LWN.net Weekly Edition for February 13, 2003
The Art of Unix Programming
Eric Raymond first announced this project back in 1999: The Art of Unix Programming was to be a new book, written with help from the community, that would "attempt to explain the Zenlike 'special transmission, outside the scriptures' that distinguishes Unix gurus from ordinary mortals." More than three years later, a draft of the book is available for review.
The Art of Unix Programming is certainly not a beginner's programming manual. It assumes, instead, that the reader is already a competent hacker and is looking to learn more about the Unix way of doing things. So there is a lot of talk about philosophy and history, and a wealth of case studies. There is a lot of language like:
Eric would, seemingly, like his book to be seen as a successor to the Kernighan and Plauger classics The Elements of Programming Style and Software Tools. This book shows some of the classic Raymond traits: no less than six case studies feature fetchmail (which he wrote), and the examples demonstrating the fortune file format are all about the evils of gun control. But there is some good stuff in there which has not necessarily been written down before. Eric is a good writer, and he has experience in the realm he is writing about. The Art of Unix Programming is worth a look.
We asked Eric a few questions about the draft release; here are his answers.
LWN: If you could characterize the art of programming in/for Unix as described in your book, in a single paragraph, how would you do it?
ESR: I'll do better, I'll boil it down to a single phrase. Keep it simple, stupid!
The true art of programming -- and this is something Unix guys were arguably the first to figure out and the most consistent at applying -- is minimizing global complexity. Most of the rest of the Unix philosophy pretty much falls out of that.
LWN: The draft as posted does not include any sort of licensing; will the final version be available under a free license?
ESR: Yes, but I haven't decided which one. There will be some restrictions on print reproduction, but none on electronic.
LWN: When you first announced the book project, it seemed you were planning to put the chapters out gradually and make use of a lot of community input. After chapter four, however (released almost exactly two years ago), things went quiet, and the rest of the book, seemingly, was done in a "cathedral" mode. Why is that? Did the more open approach not work out?
ESR: No, it's just that I stalled out for a long time and then gave it six weeks of intense work. This happened after an acquisitions editor at Addison-Wesley called me and said "Uh. Apparently you had an agreement to do a book with my predecessor, but I can't find a contract." There wasn't one; I have a twitch that way, I don't sign a contract until the book is essentially complete. He successfully nudged me into working on it again.
LWN: The book talks little about the programming of complex graphical applications, and avoids the GNOME/KDE issue altogether. Yet one could argue that complex applications are a big part of the future of Unix-like systems. There is often, however, a sort of impedance mismatch between fancy applications (think StarOffice 5) and the Unix way of doing things. What suggestions do you have for authors of graphical applications to help them carry forward the Unix tradition in the graphical world?
ESR: Separate policy from mechanism, because policy ages much faster than mechanism. Separate engines from interfaces, because tangling the two together tends to lead to unmaintainable messes. Don't give it a GUI if it doesn't need one.
Policy-mechanism separation is a major theme in the book. It's usually thought of in connection with X, but it can be applied a lot more widely -- and, in fact, Unix programmers *do* apply it a lot more widely without being really aware of the principle consciously.
(Yes, that's right, I'm doing another yet another book that's basically about conscious expression of unconscious folk practices. This would be #3. Is there anybody left who still finds this surprising? No? I thought not... :-))
One of the insights I got, one that's especially applicable to big gnarly GUI applications, is that Unix programmers divide all Gaul into three parts -- policy, mechanism, and glue. Mechanism is code that tells how to do things, policy is code that tells what to do -- and glue is the stuff that binds policy and mechanism together.
The punch line: glue is evil and must be destroyed, or at least minimized. Your typical huge honkin' C++ application with classes stacked twelve deep is an unmaintainable mess because the top two layers are policy, the bottom two are mechanism, and the middle eight are glue. And the trouble with glue is that it's opaque -- it impedes your ability to see clear down through the system from the top, or clear up from the bottom. You can't debug what you can't see through, because you can't form an adequate mental model of its behavior.
So my advice to GUI programmers is this: Decide what's policy and what's mechanism. Separate them cleanly -- ideally, have the GUI and engine running in separate processes, like gv and ghostscript or xcdroast and cdrecord. Then *ruthlessly eliminate all glue*. Or as much of it as you can, anyway.
LWN: There is very little treatment of security in the book. Why is that? Is, in your mind, security peripheral to the main art of Unix programming, or is something else going on?
ESR: It's peripheral. This is not a book about system administration, it's about how to design well. There's an aspect of that that has to do with secirity of course, but most of the things that make for good security (like minimizing code that has to be trusted) are just good engineering practice. That I *do* talk about a lot.
LWN: Unix has had a long run in the computing world, and, by all indications, it has a while to go yet. All good things come to an end eventually, however. What do you think might bring about the end of the Unix era, and what might replace Unix in the future?
ESR: My money is on capability-based persistent-object systems like EROS. But prophecy is difficult, especially about the future.
Comparing free and proprietary software defect rates
[This article was contributed by Joe 'Zonker' Brockmeier]
Tuesday a company called Reasoning, Inc. released a study that seems to prove what Open Source developers have been saying for years: Open code, and the inspection that it allows, produces a better product. Specifically, the company compared the Linux TCP/IP stack against a number of commercial TCP/IP stacks and found that the Linux implementation had fewer defects than other proprietary implementations.The paper, "How Open-Source and Commercial Software Compare" is available from Reasoning by request, so we decided to take a look at it to see how they had reached their conclusions.
Specifically, Reasoning lined up the Linux TCP/IP implementation from the 2.4.19 Linux kernel against five commercial implementations. In total, out of 81,852 lines of code, Reasoning found only 8 defects in the Linux TCP/IP code. All but one of the other five implementations compared with Linux were at least ten years old, the other is about three years old. The company did not name the specific operating systems, but Reasoning's CEO Scott Trappe confirmed that two were commercial Unix systems, one was "not Unix but in very broad use," and the embedded implementations were by "major vendors of networking equipment." Trappe said that Reasoning couldn't name companies specifically, but the companies had agreed to let Reasoning use the aggregate data.
As always, it helps to understand the company doing the research, and the context of the research, before taking the results too seriously. We spoke with Trappe, to clarify some information not in the white paper and to get a feel for Reasoning's background. Reasoning is a company that specializes in automated testing of software written in C/C++, which it has been doing since 2001. Prior to that, the company had specialized in Y2K testing. The company plans to add testing of Java software to its services later this year.
The study was not commissioned by any of the Linux vendors or companies who might be competing with Linux. Instead, Trappe said that the company had performed the study primarily to highlight its services. Unlike the other projects that Reasoning works on, they were free to release their results along with specific code examples from the Linux TCP/IP stack. Trappe also said that the company was looking to prove that inspection itself was important in providing quality software and that "testing alone can never uncover all the defects in software."
The company chose the TCP/IP stack because it provided a good point of comparison. Trappe admitted that it might be stretching it to draw too many conclusions from the study of one piece of software, but that their study "does support some claims that it can rival commercial quality." Trappe also mentioned that the company may do further studies in the future comparing Open Source software to commercial software.
The company looks for five kinds of defects in code: Memory leaks, null pointer dereferences, bad deallocations, out of bounds array access and uninitialized variables. According to Trappe, none of the errors found in the Linux TCP/IP stack were security issues. At least one of the issues, a memory leak, was fixed in the 2.4.20 kernel before Reasoning notifed the kernel team of the defects. Four of the problems found (an uninitialized variable and some out-of-bounds errors) are not truly defects, since they do not cause the code to behave incorrectly. So, of eight defects reported, four are not real, three are debatable and one has been fixed.
When taking into account the revised information, the Linux TCP/IP stack has a defect density of 0.013 per 1,000 lines of code. The implementation with the fewest defects after Linux is one of the embedded stacks, with .08 defects per 1,000 lines of code. One implementation, one of the commercial OSes, had 183 defects out of about 269,100 lines of code - 0.7 per thousand.
