system, so, at the bottom level, it has a very small kernel. It handles interrupts, the core notion of processes, and the system clock. There is a simple inter-process communication mechanism for sending messages around the system. It is built on a request/reply structure, so that the kernel always knows which requests have not yet been acted upon.

There is also a simple kernel API for device drivers. These include reading and writing I/O ports (drivers do not have direct access to ports), setting interrupt policies, and copying data to and from a process's virtual address space. For virtual address space access, the driver will be constrained to a range of addresses explicitly authorized by the calling process.

Everything else runs in user mode. Low-level user-mode processes include the device drivers, filesystems, a process server, a "reincarnation server," an information server, a data store, a network server (implementing TCP/IP), and more. The reincarnation server's job is to be the parent of all low-level system processes. It gets notified if any of them die, and occasionally pings them to be sure that they are still responsive. Should a process go away, a table of actions is consulted to see how the system should respond; often that response involves restarting the process.

If, for example, a disk driver dies, the reincarnation server will start a new one. It will also tell the filesystem process(es) about the fact that there is a new disk driver; the filesystems can then restart any requests that had been outstanding at the time of the failure. Things pick up where they were before. Disks are relatively easy to handle this way; servers which maintain a higher level of internal or device state can be harder.

A key point is that most operating system failures in deployed systems tend to result from transient events. If a race condition leads to the demise of a device driver, that same race is unlikely to repeat after the driver is restarted. Algorithmic errors which are repeatable will get fixed eventually, but the transient problems can be much harder to track down. So the next best thing is to be able to restart failing code and expect that things will work better the second time.

There were a number of performance figures presented. Running disk benchmarks while occasionally killing the driver had the unsurprising result of hurting performance a bit - but the system continued to run. Another set of numbers made the claim that the performance impact of the microkernel architecture was on the order of 5-10%. It's worth noting that not everybody buys those numbers; there were not a whole lot of details on how they were generated.

In summary, Mr. Tanenbaum listed a number of goals for the Minix project. Minix may well be applicable for high-reliability systems, and for embedded applications as well. But, primarily, the purpose is to demonstrate the the creation of ultra-reliable systems is possible.

The talk did show that it is possible to code systems which can isolate certain kinds of faults and attempt to recover from them. It was an entertaining and well-presented discussion. Your editor has not, however, noticed a surge of sympathy for the idea of moving Linux over to a microkernel architecture. So it is not clear whether the ideas presented in this talk will have an influence over how Linux is developed in the future.

Comments (87 posted)

LCA: Updates on the X Window System

The X Window System is, in some sense, the kernel of our graphical desktop systems; it controls access to the hardware and ensures that applications play well together. So the capabilities provided by X matter, and that importance can only increase as free software developers work toward the creation of more complete and compelling desktop experiences. Keith Packard gave a couple of talks at linux.conf.au in Sydney on where X is going; your editor had no choice but to be there and listen.

In its early days, X would normally be run on some sort of Unix workstation. The display hardware in use in those days was not normally expected to change while X was running - or over the life of the system in general. One connected The Monitor to The Adapter and things stayed that way forevermore. So the X protocol was set up to enumerate all of the available screens whenever an application made its connection. There was no way to add more screens on the fly or change their geometry, and there was no way to move windows from one screen to another. Fixing this was a hard problem.

As graphics hardware has become more powerful and flexible, a number of extensions have been developed in an attempt to provide proper support in X. The Xinerama extension uses a clever technique: merging all of the monitors into a single, large, virtual screen. Applications can then move between monitors, because they think they are just moving around on the same screen. The XFree86 VidModeExtension tried to address hardware changes by allowing the video modes to be changed on the fly. Then along came the first version of the Resize and Rotate (RandR) extension, which tried to improve the handling of mode changes and implement rotation - especially useful on handheld devices, where the screen can be used in both landscape and portrait orientations. RandR 1.0 was limited by a policy (imposed by the XFree86 maintainers) that the driver API could not be changed; as a result it was nowhere near as flexible as its developers would have liked.

All of this came together into "a kludge tower of extensions" which was guaranteed to fall down, sooner or later.

Since then, the X Window System has come under new management and the need for display flexibility has continued to grow. Enter RandR 1.2, soon to come to an X server near you. The new RandR release comes with the intention of being able to fully express (and use) the capabilities of the hardware. All configuration options will be brought back together into a single file, and they will all be adjustable at run time. Much of the driver-specific code has been moved back into the core, allowing all hardware to be configured in the same way. This was a much-needed change; according to Keith there are currently five independent Xinerama implementations in the X server.

RandR 1.2 uses a combination of new and old concepts. A "screen" retains its current meaning, and the one big screen is still present. Each screen, however, can work with one or more "CRT controllers," (CRTCs) each of which grabs a rectangular portion of the big screen and sends it to a monitor (highly unlikely to actually be a CRT anymore). Each CRTC, in turn, has one or more outputs which connect to physical devices.

The flexibility of this approach was easily demonstrated on Keith's shiny little laptop. The hardware is able to implement a 2K pixel square screen, which is then scanned by three different CRTCs: the built-in display, the video output, and the (unconnected) TV output. By default, they all look at the same portion of the screen, but, with a little command line magic, that can be changed. So Keith's laptop can display an entirely different set of windows out of each CRTC; the video output can send his talk slides to the projector while the laptop screen shows something else. The display areas can overlap if desired.

If a new monitor is plugged into the system, the RandR code will detect the event and react accordingly. The new output will be turned on and given screen space according to whatever policy is in effect. If need be, the user's desktop area will be expanded to cover a wider display. Similar things happen if a monitor is removed. It all Just Works.

While he was at it, Keith extended RandR to cover some other useful hardware capabilities. These include the ability to configure the gamma lookup table, allowing for on-the-fly contrast and brightness adjustments. Applications can get the monitor's EDID identification data, should they be interested, and parameters like the brightness of the backlight can be tweaked.

The current status is that the protocol and device-independent work are done. The Intel driver works now, and the Radeon driver is "nearly usable." This code is getting ready for people to use. When most people will actually use this code depends on the release schedule, however. At a separate talk (in the middle of the Debian miniconf) Keith covered what's coming up from the X.org project.

Coming soon is the X server 1.2 release. This one looks mostly like a maintenance release; Keith says that a lot of Coverity-found bugs have been fixed. Things have been cleaned up to the point that this release has 40,000 fewer lines of code - but more functionality. Keith noted that the policy of splitting the X drivers from the core server has not worked as well as they would have liked. It adds a whole set of API compatibility issues between the two, making it hard to develop and release improved versions of the server. Keith now thinks that the Linux kernel developers got it right by keeping drivers inside the kernel.

LibX11 1.1.1 is coming soon. The big change there is that the new XCB interface is being used underneath the old Xlib API, making it easy to migrate applications in an incremental manner.

Later on we can expect release 1.2.1 of the X server. This release will include an EXA acceleration implementation "that actually works." The RandR 1.2 code described above will also make its appearance here. Further ahead, the 1.3 release (to be part of a general X.org 7.3 release) will include significant ABI changes. A lot of the "PCI munging" is coming out of the drivers. Yes, he said, this will mess up the proprietary NVidia and ATI drivers. There will also be better support for hotplugging of input devices.

There is a Mesa 6.5.2 release coming with OpenGL 2.0 API support. It also has a new memory manager which can work with the memory management unit found in modern graphics cards; it can do things like map arbitrary regions of host memory into the adapter's address space. Among other things, this means that off-screen objects can be made writable, which will be a big performance win.

On the Intel driver front, the mode setting code has been much improved in recent times. Not surprisingly (considering that Keith works for Intel these days), this driver is the first to have full RandR 1.2 support. All outputs are fully supported, and EXA is as well. Intel has set a goal of having drivers available for new chipsets on the day those chipsets are launched. When asked if Intel planned to start selling discrete adapters, he became very silent, however.

Looking further ahead, the X developers would like to move video card mode setting into the kernel. There are a lot of reasons for doing this, starting with simple robustness. It would also enable better suspend and resume support, and better handling of panics: if the system goes into an oops, an in-kernel mode-setting routine can switch back to a text mode, allowing the oops text to actually be read. There is a lot of interest in supporting multiple, simultaneous X sessions on the same screen without using Linux virtual terminals; the goal here is to enable fast switching between user accounts. And there is interest in H.264 acceleration, facilitating the display of important things like HDTV. It seems that even contemporary CPUs can have trouble keeping up with HDTV streams.

Overall, Keith painted a picture of a revitalized X project which is truly beginning to hit its stride. A lot of work is being done toward the goals of fully supporting current hardware and providing the foundation for the creation of the best desktop available anywhere. One cannot help but look forward to where things will go from here.

Comments (55 posted)

The OpenLiberty Project

A buzzword dense press release announcing a new open source project for 'identity management' is hardly the kind of thing to set hearts to racing. The release did succeed on one level, however, as it made us wonder what the openLiberty project is and what it can do for open source developers. Follow along as we try to shed some light on the world of internet identities and the standards, protocols and organizations involved.

An 'internet identity' means different things to different people; often depending on how they want to use this identity information. A website owner that allows comments has much less strict requirements for what an identity is than a hospital or stock broker might have. Some identities need to be tied to specific individuals, those used for e-commerce, for instance, whereas others can have pseudonymity. Privacy concerns also play a role in that a user does not necessarily always want to provide the same information to all parties they want to establish an identity with; LWN should not (and does not) require your government ID number in order for one to post comments here, but a stock broker might very well need it.

The sponsor of openLiberty is the Liberty Alliance, which is a consortium of vendors that seeks to provide standards for identity-based web services. This organization was started by Sun Microsystems in 2001 as a competitor to Microsoft's Passport (aka Windows Live ID) single sign-on system. At the time, many were concerned that Microsoft would become the gatekeeper of internet identity management and that would likely guarantee that competitors were locked out. Sun put together around 30 vendors and some ideas they had been working on to form the alliance with the plan to provide open, standards-based solutions for identity management.

Since that time, the alliance has come out with various specifications for what is, by all accounts, a complex, centralized system for identity management based around Security Assertion Markup Language (SAML). SAML is an emerging OASIS standard that describes the protocol for identity providers to communicate with service providers to authenticate users. The alliance system is popular with larger organizations that typically have tighter requirements for identity management. Websites and services that have simpler needs have largely used OpenID (LWN article here) to facilitate single sign-on.

The openLiberty project is an attempt to attract more interest, especially from the open source community, in the Liberty system, presumably to help drive more adoption. The website is a portal geared towards developing open source libraries to implement various alliance specifications. The first project is a java client library implementing the Identity Web Services Framework (ID-WSF) to provide single sign-on and other identity-enabled web services. The portal has all the expected features: a blog, a wiki, a mailing list, a source code repository (hosted by sourceforge), etc.

As might be expected of a project that has just been announced, there are few messages in the mailing list archive and the participant list appears to be largely made up of Liberty Alliance members. Based on the wealth of information available on the website, the project has already done a lot of the groundwork to establish the portal. It remains to be seen if it attracts a significant number of non-allied developers. Choosing a java client library to start would seem to eliminate some sizable portion of interested parties; other languages are on the roadmap and that might be enough to lure in non-java developers.

