LWN.net Weekly Edition for March 6, 2008
File monitoring with Mortadelo and SystemTap
SystemTap is a tool to help gather information about running Linux systems which has been available for some time now. But applications that use the tool have been few and far between. Mortadelo is a GUI tool that uses SystemTap to observe and record system calls. It is more of a proof-of-concept than a complete application—though it is useful in its current form—but it does start to show some of the things that can be done using SystemTap.
Mortadelo specifically intercepts system calls that deal with accessing files, collecting the arguments to the calls as well the return codes. It is patterned after the Windows Filemon program, which is used in much the same way that a Linux user might use strace—only with a GUI. Problems with permissions or files that do not exist are the kinds of things that Mortadelo could be used to diagnose.
![[Mortadelo]](https://static.lwn.net/images/mortadelo_sm.png)
The data collected is displayed in a list in the GUI (shown at left), which can then be filtered using regular expressions to pull out the information of interest. Because it uses SystemTap, Mortadelo gathers information from all running processes at once, allowing the user to choose which parts they are interested in. The filtering is somewhat primitive, in that particular fields cannot be chosen to filter on, but still useful because it searches each entry fully.
System calls that return an error are highlighted in red making it easy to pick them out. By choosing appropriate strings to filter on, all permission errors in the system or every access of a particular filename can be seen. The GUI allows one to start and stop the recording as well as to save the captured data to a file. Each entry includes a timestamp, the process name and pid, the system call, return code, and arguments.
The application is written in C#, using the Mono framework; one of the authors has an interesting weblog entry comparing Mono and Python for developing this kind of tool. Mortadelo's interface to SystemTap is fairly straightforward, it spawns a stap command and sends it the probe points and code via stdin. It then reads the stap output, parsing it and displaying it in the window.
There were some tricks to getting it to build and run, but Eugene Teo's instructions for running it on Fedora 8 were quite helpful. Part of the problem was in getting SystemTap going on the system, which is a problem we have mentioned before. There were some other small hurdles as well, but Teo's hints and proper application of grep were enough to get past those.
Mortadelo's impact isn't so much in the application itself as it is in some of the ideas behind it. Using SystemTap for GUI tools will help users and administrators, especially those who are not command-line savvy. If Mortadelo, or some descendant of it, becomes popular, that will help make SystemTap use more widespread. Distributors will start packaging it in more readily usable forms, perhaps installing it by default. That will in turn help anyone tasked with keeping a Linux system smoothly functioning, whether they are GUI-centric or not.
Ryzom returns?
Toward the end of 2006, a company called Nevrax went out of business. Nevrax was the operator of an online multiplayer game called Ryzom which had developed a dedicated (if insufficiently lucrative) following. A group of free software developers, former Nevrax employees, and assorted Ryzom players sensed an opportunity here: perhaps the source for Ryzom could be obtained from the failing company and turned into free software. It seemed like a winning solution for all sides: Nevrax's creditors could get whatever money could be raised for the code, Ryzom players would continue to have a game, and the free software community would get an extensive new code base. All that was needed was to convince the relevant bankruptcy court that this was a good idea.To that end, the Free Ryzom project raised some €170,000 in pledges - an impressive amount of money. The Free Software Foundation offered $60,000 toward this goal. But, in court, another suitor (Gameforge) won out with a plan to keep the game proprietary. The Free Ryzom folks became the Virtual Citizenship Association and faded from view; it seemed that this story was done.
Only it seems it's not done. In February, the project sent out a news update on what had been happening over the past year. It seems that Gameforge stopped paying its employees in June, 2007, and, by August, was not paying its creditors. In October, Gameforge France went back into the bankruptcy process; then, last February, the Ryzom servers were shut down. This particular plan to save Ryzom, it seems, was not as successful as one might have liked.
So it seems that the Ryzom source might, once again, be up for grabs. A news update suggests that the process is moving quickly, but the project could make a try for the code if it is able to come up with a large (at least €230,000) bid in the immediate future. As of this writing, the Free Ryzom folks are examining their options and trying to come to a decision on the best course to take.
There can be no doubt that this code would be a valuable acquisition. Despite the fact that some of the very first multiplayer online games were free software (consider Netrek, for example, which occupied rather too much of your editor's time some 15 years ago, or some of the early MUD and MOO systems), free software does not have much to offer in that area now. The lack of competitive offerings in this area is one of the biggest motivations for people to use Windows. A free Ryzom could be a strong step toward better online gaming with free software.
[PULL QUOTE: One has to wonder why we seem to be unable to put together a competitive game without relying on a huge infusion of source from the proprietary world. END QUOTE] That said, one has to wonder why we, the larger free software community, seem to be unable to put together a competitive game without relying on a huge infusion of source from the proprietary world. There are certainly projects out there; consider Battle for Wesnoth or WorldForge, for example. Wesnoth is an addictive game with basic multiplayer capability and an active developer community, but it is a turn-by-turn game with relatively rudimentary graphics - though the graphics and soundtracks are quite nice by free software standards. WorldForge has high ambitions and a lot of infrastructure, but it never really seems to get out of that pre-alpha state. A look at WorldForge's CVS logs suggests that very few developers are actively contributing to the project.
There are critics of the free software community who would argue that gaming is the sort of program that free software just cannot do as well as proprietary software. A certain amount of planning and direction is required to pull together a coherent virtual world, quite a bit of artistic work (artwork, sounds, etc) is required, and so on; a project without a business-based revenue stream just cannot compete in this area. There might be some truth to this claim - but not that much. When one looks all all that we have accomplished, it does not seem like an online multiplayer game - challenging though it might be - should be beyond our capabilities.
What seems more likely is that we just haven't gotten the project management right yet. Anybody who has hung around with people who are interested in computing knows that game playing is certainly an itch that many feel the need to scratch. We just haven't yet made it easy enough for that scratching to happen.
What's needed is a relatively simple core upon which people can easily create virtual worlds. It should be straightforward for people who are not developers - artists, musicians, script writers - to contribute to the system, and their contributions should be made welcome. The desktop projects have had a certain amount of success in bringing in non-developer contributors; a look at how they have done that could be worthwhile.
Arguably, we should have most of the pieces we need. Battle for Wesnoth has shown that it's possible to put together a community which goes beyond just software developers. WorldForge seems to have a good start on some important pieces of infrastructure. There may be some useful code to be had from the Second Life client, which has been free for a year now. We are a large and talented community, we certainly have the ability to do something interesting in this area. It should not be necessary to wait until we get a code dump from a dead proprietary software company.
NDISwrapper dodges another bullet
Hardware compatibility has long been a problem for Linux—though it has gotten much better over the years—so it will be surprising to some to see a kernel change that will make some hardware cease working. For others, who follow kernel development a bit more closely, it will come as no great surprise that NDISwrapper was disabled by a change made to the kernel back in January. NDISwrapper has never been very popular with kernel hackers, but, because it is GPL licensed and allows more hardware to be used, there are folks on both sides of the argument. For a while, it looked like NDISwrapper had lost that argument, but the 2.6.25-rc4 release restores the functionality it requires.
NDISwrapper is a kernel module that is used to load Windows-only drivers into Linux. For some hardware, notably wireless network cards, it is the only way to support them because the manufacturer provides neither specifications nor a working Linux driver. Unfortunately, many of these cards are installed in laptops where it is difficult or impossible to replace them with Linux-friendly alternatives. This is what led to implementing the Network Device Interface Specification (NDIS) for Linux. NDIS is an ancient—it was originally developed by Microsoft and 3Com for MS-DOS in the mid to late 1980s—interface for networking devices, which is still in use today.
The NDISwrapper code has been around since 2003, but always as a separate module that must be built by the user (or distribution) and loaded into the kernel. It is not part of the mainline kernel, nor will it ever be; maintaining a glue layer that allows proprietary, closed-source drivers to be linked into the kernel is not high on anyone's list. But, NDISwrapper is GPL. Its code is available for inspection or modification by all, so that is not the problem, it is the intent that matters.
When a binary-only driver—the NVidia video driver for example—is loaded into the kernel, a "taint" flag is set, indicating that the kernel is tainted by code that cannot be examined. Bug reports for tainted kernels are routinely ignored, unless they can be reproduced in an untainted kernel. Life, it seems, is too short to try and diagnose problems that could easily have been created by a buggy driver that cannot be debugged. Originally, the taint flag was just a means to detect and ignore those bug reports, but over time it has become part of a mechanism to restrict which symbols a module can access.
Some kernel symbols are considered so integral that any module using them must be a derivative work. Therefore, modules that want to use them must be GPL. Modules declare their license using the MODULE_LICENSE macro, while symbols are exported using either EXPORT_SYMBOL or EXPORT_SYMBOL_GPL. Any module that doesn't have a compatible license doesn't get access to the GPL-only symbols.
Few would argue for a GPL module which existed to re-export all of the GPL-only symbols to non-GPL modules. But that is not what NDISwrapper does; instead it implements NDIS, but in order to do that, needs access to GPL-only symbols, mostly for USB and workqueue interfaces. It would be hard to contend that NDIS drivers are derivative of the Linux kernel, they were written for an entirely different system using an interface that predates Linux. This is why NDISwrapper developers and users think that an exception should be made for it. Clearly the Windows drivers taint the kernel, but accessing a subset of the GPL-only functionality through NDISwrapper should be allowed, they argue.
Since NDISwrapper itself is GPL, the normal module loading rules would allow it to access GPL-only symbols, except that an explicit check for NDISwrapper was added to the 2.6.16 kernel. The question, then, revolves around what should be done when the kernel detects it being loaded. NDISwrapper has always been careful to mark the drivers that it loads as tainted, but the recent patch marks the module itself as tainted, disallowing access to the GPL-only symbols and breaking NDISwrapper. Absent that patch, only the kernel is marked as tainted—the module itself is not.
A similar situation occurred back in October 2006, which LWN covered on the Kernel page, when a stricter interpretation of tainting started to be enforced. At that point, NDISwrapper stopped working and it looked like it might stay that way, until Andrew Morton stepped in with objections to breaking NDISwrapper with no warning. Shortly thereafter, a patch was merged that only marked the kernel as tainted when NDISwrapper is loaded. At that point, the issue fell by the wayside, until now.
Part of the problem is that marking a symbol as GPL-only means different things to different developers. For some, it is a means to warn proprietary driver developers that they are straying into territory that makes distribution of their drivers very likely to be a violation of the GPL, while others want to use it to completely eliminate binary-only kernel drivers. There is no policy that clearly delineates which interpretation is "correct". Meanwhile, NDISwrapper has been in use by many for four years or more; breaking it now, with little or no warning, is likely to create some very unhappy users.