To be sure, the Reasoning study raises some interesting points, though there's not enough data to say conclusively that Open Source software is always of higher quality than its proprietary counterparts. The study looked only at one small piece of the Linux kernel, and only considered a small set of information. The Linux kernel has also been extensively checked for this sort of error by the Stanford checker and the new "smatch" program, so it should be relatively clean. Reasoning's study says nothing about performance or features, and it does not address the functionality of the code. However, it does supply some data in favor of the argument that open code leads to higher quality -- at least in terms of specific defects.
We'll be interested to see what kinds of studies Reasoning does in the future, and how other Open Source projects compare to commercial code.
Lawrence Lessig wins FSF Award
The Free Software Foundation has announced that this year's winner of its Award for the Advancement of Free Software is Lawrence Lessig - a fine choice. "FSF President and founder, Richard Stallman, presented the award to Professor Lawrence Lessig for promoting understanding of the political dimension of free software, including the idea that 'code is law'."
Security
Brief items
Keeping Secrets
[This article was contributed by Tom Owen]
Information contained on hard drives is often of the type that should not fall into the wrong hands. After all, being on the wrong end of a Canadian class action lawsuit for releasing personal information counts as one of the rougher server administrator nightmares. It's not clear whether the Canadian disk drive was stolen or retired, but it doesn't look like an isolated case. Responsible equipment dealers and recyclers use special tools to sanitize disks that come into their hands. But it doesn't always happen, and there's always the risk of simple theft.Being sued is one possible outcome. In Europe, criminal charges are possible, though unlikely. Even if all you have to worry about is an embarrassingly public gap between your privacy policy and your real operations, it may be time to look more closely at what might emerge if your data partitions ended up on eBay.
The problem is that the ordinary techniques of host security are useless against an explorer who can install your disks in a lab machine. 0600 modes won't be noticed by an attacker who is root already. Wipes and sanitizers won't have been used if the equipment was stolen. The only option is to encrypt the information you don't want to leak. If you do it right you can publish the contents of your disks without a qualm. Encryption is doubly important for Linux administrators because the range of software is so great that failure to encrypt is that much less excusable. The only plausible objections relate to performance and convenience issues.
In the past, the US imposed export restrictions on cryptographic software. Those rules obliged Linux kernels from kernel.org to exclude cryptographic software. Something like that never stops hackers, and the kernel code for encrypted disks and networks was hosted and has continued outside the US. The 2.5 kernel has crypto built in, but users of the current stable kernels must get their encryption code from another source. Incorporating crypto code into a standard kernel is well documented but it's simpler to use a distribution like SuSE which includes crypto out of the box.
Beyond the offerings from your distribution the broad choice is rather daunting. The standard approach uses encryption in the loopback device to create a secure partition "hosted" in a big contiguous file. A filesystem can be created on that device and mounted as the data directory. The host file is unintelligible without the passphrase.
Encrypted loopback can't handle swapfiles, and so there's a risk of leaving decrypted application information on the disk. If you can't configure enough memory, ppdd, which layers encryption on top of the plain loopback device does support swap files.
Other approaches like CFS don't use loopback, instead running a userspace daemon to encrypt on a file by file basis. These suffer under I/O load and wouldn't be a good choice to host a database.
All of this is relatively well documented. But the manuals seem to skate around the hard problems:
-
Passwords are hard to manage.
Changing the password involves backup and restore,
too much trouble to do often, so it has to be closely guarded.
Even worse, the passphrase can't be held anywhere on the machine,
so an unattended start isn't possible.
- It's surprisingly tricky to backup encrypted data. The loopback host file can be sensitive to absolute location on the disk, and getting data securely off the machine requires more encryption.
It's unfortunate that the commonest server setup, remote hosting, is one of the toughest operational security challenges. But if remote servers are the only possible answer, then encryption security is still possible. Linux is solid enough that unattended restart isn't strictly necessary. Instead, the machine can boot far enough to page the admin to ssh in and mount the loopback devices. And a backup can be prepared on the encrypted volume and once it's re-encrypted with the admin's public key any transfer method will do.
This is all convoluted to say the least. It's not standard, and it goes beyond what's commonly done. It's easy to feel that keeping the site going and current is challenge enough. But if you take privacy seriously there are no other choices. Once your hosts are as secure as you can make them against attacks from the network, it's time to move up a level. If you have other people's personal data, you should probably encrypt it.
New vulnerabilities
hypermail - buffer overflows
| Package(s): | hypermail | CVE #(s): | CAN-2003-0057 | ||||||||
| Created: | February 11, 2003 | Updated: | February 27, 2003 | ||||||||
| Description: | Ulf Harnhammar discovered two problems in hypermail, a program to
create HTML archives of mailing lists.
An attacker could craft a long filename for an attachment that would overflow two buffers when a certain option for interactive use was given, opening the possibility to inject arbitrary code. This code would then be executed under the user id hypermail runs as, mostly as a local user. Automatic and silent use of hypermail does not seem to be affected. The CGI program mail, which is not installed by the Debian package, does a reverse look-up of the user's IP number and copies the resulting hostname into a fixed-size buffer. A specially crafted DNS reply could overflow this buffer, opening the program to an exploit. | ||||||||||
| Alerts: |
| ||||||||||
kernel-utils: setuid vulnerability
| Package(s): | kernel-utils | CVE #(s): | CAN-2003-0019 | ||||
| Created: | February 7, 2003 | Updated: | January 21, 2005 | ||||
| Description: | The kernel-utils package contains several utilities that can be used to
control the kernel or machine hardware. In Red Hat Linux 8.0 this package
contains user mode linux (UML) utilities.
The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net | ||||||
| Alerts: |
| ||||||
PostgreSQL - more buffer overflows
| Package(s): | postgresql | CVE #(s): | |||||||||||||||||
| Created: | February 12, 2003 | Updated: | November 7, 2003 | ||||||||||||||||
| Description: | A new set of buffer overflows has been discovered in PostgreSQL 7.2.2; they affect the circle_poly(), path_encode(), and path_addr() functions. Exploiting these overflows requires that the attacker first obtain a connection to the PostgreSQL server. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
w3m - cross-site scripting vulnerabilities
| Package(s): | w3m | CVE #(s): | CAN-2002-1335 CAN-2002-1348 | ||||||||||||||||||||||||
| Created: | February 7, 2003 | Updated: | February 18, 2003 | ||||||||||||||||||||||||
| Description: | w3m is a pager with Web browsing capabilities. Two cross-site scripting
(XSS) issues have been found in w3m.
An XSS vulnerability in w3m 0.3.2 allows remote attackers to insert arbitrary HTML and web script into frames. Frames are disabled by default in the version of w3m shipped with Red Hat Linux. Therefore, this problem will not appear as long as users do not use w3m with the -F option, or enable frame support in either the /etc/w3m/w3mconfig or ~/.w3m/config configuration files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1335 to this issue. An XSS vulnerability in versions of w3m before 0.3.2.2 allows attackers to insert arbitrary HTML and web script into image attributes. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1348 to this issue | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
Resources
LinuxSecurity.com newsletters
This week's Linux Advisory Watch and Linux Security Week newsletters from LinuxSecurity.com are available.
Page editor: Jonathan Corbet
Kernel development
Brief items
Kernel release status
The current development kernel is 2.5.60, which was released by Linus on February 10. This release was mostly an exercise in catching up with the pile of patches that accumulated while Linus was traveling; it includes ia32 lost timer tick detection and compensation, self-unplugging block I/O request queues, an ACPI update, various architecture updates, a SCSI command queue rework, Linux Security Module networking hooks, a big user-mode Linux update, a number of kbuild changes, 64-bit jiffies support, and a great many other fixes and updates. The long-format changelog has the details.Linus's (pre-2.5.61) BitKeeper tree includes a big x86-64 update, some fixups for signal problems in 2.5.60, some kbuild work, and another set of AGP patches.