An interesting convergence of identity management solutions seems to be going on in the background right now. Proponents of the different systems all see the benefits of interoperability and there appear to be some efforts underway to allow OpenID and Liberty to work together. There is even talk that Microsoft may join the party and make some kind of effort to interoperate with Liberty.

There are clear benefits to users in having one system to manage their internet identity (or identities) across the universe of web services they might wish to use. Simplicity of implementation for web service providers and differing levels of security for different classes of service are also good features to have. One of the ways to get there is by having competing systems that can interoperate relatively transparently and it seems like we may be headed in that direction.

Comments (1 posted)

centericq: buffer overflow

Package(s):	centericq	CVE #(s):	CVE-2007-0160
Created:	January 24, 2007	Updated:	January 24, 2007
Description:	The code in centericq which interfaces with the LiveJournal service suffers from a buffer overflow. This vulnerability is exploitable if a user can be convinced to connect to an unofficial LiveJournal server.
Alerts:	Gentoo 200701-20 centericq 2007-01-24

Comments (none posted)

ed: symlink attack

Package(s):	ed	CVE #(s):	CVE-2006-6939
Created:	January 19, 2007	Updated:	January 24, 2007
Description:	GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.
Alerts:	rPath rPSA-2007-0012-1 ed 2007-01-23 Fedora FEDORA-2007-100 ed 2007-01-18 Fedora FEDORA-2007-099 ed 2007-01-18

Comments (none posted)

gtk2: denial of service

Package(s):	gtk2	CVE #(s):	CVE-2007-0010
Created:	January 24, 2007	Updated:	February 8, 2007
Description:	From the Red Hat advisory: A bug was found in the way the gtk2 GdkPixbufLoader() function processed invalid input. Applications linked against gtk2 could crash if they loaded a malformed image file.
Alerts:	Mandriva MDKSA-2007:039 gtk+2.0 2007-02-07 Ubuntu USN-415-1 gtk+2.0 2007-02-01 Debian DSA-1256-1 gtk+2.0 2007-01-31 SuSE SUSE-SR:2007:002 neon, gtk2, smb4k, amarok, jboss4 2007-01-26 rPath rPSA-2007-0019-1 gtk 2007-01-25 Red Hat RHSA-2007:0019-02 gtk2 2007-01-24

Comments (1 posted)

java: multiple vulnerabilities

Package(s):	java	CVE #(s):	CVE-2006-4339 CVE-2006-4790 CVE-2006-6731 CVE-2006-6736 CVE-2006-6737 CVE-2006-6745
Created:	January 18, 2007	Updated:	June 4, 2010
Description:	java has multiple vulnerabilities, these include: an RSA exponent padding attack vulnerability, two vulnerabilities which allow untrusted applets to access data in other applets, vulnerabilities that involve applets gaining privileges due to serialization bugs in the JRE and buffer overflows in the java image handling routines that can give attackers read/write/execute capabilities for local files.
Alerts:	Gentoo 201408-19 openoffice-bin 2014-08-31 Pardus 2010-67 openoffice 2010-06-04 Gentoo 200705-20 blackdown java 2007-05-26 Red Hat RHSA-2007:0073-01 java 2007-02-09 Red Hat RHSA-2007:0072-01 ibmjava2 2007-02-08 Red Hat RHSA-2007:0062-02 java-1.4.2-ibm 2007-02-07 Gentoo 200701-15 Sun JDK/JRE 2007-01-22 SuSE SUSE-SA:2007:010 IBMJava2 2007-01-18

Comments (1 posted)

netrik: insufficient escaping

Package(s):	netrik	CVE #(s):	CVE-2006-6678
Created:	January 22, 2007	Updated:	January 24, 2007
Description:	It has been discovered that netrik, a text mode WWW browser with vi like keybindings, doesn't properly sanitize temporary filenames when editing textareas which could allow attackers to execute arbitrary commands via shell metacharacters.
Alerts:	Debian DSA-1251-1 netrik 2007-01-21

Comments (none posted)

poppler: denial of service

Package(s):	poppler	CVE #(s):	CVE-2007-0104
Created:	January 18, 2007	Updated:	January 26, 2007
Description:	Poppler, a PDF loader library does not limit the recursion depth of the page model tree. If an attacker can trick a user into opening a specially crafted PDF file, an infinite loop can be caused, leading to a crash of the calling application. This also affects kdegraphics and koffice.
Alerts:	Ubuntu USN-410-2 tetex-bin 2007-01-25 rPath rPSA-2007-0013-1 poppler 2007-01-23 Mandriva MDKSA-2007:024 kdegraphics 2007-01-22 Mandriva MDKSA-2007:022 tetex 2006-01-18 Mandriva MDKSA-2007:021 xpdf 2007-01-18 Mandriva MDKSA-2007:020 poppler 2007-01-18 Mandriva MDKSA-2007:019 pdftohtml 2006-01-18 Mandriva MDKSA-2007:018 koffice 2007-01-18 Ubuntu USN-410-1 kdegraphics, koffice, poppler 2007-01-18

Comments (none posted)

squid: denial of service

Package(s):	squid	CVE #(s):	CVE-2007-0247
Created:	January 18, 2007	Updated:	January 26, 2007
Description:	Squid, a web client proxy caching server, can be made to crash when receiving certain FTP listings, leading to a denial of service.
Alerts:	Gentoo 200701-22 squid 2007-01-25 Ubuntu USN-414-1 squid 2007-01-24 Mandriva MDKSA-2007:026 squid 2006-01-23 SuSE SUSE-SA:2007:012 squid 2007-01-23 Trustix TSLSA-2007-0003 bzip2, kerberos5, squid, wget, xorg-x11 2007-01-19 Fedora FEDORA-2007-092 squid 2007-01-17

Comments (1 posted)

xine: format string vulnerabilities

Package(s):	xine	CVE #(s):	CVE-2007-0017
Created:	January 23, 2007	Updated:	August 10, 2007
Description:	Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plugin, and the (2) cdio_log_handler and (3) vcd_log_handler functions in modules/access/vcdx/access.c in the VCDX (libvcdx_plugin) plugin, in VideoLAN VLC 0.7.0 through 0.8.6 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in an invalid URI, as demonstrated by a udp://-- URI in an M3U file.
Alerts:	Mandriva MDKSA-2007:154 xine-ui 2007-08-09 Debian DSA-1252-1 vlc 2007-01-27 Mandriva MDKSA-2007:027 xine-ui 2007-01-26 Gentoo 200701-24 vlc 2007-01-26 SuSE SUSE-SA:2007:013 xine-ui,xine-lib,xine-extra,xine-devel 2007-01-23

Comments (none posted)

xsupplicant: potential code execution

Package(s):	xsupplicant	CVE #(s):	CVE-2006-5601
Created:	January 19, 2007	Updated:	January 24, 2007
Description:	A post-authentication stack overflow in the EAP handling could be used by already authenticated attacker to overflow a stack buffer and so potentially execute code.
Alerts:	SuSE SUSE-SR:2007:001 xsupplicant, ulogd, dazuko 2007-01-19

Comments (none posted)

Kernel release status

The current 2.6 prepatch remains 2.6.20-rc5. Patches have started flowing into the mainline git repository again, however - 250 or so of them. These patches are mostly fixes, but there is also a set of patches from the memory technology devices tree adding an AT91 NAND driver and the "Cafe" NAND driver (for OLPC systems).

For older kernels: 2.6.16.38 was released on January 21; it includes fixes for several security problems.

Comments (none posted)

An introduction to lguest

Linux cannot be said to suffer from a shortage of virtualization solutions. What is harder to come by, however, is a paravirtualization system which is amenable to relatively easy understanding. A relatively recent entrant into the field, however, changes that situation significantly. With just 6,000 lines (including the user-space code), Rusty Russell's hypervisor implementation, lguest (pronounced rʌs.ti'vai.zər), provides a full, if spartan paravirtualization mechanism for Linux.

The core of lguest is the lg loadable module. At initialization time, this module allocates a chunk of memory and maps it into the kernel's address space just above the vmalloc area - at the top, in other words. A small hypervisor is loaded into this area; it's a bit of assembly code which mainly concerns itself with switching between the kernel and the virtualized guest. Switching involves playing with the page tables - what looks like virtual memory to the host kernel is physical memory to the guest - and managing register contents.

The hypervisor will be present in the guest systems' virtual address spaces as well. Allowing a guest to modify the hypervisor would be bad news, however, as that would enable the guest to escape its virtual sandbox. Since the guest kernel will run in ring 1, normal i386 page protection won't keep it from messing with the hypervisor code. So, instead, the venerable segmentation mechanism is used to keep that code out of reach.

The lg module also implements the basics for a virtualized I/O subsystem. At the lowest level, there is a "DMA" mechanism which really just copies memory between buffers. A DMA buffer can be bound to a given address; an attempt to perform DMA to that address then copies the memory into the buffer. The DMA areas can be in memory which is shared between guests, in which case the data will be copied from one guest to another and the receiving guest will get an interrupt; this is how inter-guest networking is implemented. If no shared DMA area is found, DMA transfers are, instead, referred to the user-space hypervisor (described below) for execution. Simple disk and console drivers exist as well.

Finally, the lg module implements a controlling interface accessed via /proc/lguest - a feature which might just have to be changed before lguest goes into the mainline. The user-space hypervisor creates a guest by writing an "initialize" command to this file, specifying the memory range to use, where to find the kernel, etc. This interface can also be used to receive and execute DMA operations and send interrupts to the guest system. Interestingly, the way to actually cause the guest to run is to read from the control file; execution will continue until the guest blocks on something requiring user-space attention.

Also on the kernel side is a paravirt_ops implementation for working with the lguest hypervisor; it must be built into any kernel which will be run as a guest. At system initialization time, this code looks for a special signature left by the hypervisor at guest startup; if the signature is present, it means the kernel is running under lguest. In that situation, the lguest-specific paravirt_ops will be installed, enabling the kernel to run properly as a guest.

The last component of the system is the user-mode hypervisor client. Its job is to allocate a range of memory which will become the guest's "physical" memory; the guest's kernel image is then mapped into that memory range. The client code itself has been specially linked to sit high in the virtual address space, leaving room for the guest system below. Once that guest system is in place, the user-mode client performs its read on the control file, causing the guest to boot.

A file on the host system can become a disk image for the guest, with the user-mode client handling the "DMA" requests to move blocks back and forth. Network devices can be set up to perform communication between guests. The lg network driver can also work in a loopback mode, connecting an internal network device to a TAP device configured on the host; in this way, guests can bind to ports and run servers.

With sufficient imagination, how all of this comes together can be seen in the diagram to the right. The lguest client starts the process, running in user space on the host. It allocates the memory indicated by the blue box, which is to become the guest's virtualized physical memory, then maps in the guest kernel. Once the user-mode client reads from /proc/lguest, the page tables and segment descriptors are tweaked to make the blue box seem like the entire system, and control is passed to the guest kernel. The guest can request some services via the kernel-space hypervisor code; for everything else, control is returned to the user-mode client.

