LWN.net Weekly Edition for October 16, 2008
OpenOffice.org releases 3.0, faces new challenges
A new version of the popular free software office application suite, OpenOffice.org (OOo) 3.0, was released this week to lots of press and enough download traffic to bring down its webserver. While the release isn't a huge leap forward in terms of features, it does provide some compelling enhancements. Perhaps the most interesting is the increased focus on extensions, a la Firefox, that don't require modifying the core OOo code. This may help combat the problem—or perceived problem—that Sun is stifling OOo development through its bureaucratic procedures for adding new functionality.
The first thing one notices when starting up OOo 3.0 is the new splash screen, but it appears for only a short time. One of the major complaints about the suite has been how long it takes to start up—something that has been addressed in 3.0. The application opens to a new welcome screen (seen at left) that presents a more friendly appearance, rather than an empty window, for new users. Once past that point, the various tools look much as they did in OOo 2.4 and earlier versions.
The other changes are mostly under the covers; they will be noticed by power users, but are not immediately obvious to basic users. These include:
- Writer (word processor) has a new slider for zooming
- Writer allows multi-page display and editing
- Calc (spreadsheet) allows up to 1024 columns per sheet
- Draw (drawing) can handle poster-size files
- Impress (presentation) supports multiple monitors for presentations
- Writer has additional editing modes for multi-lingual support as well as wiki document editing
- Calc has a new equation solver
- Chart (graphing) has improved graphical output
The OOo extensions repository has many different kinds of add-ons for OOo, that provide new or enhanced functionality for users. The most popular is the PDF import extension which allows loading PDF files into the application for editing. Given that OOo has long had the ability to natively export PDFs, importing them is an excellent addition.
Clearly Sun and the OOo project see extensions as a fertile ground for innovation by folks who are not necessarily OOo "contributors"—as they have not signed the Sun Contributor Agreement (SCA) [ PDF, currently unavailable due to the download traffic problems ]. Sun's community manager for OOo, Louis Suarez-Potts, puts it this way:
I can see extensions that radically depart from what we consider "office" tools---and why not? OOo is an integrated set of tools based on fairly conservative conceptions of office software. But there is no compelling reason to stick with the conservative past, and every reason to be creative.
One of the new features that OOo developers are most excited about won't affect Linux users at all. OOo 3.0 has a native Mac OS X look and feel, rather than the earlier X11-based interface. A native Windows version has always been a part of OpenOffice (and its precursor, StarOffice), but the new default theme is said to be particularly attractive on that platform.
There are various new features aimed at those currently using—or needing to interoperate with—Microsoft Office. There is support for Access database files as well as improved Visual Basic for Applications (VBA) macro support. Somewhat controversially, OOo 3.0 has added the ability to read (but not write) Office Open XML (OOXML) files. OOXML is the newly minted standard for office documents that Microsoft and Ecma pushed through the ISO standardization process earlier this year.
Support for OOXML is one of the contentious areas surrounding OOo. There are two (vocal) developer camps, one Sun-centric, the other Novell-centric; unsurprisingly they tend to clash over OOXML as well as development pace and direction issues. It has gotten to the point where a fork, called Go-OO, has come about, led by Novell's Michael Meeks. Go-OO's version of OOo has been adopted by several distributions leading some to see it as a "hostile" fork.
Sun's chief open source officer, Simon Phipps, clearly sees Go-OO (and the related OO-Build) as an attempt by Novell to control OOo:
The motivation for Go-OO being hosted and promoted by Novell and its staff seems unmistakable to me, as does the fact it is a Novell-sponsored fork. They are promoting Microsoft's flakey XSLT-based OOXML support, they are isolating Linux from OpenOffice.org (so that no-one in the main OpenOffice.org community is able to get support contracts from Linux users). And it is all cleverly wrapped in a community-friendly story about hackers and their freedom and evil, controlling Sun, delivered without interference from Novell corporate.
Meeks most recent look
at OOo development is the proximate cause of much of the current
sniping in various blogs.
Meeks analyzes commits to the OOo codebase to try to extract trends in the
development of the tool. His conclusion is stark—undoubtedly
inflammatory to those in the Sun camp—"Crude as they
are - the statistics show a picture of slow disengagement by Sun, combined
with a spectacular lack of growth in the developer community
".
While there have been various responses to the analysis—including this LWN comment thread—there has, as yet, been no real counter-analysis that comes to a different conclusion. Perhaps there are other ways to slice and dice the data that look more favorable to growth in the OOo community, but if not, the conclusion is worrisome. OOo is a very useful tool, that is used by many, which offers a way out of Microsoft lock-in. Because of Novell's close association with Microsoft, people worry that Go-oo is an underhanded means for another kind of lock-in—this time to Novell.