Dave Jones has released 2.5.60-dj2, which adds some driver fixes and a number of 2.4 fixes to the 2.5.60 kernel.
The current stable kernel is 2.4.20; Marcelo has not released any 2.4.21 prepatches since January 29.
The current patch from Alan Cox is 2.4.21-pre4-ac4. It contains another set of IDE fixes and a few other repairs.
Kernel development news
The continuing development of I/O scheduling
The 2.5 development series has seen a great deal of work aimed at improving the performance of the block I/O subsystem. Recently there has been a resurgence of interest in I/O scheduling - deciding which disk I/O requests to process in which order. Optimal scheduling can keep the disks running at full speed and users happy, but the optimal solution can be hard to find. That doesn't stop the kernel hackers from trying, however. The anticipatory I/O scheduler work was covered here a couple of weeks ago; now a new approach is being tried which may improve I/O performance even more.The technique being looked at is "stochastic fair queueing," and it is intended to bring greater fairness to I/O scheduling decisions. In a fair situation, all users of a particular drive would be able to execute about the same number of I/O requests over a given time. This approach to fairness gets rid of starvation problems, and ensures that all processes can get some work done. The hope would be, for example, that a streaming media application would be able to move its data without outages, even in the presence of other, disk-intensive applications.
The stochastic fair queueing approach was first developed in the networking world by Paul E. McKenney; his paper on the subject can be found on this page. In the networking context, stochastic fair queueing tries to divide the available bandwidth equally among all users. Ideally, a separate queue would be used for each ongoing connection, but high-performance routers lack the resources to do things that way. So a smaller number of queues is used, with each connection being assigned to a queue via a hash function. Packets are then taken from each queue in turn, dividing the bandwidth between them. If two high-bandwidth connections happen to land on the same queue, they will be penalized relative to the other queues; to address this problem, the hash function is periodically changed to redistribute connections among the queues. The algorithm works reasonably well and is easy to make fast; the Linux networking code has had a stochastic queueing module available for some time.
In the disk I/O context, the aim is to divide the available disk bandwidth fairly between processes. The initial implementation by Jens Axboe creates 64 subqueues for each block I/O request queue, and distributes requests among the subqueues based on the process ID of the requestor. (Actually, it uses the process ID of the currently running process, which could, in some situations, not be the originator of the request). When the time comes to dispatch requests, one is taken from each subqueue, and the whole set is ordered before being sent to the drive for execution.
Taking things even further, Jens has also posted a complete fair queueing scheduler, which does away with the hash function used in the stochastic approach. Each process has its own queue, and requests are taken equally from all queues. It is hard to get fairer than that. Of course, as Jens points out, once you have this infrastructure in place, it is relatively easy to make things less fair again by adding, say, I/O priorities to processes.
Where this all appears to be heading (though probably not in the 2.5 series) is toward a configurable I/O scheduler with several possible algorithms which can be mixed and matched according to a site's local policy. In other words, it looks a lot like the traffic control code which has existed in the networking subsystem for a few years. As with networking, most sites will probably not need to tweak their disk scheduling regimes. Users with special needs, however, will be glad for the ability to fine-tune things to their specifications.
Porting drivers to 2.5
Last week's Kernel Page included the first articles in a series on porting device drivers (and other kernel code) to the 2.5 kernel. These articles are an offshoot of the work to update the Linux Device Drivers sample code (and then, of course, the book itself). Three more articles have been added to the series; one of them, which fills in more information on porting to the new module loader, appears below. The other two (on miscellaneous changes and the seq_file interface) can be read separately.These articles will be collected at lwn.net/Articles/driver-porting as the series continues to develop. With luck, they will become a useful resource for the kernel development community. Stay tuned...
Driver porting: more module changes
| This article is part of the LWN Porting Drivers to 2.6 series. |
Module parameters
The old MODULE_PARM macro, which used to specify parameters which can be passed to the module at load time, is no more. The new parameter declaration scheme add type safety and new functionality, but at the cost of breaking compatibility with older modules.Modules with parameters should now include <linux/moduleparam.h> explicitly. Parameters are then declared with module_param:
module_param(name, type, perm);
Where name is the name of the parameter (and of the variable
holding its value), type is its type, and perm is the
permissions to be applied to that parameter's sysfs entry. The
type parameter can be one of byte, short,
ushort, int, uint, long,
ulong, charp, bool or invbool. That
type will be verified during compilation, so it is no longer possible to
create confusion by declaring module parameters with mismatched types. The
plan is for module parameters to appear automatically in sysfs, but that
feature had not been implemented as of 2.6.0-test9; for now, the safest
alternative is to set perm to zero, which means "no sysfs entry."
If the name of the parameter as seen outside the module differs from the name of the variable used to hold the parameter's value, a variant on module param may be used:
module_param_named(name, value, type, perm);
Where name is the externally-visible name and value is
the internal variable.
String parameters will normally be declared with the charp type; the associated variable is a char pointer which will be set to the parameter's value. If you need to have a string value copied directly into a char array, declare it as:
module_param_string(name, string, len, perm);
Usually, len is best specified as sizeof(string).
Finally, array parameters (supplied at module load time as a comma-separated list) may be declared with:
module_param_array(name, type, num, perm);
The one parameter not found in module_param() (num) is an output parameter; if a value for name is supplied when the module is loaded, num will be set to the number of values given. This macro uses the declared length of the array to ensure that it is not overrun if too many values are provided.
As an example of how the new module parameter code works, here is a paramaterized version of the "hello world" module shown previously:
#include <linux/init.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
MODULE_LICENSE("Dual BSD/GPL");
/*
* A couple of parameters that can be passed in: how many times we say
* hello, and to whom.
*/
static char *whom = "world";
module_param(whom, charp, 0);
static int howmany = 1;
module_param(howmany, int, 0);
static int hello_init(void)
{
int i;
for (i = 0; i < howmany; i++)
printk(KERN_ALERT "(%d) Hello, %s\n", i, whom);
return 0;
}
static void hello_exit(void)
{
printk(KERN_ALERT "Goodbye, cruel %s\n", whom);
}
module_init(hello_init);
module_exit(hello_exit);
Inserting this module with a command like:
insmod ./hellop.ko howmany=2 whom=universe
causes the message "hello, universe" to show up twice in the system
logfile.
Module aliases
A module alias is an alternative name by which a loadable module can be known. These aliases are typically defined in /etc/modules.conf, but many of them are really a feature of the module itself. In 2.6, module aliases can be embedded with a module's source. Simply add a line like:
MODULE_ALIAS("alias-name");
The module use count
In 2.4 and prior kernels, modules maintained their "use count" with macros like MOD_INC_USE_COUNT. The use count, of course, is intended to prevent modules from being unloaded while they are being used. This method was always somewhat error prone, especially when the use count was manipulated inside the module itself. In the 2.6 kernel, reference counting is handled differently.The only safe way to manipulate the count of references to a module is outside of the module's code. Otherwise, there will always be times when the kernel is executing within the module, but the reference count is zero. So this work has been moved outside of the modules, and life is generally easier for module authors.
Any code which wishes to call into a module (or use some other module resource) must first attempt to increment that module's reference count:
int try_module_get(&module);
It is also necessary to look at the return value from
try_module_get(); a zero return means that the try failed, and the
module should not be used. Failure can happen, for example, when the
module is in the process of being unloaded.
A reference to a module can be released with module_put().
Again, modules will not normally have to manage their own reference counts. The only exception may be if a module provides a reference to an internal data structure or function that is not accounted for otherwise. In that (rare) case, a module could conceivably call try_module_get() on itself.
As of this writing, modules are considered "live" during initialization, meaning that a try_module_get() will succeed at that time. There is still talk of changing things, however, so that modules are not accessible until they have completed their initialization process. That change will help prevent a whole set of race conditions that come about when a module fails initialization, but it also creates difficulties for modules which have to be available early on. For example, block drivers should be available to read partition tables off of disks when those disks are registered, which usually happens when the module is initializing itself. If the policy changes and modules go back off-limits during initialization, a call to a function like make_module_live() may be required for those modules which must be available sooner. (Update 2.6.0-test9: this change has not happened and seems highly unlikely at this point).