That is a fairly complete description of what lguest can do. There is no Xen-style live migration, no UML-style copy-on-write disk devices, no resource usage management beyond what the kernel already provides, etc. As Rusty put it at linux.conf.au, lguest eschews fancy features in favor of cute pictures of puppies. The simplicity of this code is certainly one of its most attractive qualities; it is easy to understand and to play with. It should have a rather easier path into the kernel than some of the other hypervisor implementations out there. Whether it can stay simple once people start trying to do real work with it remains to be seen.

Comments (7 posted)

Video4Linux2 part 5a: colors and formats

The LWN.net Video4Linux2 API series.

This is the fifth article in the irregular LWN series on writing video drivers for Linux. Those who have not yet read the introductory article may want to start there.

Before any application can work with a video device, it must come to an understanding with the driver about how video data will be formatted. This negotiation can be a rather complex process, resulting from the facts that (1) video hardware varies widely in the formats it can handle, and (2) performing format transformations in the kernel is frowned upon. So the application must be able to find out what formats are supported by the hardware and set up a configuration which is workable for everybody involved. This article will cover the basics of how formats are described; the next installment will get into the API implemented by V4L2 drivers to negotiate formats with applications.

Colorspaces

A colorspace is, in broad terms, the coordinate system used to describe colors. There are several of them defined by the V4L2 specification, but only two are used in any broad way. They are:

• V4L2_COLORSPACE_SRGB. The [red, green, blue] tuples familiar to many developers are covered under this colorspace. They provide a simple intensity value for each of the primary colors which, when mixed together, create the illusion of a wide range of colors. There are a number of ways of representing RGB values, as we will see below.

  This colorspace also covers the set of YUV and YCbCr representations. This representation derives from the need for early color television signals to be displayable on monochrome TV sets. So the Y (or "luminance") value is a simple brightness value; when displayed alone, it yields a grayscale image. The U and V (or Cb and Cr) "chrominance" values describe the blue and red components of the color; green can be derived by subtracting those components from the luminance. Conversion between YUV and RGB is not entirely straightforward, however; there are several formulas to choose from.

  Note that YUV and YCbCr are not exactly the same thing, though the terms are often used interchangeably.

• V4L2_COLORSPACE_SMPTE170M is for analog color representations used in NTSC or PAL television signals. TV tuners will often produce data in this colorspace.

Quite a few other colorspaces exist; most of them are variants of television-related standards. See this page from the V4L2 specification for the full list.

Packed and planar

As we have seen, pixel values are expressed as tuples, usually consisting of RGB or YUV values. There are two commonly-used ways of organizing those tuples into an image:

• Packed formats store all of the values for one pixel together in memory.

• Planar formats separate each component out into a separate array. Thus a planar YUV format will have all of the Y values stored contiguously in one array, the U values in another, and the V values in a third. The planes are usually stored contiguously in a single buffer, but it does not have to be that way.

Packed formats might be more commonly used, especially with RGB formats, but both types can be generated by hardware and requested by applications. If the video device supports both packed and planar formats, the driver should make them both available to user space.

Fourcc codes

Color formats are described within the V4L2 API using the venerable "fourcc" code mechanism. These codes are 32-bit values, generated from four ASCII characters. As such, they have the advantages of being easily passed around and being human-readable. When a color format code reads, for example, 'RGB4', there is no need to go look it up in a table.

Note that fourcc codes are used in a lot of different settings, some of which predate Linux. The MPlayer application uses them internally. fourcc refers only to the coding mechanism, however, and says nothing about which codes are actually used - MPlayer has a translation function for converting between its fourcc codes and those used by V4L2.

RGB formats

In the format descriptions shown below, bytes are always listed in memory order - least significant bytes first on a little-endian machine. The least significant bit of each byte is on the right; for each color field, the lighter-shaded bit is the most significant.

Name	fourcc	Byte 0	Byte 1	Byte 2	Byte 3
V4L2_PIX_FORMAT_RGB332	RGB1
V4L2_PIX_FORMAT_RGB444	R444
V4L2_PIX_FORMAT_RGB555	RGB0
V4L2_PIX_FORMAT_RGB565	RGBP
V4L2_PIX_FORMAT_RGB555X	RGBQ
V4L2_PIX_FORMAT_RGB565X	RGBR
V4L2_PIX_FORMAT_BGR24	BGR3
V4L2_PIX_FORMAT_RGB24	RGB3
V4L2_PIX_FORMAT_BGR32	BGR4
V4L2_PIX_FORMAT_RGB32	RGB4
V4L2_PIX_FORMAT_SBGGR8	BA81

When formats with empty space (shown in gray, above) are used, applications may use that space for an alpha (transparency) value.

The final format above is the "Bayer" format, which is generally something very close to the real data from the sensor found in most cameras. There are green values for every pixel, but blue and red only for every other pixel. Essentially, green carries the more important intensity information, with red and blue being interpolated across the pixels where they are missing. This is a pattern we will see again with the YUV formats.

YUV formats

The packed YUV formats will be shown first. The key for reading this table is:

• = Y (intensity)
  
• = U (Cb)
  
• = V (Cr)

Name	fourcc	Byte 0	Byte 1	Byte 2	Byte 3
V4L2_PIX_FORMAT_GREY	GREY
V4L2_PIX_FORMAT_YUYV	YUYV
V4L2_PIX_FORMAT_UYVY	UYVY
V4L2_PIX_FORMAT_Y41P	Y41P

There are several planar YUV formats in use as well. Drawing them all out does not help much, so we'll go with one example. The commonly-used "YUV 4:2:2" format (V4L2_PIX_FMT_YUV422, fourcc 422P) uses three separate arrays. A 4x4 image would be represented like this:

Y plane:
U plane:
V plane:

As with the Bayer format, YUV 4:2:2 has one U and one V value for every other Y value; displaying the image requires interpolating across the missing values. The other planar YUV formats are:

• V4L2_PIX_FMT_YUV420: the YUV 4:2:0 format, with one U and one V value for every four Y values. U and V must be interpolated in both the horizontal and vertical directions. The planes are stored in Y-U-V order, as with the example above.

• V4L2_PIX_FMT_YVU420: like YUV 4:2:0, except that the positions of the U and V arrays are swapped.

• V4L2_PIX_FMT_YUV410: A single U and V value for each sixteen Y values. The arrays are in the order Y-U-V.

• V4L2_PIX_FMT_YVU410: A single U and V value for each sixteen Y values. The arrays are in the order Y-V-U.

A few other YUV formats exist, but they are rarely used; see this page for the full list.

Other formats

A couple of formats which might be useful for some drivers are:

• V4L2_PIX_FMT_JPEG: a vaguely-defined JPEG stream; a little more information can be found here.

• V4L2_PIX_FMT_MPEG: an MPEG stream. There are a few variants on the MPEG stream format; controlling these streams will be discussed in a future installment.

There are a number of other, miscellaneous formats, some of them proprietary; this page has a list of them.

Describing formats

Now that we have an understanding of color formats, we can take a look at how the V4L2 API describes image formats in general. The key structure here is struct v4l2_pix_format (defined in <linux/videodev2.h>, which contains these fields:

• __u32 width: the width of the image in pixels.

• __u32 height: the height of the image in pixels.

• __u32 pixelformat: the fourcc code describing the image format.

• enum v4l2_field field: many image sources will interlace the data - transferring all of the even scan lines first, followed by the odd lines. Real camera devices normally do not do interlacing. The V4L2 API allows the application to work with interlaced fields in a surprising number of ways. Common values include V4L2_FIELD_NONE (fields are not interlaced), V4l2_FIELD_TOP (top field only), or V4L2_FIELD_ANY (don't care). See this page for a full list.

• __u32 bytesperline: the number of bytes between two adjacent scan lines. It includes any padding the device may require. For planar formats, this value describes the largest (Y) plane.

• __u32 sizeimage: the size of the buffer required to hold the full image.

• enum v4l2_colorspace colorspace: the colorspace being used.

All together, these parameters describe a buffer of video data in a reasonably complete manner. An application can fill out a v4l2_pix_format structure asking for just about any sort of format that a user-space developer can imagine. On the driver side, however, things have to be restrained to the formats the hardware can work with. So every V4L2 application must go through a negotiation process with the driver in an attempt to arrive at an image format that is both supported by the hardware and adequate for the application's needs. The next installment in this series will describe how this negotiation works from the device driver's point of view.

Comments (11 posted)

The Fedora Extras license audit

Last year, the Fedora Core distribution went through a process of auditing the licenses on every package it distributed. This long task, handled by Tom Callaway, led to a number of changes as programs with problematic licensing were discovered. Among other things, the cdrecord package was reverted to an earlier version and the openmotif library was dropped altogether. It was not a lot of fun, and some users were upset by what seemed to them to be an exercise in excessive free software zealotry. But the end result was worthwhile: Fedora Core could claim, with a high level of confidence, that it was a 100% free distribution.

But Fedora Core has seen its last release. The upcoming Fedora 7 release will include a great many packages which have not been through the license audit process. Fedora's commitment to free software has not changed, but its ability to be sure that nothing in the distribution has a non-free license has gone away. All of the code which went into Extras, and which is now part of Fedora, is supposed to be free, and almost all of it certainly is. But there might just be a surprise or two in there.

So it looks like the license audit process needs to start all over again. Auditing Extras has been on the project's "we'll get around to that" list for some time, but the merging of the repositories has brought a new urgency to the task. In this context, Tom Callaway has announced the beginning of the Extras audit.

There's just one little problem: Extras is a rather larger set of packages than Core was. So Tom is asking for help:

This would be a good opportunity for anybody with an interest in Fedora to help out; coding skills are not required. What is required is the ability to look over the files in a source distribution - not just the COPYING file - and make sure that the licenses presented there are consistent and free.

In the short term, Fedora would help itself tremendously by putting together some sort of checklist for those who would participate in the auditing process. Longer term, the project may need something like the debian-legal community - a group not known for letting non-free licenses slip by. For that matter, a package which is free for Debian should also be free for Fedora, and vice versa. Maybe distributors should consider working together to avoid duplication of effort while ensuring that everything they are shipping is free software.

Comments (3 posted)

Fedora Core 6 (Zod) Re-Spins from Fedora Unity

The Fedora Unity Project has announced the release of new ISO Re-Spins (DVD and CD Sets) of Fedora Core 6. These Re-Spin ISOs are based on Fedora Core 6 and all updates released as of January 11th, 2007. The ISO images are available for i386 and x86_64 architectures via BitTorrent. PPC images should also be available, but will have had only limited testing.

Full Story (comments: none)

Gamix Basesystem Beta 3 Released.

Gamix is Mandriva-based Linux build that facilitates the creation of boot CDs so developers may create Gamix versions of their original software. Basesystem Beta 3 is available as an ISO download.

Full Story (comments: none)

openSUSE build service released

Novell has announced the release (under the GPL) of the openSUSE build service code. There is also a tool named KIWI which is useful for the creation of system images. "As a result, open source developers can more quickly build a Linux distribution that meets their particular use case, rigorously test it to ensure product quality, and easily package it for quick installation." More information can be found on the Build Service page.