In what seems almost a taunt—as well as a validation of the accusation of a hostile fork—Meeks adds a postscript to his analysis:
There have long been complaints about the pace of OOo development, along with calls for creating a foundation to oversee it. It would seem that OOo is at a bit of a crossroads. If Sun's commitment is reduced, without a corresponding increase in contributions from others, OOo could stagnate—or Go-oo could take over.
Ostensibly, the SCA is one of the sticking points for some contributors. They do not trust Sun not to take their contributions in a proprietary direction. But the conflict is really rooted in issues of control and development direction—two things likely to lead to forking. While two forks is suboptimal, perhaps, it may lead to improvements in both the code and the development process for OOo.
There are legitimate concerns on both sides of the issue—undoubtedly the mostly silent user community has yet another perspective—but there is enough bad blood between them that it is hard to see it resolving in some relatively amicable way. The office application suite is an extremely lucrative product, at least in the proprietary world. One gets the sense that both Sun and Novell are seeing dollar signs which are clouding their vision. A neutral foundation of some kind might be a good first step towards reconciliation.
LK2008: Embedded and Mobile Linux
Linux-Kongress 2008 attendees had the opportunity to hear two different sessions dedicated to organizations trying to improve the state of Linux support for embedded and mobile systems. They have similar goals, but are taking different approaches and have different levels of resources available to them.The first of these is OpenSourceEmbedded, presented by uClinux developer Jeff Dionne. He opened with a statement that, ten years ago, Linux-based embedded systems were nearly unknown. Now those systems are everywhere, with hundreds of millions of deployments. Embedded systems, he says, make up the largest installed base of Linux systems.
All is not perfect, though, in the embedded sphere. Linux still has an uncomfortably large footprint for embedded use. There is also no unified distribution for embedded use; instead, the industry is full of homemade solutions made by vendors. He would like to address this situation through the creation of a next-generation platform. It would take the form of a kit that developers could start with which comes equipped with design examples for a number of applications: telephones, digital video recorders, etc.
There are two hardware platforms being targeted initially by this effort. One is a Plasma MIPS processor - a very simple device which can be implemented with an FPGA. A simulator for this processor runs about 600 lines of code. The other, more advanced platform is a LEON 2/3 SPARC processor, a full system with a memory management unit and which supports multiprocessor configurations. Examples of the first processor include a RealTek MIPS system, while the LEON SPARC CPU is similar to current SuperH 3 processors. The Plasma and LEON SPARC processors are being designed now, with the intent of producing them as open hardware designs.
On top of these processors will be a base operating system layer with a "mini-POSIX" environment. There will be an interesting packaging system which stores components as separate "blocks" in flash, outside of any filesystem. The running system will be assembled from the blocks by the boot loader. This organization is designed to avoid bricking; any bad or corrupted components can simply be bypassed without affecting the functioning of the rest of the system. This, evidently, is how PalmOS did things.
The next challenge is creating a community around this whole effort. To that end, resources are to be put up at opensourceembedded.org - though nothing is available as of this writing. The site will include project hosting, along with the ability to download the development kits. Jeff says that the uClinux experience has shown that the kit approach works; with a ready-to-use code base like that, a community can come together.
There are also plans to create an organization behind this effort which, among other things, can enter into non-disclosure agreements with hardware manufacturers. This organization will also work to help vendors ship GPL-compliant products.
OpenSourceEmbedded appears to be in an early state, so it's hard to make any guesses about how successful it will be. For more information, see Jeff's slides [PDF].
Mobile Linux
The closing session at the 2008 Linux-Kongress was a talk by Dirk Hohndel, who began by noting that Linux-Kongress is, in fact, the oldest Linux event. It was first held in 1994, and hosted many of the kernel developers who were active at that time; Dirk estimates that about half of the development community was to be found in a single room. It would take a rather larger room to accomplish that now. Dirk complimented the event on its avoidance of commercialism and its sustained focus on the technology.
The technology that Dirk came to talk about was mobile Linux. He started by expressing his disappointment with desktop Linux. It has become a collection of poorly-integrated applications which are somehow trying to replicate Windows 95. The result does not work well on the desktop, and it most certainly is not optimized for the mobile environment.
But, says Dirk, mobile Linux is not really embedded Linux either. Embedded Linux evokes images of access points and other single-application boxes which are not meant to be extended past a single function. They are not concerned with the user's experience, and they are not concerned with mobility. The subject here is devices with a screen, and which can have new applications installed onto them. So some sort of desktop-like interface is needed, but current desktop Linux does not fill the bill.
According to Dirk, the problem with desktop Linux is the fundamental approach: developers are not the target audience for this software, but they are making all the interface decisions. What's needed is input from people who are specialized in interface design and human-computer interaction. That leads to a "scary thought": interface specialists are generally not coders, but they will be making decisions that coders are expected to implement. That is not a normal mode of operation in the free software community, but it is needed here.