Finally, it is not entirely uncommon for driver authors to put in a special ioctl() function which sets the module use count to zero. Sometimes, during module development, errors can leave the module reference count in a state where it will never reach zero, and there was no other way to get the kernel to unload the module. The new module code supports forced unloading of modules which appear to have outstanding references - if the CONFIG_MODULE_FORCE_UNLOAD option has been set. Needless to say, this option should only be used on development systems, and, even then, with great caution.
Exporting symbols
For the most part, the exporting of symbols to the rest of the kernel has not changed in 2.6 - except, of course, for the fact that any user of those symbols should be using try_module_get() first. In older kernels, however, a module which did not arrange things otherwise would implicitly export all of its symbols. In 2.6, things no longer work that way; only symbols which have explicitly been exported are visible to the rest of the kernel.Chances are that change will cause few problems. When you get a chance, however, you can remove EXPORT_NO_SYMBOLS lines from your module source. Exporting no symbols is now the default, so EXPORT_NO_SYMBOLS is a no-op.
The 2.4 inter_module_ functions have been deprecated as unsafe. The symbol_get() function exists for the cases when normal symbol linking does not work well enough. Its use requires setting up weak references at compile time, and is beyond the scope of this document; there are no users of symbol_get() in the 2.6.0-test9 kernel source.
Kernel version checking
2.4 and prior kernels would include, in each module, a string containing the version of the kernel that the module was compiled against. Normally, modules would not be loaded if the compile version failed to match the running kernel.In 2.5, things still work mostly that way. The kernel version is loaded into a separate, "link-once" ELF section, however, rather than being a visible variable within the module itself. As a result, multi-file modules no longer need to define __NO_VERSION__ before including <linux/module.h>.
The new "version magic" scheme also records other information, including the compiler version, SMP status, and preempt status; it is thus able to catch more incompatible situations than the old scheme did.
Module symbol versioning ("modversions") has been completely reworked for the 2.6 kernel. Module authors who use the makefiles shipped with the kernel (and that is about the only way to work now) will find that dealing with modversions has gotten easier than before. The #define hack which tacked checksums onto kernel symbols has gone away in favor of a scheme which stores checksum information in a separate ELF section.
Getting at the BitKeeper repositories without BitKeeper
Andrea Arcangeli, with a statement that he prefers coding to participating in flame wars, recently released a script which can pull code from a BitKeeper repository without the need to actually run BitKeeper. The script makes use of the web interface to the repository running on bkbits.net. It looks like a great way for developers who do not want to run proprietary software to get access to Linus's current tree. There is only one problem, however: the BitMover folks are very concerned about the amount of bandwidth that could be burned by extensive use of this script, and have promised to shut down the web interface if the bandwidth bill gets too high.The issue of access to the BitKeeper repositories via free software will not go away, however; there is a determined subset of the kernel hacker community that simply does not want to use proprietary code. Fortunately, there appears to be an answer on the horizon: BitMover has promised to make Linus's repository available as an automatically updated CVS repository. That repository, presumably, will be hosted at kernel.org. At that point, a lot of minds should be eased about access to the repository - and about long-term preservation of the kernel's revision history in an open format (not that the BitKeeper format, which is based on SCCS, is particularly closed).
Incidentally, it has been just over one year since Linus let the world know he was trying out BitKeeper in the 2.5.4-pre1 announcement.
Patches and updates
Kernel trees
Architecture-specific
Core kernel code
Development tools
Device drivers
Documentation
Filesystems and block I/O
Janitorial
Memory management
Benchmarks and bugs
Miscellaneous
Page editor: Jonathan Corbet
Distributions
Distribution News
Debian GNU/Linux
The Debian Project announced that it is a founding member of the Desktop Linux Consortium (DLC) which was recently founded and will be incorporated as a non-profit association. A recent survey on DesktopLinux.com indicated that Debian is the most popular GNU/Linux Distribution for the Desktop.
Stephen Frost discussed problems in OpenSSL
0.9.6/0.9.7, LDAP, SSH. "There are quite a few bugs that are
probably because of the problem I'm about to describe (177868, 178061,
173821, probably others..) so it was felt that this might be something to
make other developers aware of.
"
Gentoo Weekly Newsletter -- Volume 2, Issue 6
Here's the Gentoo Weekly Newsletter for the week of February 10th, 2003. This week's top topics: Gentoo Linux at FOSDEM; New Release Manager for 1.4; Icons for Gentoo Linux.MandrakeSoft releases Mandrake Corporate Server 2.1
MandrakeSoft announced the immediate release of Mandrake Corporate Server 2.1, a comprehensive and versatile Linux solution that provides large accounts with critical business server functions, plus MandrakeSoft's famous "user friendly" touch. The Corporate Server includes MandrakeClustering tools.Red Hat Linux
Red Hat, Inc. has announced that Red Hat Linux Advanced Server has achieved US Department of Defense (DoD) Defense Information Systems Agency (DISA) Common Operating Environment (COE) certification. COE is a DoD software security and interoperability specification.Slackware Linux
Slackware has upgraded several gnome packages and gcc has been upgraded to gcc-3.2.2 on slackware-current. See the details of these and other updates in the change log.
New Distributions
Shabdix
KDE.News covers an informal group called LIGLUG (LinuxIran Gnu/Linux User Group), which has finished its work on a customized live CD based on KNOPPIX GNU/Linux and KDE. This live CD, which is called "Shabdix", will be used to promote GNU/Linux and FarsiKDE in Iran. The initial release is Shabdix 0.7.
Minor distribution updates
2-Disk Xwindow embedded Linux
2-Disk Xwindow embedded Linux has released 1disk 1.0 update with minor bug fixes. "Changes: Text widget cleanups were made. additional net drivers were added."
MURIX Linux
MURIX Linux has released v2003-01-14 with minor feature enhancements.RUNT
RUNT has released v1.10 with major feature enhancements. "Changes: A first attempt at USB bootable support was added. Please read "Booting from USB" in README.runt."
RxLinux
RxLinux has released v1.3.0 with major feature enhancements. "Changes: Many changes have been made in the startup scripts in order to support embedded systems. This means that Rxlinux can now boot and run from solid state hard disk like Disc-On-Chip, FlashDisk, etc. It also means that it can be installed on a regular hard disk. New software packages include keepalive, Postfix, squid, and frox."
TA-Linux
TA-Linux has released v0.2.0 beta 3 (i386) with minor bug fixes. "Changes: Many packages including the kernel and XFree86 were updated. The collection now features over 360 packages, including GNOME 2.2 and KDE 3.1. Some bugs were also fixed."
TopologiLinux
TopologiLinux has released v2.0.2 with minor feature enhancements. "Changes: Small fixes and updated packages."
uClinux
uClinux has released v2.5.60-uc0 with minor feature enhancements. "Changes: Updates to the latest Linux kernel."
Vector Linux
Vector Linux has released version 3.2 of their Linux distribution. This release marks the complete conversion to a Slackware based system and mostly LSB compliant.
Distribution reviews
SuSE Linux 8.1 Takes Our Challenge (OfB.biz)
Open for Business reviews SuSE Linux 8.1. "In reality, to the average user, there really isn't much of note in SuSE 8.1's desktop that wasn't available in 8.0. Like 8.0, the default GUI is KDE 3.0, and also like 8, SuSE uses a pre-release version of the Keramik style for the widgets (buttons, scrollbars, etc.). SuSE added an attractive new window manager style to the mix that went very nicely with the new "Crystal" icons and the aforementioned Keramik style to provide a professional looking desktop. As an added bonus, we found the main program launch menu and the "quick launch" menu both to be better organized in this release than in previous editions."