Comments (none posted)

Here comes the Spring: a new life cycle for Mandriva Linux

Mandriva has announced a new Mandriva Linux release schedule. The consumer oriented products will go to a 6 month release cycle. The corporate product line will remain on an 18 to 24 month cycle with a 5-year support lifetime. "This spring, Mandriva users will enjoy a new version of Mandriva Linux. Built on the current Mandriva development branch, this new version will provide up-to-date and newly released open source software. Also expect some new breakthrough technology, to be announced shortly. The name for this new version is Mandriva Spring."

Full Story (comments: 19)

Welcome to The UbuCon - New York City - February 16, 2007

The second UbuCon, an Ubuntu user and developer event, will be held at Google's New York City offices on February 16. "February 16 will be a special day for Ubuntu users and the Ubuntu curious. If you're already an Ubuntu user, come on by - tell your story of how you're using Ubuntu Linux; help out at the installfest; or just hang out with some interesting people. If you're not an Ubuntu user, then here is your chance to learn what the fuss is about."

Full Story (comments: none)

BOSS

BOSS (Bharat Operating System Solutions) is a Linux distribution developed by the National Resource Centre For Free/Open Source Software in India. It's based on Debian and made specifically for the Indian environment with a pleasing Desktop environment coupled with Indian language support (Bengali, Gujarati, Hindi, Punjabi, Telugu and Tamil so far) and other packages that are most relevant for use in the government domain. Subsequent versions will support the educational domain and eventually add support for all 22 of India's languages. The BOSS 1.0 live CD was recently announced.

Comments (none posted)

Debian Weekly News

The Debian Weekly News for January 23, 2007 is out. Topics include Erinn Clark, co-founder and leader of Debian Women and in the top 10 of girl geeks, Chris Fearnley's rebuttal to Steven J. Vaughan-Nichols argument that Debian is in trouble, Debian and the one Laptop per Child Project, French DebianEdu Developers Meeting, Debian's History 2006, Debian-Installer for Sony PS3, Woody Distribution archived, and much more.

Full Story (comments: 1)

Fedora Weekly News Issue 74

The Fedora Weekly News for January 22, 2007 covers Fedora Unity releases updated Fedora Core 6 Re-Spins, Fedora LiveCD On-Demand Service, Flash Player 9.0.31.0 released for i386 Linux, Fluendo makes proprietary codecs available to Linux users, Fedora 7: The Linux Knight in Shining Armor?, and several other topics.

Comments (none posted)

Ubuntu Weekly News: Issue #28

The Ubuntu Weekly Newsletter December 14, 2007 covers the recent community council meeting, herd 2 release, the new screencast team, the new xubuntu-users mailing list, Ubuntu Forums weekly update, bug stats, upcoming meetings and events, Ubuntu-Women IRC Meeting, feisty changes, Main Inclusion Requests, weekly quiz update, and much more.

Full Story (comments: none)

DistroWatch Weekly, Issue 186

The DistroWatch Weekly for January 22, 2007 is out. "Continuing the post-release coverage of FreeBSD 6.2, this week's issue brings an exclusive interview with Matteo Riondato, a FreeBSD developer and the release engineer of the FreeSBIE live CD. The news section then delivers the usual round-up of miscellaneous news from the distribution world, including a story about the upcoming release of Mandriva "Metisse" edition with a new 3D-enabled desktop environment. Also in the same section, PCLinuxOS launches the first experimental release of the distribution's 2007 version, Fedora Unity announces new, up-to-date re-spins of Fedora Core 6, gNewSense prepares for the release of version 1.1 - now also with KDE, and the T2 project introduces a new minimalist rescue live CD with uClibc. Finally, we are pleased to present BOSS GNU/Linux, a new Indian distribution with the noble goal of providing complete support for India's 22 official languages."

Comments (none posted)

Fedora updates

Updates for Fedora Core 6: hal-cups-utils (bug fix update), ghostscript (bug fix update), diffstat (new version fixes a crash), coreutils (bug fix), device-mapper (update to latest stable release), lvm2 (update to latest stable release), lvm2-cluster (update to latest stable release), elfutils (update to 0.125), man (bug fix), hplip (update to 1.6.12), cups (bug fix), logrotate (bug fix), scim-bridge (update to 0.4.9), scim-tables (update to 0.5.7), selinux-policy (bug fixes), libgpod (update to 0.4.2), spamassassin (bug fixes), rhythmbox (update to 0.9.7), libxslt (upstream release 1.1.20)

Updates for Fedora Core 5: device-mapper (update to latest stable release), lvm2 (update to latest stable release), screen (bug fixes), spamassassin (bug fixes)

Comments (none posted)

Mandriva updates

Updates for Mandriva Linux 2007.0: glibc (bug fix, sparc64 updates, Unicode 5.0 support), mozilla-firefox (fixes x86_64 packages), mandriva-doc (fix broken links in Help buttons).

Comments (none posted)

rPath updates

Updates for rPath Linux 1: group-devel, group-text-tools (include rMake tool), filesystem (include the /sys directory).

Comments (none posted)

Ubuntu updates

Updates for Ubuntu 6.10: cli-common (automated backport upload), lzma (automated backport upload), dosemu-freedos (automated backport upload), flexbackup (automated backport upload), beagle (automated backport upload), mailman (automated backport upload), gajim (automated backport upload), supertux (automated backport upload), wine (automated backport upload), ubuntu-docs (stable release update), libnss-ldap (bug fix), xdg-utils (Dash shell bug fixes), idjc (bug fix), eclipse (bug fixes), totem (upload to edgy-updates), glibc (propagate to edgy-updates from edgy-proposed), gnome-hearts (bug fixes), rpy (bug fixes), kdbus (bug fixes), kiso (bug fixes), siege (bug fixes), wxwidgets2 (bug fix), apt (bug fix), popularity-contest (bug fixes), kxdocker (bug fixes), qpsmtpd (bug fix), update-manager (bug fix), linux-source-2.6.17 (initial release of a line of kernels for edgy-proposed), obconf (bug fix), evolution-jescs (bug fix), flashplugin-nonfree (automated backport upload), xfce4-xkb-plugin (bug fixes), cinepaint (bug fixes), spampd (bug fixes), update-notifier (bug fix), curl (bug fixes), glibc (bug fix).

Updates for Ubuntu 6.06 LTS: gnome-commander (new upstream release), liferea (automated backport upload), dosbox (automated backport upload), langpack-locales (upload to dapper-updates), glibc (propagate to dapper-updates from dapper-proposed), flashplugin-nonfree (automated backport upload), linux-source-2.6.15 (initial release of a line of kernels for dapper-proposed), qpsmtpd (bug fix), dosemu (bug fixes).

Comments (none posted)

PCLinuxOS 2007 Beta 2 (Test 1) (tuxmachines.org)

tuxmachines.org reviews the recently released beta of PCLinuxOS 2007. "The time is drawing near. The highly anticipated release of the all new PCLOS is right around the corner. Tex and the gang are uploading a beta to mirrors for public testing, but this lucky gal has been running an early beta on my new laptop for a coupla weeks now. I know, I can feel it in my bones, that this release will cause quite a stir. PCLOS already has one of the most loyal fan-bases in the game, but this release will bring more users than ever. I even think some larger distros will be feeling a bit of dread as announcements go out. Not only is the all new PCLOS the most beautiful yet, but it is updated to include some of the latest and greatest software available - all on top of an all new modern code base. Development has been long and hard, but the results will soon be known far and wide. Here's a bit of a sneak peek for those interested."

Comments (none posted)

Knoppix 5.1.1: Now with eye candy (Linux.com)

Dmitri Popov reviews the Knoppix 5.1.1 live CD on Linux.com "The new year has brought a new release of the Knoppix live CD. Along with the usual updates to application software, the most noticeable change in version 5.1.1 is the inclusion of the Beryl 3-D desktop with the Emerald theming engine. Since support for Beryl is still experimental, the 3-D desktop is provided in Knoppix as an option. To enable it, you have to use the knoppix desktop=beryl cheat code on boot. Considering the current status of Beryl, the new 3-D desktop works surprisingly well; it starts without any problems on a lowly Acer TravelMate 243 laptop with an Intel 82855 GM integrated graphics controller, and it feels snappy and is a joy to use."

Comments (none posted)

Dreamlinux 2.2 MME -- when dreams come true (PolishLinux.org)

PolishLinux.org reviews Dreamlinux 2.2 MME. "Dreamlinux is an operating system that boots from a Live-CD with the option to install on a hard drive as well. Dreamlinux is not just another Live-CD based on Debian, it's not another distro coming with XFCE 4.4. Dreamlinux 2.2 MME is a polished multimedia system from which Xubuntu developers could really learn a lot and which has the potential to demolish Windows Multimedia Center as far as the functionality is concerned. This review concerns Dreamlinux 2.2 Multimedia Edition."

Comments (none posted)

Damn Small Linux steps up to v3.2 (DesktopLinux)

DesktopLinux takes a look at Damn Small Linux 3.2. "DSL boasts a nearly complete desktop that includes XMMS (MP3, and MPEG), an FTP client, a links-hacked web browser, spreadsheet, email, spellcheck (US English), a word processor, three editors (Nedit, nVi, Zile [emacs clone]), Naim (AIM, ICQ, IRC), SSH/SCP server and client, a web server, calculator, and USB support. It soon will have PCMCIA support, as well, the team said."

Comments (none posted)

The new GNOME 2.18 modules

The GNOME release team announced their decisions for modules to be included, removed and retracted in the upcoming version 2.18 of the GNOME desktop project.

Here is what to expect in the area of new modules:

GNOME Devtools: "Our end goal is to create an easy to use and powerful environment for developing applications. This means having an environment that the user can tailor to his or her needs, and that fits in with the developer's way of working. Our basic strategy is to build small, well defined components that will work together to form a complete environment."

GNOME Devhelp: a component of GNOME Devtools which includes full indexing of books in XML, the GtkHTML HTML viewer, the ability to search by functions, structures and macros, automatic completion, transparent HTTP support with GnomeVFS, command line search via Bonobo and including Emacs integration, a simple installer for books, print support, multiple zoom levels and vi support.

Seahorse: "Seahorse is a GNOME application for managing encryption keys. It also integrates with nautilus, gedit and other places for encryption, decryption and other operations. With seahorse you can Encrypt/decrypt/sign files and text, Manage your keys and keyring, Synchronize your keys and your keyring with keyservers, Sign keys and publish, Cache your passphrase so you don't have to keep typing it, Backup your keys and keyring, Add an image in any GDK supported format as a OpenGPG photo ID Create SSH keys, configure them, cache them."

Nm-applet, which is the visible component of NetworkManager: "Networking on Linux right now is painful for the mobile desktop user, especially in comparison to other operating systems. A laptop user should never need to use the command line or configuration files to manage their network; it should "Just Work" as automatically as possible and intrude as little as possible into the user's workflow. NetworkManager attempts to make networking invisible. When moving into areas you've been before, NetworkManager automatically connects to the last network the user chose to connect to. Likewise, when back at the desk, NetworkManager will switch to the faster, more reliable wired network connection."