Other problems include the proliferation of "80% done" projects. Much of the work has been done, but nobody wants to do the work to finish the job. There's also far too many choices; in general, says Dirk, people do not like it if they have to choose between more than two alternatives. When dealing with the Linux desktop, it's hard to find situations where there are fewer than six choices. And, overall, the Linux desktop lacks consistency. That, says Dirk, is why he uses an Apple laptop. Apple enforces a consistent design across the application space and, he says, the result is very nice.
Devices should be simple and natural to use; such devices are increasingly hard to find anywhere. As an example, he held up a paper notebook. The device boots very quickly, has a nice "touch-based" pencil-oriented interface. No manuals or explanations are needed. Linux-based devices should be just as easy to use. But, at the same time, they need to offer an experience which is close to what people expect from an ordinary, desktop computer. It should have access to the Internet, and users should be able to install software.
Dirk then pulled out an Eee PC system and gave the five-second boot demonstration.
This work, he says, is an example of what is being done by Intel in support
of the Moblin project. Intel is
trying to solve some of the hardest problems in the mobile space,
contributing the results for everybody to use.
To that end, Moblin is working toward the creation of a base distribution for mobile systems. The user interface will be based on the GNOME mobile work, but with a lot of enhancements. The end goal is the creation of a Linux distribution for mobile devices which is far better than the state of the art today. It is not, he says, an attempt to compete with distributors; instead, Moblin is providing a base which the distributors can build on. Intel's effort will naturally focus on Intel processors, but contributions for any architecture are welcome at Moblin.
In conclusion, Dirk noted that Linux's success on the server side was relatively easy. The mobile problem is much harder. Intel is hoping that others will join in to help Moblin reach its rather ambitious goals.
Fedora checking community health with EKG
Measuring the health of communities is an interesting, difficult task. The Fedora project has recently started using a new tool, called EKG, to try to get an overview of the demographics of the free software projects that are sponsored by the distribution. EKG is still young, but already provides some interesting information. Because it is GPL-licensed, as is the Fedora norm, it can be picked up by other distributions or interested parties to target their own projects.
At its core, EKG is a few Ruby scripts that process mailing list data so that graphs can be produced. Currently, it produces both pie charts and line graphs that indicate the number of Red Hat posters versus those from elsewhere. A portion of the most recent set of graphs can be seen at right.
Red Hat's Michael DeHaan has taken on development of EKG to use as a tool to measure how well various projects are building a community separate from Red Hat. There are lots of free software projects that have been released by Red Hat—or Fedora, which often amounts to the same thing—but may or may not be seen as useful tools outside of Fedora. By looking at the mailing list traffic, particularly over time, some idea of which projects are building a community, and which aren't, can be derived. As the project page puts it:
- Who posts
- Who contributes
- What projects are most active?
- What projects need a little help?
Mailing lists are just one measure of the health of a project, of course, so DeHaan is looking at other metrics. Commits to the project repository—along with the identities of the commiter—would seem an obvious choice. Better graphs with more useful information on each axis as well as time series of the pie charts are also on the "to do" list. He is also looking at derived statistics that will allow direct comparison of different projects by using equations that in some way model success.
It is difficult to draw any conclusions from the limited graphs that are currently available. One thing that does stand out, though, is the popularity of gmail.com email addresses, which seem to account for around one-quarter of posts. One can also certainly see projects that are completely dominated by "inside" (i.e. Red Hat) folks. The JBoss lists are a good example.
Projects are trying various ways to measure how well they are doing their job; EKG is another way to do that. For the kernel, the statistics on each release are gathered by LWN, as well as over longer periods by the Linux Foundation. Ubuntu has its Upstream Report which looks at how well bugs are getting to upstream bug trackers. Undoubtedly other projects have their own ways of trying to measure their impact.
As yet, there is no mailing list for EKG development. We look forward to the day when EKG is applied to its own development list. It would seem that some kind of "metahealth" measurement of the community might be able to be derived from that data.
LK2008: The values of the Linux community
The opening keynote speaker for the 2008 Linux-Kongress was James Bottomley, who presented his views on the Linux community's values. What these values are, says James, is not entirely obvious. Related groups - the free software community, for example - have well-articulated value systems which define them. The Linux community's values are not so clearly expressed, but, he says, they are central to what we do.James started with a bit of history, noting the the initial value placed on software was entirely commercial. Once the industry realized that software could be worth far more to its users than it costs to create, the proprietary mode became dominant - and that has affected the evolution of programming in general. The value placed on the code by its developers became irrelevant, leading to "paycheck coding." There is no value placed on creativity, and such a model leads to bad code.