Page editor: Rebecca Sobol
Development
TownPortal 0.1
An interesting new open-source project called TownPortal is under development. The first release, version 0.1 has been announced.
"The alpha release is mostly feature-complete, but lots of tuning will still be needed for installation and user interfaces. Midgard experience is required for installing and using the package.
"
TownPortal provides a dynamic content-driven site structure that is managed with the Aegir CMS content management system, it works under the Midgard open source application server. TownPortal is organized as a Linux, Apache, MySQL and PHP (LAMP) system.
The system currently has the following features:
- Support for community information pages.
- Home Pages for people and groups.
- News capabilities.
- Support for photo galleries with management features.
- An event calendar.
- Support for registered users.
- Personalized user features including user calendar.
- Support for Finnish and English user interfaces.
- A localization tool for adding new languages.
- A fully-configurable portal layout.
TownPortal is licensed under the GPL, it may be downloaded here. The screenshots page shows the system in action. If your town or group needs a new web site, TownPortal looks like a nicely organized system.
System Applications
Audio Projects
JACK 0.50.0 released
Version 0.50.0 of JACK, the Jack Audio Connection Kit, has been released with a number of new capabilities.LADCCA 0.3.0 available
Bob Ham has released version 0.3.0 of LADCCA. "LADCCA, the session management system for jack and alsa sequencer applications on linux is now at version 0.3. After about a month of gentle fiddling, it now seems to work quite well. As an example, I managed to run muse, 2 standalone copies of iiwusynth and 2 copies of jack rack, save it with the server, close all the apps and restore it nearly perfectly (I say "nearly" as muse likes to control alsa ports and connections.) It's certainly coming along."
Database Software
PostgreSQL 7.3.2 Released
PostgreSQL 7.3.2 has been released. "This release addresses several overrun and memory leak issues that were found in recent weeks, so it is highly recommended that those running the 7.3.1 branch upgrade at their earliest convience. This release is backwards compa[tible] to the previous v7.3.x releases, and does not require a dump/restore to upgrade."
Education
Linux in Education Report
Issue #89 of the Linux in Education Report is out. Topics include two conferences on open-source software in education, one in the UK and another in Texas, the Blue Crane College for art, science and ecological studies' open source development centre, CD Repositories for Indian cities and towns, a new Red Hat program for educators, and more.
Electronics
gEDA news
The latest new releases from the GNU Electronic Design and Analysys (gEDA) project include Icarus Verilog snapshot 20030208 and GTKWave 2.0.0 pre3.XCircuit 3.1 revision 3 released
Release 3 of XCircuit 3.1, an electronic schematic drawing package, has been announced. "As of revision 3 (February 10, 2003), the Tcl interface appears to be stable and duplicates all of the features available under the last non-Tcl-based version."
Mail Software
Mailman 2.1.1 Released
Mailman 2.1.1 has been released. This version of the GNU Mailing List Manager fixes many bugs found in Mailman 2.1 final, and updates language support. It also fixes a cross-site scripting vulnerability. It is recommended that all Mailman 2.1 sites upgrade to version 2.1.1.
Printing
ESP Ghostscript 7.05.6 available
The CUPS project has released version 7.05.6 of ESP Ghostscript. More information on ESP Ghostscript is available here.
Web Site Development
mod_security 1.4.2 released
Version 1.4.2 of mod_security is available. "Mod_security is an Apache module whose purpose is to protect vulnerable applications and reject human or automated attacks. It is an open source intrusion detection and prevention system for Apache. In addition to request filtering, it also creates Web application audit logs. Requests are filtered using regular expressions." This version now runs without patching Apache for POST request filtering.
AxKit 1.6.1 Released (use Perl)
Use Perl has an announcement for AxKit 1.6.1, a Perl-based web site system. This version features bug-fixes and minor features.Zope Members News
The most recent headlines on the Zope Members News include: MyMediaManager 1.1 released, DCOracle2 1.3 beta available, Silva 0.9.1 beta released , Zope 2.6.1 Released, DZUG ZOPE meeting in Berlin, March 28-29th, CMFPortlets 0.5.2 released: Portlets get interactive CJKSplitter 0.1 Released, PropertyObject & PropertyFolder 1.3.1 released, Groupware Suite for CPS, Developer Preview, and ZChecker 0.1 Released.Zope Newbies
New article topics on Zope Newbies include: reStructuredText and Shipping the Prototype.
Miscellaneous
POE 0.25 Released (use Perl)
Use Perl reports on the release of POE version 0.25. "cwest writes "Version 0.25 of the award-winning POE networking and multitasking framework has been released. This version is mainly a bug fix release.""
Desktop Applications
Audio Applications
Ardour developments
The latest release of Ardour, a multi-track audio recorder, includes the following changes: "gain faders once again move during automation playback, sessions can now live anywhere on your system, s/w RAID definition is now per-session, LADSPA plugin UIs significantly improved for plugins with output and toggle controls."
JACK Rack 1.3.0 released
Version 1.3.0 of JACK Rack, a virtual audio effects rack, is available. New features include wet/dry controls for each plugin, logarithmic controls, a better file loader, and more.ALSA Patch Bay 0.5.1 released
Two versions of Alsa Patch Bay came out this week. Version 0.5.0 was released, and adds JACK support. Version 0.5.1 fixed a bug with version 0.5.0.Sweep 0.8.1 Released
Version 0.8.1 of Sweep, an audio editor and live playback tool, has been released. "This release contains performance improvements for basic editing operations, including reduced memory consumption during cut and paste insert. It also includes support for creation of new files on the command line, updated handling of raw file loading through libsndfile, and updated support for voice activity detection and intensity stereo coding features of the Speex speech codec."
AlsaPlayer 0.9.74 is out
AlsaPlayer version 0.9.74 has been released. "This release has many new features including Icecast/Shoutcast support, CDDB lookup support and lots of other fixes. Check out the ChangeLog."
Desktop Environments
FootNotes
Headlines on the GNOME desktop FootNotes site include: Gnome Gazette: An independent journalist's perspective on recent Gnome events, Evolution 1.3 (GTK2) snapshots available, XChat 2.0 is out!, The Free/Libre/Open Source Software Survey for 2003, Progress and Future of Mozilla the application suite, Ruby-GNOME2-0.3.0 is released!, New project: Gnoppix, Get involved with Gnome: Fix some Nautilus bugs!, Sodipodi 0.30 released, Dropline GNOME 2.2.0 is Ready for Consumption, Evolution 1.2.2 available, and more.KDE-CVS-Digest for February 7, 2003
The Febrary 7, 2003 edition of the KDE-CVS-Digest is available. "Work continues on the Kde Personal Information Manager and Koffice. Filters to interoperate with other applications and formats such as Outlook Express, OOImpress, MSWrite, rtf and ApplixGraphics were improved. Plus the continuing improvements to Konqueror, Kopete and many others."
KDE 3.1: Desktop Sharing in Practice
KDE.News covers the new KDE 3.1 desktop sharing capabilities. "This new feature of KDE 3.1 allows a friend or administrator to fix problems on your computer, or you can use it to show your desktop to somebody else at a remote location."
KDE 3.1: eWeek Review, More RPMs
KDE.News covers an eWeek review of KDE 3.1, and some places where KDE 3.1 binaries can be found.Kopete 0.6 available
KDE.News looks at the release of Kopte 0.6. "Kopete is KDE's all-purpose, modular and extensible chat client, which currently supports the MSN Messenger, ICQ, AIM OSCAR, Jabber and IRC protocols. A sampling of the great new features includes sophisticated (HTML) text rendering, signing / encrypting chats and sending SMS messages to mobile phones, as well as chat tabs, translucent windows and web presence notification."
Graphics
GSview 4.31 beta test is now available
A beta version of GSview 4.31, a graphical interface for the Ghostscript PostScript interpreter, is available. Changes include support for the AFPL Ghostscript 8.00 security updates, the inclusion of Catalan and Slovak languages, support for the UTF-8 character set under Linux, and bug fixes.