Glade-3: "Glade is a RAD tool to enable quick & easy development of user interfaces for the GTK+ toolkit and the GNOME desktop environment, released under the GNU GPL License. The user interfaces designed in Glade are saved as XML, and by using the libglade library these can be loaded by applications dynamically as needed. By using libglade, Glade XML files can be used in numerous programming languages including C, C++, Java, Perl, Python, C#, Pike, Ruby, Haskell, Objective Caml and Scheme. Adding support for other languages is easy too."

The modules that have been retracted for possible later inclusion are: Gnome Scan, a project whose goal is to add scanner capabilities across the desktop applications, the Tracker search and index tool and MonoDevelop, a GNOME IDE for C# and other .NET languages.

The list of removed modules includes gnome-main-menu and the Anjuta DevStudio, a C/C++ IDE. Anjuta has been removed because the stable version is unmaintained and the development version is not ready yet.

Comments (6 posted)

PostgreSQL Weekly News

The January 21, 2007 edition of the PostgreSQL Weekly News is online with the latest PostgreSQL DBMS articles and resources.

Full Story (comments: none)

SQLite 3.3.11 released

Version 3.3.11 of the SQLite DBMS is out. "Version 3.3.11 fixes for a few more problems in version 3.3.9 that version 3.3.10 failed to catch. Upgrading is recommended."

Comments (1 posted)

BusyBox 1.4.0 announced

Version 1.4.0 of BusyBox, a collection of command line utilities for embedded systems, is out with a lot of new capabilities and bug fixes. "Since this is a x.x.0 release, it probably is a bit less "stable" than usual."

Comments (none posted)

Django 0.95.1 released

Version 0.95.1 of the Django web development platform has been announced. "We've just rolled out Django 0.95.1, a new minor release of Django which includes fixes for several bugs discovered in the original 0.95 release". Upgrades are recommended.

Comments (none posted)

Rails 1.2 released

Version 1.2 of the Rails web development platform has been announced. "We got the RESTful flavor with new encouragement for resource-oriented architectures. We’re taking mime types, HTTP status codes, and multiple representations of the same resource serious. And of course there’s the international pizzazz of multibyte-safe UTF-8 wrangling. That’s just some of the headliner features. On top of that, there’s an absolutely staggering amount of polish being dished out."

Comments (none posted)

Making XML in a Rails App (O'Reilly)

Deepak Vohra uses XML within Ruby on Rails on O'Reilly's XML.com. "Ruby on Rails is a database-based web framework. An XML document may be created and parsed with Ruby on Rails. Rails provides a Ruby library called Builder to generate XML markup. The Builder package contains class Builder::XmlMarkup to generate an XML document. In this article, we will create an XML document from a database table with the Builder library."

Comments (none posted)

Java Web Development with Stripes (O'Reilly)

Mark Eagle looks at Stripes on O'Reilly. "Stripes is an open source, action-based Java web framework designed around the principles that web development should be simple and productive for developers. Traditional Java web development focused on versatility through decoupling, which resulted in multiple configuration files, additional objects, and other fragmented resources. These difficulties subjected many developers to a higher learning curve and reduced productivity. As a result, some Java developers have been lured away by non-Java frameworks such as Ruby on Rails or Django. Java web frameworks, like Stripes, are beginning to learn from the successes of alternative frameworks that streamline development. This article will show how Stripes distinguishes itself from other action based Java web frameworks, such as Struts, while supplying some of the simplicity available in Ruby on Rails."

Comments (none posted)

Tina POS 0.0.21 released (SourceForge)

Version 0.0.21 of Tina POS, a point of sale application for touch screens, has been announced. Changes include: New database support: Oracle, Better user/role management, New binary package with better third party libraries support, Third party libraries upgrade and Many bugs fixed.

Comments (none posted)

Amarok Weekly News Issue 5 Released (KDE.News)

KDE.News has announced issue #5 of the Amarok Weekly Newsletter: "This issue covers the fine tuning of the scoring algorithm, new fadeout options, configurable playlist color, as well as new handy tool for editing filters. Traditionally, with tips included."

Comments (none posted)

Ardour 2.0 beta 11.1 released

Release 2.0 beta 11.1 of Ardour, a multi-track audio workstation, has been announced. "With several crash fixes, a smattering of minor featurettes, a tubful of bugs squashed and a whole dose of community support comes 2.0 beta11.1."

Comments (none posted)

eSpeak 1.18 released

Version 1.18 of the eSpeak text to speech converter has been released, it adds asynchronous modes, two command-line invocation methods, a new voice variants feature, new languages and more.

Comments (none posted)

MaklerPlus 1.2 released

Version 1.2 of MaklerPlus, an online real estate catalog system, is available. "In this version some bugs were fixed, including some installation problems. The French translation of the layout is included. The function “fast contact” sends the inquiries directly to the object advertisers, with a copy to the email of the managers of MaklerPlus."

Comments (none posted)

Varkon 1.18B released

Stable version 1.18B of Varkon, a CAD system, has been announced. "VARKON can be used as a traditional CAD-system with drafting, modelling and visualization if you want to but the real power of VARKON is in parametric modelling and CAD applications development. VARKON includes interactive parametric modelling in 2D or 3D but also the unique MBS programming language integrated in the graphical environment."

Comments (none posted)

PLplot release 5.7.2 announced

Development release 5.7.2 of PLplot, a library of scientific plotting functions, is available. The change log lists the new capabilities. "This is a routine development release of PLplot. It represents the ongoing efforts of the community to improve the PLplot plotting package."

Comments (none posted)

GNOME Software Announcements

The following new GNOME software has been announced this week:

• atk 1.13.2 (new feature and bug fix)
• at-spi 1.7.16 (bug fixes)
• Banshee 0.11.5 (new features and bug fixes)
• cairo snapshot 1.3.12 (bug fixes, API changes, performance improvements)
• Clutter 0.2.0 (new features and bug fixes)
• control-center 2.17.90 (new features, bug fixes and translation work)
• Ekiga 2.0.4 (new features and bug fixes)
• Evolution 2.9.6 (translation work)
• Eye of GNOME 2.17.90 (bug fixes and translation work)
• gail 1.10.1 (bug fixes)
• gcalctool v5.9.11 (bug fixes and translation work)
• gdl 0.7.1 (bug fixes and translation work)
• GDM2 2.17.6 (new features and translation work)
• Gnome Games 2.17.90 (new features and bug fixes)
• Gnome Games 2.17.90.1 (bug fix)
• gnome-games-extra-data 2.17.90 (new features)
• GNOME Power Manager 2.17.90 (bug fixes and translation work)
• gnome-speech 0.4.8 (new features and bug fixes)
• GNOME Terminal 2.17.90 (new features, bug fixes and translation work)
• GNOME Utilities 2.17.90 (bug fixes and translation work)
• GNOME Utilities 2.17.91 (bug fixes and translation work)
• GOK 1.2.1 (new features, bug fixes and translation work)
• GTK+ 2.10.9 (bug fixes)
• Gtk2-Perl 2.17.90 (new features and bug fixes)
• Hipo 0.3 (new features and translation work)
• Last Exit 4 (new features and bug fixes)
• libgtksourceviewmm 0.3.0 (new features, bug fixes and documentation work)
• muine 0.8.7 (new features, bug fixes and translation work)
• nemiver 0.3.0 (new features, bug fixes and performance improvements)
• Orca 2.17.90 (new features, bug fixes and translation work)
• Pango 1.15.4 (unstable development release)
• Pango-1.15.5 (unstable development release)
• Sabayon 2.17.90 (bug fixes)
• Tomboy 0.5.4 (bug fixes)
• vte 0.15.2 (new features and bug fixes)
• Zenity 2.17.90 (translation work)

You can find more new GNOME software releases at gnomefiles.org.

Comments (none posted)

KDE Software Announcements

The following new KDE software has been announced this week:

• Contacts applet for Kicker 0.5.2 (new features)
• Contacts framework 0.2.1 (new features)
• doKa 0.1 (initial release)
• doKa 0.1.1 (new features and bug fixes)
• FALF Player 1.0rc3/rc4dev (new features, bug fixes and translation work)
• Gaim/Gajim now Listen 0.1 (initial release)
• KAlarm 1.4.8 / 1.9.4beta (bug fixes)
• kAnyRemote 2.6 (new features and bug fixes)
• katedataedit 0.1 (initial release)
• KBib 0.5.4 (new features and bug fixes)
• KMix Patch 0.1 (initial release)
• KPOPS Converter 1.0 (unspecified)
• KrecTV 0.9 (unspecified)
• Ksshagent 0.6 (unspecified)
• KVideoEncoder 0.08 (bug fixes and translation work)
• K-Yamo v0.40a4-2 (new features, bug fixes and performance improvements)
• Mailody 0.4.0-rc1 (new features and bug fixes)
• one.sh 1 (initial release)
• Piklab 0.13 (new features and bug fixes)
• Pnxsmbtool 0.0.4 (build improvement)
• QtiPlot 0.8.9 (new features and bug fixes)
• rkward 0.4.5 (new features and bug fixes)
• SIM Instant Messenger 0.9.4.2 (new features, bug fixes and translation work)
• Smart Installer 0.1 (initial release)
• thin liquid film 0.92 (bug fixes)
• trix 0.91 (unspecified)
• Umbrello UML Modeller 1.5.6 (bug fixes)
• WebIssues 0.8.3 / 0.8.1 (new features and bug fixes)
• XGL on Debian GNU/Linux 1.0.4 (unspecified)
• xvidenc 4.6 (unspecified)
• Zhu3D 2.9.4 (new features and translation work)

You can find more new KDE software releases at kde-apps.org.

Comments (none posted)

The Road to KDE 4: Job Progress Reimagined (KDE.News)

KDE.News looks forward to the KDE4 job tracker. "Picture it as a cross between the Firefox download manager and the KDE printer queue, except that there is no real restriction on what type of jobs can be monitored. The way it works is that each KDE 4 app that has a progress dialog adds a flag for something called an Observer. Then, a separate application can observe any running Jobs, displaying progress and even adding certain actions (like 'Cancel Download') which can be submitted back to the application that actually has the progress dialog."

Comments (none posted)

KDE Commit-Digest for 21st January 2007 (KDE.News)

The January 21, 2007 edition of the KDE Commit-Digest has been announced. The content summary says: "KHangman becomes the latest application to migrate to SVG-based scalable interface rendering. KOpenBabel is merged and the beginnings of a 3d navigation system in Kalzium. Work expands in the Umbrello/KPlato Student Mentoring program. Support for the ComicBook Archive and other improvements in okular. Work on Picture, Video and Krita "Flake" shapes in KOffice. Improvements in both the KDE 3.5 and 4.0 versions of Konsole. Language detection in Sonnet continues to mature. Import of concept code demos in Decibel. "Simple-search" user interface work, and support for indexing binary data fields in Strigi. "liveui" moves back into kdelibs. dbmodeler, a database schema modelling application (part of the Season of KDE), is renamed "grama"."