Linus Torvalds clearly thinks there are no licensing issues with NDISwrapper:
Jon Masters, the author of the patch that inadvertently made this change, had an excellent suggestion that should be pursued to try and reduce these kinds of problems in the future:
Another interesting battle will be that surrounding exporting init_mm() which was removed in early versions of 2.6.25, but then restored in 2.6.25-rc4. It is fairly clearly a low-level kernel interface that is unused by any in-tree driver, so its export was removed. One rather glaring exception is that the out-of-tree NVidia binary drivers do use it. Its export has been restored for one more development cycle, but it is clearly seen as something that should not be touched by drivers. It could be quite a struggle between the developers and users of a very popular driver and the kernel hackers that don't want to see kernel API abuse.
Issues surrounding the GPL are always contentious on linux-kernel; this one is no different. While NDISwrapper is an out-of-tree driver, it has hardly been invisible, so complaints when it breaks should come as no surprise. A simple renaming will avoid the current kernel check, so breaking it that way will mostly be an annoyance to users rather than a real barrier to its use. Since there is no real consensus amongst kernel hackers on the binary driver issue, it is hard to see one emerging with regards to NDISwrapper, but that would be the best outcome. One way or another, it needs to be decided, NDISwrapper shouldn't come under a periodic threat of breaking. If it is determined to be a violation of the kernel interfaces, that should be clearly indicated and its users should be given some warning so they can find alternatives.
Security
Authentication bypass in routers
An authentication bypass vulnerability is one of the more dangerous problems that a web application can have. It allows the attacker to perform some action that the application designer saw fit to restrict to authenticated users without providing said authentication. Using these techniques, an attacker can control a targeted web application from afar without even wasting time cracking bad passwords—a dream scenario for such people.
If an authentication bypass is found in the latest social networking site, the flaw could cause embarrassment, but if that bypass is in your home router, much worse things could result. A series of articles over at GNUCITIZEN highlights quite a variety of authentication bypass flaws in various embedded devices including routers. The flaws come from their research and recent router hacking challenge, which challenged readers to find holes in their routers. (There is no table of contents for the series, so here are links to the four installments: 1, 2, 3, and 4).
Most authentication bypass flaws are caused by a conceptual mistake made by web programmers: believing that the "normal" way of accessing the site is the only way to access it. This manifests itself as applications that check for particular URLs to see if they require credentials without considering the possibility of aliasing. For example, web servers will generally ignore double-slashes in a URL, but if the application checks for /privileged/page and gets /privileged//page it may very well fall prey to an authentication bypass. Other similar schemes can be used to make the URL look different, but arrive at the same place.
A far uglier possibility is applications that believe you can only get to a particular URL via a page that enforces authentication. This is a belief in "security through obscurity"; that attackers won't be able to guess the URLs for the pages "behind" the authentication screen. This is almost comical in that there are many ways to find out what those URLs are, not least by buying the device and accessing them yourself. Pages that require authentication need to check that the credentials have been provided whenever the page is accessed—without regard for what URL got them there.
Some applications do all of the checking correctly on the pages that show various settings in a form allowing them to be changed, but the action of the form submits it to a different program. Inexplicably, sometimes that program does not check for credentials. Perhaps the programmer believes that web forms can only be submitted from the page that they have created, but it is trivially easy to generate an HTTP POST with the appropriate parameters. It certainly does no good to protect the current value of settings from non-authenticated users if they can easily change them to any values they want.
In terms of web security, authentication bypass is usually quite easy to avoid, it is a matter of ensuring valid credentials anywhere they are required. Before performing any action that requires a logged-in user, check the cookie (or other persistent authentication mechanism) for validity to perform the action requested. For people using routers at home, perhaps the best advice is to make sure its administrative interface is not internet facing. Routers have a pretty bad track record of getting this right, so far, as the hacking challenge and other research has shown.
Brief items
A set of Android vulnerabilities
Core Security has sent out an lengthy security advisory about Google's Android platform. It seems that, in their hurry to get something out there, the developers at Google used some old image processing libraries with a number of old, well-known vulnerabilities. This release was not meant for deployment anywhere, and there should have been no harm done. Given the stakes, though, one can only assume that future releases will be made with more care.
New vulnerabilities
am-utils: overwrite arbitrary files
| Package(s): | am-utils | CVE #(s): | |||||
| Created: | February 29, 2008 | Updated: | March 5, 2008 | ||||
| Description: | The am-utils package could be vulnerable to an attack in which one local user can modify the contents of arbitrary files to which other local users running expn have write access. | ||||||
| Alerts: |
| ||||||
audacity: insecure tmpfile handling
| Package(s): | audacity | CVE #(s): | CVE-2007-6061 | ||||||||||||||||
| Created: | March 3, 2008 | Updated: | May 12, 2008 | ||||||||||||||||
| Description: | From the Gentoo advisory:
Viktor Griph reported that the "AudacityApp::OnInit()" method in file src/AudacityApp.cpp does not handle temporary files properly. A local attacker could exploit this vulnerability to conduct symlink attacks to delete arbitrary files and directories with the privileges of the user running Audacity. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
cacti: multiple vulnerabilities
| Package(s): | cacti | CVE #(s): | CVE-2008-0783 CVE-2008-0784 CVE-2008-0785 CVE-2008-0786 | ||||||||||||||||||||||||
| Created: | February 28, 2008 | Updated: | July 16, 2008 | ||||||||||||||||||||||||
| Description: | From the Mandriva alert: A number of vulnerabilities were found in the Cacti program, including XSS vulnerabilities, SQL injection vulnerabilities, CRLF injection vulnerabilities, and information disclosure vulnerabilities. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
dbus: privilege escalation
| Package(s): | dbus | CVE #(s): | CVE-2008-0595 | ||||||||||||||||||||||||||||||||||||
| Created: | February 28, 2008 | Updated: | October 14, 2008 | ||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat alert: Havoc Pennington discovered a flaw in the way the dbus-daemon applies its security policy. A user with the ability to connect to the dbus-daemon may be able to execute certain method calls they should normally not have permission to access. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
evolution: format string vulnerability
| Package(s): | evolution | CVE #(s): | CVE-2008-0072 | ||||||||||||||||||||||||||||||||||||||||
| Created: | March 5, 2008 | Updated: | May 28, 2008 | ||||||||||||||||||||||||||||||||||||||||
| Description: | The encrypted mail display code in evolution suffers from a format string vulnerability which could be exploited by way of a specially crafted email message. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
firebird: multiple vulnerabilities
| Package(s): | firebird | CVE #(s): | CVE-2008-0387 CVE-2008-0467 | ||||||||
| Created: | March 3, 2008 | Updated: | March 27, 2008 | ||||||||
| Description: | From the Gentoo advisory:
Firebird does not properly handle certain types of XDR requests, resulting in an integer overflow (CVE-2008-0387). Furthermore, it is vulnerable to a buffer overflow when processing usernames (CVE-2008-0467). A remote attacker could send specially crafted XDR requests or an overly long username to the vulnerable server, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application. | ||||||||||
| Alerts: |
| ||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2007-3731 | ||||
| Created: | March 3, 2008 | Updated: | March 5, 2008 | ||||
| Description: | From the rPath advisory:
Previous versions of the Linux kernel package contain a vulnerability in the ptrace system call which allows local users to cause a Denial of Service. | ||||||
| Alerts: |
| ||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2006-6921 | ||||
| Created: | March 5, 2008 | Updated: | March 5, 2008 | ||||
| Description: | From the Red Hat advisory: a flaw was found in the handling of zombie processes. A local user could create processes that would not be properly reaped, possibly causing a denial of service. | ||||||
| Alerts: |
| ||||||
kernel: information disclosure
| Package(s): | kernel | CVE #(s): | CVE-2007-6207 | ||||
| Created: | March 5, 2008 | Updated: | March 5, 2008 | ||||
| Description: | From the Red Hat advisory: a flaw in the hypervisor for hosts running on Itanium architectures allowed an Intel VTi domain to read arbitrary physical memory from other Intel VTi domains, which could make information available to unauthorized users. | ||||||
| Alerts: |
| ||||||
lighttpd: denial of service
| Package(s): | lighttpd | CVE #(s): | CVE-2008-0983 | ||||||||||||||||||||||||
| Created: | February 29, 2008 | Updated: | July 15, 2008 | ||||||||||||||||||||||||
| Description: | From the CVE entry: lighttpd 1.4.18, and possibly other versions before 1.5.0, does not properly calculate the size of a file descriptor array, which allows remote attackers to cause a denial of service (crash) via a large number of connections, which triggers an out-of-bounds access. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
opera: several vulnerabilities
| Package(s): | opera | CVE #(s): | CVE-2008-1080 CVE-2008-1081 CVE-2008-1082 | ||||||||
| Created: | February 29, 2008 | Updated: | March 5, 2008 | ||||||||
| Description: | Opera version 9.26 fixes: an issue where simulated text inputs could trick users into uploading arbitrary files, image properties can no longer be used to execute scripts, and an issue where the representation of DOM attribute values could allow cross site scripting. | ||||||||||
| Alerts: |
| ||||||||||
qemu: insufficient block device address range checking
| Package(s): | qemu, zen | CVE #(s): | CVE-2008-0928 | ||||||||||||||||||||||||||||||||
| Created: | February 29, 2008 | Updated: | October 7, 2009 | ||||||||||||||||||||||||||||||||
| Description: | From Debian Security: Ian Jackson discovered that accesses beyond end of qemu emulated disk devices can result in accesses to emulator's virtual memory space accesses and thus can allow user with sufficient privilege in guest (root, as this would need modification to kernel's driver) to break out of VM. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
thunderbird: heap overflow
| Package(s): | thunderbird seamonkey | CVE #(s): | CVE-2008-0304 | ||||||||||||||||||||||||||||||||||||||||
| Created: | February 29, 2008 | Updated: | January 8, 2009 | ||||||||||||||||||||||||||||||||||||||||
| Description: | Security research firm iDefense reported that researcher regenrecht discovered a heap-based buffer overflow vulnerability in Mozilla mail code which could potentially allow an attacker to run arbitrary code. The vulnerability is caused by allocating a buffer that can be three bytes too small in certain cases when viewing an email message with an external MIME body. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
tshark, wireshark: multiple vulnerabilities
| Package(s): | tshark,wireshark | CVE #(s): | CVE-2008-1070 CVE-2008-1071 CVE-2008-1072 | ||||||||||||||||||||||||||||||||||||
| Created: | March 3, 2008 | Updated: | October 2, 2008 | ||||||||||||||||||||||||||||||||||||
| Description: | From the rPath advisory:
Previous versions of the wireshark package are vulnerable to multiple types of Denial of Service attacks, including crashes and excessive memory consumption. It has not been determined that these vulnerabilities can be exploited to execute malicious code. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
viewvc: multiple access violations
| Package(s): | viewvc | CVE #(s): | |||||||||
| Created: | March 3, 2008 | Updated: | March 5, 2008 | ||||||||
| Description: | From the Fedora advisory:
These security issues have been fixed: - omit commits of all-forbidden files from query results - disallow direct URL navigation to hidden CVSROOT folder - strip forbidden paths from revision view - don't traverse log history thru forbidden locations - honor forbiddenness via diff view path parameters | ||||||||||
| Alerts: |
| ||||||||||
Page editor: Jake Edge
Kernel development
Brief items
Kernel release status
The current 2.6 development kernel is 2.6.25-rc4, released on March 4. Patches still continue to go into the mainline repository at a high rate; most of them are fixes, but there's also kdump support in the ehea driver, dynamic tick handling in the RCU code, the temporary re-exporting of init_mm until outside modules can be fixed, HT1100 SATA support, Freescale MPC85xx DMA controller support, Seiko Instruments S-35390A RTC support, and the restoration of GPL-only symbol access for ndiswrapper. See the short-form changelog for details, or the full changelog for lots of details.As of this writing, no post-rc4 patches have been merged into the mainline repository.