GUI Packages
FLTK Developments
The latest new software for FLTK, the Fast, Light ToolKit includes: fl_connect 0.99, Log 0.91, and Fltk 1.1.XX utf-8 patch.
Interoperability
Kernel Cousin Wine
Issue #156 of Kernel Cousin Wine is out. Topics include: Cross-compiling Windows Apps, Threading Problems with glibc 2.3 (cont'd), RPC Data Marshalling (cont'd), Paypal Link, Wineconf 2003?, ReactOS v0.1, Windows API Database (cont'd), and GDI Performance.Samba 2.2.8pre1 released
Version 2.2.8pre1 of Samba is available for testing. "This is a non-production preview release provided for testing purposes. The full release notes and source code can be found on Samba mirrors."
Office Applications
AbiWord Weekly News
Issue #130 of the AbiWord Weekly News is out, with the latest AbiWord word processor development news. "Dom and Hub add a little to their respective hackdowns. Hub's in particular refers to the re-opening of that annoying crash-on-zoom problem, while Dom does some bug spotting and decides it belongs in the 2.0 hackdown. Needless to say, with crash on zoom's return, so has its position in the top20."
Release of GnuCash stable version 1.8.1
GnuCash 1.8.1 has been released. New features include automatic entering for scheduled transactions, a mortgage and loand repayment druid, new small business accounting features, OFX import, HBCI support, multi-currency transaction handling, redesigned menus, and improved documentation.LyX 1.3.0 is out
Version 1.3.0 of LyX, a GUI front-end for the TeX typesetting system, has been released. "One of the major projects that has been going on behind the scenes is the so-called GUI-independence project. We are glad to announce that version 1.3.0 shows the first results of this. LyX now comes in two flavours: Qt-LyX and xforms-LyX!"
LyX Development News
The February 4, 2003 edition of the LyX Development News is out. Topics include the release of LyX 1.2.3, CJK LyX, and the translation effect.OpenOffice.org 1.0.2 Beta SDK
Version 1.0.2 Beta of the OpenOffice.org Software Development Kit is available for download. "The highlight of this SDK is the new Developer's Guide. This guide provides a detailed description of the OpenOffice.org API concepts, the OpenOffice.org UNO component model and how to use the API in the context of the different application areas."
Web Browsers
Mozilla 1.3 beta released
Version 1.3 beta of Mozilla has been announced. New features include image auto sizing, the nearing completion of Mozilla Mail's junk-mail classification, dynamic profile switching, find as you type, a mozilla preferences panel for Chatzilla, an editable about:config preference list, and a new machine learning autocompletion feature. See the release notes for details.mozillaZine
The latest mozillaZine topics include: Andy Ihnatko of Chicago Sun-Times Still Prefers Mozilla, Review of Mozilla Composer, Mozilla 1.3 Beta Going Live as We Speak, Progress and Future of Mozilla the Application Suite, and Independent Status Reports.
Miscellaneous
GNU nano 1.2.0 needs feedback
Testers are being requested to help work out the bugs in the GNU nano editor. "As you may know, the nano development team is readying the 1.2.0 release of GNU nano. If you haven't already tried a recent version of nano, we have eliminated a large number of bugs in the 1.1 series. Our most recent release, 1.1.99pre2, should be stable enough for everyday use."
GNU Midnight Commander 4.6.0 released
Version 4.6.0 of GNU Midnight Commander is available, upgrades are recommended. "The difference from the last prerelease 4.6.0-pre3 is not very significant, but it's still recommended to upgrade because of a bug that could cause GNU Midnight Commander to remain in memory and eat CPU cycles after closing the terminal it's running on."
Languages and Tools
Caml
Caml Weekly News
The Caml Weekly News for February 4-11, 2003 is out. Topics include the future of Camlp4, Support for Unicode, ocamlnet-0.95 released, Optimizing false polymorphic local functions, and the first release of Cstr.The Caml Light / OCaml Hump
This week, the new software on The Caml Light / OCaml Hump includes: Cstr; A full-featured charset and string library, GeoCaml; A tool allowing to handle easily euclidian geometry, and OCamlnet; A collection of modules for the Objective Caml language which focus on application-level Internet protocols and conventions.
HTML
HTML to Formatting Objects (FO) conversion guide (IBM developerWorks)
IBM's developerWorks has published a guide that details the process of converting HTML documents to formatting objects. "Need help converting HTML documents to PDF? This reference guide shows by example how to use XSLT templates to convert 45 commonly used HTML elements to formatting objects (from the XSL-FO vocabulary) for easy transformation to PDF using XSLT. The examples assume that you're using the Java-based XSLT processor Xalan and the Apache XML Project's FOP tool, but most of the methods would work just as well with other tools."
Java
Sun says 22% of JVM bugs left unfixed
According to this internal memo which was leaked from Sun, a number of known Java bugs have been marked as "will not fix". "Our experience in filing bugs against Java has been to see them rapidly closed as "will not fix". 22% of accepted on-duplicate bugs against base Java are closed in this way as opposed to 7% for C++." Thanks to Giorgio Zoppi.
Using the Decorator Pattern (O'Reilly)
Budi Kurniawan talks about the decorator pattern in relation to Java Swing on O'Reilly. "This article explains the Decorator pattern and when to subclass and when to decorate."
Automating EJB Unit Testing (O'Reilly)
JiRong Hu writes about performing unit testing on EJBs on O'Reilly. "Enterprise Java Beans, or EJBs, cannot be tested on their own as can plain Java classes. There are additional steps to deploy them to an EJB container before they can be tested. This means that our testing process must include the additional process of deployment and re-deployment of EJBs. The deployment must be automated as well."
A JSTL primer: The expression language (IBM developerWorks)
IBM's developerWorks has an article by Mark A. Kolb on the use of JSTL tags. "The JSP Standard Tag Library (JSTL) is a collection of custom tag libraries that implement general-purpose functionality common to Web applications, including iteration and conditionalization, data management formatting, manipulation of XML, and database access. In this first installment of his new series on developerWorks, software engineer Mark Kolb shows you how to use JSTL tags to avoid using scripting elements in your JSP pages."
Lisp
OpenMCL 0.13.4 released
Version 0.13.4 of OpenMCL, an open-source Common Lisp implementation, has been released. "OpenMCL 0.13.4 is a maintenance release, containing bug fixes and minor feature enhancements relative to 0.13.3."
Perl
The Perl Journal
The February, 2003 edition of The Perl Journal has been published. Topics include: Using PerlObjCBridge to Write Cocoa Applications in Perl, Parsing MIME & HTML, Home Automation with Perl, Amazon.com Wish Lists by brian d foy, Other People's Arguments by Simon Cozens, And including a review of Practical Python.This Week on perl5-porters
The February 3-9, 2003 edition of This Week on perl5-porters is out. Topics include: Maintenance releases, Reducing op size, Seeking a safe signal test, and more.This week on Perl 6 (O'Reilly)
The February 2, 2003 edition of This week on Perl 6 is out with the latest Perl 6 news. Topics include: Parrot Objects (noun, not verb), The packfile patches, an ongoing saga, Securing Parrot ASM, Parrot Developer World Map, Coroutine context patch, Multiple code segments and the interpreter, Parrot run loop problems, More Array Behaviours, Spare Brackets, Arrays: Default values, Damian Takes a Sabbatical, and more.
PHP
PHP Weekly Summary
Topics on this week's PHP Weekly Summary include: Recommendation engine testers, Non-command prompt PHP, CVS confusion, Solaris build issues, NSAPI changes, php.NET?, servlet SAPI, and Timezone functions.Working with Permissions in PHP, Part 1 (O'Reilly)
John Coggeshall discusses Unix file permissions under PHP on O'Reilly. "In the past few columns, I have been discussing using PHP's file I/O capabilities for manipulating both files and directories. This week, we'll take a slight detour from a strictly PHP-related subject and discuss file permissions in Unix systems."