Comments (none posted)

Xfce 4.4 released

Xfce 4.4 has been released. The release announcement has pointers to screenshots and download information.

Full Story (comments: 1)

Xorg Software Announcements

The following new Xorg software has been announced this week:

• appres 1.0.1 (documentation work)
• bitmap 1.0.3 (documentation work)
• editres 1.0.3 (documentation work)
• libXfont 1.2.7 (new features and bug fixes)
• xrdb 1.0.3 (documentation work)
• xserver 1.2.0 (new features, bug fixes and documentation work)

More information can be found on the X.Org Foundation wiki.

Comments (none posted)

SQL-Ledger 2.6.23 is available

Version 2.6.23 of SQL-Ledger, a web-based accounting system, has been announced. Changes include: "fixed formatting error for "ship" field when European number format is in use".

Comments (none posted)

Cyphesis 0.5.11 released

The WorldForge game project has announced the release of version 0.5.11 of Cyphesis. "Cyphesis is a small to medium scale server for WorldForge games, with builtin AI. This version includes the demo game Mason which is currently in development. This release is intended for server administrators wishing to run a Mason server and World developers developing new worlds or game systems."

Comments (none posted)

Mozilla Thunderbird 2 Beta 2 Released (MozillaZine)

MozillaZine notes that the second Thunderbird 2 beta release is out. "Features new to Thunderbird 2 include message tags, folder views, session navigation history, a visual refresh of the theme, and improved new mail notification alerts." See the release notes for more information.

Comments (5 posted)

SeaMonkey 1.1 Released

Version 1.1 of SeaMonkey, an internet application suite with a web browser, e-mail, newsgroup and IRC clients and an HTML editor, is out. "Powered by the same engine as Firefox 2 and the upcoming Thunderbird 2, SeaMonkey 1.1 includes numerous enhancements including more visible security indicators in the browser and enhanced phishing detection for e-mail, a new tagging system for e-mail that supersedes labels, support for multi-line tooltips in web pages, and previews images in tab tooltips. Other changes include inline spell checking in the browser, an updated version of ChatZilla, and a significantly improved startup script on Linux."

Comments (1 posted)

bzip2 1.0.4 is available

Version 1.0.4 of the bzip2 compression utility is out with bug fixes and other improvements.

Full Story (comments: none)

Caml Weekly News

The January 23, 2007 edition of the Caml Weekly News is out with new Caml language articles.

Full Story (comments: none)

What's New in Prototype 1.5? (O'Reilly)

Scott Raymond covers Prototype 1.5 on O'Reilly's XML.com. "The latest release of Ruby on Rails, version 1.2, was announced last week to great fanfare. But the announcement might have overshadowed news of a simultaneous release: version 1.5 of Prototype, the popular JavaScript library. Despite the synchronization and developer overlap between the two projects, nothing about Prototype depends on Rails—it's perfectly suitable for use with any server-side technology. In fact, Prototype has amassed a huge user base beyond the Rails community—from dozens of Web 2.0 startups to household names like Apple, NBC, and Gucci."

Comments (1 posted)

Weekly Perl 6 mailing list summary (O'Reilly)

The January 21, 2007 edition of the Weekly Perl 6 mailing list summary is out with coverage of the latest Perl 6 developments.

Comments (none posted)

Why I Stopped Coding and Why I'd Start Again (O'ReillyNet)

Brian McConnell writes about Python in an O'Reilly article. "What happens when programming stops being fun? What do you do when juggling dependencies and worrying about installation issues takes all of the joy out of writing code for other people? You can stop coding... or you can try to address the underlying problems. Brian McConnell postulates an enhancement of the Python language to make programming as fun as it was in the BASIC-in-ROM minicomputer days."

Comments (none posted)

Tcl-URL!

The January 22, 2007 edition of the Tcl-URL! is online with new Tcl/Tk articles and resources.

Full Story (comments: none)

cairomm release 1.2.4 now available

Release 1.2.4 of cairomm, a C++ API for the cairo graphics library, is out with a bug fix.

Full Story (comments: none)

IT++ 3.99.0 development release (SourceForge)

3.99.0 development release 3.99.0 of IT++ has been announced. "IT++ is a C++ library of mathematical, signal processing and communication system routines/functions. Its main use is in simulation of communication systems or for performing research in the area of communications. It has been over 10 months since the first release of IT++ 3.10.x stable series was released. During this period a lot of new functionality and improvements have been committed to the main branch (trunk) of the IT++ SVN repository. Therefore, we decided to publish a set of development releases as 3.99.x series before preparing a new stable branch 4.0.x."

Comments (none posted)

Searching for Openness in Microsoft's OOXML and Finding Contradictions (Groklaw)

Groklaw investigates the openness of the OOXML (OpenXML) document standard. "From what I've been reading, which I'll share with you, I think it's time to ask ourselves some serious questions: does OOXML really qualify as a standard? Or is it yet another monopoly-enabler in the guise of a standard? It's a good time to ask, because it turns out that we are right now in the window of time where contradictions in the OOXML standard can be reported by member bodies of the ISO/IEC Joint Technical Committee 1. February 5 is the deadline, so now is the time to bring such to their attention."

Comments (9 posted)

The Big Picture (Joel on Software)

Joel Spolsky looks at what went wrong with Chandler as reflected in the new book Dreaming in Code. "Still, it's a great look at one particular type of software project: the kind that ends up spinning and spinning its wheels without really going anywhere because the vision was too grand and the details were a little short. Near as I can tell, Chandler's original vision was pretty much just to be 'revolutionary.' Well, I don't know about you, but I can't code 'revolutionary.' I need more details to write code."

Comments (10 posted)

Linux down under: Day two at LCA 2007 (Linux.com)

Joe 'Zonker' Brockmeier covers day two at linux.conf.au. "The seventh Linux.conf.au (LCA) continued Tuesday at the Kensington campus of the University of New South Wales in Sydney, Australia, with miniconferences and a keynote by Christopher Blizzard. Blizzard spoke about interface design for the One Laptop Per Child (OLPC) project, and how to be relevant to users. He ventured into slightly dangerous territory, saying that part of being "relevant" means being able to "move the needle" -- that is, increase adoption -- and asked, "How many years now has it been 'the year of the Linux desktop'?""

Comments (1 posted)

Linux ups Web cams to Wi-Fi (ComputerPartner)

ComputerPartner covers an LCA talk by LWN's Jonathan Corbet. "Two years after his 2005 Kernel Report, Colorado-based Linux developer Jonathan Corbet returned to Australia's linux.conf.au conference in Sydney this week to discuss recent enhancements to the open source operating system. Corbet said the next release, kernel 2.6.20, will include a whole lot of new drivers, including a USB vision driver which will bring support for USB Web cams. "Linux hardware support is better than ever and it supports more hardware natively out-of-the-box than any other operating system," he said. "The biggest problem is vendors that won't release drivers or specifications.""

Comments (8 posted)

Open house for open source: Linux.conf.au day four (Linux.com)

Joe 'Zonker' Brockmeier reports from sunny Sydney. "The seventh Linux.conf.au continued Thursday at the Kensington campus of the University of New South Wales in Sydney with talks, tutorials, and Open Day. I didn't attend as many talks on Thursday as I did during the first half of the week because I had my own talk to deliver at 11 a.m. on marketing open source projects. You can view it online, along with most of the other talks. I've encountered very few "drone and point" talks at LCA 2007, perhaps thanks to a presentation at the speaker's dinner on Monday on improving presentations and making them more engaging."

Comments (none posted)

SCO's FY06 results: not a pretty picture (Linux-Watch)

Linux-Watch examines SCO's recently released fourth quarter financial report. "SCO's revenue for the fourth quarter of fiscal year 2006 was $7.349 million, a decline of over a million dollars from $8.528 million for the comparable quarter of the prior year. The company managed to staunch its losses to a degree. The net loss for the quarter was $3.743 million, or $0.18 per diluted common share, as compared to a net loss of $3.431 million, or $0.19 per diluted common share, for the comparable quarter of the prior year. Darl McBride, president and CEO said in a conference call that "The decrease in revenue was primarily attributable to continued competitive pressures on the company's Unix products and services.""

Comments (2 posted)

Linspire, SageTV simplify Linux Media Center installation (LinuxDevices)

LinuxDevices reports that SageTV LLC and Linspire are collaborating on the SageTV Media Center Version 6. "SageTV Media Center software lets users watch, pause, and record TV programs on their Linux PCs, and provides a single user interface for accessing online video as well as personal music, photos, and videos stored on a PC or network. The optional SageTV Placeshifter, ala Slingbox, now also enables users to access their PC-based media library on any Internet-connected Linspire PC."

Comments (none posted)

Kerala's draft IT policy released (The Hindu)

The Hindu reports on a draft information technology policy being discussed in Kerala, India. "The policy stresses that Free and Open Source Software (FOSS) will be used in e-governance projects. Open standards such as Unicode and Open Document Format and Open Architectures will be followed in e-governance projects to avoid total dependence on select vendors. The Government proposed to develop the State as the FOSS destination in the country. It will provide special incentives to companies developing FOSS." (Thanks to Joseph Vimal.)

Comments (none posted)

Linux guru argues against security liability (ZDNet UK)

ZDNet UK reports that Alan Cox addressed a House of Lords hearing on the topic of software security liability. "Cox said that it would be difficult to make open-source developers liable for their code because of the nature of open-source software development. As developers share code around the community, responsibility is collective. "Potentially there's no way to enforce liability," he said. The question of open-source liability becomes more complex because of how the code is used, added Cox. Open-source code is generally given away, but companies use that code to develop their own products. Cox said that there was a question of how liability would move from the initial developers to the companies."

Comments (22 posted)

Rosegarden - Project of the Month (SourceForge)

SourceForge has named Rosegarden the December 2006 project of the month. The article includes an interview with the developers. "Why and how did you get started? Chris: The first Rosegarden project was a university project that started at the end of 1993 at the University of Bath. I just kept working on it after I left university. The current program is a separate project that we made a fresh start on (complete with SourceForge page!) at the start of 2000. But we already knew each other by then and had been working together for a while." (Found on KDE.News)

Comments (3 posted)

Daniel Molkentin - People Behind KDE

KDE.News has announced a new interview in the People Behind KDE series, this one features Daniel Molkentin. "For the next interview in the fortnightly People Behind KDE series we meet a developer who has unfinished business with midges, someone who prefers bullets to stars -- tonight's star of People Behind KDE is Daniel Molkentin."