The current -mm tree is 2.6.25-rc3-mm1. Recent changes to -mm include a big set of IDE changes and the removal of some old wireless drivers. The ext4 filesystem is disabled in -mm until it catches up with some API changes.
Kernel development news
Quotes of the week
Realtime adaptive locks
The realtime patchset has one overriding goal: provide deterministic response times in all situations. To that end, much work has been done to eliminate places in the kernel which can be the source of excessive latencies; quite a bit of that work has been merged into the mainline over the last two years or so. One of the biggest remaining out-of-tree components is the sleeping spinlock code. Sleeping spinlocks have advantages and disadvantages. A recently posted set of patches has the potential to significantly reduce one of the biggest disadvantages of the realtime spinlock code.Mainline spinlocks work by repeatedly polling a lock variable until it becomes available. This busy-waiting code thus "spins" while waiting for a lock. Spinlocks are quite fast, but they can also be a source of significant latencies: a processor which is holding a lock can delay others for indefinite amounts of time. In the mainline kernel, it is also not possible to preempt a thread which holds a spinlock - another source of latencies. (See this article for a more detailed description of the mainline spinlock implementation).
The realtime patch set addresses this problem in a couple of ways. One of those is to cause threads waiting for a contended lock to sleep rather than spin. As a result, lock contention cannot create latencies on processors which are not holding the lock. When spinning is removed, it is also possible to make code preemptible even when it holds a lock without causing deadlock problems. That allows a high-priority process to run regardless of any lower-priority processes which might currently hold locks on the current CPU. Finally, the realtime patch set has added priority awareness and priority inheritance to the locking code to ensure that the highest-priority process is always able to run.
This is all good stuff, but there is one little disadvantage: the extra overhead imposed by the more complicated locks can reduce system throughput considerably. This is a cost that the realtime developers have been willing to pay; it is often necessary to make trade-offs between throughput and latency. Recently, though, some developers at Novell have come to the conclusion that the throughput cost of the realtime patch set need not be as severe as it currently is; the resulting adaptive realtime locks patch brings the throughput of the realtime kernel to a level much closer to that found in the mainline - at least, for some workloads.
The core observation encapsulated in this patch set is that hold times for spinlocks tend to be quite short, especially in the realtime kernel. So the cost of putting a waiting thread to sleep may well exceed the cost of simply busy-waiting until the lock becomes free. So adaptive locks behave more like their mainline counterpart and simply spin until the lock becomes available. There are some twists, though, which are necessitated by the realtime system:
- The spinning cannot go on forever, since it may cause unacceptable
latencies elsewhere in the system. So an adaptive lock will only spin
up to a configurable number of times (the default is 10,000) before
giving up and going to sleep.
- Since lock holders are preemptible in the realtime kernel, it is
possible that the thread which currently holds the lock was previously
running on the same CPU as the process trying to acquire the lock. In
that situation, spinning for the lock is
clearly a bad thing to do. In the absence of a loop counter, it would
be a hard deadlock situation; with the counter, it would just be an
unnecessary delay. Either way, the result is undesirable, so, if the
lock owner is running on the same
processor, the thread waiting for the lock simply goes to sleep.
- If the lock owner is, instead, itself sleeping while waiting for something, there is little point in having another thread stay awake in the hope that the owner will release the lock soon. So, in this case too, a thread contending for a lock will simply go to sleep rather than spin.
One other throughput improvement is obtained by changing the lock-stealing code. Locks in the realtime system are normally fair, in that threads waiting for a lock will get it in first-come-first-served order. A higher-priority process will jump the queue, however, and "steal" the lock from lower-priority processes which have been waiting for longer. The adaptive locks patch tweaks this algorithm by allowing a running process to steal a lock from another, equal-priority process which is sleeping. This change adds some unfairness to the locking code, but it allows the system to avoid a context switch and keep a running, cache-warm process going.
Some benchmark results [PDF] have been posted. On the test system, the dbench benchmark runs at about 1500 MB/s on a stock 2.6.24 system, but at just under 170 MB/s on a system with the realtime patches applied. The adaptive lock patch raises that number back to over 700 MB/s - still far from a mainline system, but much better than before. The improvement in hackbench results is even better, while the change in the all-important "build the kernel" benchmark is small (but still positive). A fundamental patch like this will require quite a bit of review and testing before it might be accepted. But the initial results suggest that adaptive locks might be a big win for the realtime patch set.
An object debugging infrastructure
Thomas Gleixner has discovered that being the maintainer of a core kernel infrastructure module can bring some special challenges. Whenever somebody's kernel oopses in the timer code, for example, Thomas tends to hear about it. The only problem is that the timer code is almost never where the bug is. Instead, it's far more likely that some other kernel subsystem has corrupted an active timer, leaving a bomb that will only explode later, in the timer code, when that timer is set to expire. At that point, it can be hard to figure out where the real problem is, as the culprit will be long gone.In response, Thomas developed some special-purpose code aimed at finding the real source of timer-related problems, preferably before it brings down the kernel. He has now generalized that code and posted it as the object debugging infrastructure patch, which was subsequently significantly revised. As this code develops, it has the potential to help find whole classes of especially difficult bugs before they bring the system down.
There's a few steps involved in adding support for object debugging to a new subsystem. The first is to create and populate a debug_obj_descr structure (defined in <linux/debugobjects.h>):
struct debug_obj_descr {
const char *name;
int (*fixup_init) (void *addr, enum debug_obj_state state);
int (*fixup_activate) (void *addr, enum debug_obj_state state);
int (*fixup_destroy) (void *addr, enum debug_obj_state state);
int (*fixup_free) (void *addr, enum debug_obj_state state);
};
The name field is the name of the subsystem; it is used in debugging output. We will return to the other fields below.
The next step is to call into the object debugging code whenever an action of interest involves one of the tracked objects. There is a set of functions used for this purpose:
void debug_object_init (void *addr, struct debug_obj_descr *descr);
void debug_object_activate (void *addr, struct debug_obj_descr *descr);
void debug_object_deactivate(void *addr, struct debug_obj_descr *descr);
void debug_object_destroy (void *addr, struct debug_obj_descr *descr);
void debug_object_free (void *addr, struct debug_obj_descr *descr);
In each case, addr is a pointer to the object being operated on, and descr is a pointer to the debug_obj_descr structure mentioned above. The meaning of each call is:
- debug_object_init(): the object is being initialized.
- debug_object_activate(): it is being added to a subsystem list. For
timer debugging, this action happens when add_timer() is
called.
- debug_object_deactivate(): the object is being removed from a subsystem
list.
- debug_object_destroy(): the object is being destroyed and is
no longer referenced within the subsystem. This call is not
used in the version 2 patch set.
- debug_object_free(): the object is being freed.
The debugging code maintains a hashed set of lists for tracking objects; each object is added to the appropriate list when one of the above calls is made. As actions are performed on the objects, their state is tracked. In this way, the debugging code is able to test for a number of common mistakes, including deactivating an object which is not active, reinitializing active objects, or adding objects twice.
When something goes wrong, a backtrace is sent to the system logs. Since this backtrace identifies where the original error is made, it is likely to be far more useful than the trace associated with the system crash which will probably come later. But this infrastructure can also help to make that crash less likely, in that each subsystem can register a set of "fixup functions." These, of course, are all the methods in the debug_obj_descr structure which we glossed over above.
For example, if a call to debug_object_init() is made with an object which has already been activated, the debugging infrastructure will respond with a call to the fixup_init() callback, passing in the object in question and its current state (ODEBUG_STATE_ACTIVE in this case). The callback should return zero if it is able to, somehow, repair the damage. Even if things cannot be truly fixed, though, there is still use for this function; the timer code, for example, will disable an active timer if the calling code mishandles it. The kernel will almost certainly not operate as expected, but, at least, it has a smaller chance of crashing at some random time in the future.
Most debugging checks are performed in response to calls from within the subsystem itself. There is one useful check which cannot be done that way, though: detecting the freeing of objects which are still under some sort of subsystem management. To catch that mistake, Thomas's patch inserts a hook into functions like kfree() and free_hot_cold_page(). Every time an object is freed, the code checks through the appropriate list to see if it is still seen as being active in some subsystem. Freeing an object which is still known to a subsystem is almost always a bug - one which can be hard to track down later on.
The check on freed memory objects is clearly a useful debugging tool. It could also have a nontrivial overhead, though, since it requires searching a list every time some memory is freed. So it has its own configuration option and can be configured out of the kernel, even if the rest of the debugging code is built in.
At this point, only the timer subsystem is covered by this infrastructure, but there are plenty of other obvious candidates. Perhaps at the top of the list would be kobjects, which are famously susceptible to all kinds of programming mistakes. So expect to see the coverage of this code grow in the near future.