Python
The Daily Python-URL
This week's Daily Python-URL article topics include: David Mertz on reStructuredText, A conversation with Guido van Rossum, part V: Strong versus weak typing, The Java Problem, Interview with Dennis Ritchie, Shipping the prototype, pypy-dev List Summary, exchange4linux, Alpha of Kapor's open-source PIM due in spring.This week's Python-URL
Dr. Dobb's Python-URL for February 10 is available with the latest news from the Python development community - including a proposal to add a ternary operator to the language at last.Python for Freenet
A Python-based API has been made available for the Freenet anonymising/encrypting publishing and file-sharing network.
Ruby
The Ruby Weekly News
Topics on this week's Ruby Weekly News include: Embedding Ruby in C code, locana, SVG, cross-platform GUI meanderings, Blogging software, The way of the Gentoo, Relative performance of Ruby templating systems, and ruby-dev summary 19457-19539.New Ruby software includes: ZenWeb 2.15.0 Released, sys-uname 0.4.0, Text::Format 0.61, Digest::CRC32 0.1.0, bdb, FXRuby-1.0.19 Now Available, plruby, math-const 1.0.0, Ruby-GNOME2-0.3.0, MIME::Types 1.005, and ruby syntax file for GNU Source-highlight.
Scheme
Scheme Weekly News
The February 10, 2003 edition of the Scheme Weekly News has been published. Check it out for the latest Scheme news.
Tcl/Tk
Dr. Dobbs' Tcl-URL!
The February 10, 2003 edition of Dr. Dobb's Tcl-URL! is out with lots of Tcl news and links.
XML
Managing Enumerations in W3C XML Schemas (O'Reilly)
Anthony Coates covers XML controlled vocabularies on O'Reilly. "In this article, we will discuss how controlled vocabularies can be managed when using W3C XML Schemas, since this is the dominant XML schema format for data-oriented XML. Note that the "vocabularies" we refer to are enumerated lists of element-attribute values. This differs from other contexts where "vocabularies" are sets of XML element names."
BrownSauce: An RDF Browser (O'Reilly)
Damian Steer describes his BrownSauce RDF browser on O'Reilly. "BrownSauce is an RDF browser. It attempts, armed with no more than a knowledge of RDF and RDF Schema, to present all RDF data as intelligibly as possible."
Page editor: Forrest Cook
Linux in the news
Recommended Reading
MS .Net patent--a threat to standards? (ZDNet)
Microsoft is in the process of applying for a wide-ranging patent that covers a variety of functions related to its .Net initiative, say this ZDNet article. "If approved as is, the patent would cover application programming interfaces (APIs) that allow actions related to accessing the network, handling Extensible Markup Language (XML), and managing data from multiple sources. APIs are the hooks in software that allow applications to work with another system."
Companies
Tale of Two Stories (Linux Journal)
The Linux Journal looks at Google's success. "But what does "leading Linux company" mean when the real leaders aren't the usual suspects at all? They're the worker bees at companies of all sizes that are shifting IT dependencies from other operating systems and development methods to Linux and open source. They're IT departments embracing a de facto standard. And more, much more."
Red Hat offers Linux exams for schools (vnunet)
Vnunet covers the Red Hat Academy, an academic version of its Red Hat Certified Engineer training program for schools and colleges. "Among the subjects covered will be: systems administration, network engineering, C or C++ programming, databases, web development, PC repair and forensic computing."
Linux Adoption
Banks Want to Swim With Penguin (Wired)
Wired looks at the financial institutions that are using Linux to run their back-end operations. "Tux the penguin, Linux's beloved mascot, is rapidly becoming the financial services industry's totem animal of choice. In fact, it seems that the only steadily rising statistic on Wall Street these days is the number of companies moving to open-source systems."
Sam's joins $300 Linux PC club (News.com)
News.com reports that Sam's Club will be selling PCs running Red Hat Linux. "The Sam's Club PCs will include a wealth of open-source software ready to run, including the OpenOffice productivity package, Mozilla Web browser, and Evolution personal information manager."
Pixar switches from Sun to Intel (News.com)
News.com reports on Pixar, which has switched from Unix systems to a Linux cluster for its image rendering. "While the financial impact of the individual contract may be negligible to Sun, the symbolism is tough to ignore. A number of film and entertainment studios in the past year have swapped out Unix computers containing reduced instruction set computer (RISC) processors, like Sun's UltraSparc III, in favor of systems running Linux and chips from Intel or from Intel rival Advanced Micro Devices."
Sales increase for U.S. Linux servers (News.com)
News.com reports that sales of servers running Linux are up. ""Linux (sales) increased a lot because of IBM," said Shahin Naftchi, server analyst for Gartner. Naftchi said that IBM is now shipping blade servers, 75 percent of which run Linux."
Interviews
Interview - Dennis Ritchie (unix.se)
Unix.se has published an interview with Dennis Ritchie.Dennis Ritchie: The single thing that I'm happiest about is that the notion of making the Unix system portable was mostly mine. C was already implemented on several quite different machines and OSs, Unix was already being distributed on the PDP-11, but the portability of the whole system was new.
Gates Taking 'Pervasive' Linux Seriously (eWeek)
eWeek is carrying an article on Bill Gates's latest remarks on Linux. "In a way, there's more incompatible versions of Linux than there are of all other operating systems put together. That is, as people do innovations on top of Linux, they don't all get tested together and they're not all consistent with each other."
IBM's Linux Growth Path (eWeek)
eWeek features an interview with IBM's general manager of Linux, Jim Stallings. "Here are the numbers. Some 15 to 20 percent of our servers [sold] are Linux-driven. So it helps our server business, and we make a lot of money from our server business. There are other companies who don't make any money from their server business. Dell [Computer Corp.] and IBM are the only ones out there making money on their server business. So Linux is important to that business for us. It just so happens we also have a services business, and we make money on that, too."
Resources
Linux Productivity Magazine - February 2003
The February issue of Linux Productivity Magazine takes a long look at Perl Tk. "Perl Tk is an excellent choice for GUI apps because of its highly developed Tk widgets, and even more so because of Perl's ubiquity and the incredible power of Perl and its available modules. This Linux Productivity magazine contains details of major Tk widgets, culminating with a GPL licensed speech timer program."
Reviews
Gnome 2.2 cleans up the Linux desktop (ZDNet)
ZDNet covers the launch of Gnome 2.2. "The Gnome project said that version 2.2 has added support for other Freedesktop.org specifications, including icon themes, recent files and thumbnail management."
Trail of tears: MySQL, ODBC and OpenOffice 1.0 (LinuxWorld.com)
Joe Barr writes about the good and bad parts of working with MySQL, ODBC and OpenOffice 1.0. "I found a wonderful "how-to" piece called "OpenOffice.org 1.0, ODBC and MySQL," by John McCreesh. In the introduction, McCreesh writes about OpenOffice.org 1.0's "best kept secret" that secret being the fact that hidden away inside, completely unknown to most OpenOffice users, is a user-friendly front end for databases that is "a Microsoft Access (and more) equivalent." That may be so, but there is a very good reason why it's a secret: it's too damn hard getting OpenOffice and ODBC wired up correctly."
KDE 3.1 reviewed (eWeek)
eWeek reviews KDE version 3.1. "In the latest releaseKDE 3.1, which became available late last monththe product has seen significant advances since its 3.0 version, which eWeek Labs reviewed last spring, and represents Linux's best hope for becoming a viable desktop contender."
Open-Source GUI Fans: Meet Gnome 2.2 (TechWeb)
TechWeb takes a look at Gnome 2.2. "The upgrade moves toward settling unnecessary differences with its open-source competitor the K Desktop Environment, or KDE. There's a growing trend among developers in both camps to adopt specifications that bring consistency to common functions found in desktops and applications, such as having similar help, file, and cut-and-paste operations."