Comments (none posted)

An interview with gNewSense founders Paul O'Malley and Brian Brazil (Cutting Free)

Cutting Free has an interview with the founders of the gNewSense distribution. "The co-founders of gNewSense, Paul O'Malley & Brian Brazil, very kindly agreed to give an interview. As usual, it was conducted by email. It's great to have their two differing perspectives. Between them, they provide a balance that is probably responsible for the success of gNewSense. Their passion is also quite evident. They tell us what gNewSense is about, where it's going, and why their distribution maintenance tool, "Builder", is so invaluable." (Thanks to Joey Schulze)

Comments (4 posted)

The Software Ecology Of Rui Nuno Capela (Linux Journal)

Dave Phillips' looks at Rui Nuno Capela's Linux sound & music software catalog and talks with Rui Capela. "Rui Capela's software has appeared in this column many times. I've written about it directly (see At the Sounding Edge: Using QSynth and QJackCtl and HDRs and DAWs For Linux: The New Breed) and it shows up in almost every article I write. I'm not exaggerating when I state that Rui's programs have become indispensable components here at Studio Dave, so naturally I'm interested in the mind behind it all. In this entry I'll recap the nature and state of Rui's software, after which we'll meet the man himself in another lively interview here at the sounding edge."

Comments (none posted)

Security and Apache Geronimo's future (developerWorks)

IBM developerWorks talks with David Jencks about Apache Geronimo security. "A full-service application server like Apache Geronimo needs to have a full-service security implementation, and that means more than just supporting SSL connections. It means securing the internal requests made within an application. In this installment, David Jencks talks to the renegade about the current and future view of Geronimo's security implementation."

Comments (none posted)

State of the Computer Book Market (O'Reilly Radar)

Tim O'Reilly has published a summary of sales in the computer book market with some interesting trend graphics. "Bright spots in the market include SQL Server and to a lesser extent MySQL, as well as data warehousing and data analysis; open source programming languages Python and Ruby; "Linux Other" (which really these days means Ubuntu); and software engineering topics like project management, agile programming, object oriented programming, and user interface design; Cisco; and .Net programming."

Comments (none posted)

How To Set Up Linux As A Dial-In Server (HowtoForge)

HowtoForge sets up a Linux box as a dial-in server. "This document describes how to attach modems to a Linux box and allow it to receive calls to connect users to the network. Its like being your own ISP (Internet Service Provider). If your Linux box is connected to the Internet, then the users will also be connected to the Internet. Your Linux box becomes a router. This is also known as RAS (Remote Access Services) in the Microsoft world. In the Linux world its called PPP (Point to Point Protocol)."

Comments (1 posted)

Customizing general OpenOffice.org settings (Linux Journal)

Linux Journal looks at customizing OpenOffice.org. "OpenOffice.org includes dozens of options for how it behaves. Available from Tools > Options, they are divided into general settings for the entire office suite and settings particular to each application. General settings are available under the general headings of OpenOffice.org, Load/Save, and Language Settings."

Comments (none posted)

Samba share permissions simplified (nixCraft)

nixCraft presents a tutorial on setting Samba share permissions. "Samba comes with different types of permissions for share. Try to remember few things about UNIX and Samba permissions. (a) Linux system permissions take precedence over Samba permissions. For example if a directory does not have Linux write permission, setting samba writeable = Yes (see below) will not allow to write to shared directory / share. (b) The filesystem permission cannot be take priority over Samba permission."

Comments (none posted)

Get your groove on with Amarok (Linux.com)

Joe 'Zonker' Brockmeier reviews Amarok on Linux.com. "So, you got the new iPod that you wanted for Christmas, but you're no fan of iTunes. No problem -- you can cast off your iTunes chains and manage your music entirely with Linux using Amarok. Amarok gives you everything you need to manage your music, from playing to burning music CDs to managing your portable music player."

Comments (none posted)

FreeNAS makes it easy to add storage to home networks (Linux.com)

Linux.com looks at FreeNAS. "FreeNAS is a small, powerful, full-featured implementation of FreeBSD as a network-attached storage device. (It also happens to be January's Project of the Month at SourceForge.net.) If you're a Linux user like me, the BSD-speak used for devices and such might give you pause, but other than that small caveat, installation and usage shouldn't be a problem. It's powerful enough to be used in the enterprise, but it's friendly enough so that even a typical home office user can take advantage of it. Here's how I created an easy-to-use NAS device for rsync backups and FTP server on my LAN."

Comments (1 posted)

Linux Audio Players, Tested and Graded (PC World)

PC World has run a reasonably comprehensive review of several free music players. "The way Amarok presents your music library stands in stark contrast to the approach of the Gnome apps I've covered thus far. Albums are grouped by artist in a hierarchical listing. A search box provides instantaneous filtering--the fastest in any app I tested. And The Beatles are alphabetized under 'B.'"

Comments (12 posted)

OVIS enables powerful open-source cluster management (Linux-Watch)

Linux-Watch looks at OVIS, an open-source software tool that provides intelligent, real-time monitoring of computer clusters. "OVIS 1.1 takes a statistical approach to the problem of computational platform monitoring and analysis. Traditionally, cluster monitoring tools keep an eye on manufacturer-specified, "absolute" thresholds. OVIS takes a new tack. It observes the overall statistical properties and environmental effects of a cluster, characterizing individual device behaviors and comparing them to a large number of statistically similar devices."

Comments (none posted)

Psiphon secure browsing proxy released (NewsForge)

Nathan Willis takes a look at Psiphon on NewsForge. "Last month, Toronto-based civic activists at The Citizen Lab released a new open source secure Web browsing tool designed to let people in repressive countries tunnel through government Internet filters. Known as Psiphon, the program allows users with unfiltered Internet access to provide a private, SSL-encrypted Web proxy for use by individuals in firewalled countries." Linux binaries of Psion are in the works, but have not yet been released.

Comments (none posted)

2007 Begins with a Bang (Linux Journal)

Glyn Moody looks at some recent announcements in this Linux Journal article. "Wow: has there ever been a month in computing like this one? A January distinguished by not one major announcement, not two, but four significant events that will surely go down as milestones in the history of technology."

Comments (34 posted)

FSFE becomes the legal guardian of the OpenSwarm Project

The Free Software Foundation Europe has become the legal guardian of the OpenSwarm project. "Anastasios Hatzis, the developer behind the OpenSwarm model-driven development platform for Python applications, lead the process of assigning copyright to FSFE. "My company - HATZIS Edelstahlbearbeitung GmbH - wanted to foster a development community around the OpenSwarm technology while also underwriting our commitment to Free Software," said Anastasios. "The FLA has provided us with an excellent way to ensure code coherency and a framework for long-term development.""

Full Story (comments: 1)

Two open gaming platform efforts

Gamix is an effort to create a Linux-based gaming platform; it is based on the Mandriva distribution. There are some limits to its openness, since it specifies an NVidia graphics adapter. A beta release of the Gamix platform is now available for download for those who would like to try it out.

Meanwhile, the Open Game Console consortium is working on a platform of its own; see this proposal for details. It, too, uses some closed components; the software will be based on an unspecified Linux distribution. (Thanks to Per Ekström).

Comments (11 posted)

Liberty Alliance Announces openLiberty Project

Liberty Alliance has announced the openLiberty Project, a global open source initiative formed to provide open source developers with tools for integrating the privacy and security capabilities of Liberty Federation and Liberty Web Services into a variety of new identity-based services. The initial focus is on delivering ID-WSF Web Services Consumer (WSC) libraries to allow open source developers to incorporate SAML 2.0 functionality into Web services applications. openLiberty.org is bringing together the resources developers need to more easily and quickly build open source identity-based

Full Story (comments: 3)

OpenMoko phone schedule announced

The schedule for the release of the truly open OpenMoko phone is out. Some developers will get phones in February; the rest of us will be able to buy one starting on March 11 (for US$350). Click below for the details.

Full Story (comments: 7)

OSDL, FSG to merge

The Open Source Development Laboratory and the Free Standards Group have sent out a press release stating their intent to merge; the combined group will be known as the Linux Foundation. "The Linux Foundation, which continues to sponsor the work of Linux creator Linus Torvalds, employs a shared resources strategy - much like open source development itself - to collaborate on platform development while enhancing the Linux market for end users, the community, developers and industry."

Comments (none posted)

ActiveState announces Komodo IDE 4.0

ActiveState has announced the release of Komodo IDE version 4.0. "With this release, developers can now create entire web applications—server, browser, and the HTTP conversation that connects them—within a single unified workspace. Komodo IDE enables developers to write, debug, share and organize quality code in a customizable programming environment. With 4.0, Komodo's support for dynamic languages such as Perl, PHP, Python, Ruby and Tcl, is extended to browser-side languages including JavaScript, CSS, HTML and XML."

Comments (none posted)

Centeris Ships Cross-Platform Identity Management Solution

Centeris Corporation has announced Likewise Identity 3.0, a cross–platform identity management system. "Centeris Corporation, a pioneer in developing software for easy management of Linux® servers in a Microsoft® Windows® network, today introduced Likewise Identity 3.0, a cross–platform identity management solution that provides seamless integration of Linux and UNIX users and systems with Microsoft Active Directory."

Full Story (comments: none)

Commercial DVR Software Comes to Desktop Linux

Linspire, Inc. has announced the availability of the SageTV Media Center Version 6 for Linspire and Freespire. "SageTV Media Center software lets users watch, pause and record TV programs on their desktop and living room Linux PCs and provides a single user interface for accessing online video as well as personal music, photos and videos stored on the personal computer. The optional SageTV Placeshifter also enables users to access their home TV and entire PC-based media library on any Internet-connected Linspire PC at home or away from home."

Comments (none posted)

Updated Enomalism Virtual Server Management Dashboard

Enomaly, Inc. has announced a significant new release of its Enomalism virtualization administrative management dashboard for Xen Hypervisor 3.0x. The free update and immediate availability of version 0.6 software adds important new improvements and features to the web-based administrative tool.

Full Story (comments: none)

Linspire Standardizes Software Installation Across Linux Distributions

Linspire, Inc. has announced plans to make its CNR ("Click 'N Run") digital download and software management service available to several of the most popular desktop Linux distributions in 2007. "Previously available only for Linspire and Freespire desktop Linux users, the CNR Service will begin providing users of other desktop Linux distributions a free and easy way to access over 20,000 desktop Linux products, packages and libraries, all with a single mouse click."

Comments (9 posted)

Macraigor Systems Joins the Eclipse Foundation

Macraigor Systems is the latest company to join the Eclipse Foundation. "Macraigor Systems today announced the immediate availability of a free Eclipse-compliant embedded debugging solution with sample Eclipse projects that run on many standard evaluation boards. This provides embedded systems engineers with an integrated platform for developing and debugging embedded systems using the widely supported Eclipse platform. Macraigor Systems today also announced that the company was joining the Eclipse Foundation as an Add-In Provider."

Full Story (comments: none)

SugarCRM Expands in Japan With CareBrains Strategic Partnership

SugarCRM Inc. has announced a partnership with CareBrains Inc. "In response to growing demand for Sugar commercial open source products in the Japanese market, SugarCRM and CareBrains are providing CareBrains partners access to SugarCRM partner program benefits, which include special partner Japanese language pack access, resell rights to Sugar commercial versions, and fully localized sales and marketing tools."