The rest of the vmsplice() exploit story
Back in February, LWN published a discussion of the vmsplice() exploit which showed how the failure to check permissions for a read operation led to a buffer overflow within the kernel. Subsequently, a linux-kernel reader pointed out that the article stopped short of a complete explanation: this is not an ordinary buffer overflow exploit. Travel schedules and such prevented the writing of an immediate followup, but your editor would still like to tell the full story. So this article picks up where the last one left off and describes how the vmsplice() exploit makes use of this buffer overflow to take over the system.When vmsplice() is being used to feed data from memory into a pipe, the function charged with making it all happen is vmsplice_to_pipe(), found in fs/splice.c. It declares a couple of arrays of interest:
struct page *pages[PIPE_BUFFERS];
struct partial_page partial[PIPE_BUFFERS];
PIPE_BUFFERS, remember, is 16 on exploitable configurations. Both of these arrays are passed into get_iovec_page_array(), which, as described in the previous article, makes a call to get_user_pages() to fill in the pages array. As a result of the failure to check whether the calling application is allowed to read the requested region of memory, get_user_pages() will overflow the pages array, writing far more than PIPE_BUFFERS pointers into it. These are, however, pointers to legitimate kernel data structures; it remains to be seen how this overflow enables the attacker to take control of the system.
The partial array is also passed into get_iovec_page_array(); it describes the portion of each page which should be written into the pipe. To that end, a loop like this is run immediately after returning from get_user_pages():
for (i = 0; i < error; i++) {
const int plen = min_t(size_t, len, PAGE_SIZE - off);
partial[buffers].offset = off;
partial[buffers].len = plen;
/* ... */
}
Since full pages are being written in this case, the calculated offset will be zero, and the length will be PAGE_SIZE (4096). The value of error is the return value from get_user_pages(); that will be the number of pages actually mapped: 46, in the case of the exploit. Remember that the partial array is also dimensioned to hold 16 entries, so this loop will overflow that array as well.
Both of these arrays are declared, one right after the other, in vmsplice_to_page(). A quick test by your editor suggests that the partial array will be placed below pages in memory, so, once partial is overflowed, the loop will start overwriting pages instead. So the pages array will end up containing alternating values of zero and 4096 rather than the real struct page pointers it had before. (It's worth noting that the exploit still works if the arrays are placed in the opposite order, since the overflow causes code down the line to think that pages is larger than it really is).
Once all this has happened, control returns to vmsplice_to_pipe() - the overflow is not big enough to have overwritten the return address. A call to splice_to_pipe() is supposed to finish the job, but something interesting happens there. Toward the beginning of this function, this test is made:
if (!pipe->readers) {
send_sig(SIGPIPE, current, 0);
if (!ret)
ret = -EPIPE;
break;
}
Looking back at the exploit code, we see that it closes the read side of the pipe before calling vmsplice(). So splice_to_pipe() will quit almost immediately. On its way out, however, it does this:
while (page_nr < spd_pages)
page_cache_release(spd->pages[page_nr++]);
The call to get_user_pages() will have locked each of the relevant pages into memory to allow the kernel to work with them; this is the cleanup code which goes back and unlocks the pages which will not be used. But remember that the pointers in the pages array have been overwritten, and are now either zero or 4096. What would normally happen here is a kernel oops, since those are not legitimate addresses. The exploit code has done something tricky, though: using some special mmap() calls, it has created some anonymous memory at the bottom of its address space.
Directly dereferencing user-space addresses while running in kernel mode is frowned upon for a number of reasons; it can blow up in a number of ways. But, if the address is valid and the relevant page is resident in memory, direct access to user-space memory will work. So, when the kernel starts to work with the addresses that it thinks are struct page pointers, it does not get any sort of fault; instead, it gets the data placed in that memory by the exploit. Needless to say, that data has been arranged carefully.
The Linux kernel normally manages each page as an independent object. There are times, however, when pages are grouped into larger units, called "compound pages." This generally happens when physically contiguous allocations larger than one page are needed by the kernel; when this happens, a compound page is passed back to the caller. These pages are special in that they must be split back apart when they are released back into the system, and there may be other cleanup work to do. So compound pages have an attribute not found on normal pages: a destructor which is called when the page is freed.
So, if we look at how the exploit sets up its low-memory page structures, we see:
pages[0]->flags = 1 << PG_compound;
pages[0]->private = (unsigned long) pages[0];
pages[0]->count = 1;
pages[1]->lru.next = (long) kernel_code;
When the kernel looks for a page structure at user-space address zero, it will find something which looks like a compound page. The destructor (stored in the lru.next field of the second page structure) is set to kernel_code(), a function defined within the exploit itself. Since the count is set to one, the call to page_cache_release() (which decrements that count) will conclude that there are no further references and, since the page looks like a compound page, the destructor will be called. At this point, the exploit has arbitrary code running in kernel mode, and the show is truly over. This code just sets the process's uid to zero (giving it root access), then engages in some assembly-language trickery to return immediately to user space, shorting out the rest of the cleanup process.
There are a couple of interesting implications from all of this. One, clearly, is that this exploit is not something which was bashed out by a script kiddie somewhere. It was written by somebody who understands low-level kernel code quite well and who is able to use that understanding to escalate an apparent information-disclosure vulnerability into a full code execution problem. It is, clearly, a mistake to underestimate those who write exploits, not all of whom immediately make their works known to the development community. One also should not assume that they have not already written exploits for other, still unfixed bugs.
Also worth noting is the fact that ordinary buffer overflow protection may well have not been effective against this vulnerability. The return address on the stack was not overwritten, and no exploit code was put in data areas. This episode has caused a renewed interested in technical security measures in the kernel. These measures are good, but it would be a mistake to think that they will fix the problem. What is really needed is stronger review of patches with security in mind; it is not yet clear to your editor that this review is happening.
Patches and updates
Kernel trees
Architecture-specific
Core kernel code
Development tools
Device drivers
Filesystems and block I/O
Memory management
Networking
Security-related
Virtualization and containers
Miscellaneous
Page editor: Jonathan Corbet
Distributions
News and Editorials
A draft proposal for Fedora spins
This week Jeff Spaleta posted a draft proposal for a spin submission and approval process. For those interested in creating officially approved Fedora spins, it is worth a look.Anyone can create a Fedora spin for their personal use. Just create a kickstart file to install the packages you want. There are various ways of doing this, but the Anaconda kickstart is probably the most common. This kickstart file tells the Anaconda installer what packages you want, and you have your own Fedora spin.
This draft is about creating official spins that will be listed at the Fedora Project Spins Tracker, and available for interested users to get the official Fedora spin of their choice. However there does need to be a way to cleanly distinguish between Released Spins and Contributed Spins.
What will it take to create an official Fedora spin according to this proposal? The first step is get a kickstart file into the Kickstart Pool, where the file will be reviewed and tested by a peer group of Spin Maintainers. If the peer group approves then the spin proposal goes to the board for review. If the Fedora Board approves the spin it will be granted trademark usage and from there it can be added to the Fedora CVS.
A number of steps need to be completed for this plan to work. First is the creation of Spin Guidelines. The guidelines will specify a minimum level of technical quality for kickstart files, and contain a naming scheme for new spins. The not-yet-formed peer group of Spin Maintainers will have some say in these Guidelines, although the release engineering team will probably create the first draft.
There is a long way to go to get a straightforward way for a Fedora Special Interest Group (or anyone else) to get a spin approved, but such things always have a start somewhere.
New Releases
FreeBSD 7.0-RELEASE available
The first stable FreeBSD 7.0 release is out. There's a lot of new features and performance improvements claimed. "Dramatic improvements in performance and SMP scalability shown by various database and other benchmarks, in some cases showing peak performance improvements as high as 350% over FreeBSD 6.X under normal loads and 1500% at high loads. When compared with the best performing Linux kernel (2.6.22 or 2.6.24) performance is 15% better."
Kubuntu-KDE4 Alpha Released
The first alpha release of the Kubuntu distribution with KDE4 is available. "There will be two editions of Kubuntu with the 8.04 release, a commercially supported KDE 3 edition and a community supported KDE 4 edition. It includes KDE 4.0.1 and a few applications from KDE 3 to fill in any gaps. This is our first alpha for the KDE 4 version of Kubuntu."
Mandriva Linux 2008 Spring RC 1 "Serapia" released
The first release candidate of Mandriva Linux 2008.1 has been released. "This pre-release includes the all-new artwork for the 2008 Spring release, further improvements to the Mandriva software management tools, WPA-EAP support in the network configuration tools, KDE 3.5.9 and available 4.0.1, some new default applications in KDE and GNOME, and the latest pre-release of OpenOffice.org 2.4."
Distribution News
Debian GNU/Linux
Debian Project Leader Elections 2008: Call for nominations
The Debian project is looking for nominations for the Project Leader role. Nominations are due by Sunday March 9, 2008 and a new project leader will take office on April 17th. In between, there will be a campaign, with IRC debates, and a vote. Click below for more details.Release Update: Release numbering, goals, armel architecture, BSPs
Marc 'HE' Brockschmidt takes a look at the Debian Lenny release. "There haven't been any changes in our release schedule. Please note that we want to release lenny in *6 months*..."
Bits from the listmaster team
The Debian listmaster team has been improving the setup of the listserver. Quite a few things have happened since the update last September. Click below for some highlights; including the new hosting location, the new list archive search engine, config cleanup, better bounce handling, de-spamming the list archive, and more.Security Support for Debian 3.1 to be terminated
Security support for Debian GNU/Linux 3.1 (Sarge) will be terminated on March 31, 2008. "One year after the release of Debian GNU/Linux 4.0 alias 'etch' and nearly three years after the release of Debian GNU/Linux 3.1 alias 'sarge' the security support for the old distribution (3.1 alias 'sarge') is coming to an end next month. The Debian project is proud to be able to support its old distribution for such a long time and even for one year after a new version has been released."
Fedora
Proposal: Fedora@Home
The Fedora project has just begun considering a proposal (from Red Hat) to incorporate the MRG grid scheduler into its distribution. This would enable Fedora users to donate their spare CPU cycles to some worthy project. "This would be fantastic for Fedora as it would allow us to lead the open source movement into the area of open services and community computing based on open source. It would also be a great marketing showcase for Fedora by showing our leadership in grid technology and in the power of our community. And, it would provide Fedora users a feel-good way to contribute to Fedora--even if they don't code--by contributing CPU cycles towards things like builds or automated testing."
Fedora Beta freeze/release slipping by a week
Anyone who has been running Fedora rawhide, or keeping up with the mail on the 'testers' list knows that rawhide has been quite unstable. The Fedora 9 beta has been postponed for a week to stabilize rawhide, fix problems in X and get the impending release of perl-5.10.0 into the system.Fedora Board Recap 2008-FEB-26
Click below for some notes on the February 26, 2008 meeting of the Fedora Board. Topics discussed include secondary arch hosting, fedoraproject.org mail, status of PPC, Summer of Code, and several other topics.