Miscellaneous
Perens throws hat into SPI ring (Register)
The Register covers elections at Software in the Public Interest. "SPI is looking to elect three new board members from a total of eight candidates. Contributing members of SPI are eligible to vote. A contributing member is one who is considered to have made a significant contribution to the Free Software community, as determined by SPI's membership committee."
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
Debian joins Desktop Linux Consortium
The Debian Project announced that it is a founding member of the Desktop Linux Consortium (DLC). A recent survey on DesktopLinux.com indicated that Debian is the most popular GNU/Linux Distribution for the Desktop.New DLC mailing list
The Desktop Linux Consortium has created a moderate volume mailing list for general discussions regarding the DLC.openMosix celebrates first anniversary
The openMosix project is celebrating its first anniversary. "This OpenSource project has quickly attracted thousands of users, building thousands of clusters. OpenSource is more than just free access to software source code. openMosix is a modern OpenSource project which encourages a very active user community."
Commercial announcements
UCITA withdrawn from the ABA
An attempt to get American Bar Association approval for the UCITA "shrink-wrap software law" bill has been withdrawn after it became clear that it would not pass. ABA approval, while not strictly required, is a usual step taken before trying to push a law through state legislatures throughout the U.S. This is a big setback for UCITA, but experience over the years shows that this law (which, among other things, would legitimize a number of restrictive licensing practices, and potentially subject free software developers to liability claims) will be back before too long. (Thanks to Max Hyre).Merant Showcases Solutions in IBMs Linux Center of Competence
Financial services are coming to Linux. Merant has announced that it is showcasing its solutions at IBMs Linux Center of Competence. Merant is offering financial organizations the opportunity to evaluate two of its leading products, PVCS Dimensions and PVCS Version Manager, in the Centers Linux environment.Quicknet PC-to-Phone Service now available for Linux users
Quicknet Technologies announced the Linux Special Edition, a commercial PC-to-Phone supported service for Linux users in concert with GnomeMeeting.Org.Press Release from Castle Technology Ltd
Castle Technology Limited has put out a press release concerning an alleged GPL violation. Source code is being made available to alleviate the concern. Thanks to Jonathan Riddell.Linux LPI Bootcamp
Jim Dennis will be teaching the first in a series of Linux LPI Bootcamp courses in Concord, California, starting on Febrary 24, 2003.SnapGear Develops Linux-Based Integrated Development Toolchain for Intel XScale Processor
SnapGear, Inc. has announced an open source developement environment for the Intel XScale(TM) (IXP425) microprocessor.
Resources
Study: comparing free and proprietary network stacks
A company called Reasoning has put out a press release on a defect study it did of six different TCP/IP stacks. "Reasoning found 8 defects in 81,852 lines of Linux kernel source code - the fewest number of defects of the various implementations of TCP/IP inspected by Reasoning as part of its study."
Beginning Perl available online
Wrox Press has made Simon Cozens' book Beginning Perl available online at no charge.wxWindows Tutorials online
Julian Smart's FOSDEM 2003 presentation and tutorial on the wxWindows cross-platform GUI framework are available online.
Upcoming Events
NOIE Open Source Software Seminar
The National Office for the Information Economy is hosting a seminar for departmental Chief Information Officer's (CIO's), Chief Technology Officer's (CTO's), agency ICT professionals and invited guests on government demand for Open Source Software. The seminar will take place at the National Press Club in Canberra, Australia on February 18, 2003.OpenOffice.org Conference 2003
The first OpenOffice.org conference will be happening March 20 and 21 in Hamburg, Germany - right after CeBIT. Speakers will include Bruce Perens and Curtis Sasaki (the VP of Engineering of the Desktop Systems Group at Sun Microsystems).GUADIC 2003 - the first Italian GNOME Users and Developers Conference
GUADIC 2003 - the "GNOME Users And Developers Italian Conference" will be held February 22 in Florence. Click below for the full announcement (in Italian).FSF Announces Date for Annual Associate Membership Meeting
The Free Software Foundation will hold an annual meeting on March 15, 2003. The event will include a panel discussion with some board members of FSF.KDE Developers Meet In Brussels For FOSDEM
KDE.News covers KDE developers at FOSDEM. "Activities included bugfixing, development discussions and presentations, keysigning and of course socializing. Pictures are available."
Copenhagen Perl Workshop in April (use Perl)
Use Perl reports on work by the Copenhagen Perl Mongers to put together a Perl Workshop in Copenhagen. The event it tentatively scheduled for the end of April.Call for Candidates YAPC::Europe::2004 (use Perl)
A Call for Candidates has been posted for the YAPC::Europe::2004 conference.Open Source for National and Local eGovernment Programs in the U.S. and EU
The Open Source for National and Local eGovernment Programs in the U.S. and EU conference will be held in Washington, D.C. on March 17-19, 2003.Events: February 13 - April 10, 2003
| Date | Event | Location |
|---|---|---|
| February 13 - 14, 2003 | The fifth NordU/USENIX Conference(NordU2003) | (Aros Congress Center)Västerås, Sweden |
| February 20 - 21, 2003 | Desktop Linux Summit | (Vivendi Universal Building)San Diego, CA |
| February 22 - 24, 2003 | CodeCon 2.0 | (Club NV)San Francisco CA, USA |
| February 27 - 28, 2003 | Linux Summit 2003 | (Dipoli Conference Center)Espoo, Finland |
| March 17 - 19, 2003 | Open Source for National and Local eGovernment Programs in the U.S. and EU | (The Marvin Center Grand Ballroom, George Washington University)Washington, DC |
| March 20 - 21, 2003 | First OpenOffice.org Conference(OOoCon2003) | (University of Hamburg)Hamburg, Germany |
| March 20 - 21, 2003 | Conference PHP 2003 | (École Polytechnique de Montréal)Montreal, Quebec, Canada |
| March 26 - 28, 2003 | PyCon DC 2003 | (George Washington University)Washington DC |
| March 31 - April 2, 2003 | 2nd USENIX Conference on File and Storage Technologies(FAST '03) | (Cathedral Hill Hotel)San Francisco, CA |
| April 2 - 3, 2003 | The UK Python Conference | (Holiday Inn Oxford)Oxford, England |
| April 10 - 12, 2003 | MySQL Users Conference & Expo 2003 | (Doubletree Hotel)San Jose, California |
Web sites
ALU.CLiki.net web site
alu.cliki.net is the location of a new CLiki-based web site which contains general LISP information.KDE-Forum.org and KDE-Look.org Hosting Updates
KDE.News reports on the resurfacing of KDE-Forum.org. "We're pleased to note that KDE-Forum.org is now back online after a rocky start. A big thanks goes out to Pierre-Emmanuel Muller and Cyberbrain who are now hosting this site, and of course to zenok, fan of KDE and creator of KDE-Forum.org for web-based KDE-related discussions."
Software announcements
This week's software announcements
Here are the software announcements, courtesy of Freshmeat.net. They are available in two formats:
- Sorted alphabetically,
- Sorted by license.
Page editor: Forrest Cook
Letters to the editor
Misleading reporting of TRACE flaw
| From: | John Fremlin <john@fremlin.de> | |
| To: | letters@lwn.net | |
| Subject: | Misleading reporting of TRACE flaw | |
| Date: | Fri, 07 Feb 2003 03:59:54 +0000 |
In http://lwn.net/Articles/21364/ "Cross-site tracing attacks" it says:
The whitepaper is more tempered, but it implies that the TRACE
method has a defect which compromises every web server.
This is misleading. Having read the white paper I cannot see where it
implies or states that.
The information is being leaked from the client. The client wrongly
sends the sensitive information to the server, which is then echoed
back, and this reply containing the sensitive information is wrongly
made available to the untrusted code.
The problem clearly lies with a bug in the ActiveX, etc. objects, not
the server, as the white paper states. It does recommend that TRACE be
disabled to make it impossible for the vulnerability to affect
vulnerable clients, but the problem will not lead to the compromise of
any web server unless it is possible to do that by reading someone's
cookie. Which is very, very doubtful.
Page editor: Jonathan Corbet