Comments (none posted)

Sun announces new NetBeans IDE support and contributions

Sun Microsystems, Inc. has announced new third party support and contributions to the NetBeans 5.5 Integrated Development Environment. "This includes the general availability of the NetBeans Mobility Pack for Connected Device Configuration (CDC) 5.5, which features significant code contributions from Ricoh Corporation. In addition, collaborative software development specialist Intland Software has joined the NetBeans Strategic Partner Program and created a new plug-in for its CodeBeamer technology for the NetBeans 5.5 IDE, which is already being used by the United States Department of Agriculture."

Comments (none posted)

SWsoft partners with Parallels

SWsoft has announced that it is now in control of Parallels. "The combination of SWsoft and Parallels means that we are the only company in the world to provide a complete suite of virtualization and automation software that includes operating system virtualization (Virtuozzo), desktop virtual machine technology (Parallels) and our range of automation solutions across all major computing platforms including Windows, Linux, MacOS and beyond."

Full Story (comments: none)

Terracotta Open 2.2 released

Terracotta, Inc. has announced the release of Open Terracotta 2.2, an open-source Java clustering solution. ""Open Terracotta provides a very simple, transparent way to program Java applications that scale well without the headache of JEE and EJBs. The value of Terracotta’s clustering approach is to allow developers to focus on the logic of their own software using plain Java and basic data structures with less time devoted to complex APIs dictated by the application server vendor in the name of scalability and availability," commented Prosper Nwankpa, co-founder of Xuqa.com, one of the fastest growing social gaming sites on the Internet."

Full Story (comments: none)

Themis and Terra Soft offer 64-bit PowerPC Linux board support package

Themis Computer and Terra Soft Solutions are collaborating to deliver a Linux distribution for the Themis 6U VMEbus TPPC64 single board computer line. ""We are pleased to play a vital role in the delivery of Themis' PowerPC 970-based product" stated Kai Staats, CEO of Terra Soft Solutions. "Themis' TPPC64 is an excellent host for our leadership LINUX platform, offering high-density, high performance computing, combined with the full features of a single board computer, including audio and video", Mr. Staats added."

Full Story (comments: none)

New Xandros Desktop Professional Box announced

Xandros has announced the availability of the boxed version of Xandros Desktop - Professional. "Available as a download since December, the new enterprise desktop features Bluetooth wireless support, desktop search and ISV support. It also provides seamless compatibility with Windows, Linux and UNIX networks including Windows domain authentication, plus support for logon scripts, group policy profiles and Microsoft Exchange. Xandros Desktop - Professional is available for a list price of USD 99.99."

Full Story (comments: none)

Ajax on Rails - O'Reilly's Latest Release

O'Reilly has published the book Ajax on Rails by Scott Raymond.

Full Story (comments: none)

The ODF Toolkit Project

OpenOffice.org has announced the ODF Toolkit Project. "[W]e are inviting developers everywhere to take the source of the world's leading Free and Open office productivity suite in bold new directions. These may include technologies that engage tools for collaboration, communication and content creation of every kind; tools that will complement and even transcend the already powerful productivity suite. The anchor of this new project is the OpenDocument Format (ODF), the ISO and OASIS standard format for office applications and the most flexible and adaptable format for the future."

Full Story (comments: 2)

Hybrid Share Project (GnomeDesktop)

GnomeDesktop.org has announced a logo contest for Hybrid Share. "Hybrid Share is a simple (User Friendly) Mono C#/Gtk# Application that allow Mac, Windows and Linux Users To Share Files. The Application is extensible via Plugins, so you can Talk with connected people, check your mailbox or other things that plugins could do."

Comments (none posted)

PyWeek game programming challenge

The fourth PyWeek Python game programming challenge has been announced. "The next challenge is PyWeek 4, "Four Yorkshiremen", which will run in the first week of April. The theme for the latest challenge was "The Disappearing Act"". Registration will open in March.

Comments (none posted)

On-site Training Now Available for GNU Radio and USRP

Corgan Enterprises has announced a two-day, on-site training course for GNU Radio software and USRP (Universal Software Radio Peripheral) users.

Full Story (comments: none)

Free training materials on writing Linux USB device drivers

Free Electrons has announced some USB device driver training materials. "Free Electrons, a training and consulting company in Free and Open Source Software for embedded systems, has just released a new set of free training slides on USB device driver development: http://free-electrons.com/news/news.2007-01-21."

Full Story (comments: none)

LPI announces new affiliate in Portugal

The Linux Professional Institute has announced its newest training affiliate, DRI / Lisbon, Portugal. "DRI was established in 1999 and specializes in IT infrastructure projects and web applications for the Portuguese market."

Full Story (comments: none)

Registration Open for Gelato ICE 2007

The 2007 Gelato ICE Conference has been announced. "On the eve of our fifth anniversary, the Gelato Federation is proud to announce the opening of registration for the Gelato ICE: Itanium Conference & Expo to be held on April 15-18, 2007, in San Jose, California."

Full Story (comments: none)

LinuxWorld OpenSolutions Summit

IDG World Expo has announced that LinuxWorld OpenSolutions Summit will tackle the subject of Linux on the Desktop. The OpenSolutions Summit is scheduled to take place February 14-15, 2007, at the New York Marriott Marquis.

Comments (none posted)

PyPy Trillke Sprints Feb/March 2007

The next EU PyPy sprint has been announced, it will take place between February 25 and March 5, 2007 in Hildesheim, Germany. "Some two years and some thousands of commits later, the EU project period of the PyPy project is about to close ... and a new period to begin: we are going for a sprint of three days of focusing on EU reports and administrative issues, and another three day sprint of happy hacking on the numerous interesting open ends of PyPy, the source code."

Comments (none posted)

Think Tank 2007: The Future of Commercial Open Source

The 2007 Open Source Think Tank has been announced. "The Open Source Think Tank is accepting applications to attend the second annual gathering of leading industry insiders for three days of hands-on, brainstorm-style sessions addressing the future of open source software and commerce. The annual conference, "Think Tank 2007: The Future of Commercial Open Source," is an exclusive, invitation-only event being held March 8 - 10 at the Silverado Country Club in Napa, California. Participation is limited to 120 people."

Comments (none posted)

Events: February 1, 2007 to April 2, 2007

The following event listing is taken from the LWN.net Calendar.

Date(s)	Event	Location
January 30 February 1	Solutions Linux Expo	Paris, France
February 1 February 2	LinuxDays Luxembourg	Luxembourg, Luxembourg
February 2	FUDCon Boston 2007	Boston, MA, USA
February 7 February 9	Free Software World Conference 3.0	Badajoz, Spain
February 7 February 9	Xorg Developer's Conference	Santa Clara, CA, USA
February 9	Women In Open Source	Los Angeles, USA
February 9	Open Source Health Care Summit	Los Angeles, USA
February 10 February 11	2007 Southern California Linux Expo	Los Angeles, USA
February 12 February 13	Vancouver PHP Conference	Vancouver, BC, Canada
February 12 February 13	Linux Storage and Filesystem Workshop	San Jose, CA, USA
February 12 February 16	Ruby on Rails Bootcamp Training	Atlanta, USA
February 12 February 15	3GSM World Congress 2007	Barcelona, Spain
February 14 February 15	LinuxWorld OpenSolutions Summit	New York, NY, USA
February 15	TiE Open Source Summit	Pittsburgh, PA, USA
February 16	The Ubucon New York	New York, NY, USA
February 19 February 23	DebianEDU DevCamp	Soissons, France
February 22	PyCon Tutorial Day	Addison, Texas
February 22	CELF Japan Linux Technical Jamboree #13	Tokyo, Japan
February 22 February 24	OpenMind 2007	San Giorgio a Cremano, Naples, Italy
February 23 February 25	PyCon 2007	Addison, Texas
February 23	PHP Conference UK 2007	London, England
February 24 February 25	Free and Open Source Software Developers' European Meeting	Brussels, Belgium
February 24 February 25	Java/DevJam/2007/Fosdem	Brussels, Belgium
February 26 March 1	PyCon Sprints	Addison, Texas
February 26 March 2	PHP5 Bootcamp Training at the Big Nerd Ranch	Atlanta, Georgia, USA
February 27 March 1	O'Reilly Emerging Telephony Conference	San Francisco, CA
February 27 March 2	EUSecWest Applied Security Conference	London, UK
February 28 March 2	Network and Distributed System Security Symposium	San Diego, CA, USA
March 2 March 3	LinuxForum 2007	Copenhagen, Denmark
March 3 March 8	O'Reilly Emerging Technology Conference	San Diego, CA, USA
March 5 March 8	EclipseCon 2007	Santa Clara, CA, USA
March 5 March 6	Karlsruhe Workshop on Software Radios	Karlsruhe, Germany
March 8 March 10	2007 Open Source Think Tank	Napa, CA, USA
March 10 March 13	Camp 5 Advanced Zope3 Training	Charlotte, North Carolina, USA
March 12 March 16	QCon	London, England
March 12 March 16	Third Annual Security Enhanced Linux Symposium	Baltimore, US
March 12 March 14	BOSSA Conference	Porto de Galinhas, Brazil
March 13 March 14	The Linux Foundation Japan Symposium	Tokyo, Japan
March 14 March 16	PHP Quebec Conference	Montreal, Canada
March 14 March 17	Barbeque Sprint for Plone3	Charlotte, North Carolina, USA
March 15 March 21	CeBIT computer fair	Hannover, Germany
March 16 March 17	MountainWest RubyConf	Salt Lake City, USA
March 18 March 23	Novell BrainShare 2007	Salt Lake City, Utah, USA
March 19 March 21	UKUUG LISA/Spring Conference 2007	Manchester, UK
March 22 March 25	Linux Audio Conference	Berlin, Germany
March 23 March 25	ShmooCon	Washington DC, USA
March 23 March 25	Guademy	Coruña, Spain
March 24	FSF Associate Membership Meeting	Cambridge, MA, USA
March 26 March 29	Emerging Technology Conference	San Diego, CA, USA
April 1 April 4	International Lisp Conference 2007	Cambridge, England
April 1 April 5	Embedded Systems Conference	San Jose, CA, USA
April 1	GPLv3: Improving a Great Licence (discussion draft 3)	Brussels, Belgium

If your event does not appear here, please tell us about it.

HPC Consortium "hack-a-thon" moves into 3rd Day

Terra Soft covers the first three days of the Cell processor "hack-a-thon". "Following an intense day of learning, Saturday night found a half dozen individuals defending the earth from alien invasion via networked PS3s. Robert Cook of Southern Georgia University states, "The blizzard outside is nothing compared to the maelstrom of intellectual give-and-take at Terra Soft's HPC Hack-A-Thon. The result is a rare free flow of ideas. Vendors are modifying product specs and offerings on-the-fly based on feedback from workshop attendees. Action items were piling up faster than the snow outside."

Full Story (comments: none)

State Of Jokosher recorded in Jokosher

A podcast done with and about the Jokosher audio editor is available. "A sample podcast recorded by Jono Bacon has been recorded, edited, mixed and exported entirely in Jokosher. The podcast shows the kind of recording you can do in Jokosher with recorded audio, imported audio, fades and cuts. The process of recording the show also unveiled a number of bugs which have been fixed within hours of them being recorded."

Comments (none posted)