Gentoo Linux
Gentoo Foundation 2008 Elections - Results
New trustees of the Gentoo Foundation have been elected. The winners are Roy Bamford (neddyseagoon), Ferris McCormick (fmccor), Joshua Jackson (tsunam), Tom Gall (tgall) and William Thomson (wltjr).
Mandriva Linux
What's coming in Mandriva Linux 2008 Spring
The Mandriva developers are putting together a "what's coming" document describing the 2008 Spring release, which has just gone into release-candidate status. "The graphical software manager now defaults to searching only among applications with a graphical user interface, rather than among all available packages (of course, it is still easy to switch to searching through all available packages), reducing the confusion new and inexperienced users find on being presented with lots of packages they likely are not interested in installing."
SUSE Linux and openSUSE
openSUSE Board elections
The current openSUSE board is working on a proposal for organizing the elections of the next board. "As a first step, and also because we want it to be an open and transparent process, we'd like to hear about ideas and recommendations about how we should do that."
Distribution Newsletters
Fedora Weekly News Issue 122
The Fedora Weekly News for February 25, 2008 looks at "Banners for Interviews", "Network Manager Interview", "New Fedora Chair plans to remove obstacles for volunteers" and much more.OpenSUSE Weekly News/12
This week the OpenSUSE Weekly News covers small changes, continued work on slimming down the installation, Firefox 3.0 beta 3 packages, expanded Lenovo SUSE Linux offerings, and much more.Ubuntu Weekly Newsletter #80
The Ubuntu Weekly Newsletter for March 1, 2008 covers the Alpha 6 Freeze, the release of Kubuntu-KDE4, Full Circle Magazine #10, Ubuntu Mobile, launch of Ubuntu Brainstorm, a Mark Shuttleworth Interview, and much more.DistroWatch Weekly, Issue 242
The DistroWatch Weekly for March 3, 2008 is out. "The delayed FreeBSD 7.0 was finally released last week and there is a lot to be excited about - especially if you deploy this excellent operating system on servers. But how about the desktop users? Is this latest version ready to take over our workstations? Read our first look review to find out. In the news section, the Debian release team contemplates the inclusion of KDE 4 in "Lenny", KNOPPIX springs to life at CeBIT with a new live DVD, Mandriva continues its relentless march towards version 2008.1, and Fedora discusses improvements in NetworkManager. Finally, we are pleased to announce that the recipient of the DistroWatch February 2008 donation is Frugalware Linux, a community distribution from Hungary."
Interviews
Fedora Project Leader: Hello and Goodbye
In his ongoing series of interviews on the Fedora wiki, Jonathan Roberts talks to both the incoming and outgoing Fedora Project Leaders, Paul Frields and Max Spevack respectively. The interview covers the history of the position, how it came about, what Spevack accomplished, what Frields hopes to accomplish, and more. "Paul: To be honest, like most Fedora contributors outside Red Hat, I didn't know Max. However, I did know that Matthew Szulik had asked Max specifically to do this job. I also knew Matthew was totally committed to an open culture that promoted work like that of Fedora, so I knew that his choice would be informed by those principles. If he was putting his faith in Max, I was pretty certain we could expect someone carrying those principles into practice. When I met Max at the Fedora Core 5 FUDCon in 2006 I knew he was definitely one of us! And the last two years have been a real testament to that good judgment on Matthew's part."
People of openSUSE: Marcus Rueckert
This week the People of openSUSE talks with Marcus Rueckert, also known as darix. "When did you join the openSUSE community and what made you do that? I don't think you can really join a community. You grow into it. When more and more stuff got moved to Linux I started hanging out on some Linux IRC channels in ircnet. Later some OSS project channels got added to the list. And at some point I started packaging stuff I needed for my servers. The first 2 SuSE guys I met on IRC were mmj and daemon. I got invited to join the beta program and later started working directly at SuSE."
Distribution reviews
The best Linux system repair disk graduates to 1.0 (Linux-Watch)
Linux-Watch takes a look at the recent release of SystemRescueCd v1.0. "For those of you who haven't had the pleasure of using SystemRescueCd, the Linux kernel 2.6.24.2-based distribution can be booted from either a CD-ROM or a USB stick. Once it's running, and I've yet to meet a busted PC that still had a working CPU and memory it couldn't run on, you have your choice of the lightweight WindowsMaker GUI or a shell command-line interface."
Page editor: Rebecca Sobol
Development
The GNOME Foundation launches an accessibility outreach program
The GNOME Foundation has announced a new outreach program for the GNOME accessibility project:
![[GNOME Accessibility]](https://static.lwn.net/images/ns/gnomeaccessibility.png)
Applications were opened for review starting on March 1, the project closes on December 31. Acceptance of long-term tasks closes on October 1, short-term task acceptance closes on December 15. The goal of the program is to work on improving shortcomings in the existing GNOME accessibility system. There is an aim to increase awareness of accessibility-related issues, encourage developers to work on accessibility issues and generally improve accessibility in free software.
From the project announcement:
"There will be two tracks to the program: In the first track accepted individuals will work towards accomplishing one of the major projects nominated for the program, earning US$6,000 and can take up to six months to complete the task. The second track will reward contributors US$1,000 for fixing five bugs out of a pool of accessibility bugs nominated by the program judges.
"
The
program rules explain the contract that the developers will
work under, the process of claiming tasks, the judging process
and more.
A
list of tasks has been
announced:
"Are you a developer who wants to become more familiar with accessibility? Are you an artist that can draw? Maybe you might also be interested in becoming a module maintainer some day. A great way to get started is by fixing bugs, and we're offering you a way to get paid to do it. :-)
"
The list of long-term tasks includes:
- Writing and updating accessibility documentation.
- Improving accessibility support in the Evince document viewer.
- Adding and improving GNOME magnification support.
- Building an accessibility testing framework.
- Adding new participant-defined accessibility projects.
Developers who need some income and are willing to improve availability of GNOME to all should consider taking on a task.
System Applications
Database Software
SQuirreL SQL Client: Version 2.6.5 released (SourceForge)
Version 2.6.5 of SQuirreL SQL Client has been announced. "SQuirreL SQL Client is a graphical SQL client written in Java that will allow you to view the structure of a JDBC compliant database, browse the data in tables, issue SQL commands etc. This is a bug-fix release".
Postgres Weekly News
The March 2, 2008 edition of the Postgres Weekly News is online with the latest PostgreSQL DBMS articles and resources.
Web Site Development
Samizdat 0.6.1 released
Version 0.6.1 of Samizdat is out with new security features. "Samizdat is a generic RDF-based engine for building collaboration and open publishing web sites. Samizdat provides users with means to cooperate and coordinate on all kinds of activities, including media activism, resource sharing, education and research, advocacy, and so on. Samizdat intends to promote values of freedom, openness, equality, and cooperation."
Miscellaneous
SBLIM: new release: JSR48 CIM Client 2.0.4 (SourceForge)
The JSR48 CIM Client 2.0.4 component of SBLIM has been announced. "SBLIM (pronounced "sublime"), the Standards Based Linux Instrumentation for Manageability is an IBM-initiated Open Source project, intended to enhance the manageability of GNU/Linux systems. It does so by enabling WBEM, Web Based Enterprise Management. Today the SBLIM project has released the initial public version of the JSR48 CIM Client, a Java Class Library based on the Java Specification Request 48 which can be used for the development of applications which need to communicate to a CIM server via the CIM Operations over HTTP protocol."
Desktop Applications
Audio Applications
MIDI Happenings in Ardour
There is a new report on MIDI progress with the Ardour multi-track audio recorder. "Dave MIDI Robillard writes: Hi all. Thought Id make a little post on MIDI stuff so things appear alive to you weirdos who arent on IRC 24 hours a day. Just some random not-very-prepared screenshots. An older shot showing multi-line controllers, and the editor controllers: Editor controls. On MIDI controller tracks (CC) the bar controllers can be used to record/touch, or twiddled in realtime to control MIDI apps/gear. MIDI import was introduced yesterday (Importing MIDI is done with the same dialog as audio, though it doesnt look appropriate yet..). Heres some Mozart imported into Ardour from a (single, multi-track) Standard MIDI File: Mozart Import."
pyjackctl 1.0 released
Version 1.0 of pyjackctl has been announced. "This project was created to take advantage of Nedko Arnaudov's JACK Audio Connection Kit (improvements) patches, especially the dbus proof of concept patch. It offers basic functionalities to control a JACK daemon over a dbus interface (start/stop, configure, etc.), it also includes a jack log viewer, a wmdock applet and a script to display jack's state on a G15 keyboard's LCD. Those curious of how it looks will find a set of screenshots on the homepage. You are welcome to test and comment."
Vamp plugin SDK 1.2 now available
Version 1.2 of Vamp plugin SDK has been announced. "Vamp is a plugin API for audio analysis and feature extraction plugins written in C or C++. Its SDK features an easy-to-use set of C++ classes for plugin and host developers, a reference host implementation, example plugins, and documentation. It is supported across Linux, OS/X and Windows. Version 1.2 contains a further addition to the host extension classes introduced in 1.1".
Desktop Environments
GARNOME 2.22.0 release candidate (2.21.92) announced
Release candidate 2.21.92 of GARNOME 2.22.0, the bleeding edge GNOME distribution, is out. "This is the last unstable GNOME release before 2.22.0. It's been a pretty fun ride since September. New features. Bug fixes. Translations. Documentation. Lots of bug triaging too. And we're getting ready to start again for 2.23!"
GNOME 2.22.0 release candidate (2.21.92) released
Release candidate 2.21.92 of the GNOME desktop is available. "This is the last unstable release before 2.22.0. It's been a pretty fun ride since September. New features. Bug fixes. Translations. Documentation. Lots of bug triaging too. And we're getting ready to start again for 2.23! But before, we need to make sure 2.22.0 will be rock-solid. There's still a few days before the hard code freeze, so it's not too late to fix this last bug you're ashamed of ;-)"
GNOME Software Announcements
The following new GNOME software has been announced this week:- cairo snapshot 1.5.12 (new features and bug fixes)
- Empathy 0.21.91 (new features, bug fixes and translation work)
- GNOME Commander 1.2.5 (bug fixes)
- gnome-pilot and gnome-pilot-conduits 2.0.16 (new features, bug fixes and translation work)
- Gnome Scan 0.5.93 (new features, bug fixes and translation work)
- GNOME Scan 0.5.94 (bug and build fixes, translation work)
- GnuCash 2.2.4 (new features, bug fixes and translation work)
- java-access-bridge 1.22.0 (bug fixes)
- metacity 2.21.21 (new feature and translation work)
- Tinymail pre-release 0.0.8 (new features and bug fixes)
- Tomboy 0.9.8 (bug fixes and translation work)
- Tracker 0.6.5 (new features and bug fixes)
- Tracker 0.6.6 (new feature and bug fixes)
- Vala 0.1.7 (new features and bug fixes)
KDE Software Announcements
The following new KDE software has been announced this week:- BeeDiff 1.2 (new feature and bug fixes)
- CenterShell 1.1 (new feature)
- eric4 4.1.1 (bug fixes)
- KDiamond 0.3 (new features and bug fixes)
- konqil.icio.us 2.3 (new features, bug fixes and translation work)
- Kraft 0.25 (new features and bug fixes)
- KSplasher 0.9 (new features)
- kuftp 1.2.0-beta1 (unspecified)
- Manslide 2.0.2 (new features, bug fix and translation work)
- PKanaEditor 0.2 (unspecified)
- QtiPlot 0.9.3 (new features and bug fixes)
- Soprano 2.0.3 (bug fixes)
- Yakuake 2.9 (KDE 4 release)
Xorg Software Announcements
The following new Xorg software has been announced this week:- libXext 1.0.4 (new features and bug fixes)
Financial Applications
SQL-Ledger 2.8.13 released
Version 2.8.13 of SQL-Ledger, a web-based accounting system, has been announced. Changes include: "added subject, message and inline/attachment option to batch email, removed extra line when "Ship all" was clicked, added missing customer number to generate sales order list, fixed foreign exchange gain/loss calculation when exchange rate is 1, added company name to title line for account detail report, updated German and Swiss German translations."
Games
Ember progress report (WorldForge)
The WorldForge game project has published a new Ember progress report. "Since the release of 0.5.1 Ive spent some time fixing a large number of bugs, many of which were discovered through the public release of 0.5.1, and reported on the Launchpad. So far Im very pleased with the Launchpad, since its actually being used for bug reporting. However, Id like to highlight some of the new features in Ember currently being developed. The main improvement is the inclusion of a new system for rendering foliage and trees. Its called the Paged Geometry engine and is a plugin component to Ogre."
Announcing the public release of Te Tuhi Video Game System
The first release of Te Tuhi Video Game System is available. "Te Tuhi is not a game in itself; rather it creates games based on arbitrary images that it is given. To use it, you draw a picture of the game you want to play, and it will give you the game that you really drew. The software was originally written for an exhibit at Te Tuhi Centre for the Arts in Manukau City, New Zealand, from which it borrowed its name. That show ended on 10 February 2008, at which point the software was released under the GPL. It is written primarily in Python and C."
GUI Packages
FLTK 1.1.8rc1 released
Version 1.1.8rc1 of FLTK, the Fast Light ToolKit, has been announced. This release features a long list of bug fixes.
Instant Messaging
AJAX Chat: Version 0.7.4 released (SourceForge)
Version 0.7.4 of AJAX Chat has been announced. "AJAX Chat is a fully customizable web chat implemented in JavaScript, PHP and MySQL which integrates nicely with common forum systems like phpBB, MyBB, PunBB, SMF and vBulletin. A Flash and Ruby based socket connection can be used to boost performance. AJAX Chat now features an easy to use installation script to create the required database tables. Additionally some minor bugs have been fixed and some translations have been updated (see changelog for this release)."
Mail Clients
Claws Mail 3.3.1 announced
Version 3.3.1 of Claws Mail has been announced. Changes include bug fixes and: "Forbid attaching anything containing "../" or ".ssh/" in mailto: URIs. Add a hidden preference, 'use_networkmanager', to disable NetworkManager handling Updated translations: French, Hebrew"
Multimedia
MediaInfo: 0.7.6.0 released (SourceForge)
Version 0.7.6.0 of MediaInfo has been announced. "MediaInfo supplies technical and tag information about video or audio files (MKV/AVI/MOV/MPEG1, 2, 4/M4A/M4V/MP3/AAC/RM/...) There are several versions: Graphical interface, Command line, or DLL for third-party software developers (like emule). GUI is multi-language. In this release: RMP3 and Id3v2.2 support, better detection of Lame encoder (MP3), and few bug fixes."
Music Applications
Amuc version 1.6 announced
Version 1.6 of the Amsterdam Music Composer has been announced. "This version is aiming more at "real composers", who are not supposed t[o] be computer geeks also. So more menu's and less need to use the command line. Also a Debian package is available, so you don't need a development environment in order to install Amuc."
Office Suites
OpenOffice.org Newsletter
The February, 2008 edition of the OpenOffice.org Newsletter is out with the latest OO.o office suite articles and events.PalOOCa: Version 0.8.0 Release (SourceForge)
Version 0.8.0 of PalOOCa has been announced. "PalOOCa is a Java based OpenOffice OLAP Add-On intended to be used with OpenOffice Calc. It is supposed to be the equivalent to the Palo Add-in for MS Excel. It took a while longer before I was able to test this release but finally it is done. Version 0.8.0 includes a first version of the promised modeller aswell as the ability to localize most of the dialogs. I also localized it into German to give an example how it is done."
Web Browsers
Mozilla Links Newsletter
The February 7, 2008 edition of the Mozilla Links Newsletter is online, take a look for the latest news about the Mozilla browser and related projects.
Languages and Tools
C
GCC 4.3.0-rc2 available
Version 4.3.0-rc2 of GCC has been announced. "Please test the tarballs there and report any problems to Bugzilla. CC me on the bugs if you believe they are regressions from previous releases severe enough that they should block the 4.3.0 release."
GCC 4.3.0 Status Report
The March 3, 2008 edition of the GCC 4.3.0 Status Report has been published. "GCC 4.3.0rc2 is out and we are not expecting further delay of the 4.3.0 release. The trunk is in stage1 since two weeks."
Caml
Caml Weekly News
The March 4, 2008 edition of the Caml Weekly News is out with new articles about the Caml language.
Java
Retrotranslator: 1.2.6 released (SourceForge)
Version 1.2.6 of Retrotranslator is available with some new capabilities. "Retrotranslator is a tool that makes Java applications compatible with Java 1.4, Java 1.3 and other environments. It supports all Java 5.0 language features and a significant part of the Java 5.0 API on both J2SE 1.4 and J2SE 1.3. In other Java environments only the Java 5.0 features that don't depend on the new API are supported."
Perl
This Week on perl5-porters (use Perl)
The February 17-23, 2008 edition of This Week on perl5-porters is out with the latest Perl 5 news.
Python
Python-URL! - weekly Python news and links
The March 3, 2008 edition of the Python-URL! is online with a new collection of Python article links.
Tcl/Tk
Tcl-URL! - weekly Tcl news and links
The February 27, 2008 edition of the Tcl-URL! is online with new Tcl/Tk articles and resources.
XML
xmote: 1.0.0 released (SourceForge)
Version 1.0.0 of xmote has been announced. "xmote is a standard for exchanging data in a compact standardized XML format. In addition to defining the standard, xmote aims to provide a fully compliant and easy to use reference implementation. Version 1.0.0 of the xmote standard and Java API are now available."
Version Control
Elijah Newren on what's happening in the VCS world
GNOME hacker Elijah Newren has put up a survey of recent developments in version control systems. "I have often found it somewhat strange that mercurial doesnt have more active vocal proponents. Usually one hears from the git or bzr proponents, but not so much from mercurial. Yet it has always had many of the advantages of both (and, in some ways seems to have the most svn-like UI, and would seem a more natural transition for svn converts). I guess its a case where having most of the advantages or capabilities of other systems (even multiple other systems) yet not clearly standing out in one particular area will rob you of the active advocates that you could otherwise have."
On a related note, it appears that Emacs will be moving to Bzr, not for a specific technical reason, but because Bzr is becoming a GNU project.
Page editor: Forrest Cook
Linux in the news
Recommended Reading
Adobe Pushes DRM for Flash
The Gnash video player site mentions efforts by Adobe to add DRM capabilities to the next version of Flash. "The immense popularity of sites like YouTube has unexpectedly turned Flash Video (FLV) into one of the de facto standards for Internet video. The proliferation of sites using FLV has been a boon for remix culture, as creators made their own versions of posted videos. And thus far there has been no widespread DRM standard for Flash or Flash Video formats; indeed, most sites that use these formats simply serve standalone, unencrypted files via ordinary web servers. Now Adobe, which controls Flash and Flash Video, is trying to change that with the introduction of DRM restrictions in version 9 of its Flash Player and version 3 of its Flash Media Server software."
Trade Shows and Conferences
KDE Rocks FOSDEM 2008 (KDE.News)
KDE.News covers the KDE presence at this year's FOSDEM conference. "The combined KDE/Amarok booth and developer room at the annual Free and Open Source Developers' European Meeting (FOSDEM) in Brusssels was a great experience (as usual!). Many people showed up from the KDE and Amarok communities, and we had a hard time fitting all our cool hardware and people in the booth. Luckily, the talks drew quite a crowd, and the booth became less busy as the day progressed. Read on for an overview of FOSDEM 2008 from the KDE perspective."
Companies
Adobe to deliver AIR for Linux (eWeek)
eWeek reports on Adobe's plans to release Adobe Integrated Runtime for Linux. "Adobe Systems hopes to make nice with the open-source community and soon deliver a Linux version of its newly released Adobe Integrated Runtime. Kevin Lynch, chief technology officer at Adobe, said the company is working on a Linux version of AIR, a run-time that lets developers use proven Web technologies to build RIAs (rich Internet applications) that deploy to the desktop and run across operating systems."
Sun Hires Python Experts (eWeek)
eWeek reports that Sun Microsystems is hiring Python developer Ted Leung and Jython lead implementer Frank Wierzbicki. "Leung and Wierzbicki join other technologists, such as Ian Murdock, Charles Nutter, Thomas Enebo and Nick Kew, who have recently joined Sun to pursue open-source project development and community activities. Murdock is the founder of the Debian Linux project, Nutter and Enebo are lead developers on the JRuby effort to create an implementation of Ruby on the JVM, and Kew is involved in a variety of ASF technologies and is working on OpenSolaris at Sun."
Linux at Work
Fedora on the Final Frontier (MadRhetoric)
Fedora developer Jack Aboutboul had the opportunity to visit NASA (National Aeronautics and Space Administration in the US). This blog post covers a day at NASA, with lots of photos. "There has been a long standing rumor regarding NASA running Fedora which all of us in the Fedora community have been always intrigued by. Is it true? What are they doing with it there? Why don't they run RHEL. Fortunately enough, a couple of weeks ago, I got to experience NASA behind the scenes, first hand, and hang out with the coolest members of the Fedora community, and find out the answer to these questions and lots more."
New supercomputer is a rack of PlayStations (Digital Life)
Digital Life reports on a cluster based on Linux PlayStation3 platforms. "When the PlayStation3 was released in November 2006, Gaurav Khanna's wife braved long queues so he could be one of the first people in the US to get his hands on the gaming console. But the astrophysicist was not itching to burn some rubber in Gran Turismo or shoot hoops in NBA 07. Instead he wanted to build his own supercomputer. Mr Khanna now owns 16 PS3s, which spend their days simulating the activities of very large black holes in the universe for the physics department at the University of Massachusetts." (Thanks to Mark Tall).
Legal
Germany's Highest Court Restricts Internet Surveillance (DW-World.de)
DW-World.de covers a ruling by Germany's Constitutional Court that limits police online investigations to the most serious cases. "Intelligence agencies will only be allowed to collect data secretly from suspects' computer hard drives if there is evidence that "legally protected interests," like human lives or state property, are in danger, the Constitutional Court in Karlsruhe announced." Here is the ruling (in German). (Thanks to Marc Mutz)
Interviews
Interview with Vint Cerf, by Sean Daly (Groklaw)
Sean Daly interviews Vint Cerf for Groklaw. "Groklaw's Sean Daly had an opportunity to meet Vint Cerf, Vice President and Chief Internet Evangelist at Google, at OpenForum Europe last week. Mr. Cerf, known as the Father of the Internet because of being the co-designer with Robert Kahn of TCP/IP protocols and the basic architecture of the Internet, was gracious enough to answer some email questions Sean propounded regarding the future of the Internet, standards in general, and OOXML in particular. Like many others this week, Cerf has been giving the standards process considerable thought, and he concludes in connection with OOXML that "Internet users deserve better handling of global Internet standards.""
Reviews
Thunderbird 3.0 to begin ascent next month: what to expect (ars technica)
ars technica looks forward to Thunderbird 3.0, which has an alpha release due next month. "Thunderbird 3 will use Gecko 1.9, a new version of the rendering engine that serves as the foundation for the Mozilla platform. Gecko 1.9, which has also been instrumental in the making of Firefox 3, offers a number of very significant improvements, including a new Cairo-based rendering backend and support for JavaScript 2. Improving the Thunderbird user interface is another very high priority for version 3."
Creating rich Internet applications on Linux with WebKit (ars technica)
Ryan Paul takes a look at WebKit. "The open-source WebKit HTML rendering engine is rapidly gaining ground on the Linux platform where it is increasingly being adopted by conventional desktop applications for content display. Ongoing efforts to facilitate tighter WebKit integration are opening the door for developing rich Internet applications on Linux with the open-source GTK and Qt development toolkits."
Miscellaneous
OOXML Fails to Get Majority Approval at BRM (Groklaw)
Groklaw reports that OOXML failed to get majority approval at the Ballot Resolution Meeting (BRM) in Geneva. "Now it's the 30-day voting period, but Updegrove asks, if they never could discuss all the issues, which is the purpose of a BRM, what's the basis for a vote? And with the vast majority either voting to abstain or even refusing to vote as a protest, I think one may conclude this proposal didn't belong on the fast track, and it isn't getting the kind of support you would have thought it might, given all the muscle that has gone into the push to get OOXML approved."
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
FSFE calls on Microsoft to release interoperability information without restrictions
The Free Software Foundation Europe is calling on Microsoft to release interoperability information without restrictions. "The European Commission has fined Microsoft 899 million Euro for anti-competitive behaviour by restricting access to interoperability information through unreasonable royalty payments prior to October 2007. This is in addition previous fines of 497 million Euro and 280 million Euro applied in the same investigation, resulting in a total penalty of 1.676 billion Euro. "Microsoft is the last company that actively promotes the use of software patents to restrict interoperability. This kind of behaviour has no place in an Internet society where all components should connect seamlessly regardless of their origin," says Georg Greve, president of the Free Software Foundation Europe."
GNOME and Mozilla Foundations announce cooperation
The GNOME Foundation and the Mozilla Foundation have announced that they will be working more closely together in the future. Specifics include Mozilla joining the GNOME advisory board, working with GNOME on XUL and Firefox, and a $10,000 donation in support of the recently-announced accessibility program.Google helps FSFE' Freedom Task Force to deliver training, attend conferences and translate documents
The Free Software Foundation Europe reports on a donation to its Freedom Task Force by Google. "Google has made a donation to assist FSFE's Freedom Task Force with delivering training courses, attending conferences and localising documents. "The Freedom Task Force is working to foster effective legal infrastructure for Free Software in Europe. A great deal of our work is based on engaging directly with people and Google's contribution will allow us to do this more effectively," says Shane Coughlan, FTF Coordinator. "Training, physical presence in countries and providing materials in local languages are essential aspects of building a coherent pan-European community.""
New Linux Foundation Board Members Elected
The Linux Foundation (LF) has announced the results of its annual Board of Directors election. The LF board is comprised of all LF membership classes as well as individual affiliates. "New board members elected during this cycle include Linux and open-source expert Larry Augustin, Advanced Micro Device's Chris Schlaeger and Texas Instrument's Eric Thomas. Mark Shuttleworth, founder of Ubuntu, has been re-elected as an individual member to the board. James Bottomley was also re-elected as the Technical Advisory Board's (TAB) representative to the board. The TAB is a collection of community developers and provides the Linux kernel community a direct voice into The Linux Foundation's activities."
Judge dissolves wikileaks.org injunction
The Electronic Frontier Foundation reports that an injunction against wikileaks.org has been dropped. "A federal district court judge in San Francisco today rescinded a controversial order that disabled the "wikileaks.org" domain name which had -- until two weeks ago -- pointed to Wikileaks, a website designed to give whistleblowers a forum for posting materials of public concern."
Commercial announcements
IGEL Technology presents embedded Linux speech recognition capabilities
IGEL Technology has announced full dictation and speech recognition capabilities on Linux and XP embedded thin clients. "IGEL Technology, one of the world's leading thin client vendors, today announced that they have partnered with Philips Speech Recognition Systems to bring advanced digital dictation and speech recognition solutions to its Linux and XP embedded thin clients. This solution is expected to offer substantial savings and optimization potential in the healthcare sector because it enables attaching digitally captured findings directly to patient files where additional information can be added and stored."
Linspire and Virtual Bridges announce Win4Lin Pro Desktop 4.5
Linspire, Inc. and Virtual Bridges have announced the availability of Win4Lin Pro Desktop 4.5 through the CNR.com site. "Available at a special introductory price of $34.99, Win4Lin Pro Desktop provides consumers, SMBs and enterprise customers an easy-to-use virtualization solution that allows Freespire 2.0, Linspire 6.0, Ubuntu 7.04 & 7.10 desktop Linux users to run Windows on Linux and assists in the complete migration process to desktop Linux."
Novell reports 1Q 2008 financial results
Novell, Inc. has announced its financial results for the first quarter of its 2008 fiscal year, which ended on January 31. "For the quarter, Novell reported net revenue of $231 million. This compares to net revenue of $218 million for the first fiscal quarter 2007. Income from operations for the first fiscal quarter 2008 was $8 million, compared to a loss from operations of $21 million for the first fiscal quarter 2007. Income from continuing operations in the first fiscal quarter 2008 was $15 million, or $0.04 per share. This compares to a loss from continuing operations of $12 million, or $0.04 loss per share, for the first fiscal quarter 2007. Foreign currency exchange rates favorably impacted revenue and unfavorably impacted operating expenses by $7 million and did not materially impact income from operations year-over-year."
OpenedHand announce Poky platform builder 3.1
OpenedHand has released version 3.1 of Poky platform builder. "OpenedHand are pleased to announced the release of version 3.1 of Poky platform builder. Poky is a freely available open source platform build tool that enables device manufacturers to design, develop, build, debug, and test a complete, modern, software stack using Linux, the X Window System and GNOME Mobile based application frameworks for both ARM and x86 based platforms."
OpenMoko unlocks Neo Phone industrial design
OpenMoko has announced the availability of the industrial design source files for its Neo branded mobile phones. "Openmoko's source code was freed in February 2007, allowing complete transformation of its mobile phone software. Now, by publishing mechanical CAD files, Openmoko frees industrial designers to fundamentally redesign the Neo branded mobile phones to fit their vision and market needs. Some already have."
Shuttle's KPC computer will run Foresignt Linux
Shuttle has announced that the newly launched $199 KPC will feature the Foresight Linux operating system. "With an intuitive interface and user focused design, Foresight does away with the need for users to be familiar with Linux. A host of the latest software is packaged with the operating system, giving users convenient and enjoyable access to music, photos, videos, documents, and the Internet. Even keeping up-to-date with the latest features and fixes is a simple process with the user friendly update button."
Vyatta.org launched
Vyatta has announced the launch of Vyatta.org. "Vyatta, the leader in Linux-based networking, today announced Vyatta.org, a new site for the popular Vyatta Community, which brings together users and developers to advance the cause of open-source networking as an alternative to the over-priced and inflexible solutions from proprietary vendors. Vyatta.org will feature more collaborative and efficient ways for members to contribute, learn, and shape the future of Vyatta."
Resources
Linux Gazette #148 is out
Issue #148 of the Linux Gazette has been published. "Linux Gazette is a volunteer-run monthly web magazine dedicated to two simple ideas: making Linux a little more fun, and sharing ideas and discoveries."
Contests and Awards
Alfresco announces Alfresco Content Excellence award winners
Alfresco Software, Inc. has announced the winners of its 2007 Annual Content Excellence Awards. "The debut year for the awards program recognizes its top partners and contributors in the categories of Partner of the Year, Content Management and Collaboration Implementation of the Year, and Contributor of the Year, in Europe and North America."
Join EFF at the 17th Annual Pioneer Awards at ETech
The Electronic Frontier Foundation will hold its 17th Annual Pioneer Awards at the O'Reilly Emerging Technology Conference. "The ceremony will be held at 7:15 p.m., March 4th, in the Marina Ballroom of the San Diego Marriott Hotel and Marina. The 2008 winners of EFF's Pioneer Awards are the Mozilla Foundation and its Chairman Mitchell Baker, University of Ottawa Professor Michael Geist, and AT&T whistleblower Mark Klein. Michael Robertson -- founder and CEO of MP3.com, Linspire, MP3Tunes and Gizmo5 -- will give the awards' keynote address: "What to Expect When You're Expecting...To Be Sued.""
Meeting Minutes
Perl 6 Design Meeting Minutes (use Perl)
The minutes from the , 2008 Perl 6 Design Meeting have been published. "The Perl 6 design team met by phone on 27 February 2008. Larry, Allison, Patrick, Will, Jerry, Jesse, Nicholas, and chromatic attended."
X.Org board meeting minutes
The meeting minutes from the February 14, 2008 X.Org board meeting have been published. "Attending: Bart Massey, Keith Packard, Carl Worth, Stuart Kreitman, Kevin Martin, Daniel Stone, Matthieu Herrb, Jim McQuillan, Adam Jackson, Egbert Eich, Stuart Anderson, Eric Anholt".
Calls for Presentations
Akademy 2008: Call for Presentations (KDE.News)
A Call for Presentations has gone out for Akademy 2008. "As the new leaves of spring bud in the Low Countries, the organisation of Akademy is also growing. This will bear fruit in August as the worldwide KDE community gathers in Sint-Katelijne-Waver, Belgium at the De Nayer Institute to celebrate and consider the post-KDE 4.0 world. Now that the KDE 4 technology platform is in place, this year's Akademy will focus on bringing the pillars of KDE to applications, research efforts around KDE, and work on non-traditional platforms for the desktop. Your work on KDE is interesting to us, so please submit a talk. See the complete Call for Presentations for more details. The important date is the deadline for submissions to the main conference tracks: May 1st."
2008 Google Summer of Code
A call for participation has gone out for the 2008 Google Summer of Code. "Google Summer of Code 2008 is on! Over the past three years, the program has brought together over 1500 students and 2000 mentors from 90 countries worldwide, all for the love of code. We look forward to welcoming more new contributors and projects this year. We are now accepting applications from open source projects who would like to act as mentoring organizations for 2008, and will be accepting these applications through March 12, 2008. We will begin accepting student applications on Monday, March 24th."
GUADEC 2008 Website and CFP
The GUADEC 2008 web site is online and a call for participation has gone out. "GUADEC, the annual GNOME conference will be held in Istanbul, Turkey from the 7th to the 12th of July 2008. The conference will bring together the GNOME development and user community and key personalities from businesses and governments, to discuss the future direction of the GNOME project." The submission deadline is March 30.
SAGE-AU Call for Technical Papers and Tutorials
A call for papers and tutorials has gone out for the 2008 SAGE-AU conference. The event takes place in Adelaide, Australia on August 11-15, 2008, submissions are due by March 31. "The SAGE-AU Annual Conference is the premier Systems Administration event in the Asia-Pacific region. The conference offers a premium educational forum for System Administrators of all platforms and levels of experience, and an excellent opportunity to meet, network and learn from acknowledged experts in the field. This year's conference will start with three days of tutorials followed by the technical program. The technical program will run in two parallel streams covering a wide variety of system administration related talks."
Upcoming Events
FSF annual associate member meeting announced
The FSF Annual Associate Member Meeting will take place on Saturday, March 15 at MIT, Cambridge, MA. "Keynote speeches from FSF board members Mako Hill and Henri Poole and the director of the FSF-backed End Software Patents campaign Ben Klemens will each address the 2008 theme, "Tackling the Big Issues." They will look at the projects that will demand the Free Software Foundation's attention in 2008: from software patents to freedom for web services, from advancing free software adoption to the changing relations with the entertainment industry brought about by this year's Hollywood writers strike."
GUADEC 2008 to be held in Istanbul, Turkey (GnomeDesktop)
GUADEC 2008 has been announced. "GUADEC, the annual GNOME conference will be held in Istanbul, Turkey from the 7th to the 12th of July 2008. The conference will bring together the GNOME development and user community and key personalities from businesses and governments, to discuss the future direction of the GNOME project."
The OpenOffice.org Annual Conference goes to Beijing
The OpenOffice.org community overwhelmingly voted for Beijing, China as the site for the next OOo conference. This is the first time OOoCon has been held outside of Europe. It is tentatively scheduled for October 15-17. Click below for more details.Continuent Sponsors PostgreSQL Conference East 08
Continuent, Inc. has announced its sponsorship of the PostgreSQL Conference East 08. "Continuent, Inc., the leading provider of commercial open source middleware solutions for database high-availability and scalability, today announced its sponsorship of the PostgreSQL Conference East 08. The conference takes place March 29-30, 2008, in the Computer and Space Sciences Building at the University of Maryland College Park, and is designed allow contributors, current users and future users/developers to learn and network."
Events: March 13, 2008 to May 12, 2008
The following event listing is taken from the LWN.net Calendar.
| Date(s) | Event | Location |
|---|---|---|
| March 8 March 14 |
Asia OSS Conference & Showcase 2008 | Guangzhou, China |
| March 14 March 16 |
PyCon 2008 | Chicago, IL, USA |
| March 15 | FSF Associate Members Meeting | Cambridge, MA, USA |
| March 16 March 19 |
BossaConference 2008 - International Conference on Open Source Software for Mobile Embedded Platforms | Pernambuco, Brazil |
| March 16 March 21 |
Novell BrainShare 2008 | Salt Lake City, UT, USA |
| March 16 March 20 |
Free Software and Open Source Foundation for Africa | Dakar, Senegal |
| March 17 March 20 |
Eclipse Community Conference | Santa Clara, CA, USA |
| March 17 March 20 |
Spring VON.x Conference | San Jose, CA, USA |
| March 19 March 20 |
LinuxWorld Expo 2008 Brussels | Brussels, Belgium |
| March 24 | SDForum Global Open Source Conference | San Francisco, CA, USA |
| March 26 March 28 |
CanSecWest 2008 | Vancouver, BC, Canada |
| March 26 | Document Freedom Day | Everywhere, Worldwide |
| March 29 March 30 |
PostgreSQL Conference East 2008 | College Park, MD, USA |
| March 31 April 2 |
UKUUG Spring 2008 Conference - Dynamic Languages | Birmingham, England |
| March 31 | 2008 European Workshop on System Security | Glasgow, Scotland |
| March 31 April 2 |
UKUUG Spring 2008 Conference | Birmingham, England |
| March 31 April 2 |
Sharkfest Wireshark Network Analysis Summit | Los Altos Hills, CA, USA |
| April 2 | First meeting UKUUG PostgreSQL SIG | Birmingham, England |
| April 3 April 4 |
E-Mail Systems Conference 2008 (Exim and other mail systems) | Birmingham, England |
| April 4 April 5 |
openSUSE Packaging Days II | IRC, Everywhere |
| April 7 April 9 |
IT360 Conference & Expo | Toronto, Canada |
| April 7 April 11 |
Django Bootcamp with Juan Pablo Claude | Atlanta, Georgia, USA |
| April 8 April 10 |
Linux Foundation Collaboration Summit | Austin, TX, USA |
| April 10 April 13 |
Go-OO Conference 2008 | Prague, Czech Republic |
| April 12 April 13 |
Open Source Developers Conference Taiwan, 2008 | Taipei, Taiwan |
| April 12 April 13 |
LugRadio Live USA 2008 | San Francisco, CA, USA |
| April 12 April 18 |
KDevelop Developer Meeting 2008 | Munich, Germany |
| April 14 April 18 |
Embedded Systems Conference - Silicon Valley | San Jose, CA, USA |
| April 14 April 17 |
MySQL Conference and Expo | Santa Clara, CA, USA |
| April 14 April 18 |
Samba eXPerience 2008 | Göttingen, Germany |
| April 15 April 17 |
Embedded Linux Conference 2008 | Mountain View, CA, USA |
| April 15 April 17 |
SOA in Health Care | Chicago, IL, USA |
| April 16 April 18 |
X Developers' Conference 2008 | Mountain View, CA, USA |
| April 16 April 18 |
X Developers' Conference for 2008 | Mountain View, USA |
| April 16 April 18 |
Croatian Linux User Conference | Zagreb, Croatia |
| April 17 April 19 |
9th International Free Software Forum | Porto Alegre, Brazil |
| April 18 April 19 |
Third Annual Silicon Valley Ruby Conference | San Jose, CA, USA |
| April 18 April 20 |
National Collegiate Cyber Defense Competition | San Antonio, TX, USA |
| April 18 April 20 |
Penguicon 2008 | Troy, Michigan, USA |
| April 21 April 25 |
Open Source meets Industry: Application Park and International Congress | Hannover, Germany |
| April 22 | The Mobile Future | Santa Clara, CA, USA |
| April 22 April 25 |
Web 2.0 Expo | San Francisco, CA, USA |
| April 22 | OSADL International Congress | Hannover, Germany |
| April 23 April 24 |
Troopers 2008 Security Conference | Munich, Germany |
| April 23 | Linux Foundation Spring Legal Summit | Schaumburg, IL, USA |
| April 25 April 29 |
Open Tech Summit Taiwan 2008 | Taipei, Taiwan |
| April 25 April 26 |
Guademy 2008 | Valencia, Spain |
| April 27 May 2 |
INTEROP Las Vegas 2008 | Las Vegas, NV, USA |
| April 28 May 4 |
Monotone Developer Summit | Wuppertal, Germany |
| May 2 May 3 |
Maker Faire Bay Area | San Mateo, CA, USA |
| May 5 May 9 |
Ruby on Rails Bootcamp with Charles B. Quinn | Atlanta, Georgia, USA |
| May 8 | Embedded Masterclass 2008 | London, UK |
| May 8 May 11 |
Libre Graphics Meeting 2008 | Wroclaw, Poland |
| May 8 May 9 |
IV WHYFLOSS CONFERENCE MADRID 08 | Madrid, Spain |
| May 9 May 11 |
Pycon Italia Due | Firenze, Italy |
If your event does not appear here, please tell us about it.
Event Reports
Open eHealth Foundation and partners announced at HIMSS 2008 (LinuxMedNews)
LinuxMedNews covers an announcement at the HIMSS 2008 conference. "At the HIMSS 2008 conference in Orlando, Florida, the Open eHealth Foundation released a press statement describing the formation of this new organization with new partners including InterComponentWare, Agfa HealthCare and Sun Microsystems."
Page editor: Forrest Cook