Eventually Richard Stallman came along and challenged the commercial view
of software. But, during this time, about the only alternative to
commercial software was the BSD Unix distribution, and that got caught up
in the lawsuit by ATT. So closed software took over; Windows won on
commodity platforms, but proprietary software also became dominant in the
Unix arena.
In 1991, Linux hit the scene; since then, it has become the most popular and vibrant free software operating system available. In a sense, this is interesting, in that Linux is licensed under the GPL, a license that many companies hate. Apple explicitly chose BSD as the base for MAC OS to avoid GPL-licensed code. But, despite this antipathy, lots of companies use Linux, and even contribute to its development. It is interesting, James says, to look at why that is.
The reason is the Linux community's values. In particular, the community prizes technical merit above all other considerations - including small things like what any company or user would like to have. Also prized is passion; code supported by a developer who clearly cares about it will generally fare better in the review process. If the code quality and the passion are there, the community does not care about much of anything else. Factors like the source of the code or who might benefit from its incorporation don't really matter.
In particular, contributors to the kernel are not required to sign on to any particular belief system or any specific view of freedom. A contributor may have an FSF-like belief in free software, or, instead, be a corporate developer who does not care about software freedom at all. Even the BSD community requires acquiescence with a specific view of freedom. A Linux contributor, instead, need only be willing to contribute the code under the share-alike rules of the GPL.
As a result, anybody can play with Linux, regardless of philosophy or corporate status. We have a community which is defined by contributions, not by a specific set of values regarding software freedom. That has allowed the formation of a very diverse community with a specific shared interest: creating the best kernel we can.
There are some significant benefits from this approach. It forces companies to recognize their engineers' values; that, in turn, makes for more motivated developers. Developers who are interested in improving Linux can get resources and support from corporations. Users get high-quality code from developers who care about what they are doing. Companies get the ability to focus on their little piece of the problem while taking advantage of the community-maintained kernel for the rest; they can also offload their older code to the community for long-term maintenance.
James compared the Linux way of doing things with the US constitution. That document only mentions freedom three times, yet it has become a blueprint which has supported freedom for over 200 years. It is a relatively short document. The proposed EU constitution, instead, is about 20 times the length, before taking into account other documents which are referenced. That document would appear to be somewhat bloated; the goals would be better served by a more concise formulation.
Similarly, the Linux community spends little time talking about freedom. Instead, the focus is on a set of brief principles involving code quality and passion. Freedom is not legislated; it arises as an emergent value inherent in the Linux way of doing things. Linux has managed to bring about software freedom without talking about it, and without imposing a view of software freedom on its contributors. In the process, Linux has succeeded in creating something which is as free - or more free - than the GNU system envisioned by the Free Software Foundation.
During the question period, James wished for a free software advocate who would argue the point with him, but no such person emerged. He will, it seems, have to repeat the talk in a different venue before he can have that debate.
Security
SELinux permissive domains
Readers of this page—along with the kernel page—will not find it surprising that SELinux is a complex beast. It is, however, the dominant security framework for Linux, pushed hard by Red Hat, but also being adopted, slowly, by SUSE, Ubuntu, and others. Over the years, through lots of hard work, it has become somewhat less complex, at least for administrators; a new feature, called permissive domains will help further ease the administration of SELinux-enabled systems.
These days, SELinux has two modes, the aptly named enforcing and permissive modes. When in enforcing mode, SELinux will not allow operations that are not permitted by the policy, whereas in permissive mode, a violation is just logged and the operation is allowed to continue. Administrators trying to track down an SELinux problem with an application—whether a real security issue or just a problem with the policy—can put the system into permissive mode, then study the logs to determine what policies are being violated. Or they can use audit2allow to make those policy changes for them.
Until permissive domains, though, the choice between permissive and enforcing was binary for the entire system. By putting a system into permissive mode, various attacks that SELinux might normally stop on other applications would instead just be logged. With permissive domains, a single process, or group of related processes, can be marked as permissive, while the rest of the system stays in enforcing mode.
Red Hat SELinux hacker Dan Walsh, describes permissive domains on his blog. One of the motivations is to help third-party software developers feel more comfortable about shipping SELinux policy with their application:
Permissive domains are available in recently updated Fedora 9 systems and will come standard with Fedora 10. As Walsh shows, enabling permissive mode for a domain is trivial:
# semanage permissive -a httpd_sys_script_t
which would put all CGI scripts into permissive mode. And:
# semanage permissive -d httpd_sys_script_t
to remove permissive mode for the CGI script domain
(httpd_sys_script_t).
This is definitely a nice step forward for assisting with policy development, but there is still a lingering problem with the recommended way to generate SELinux policies. Walsh describes how that is done:
The problem, of course, is that blindly using audit2allow is extremely dangerous. It assumes that the application has no security problems, that all of its accesses should be permitted—if that can be assumed, what is SELinux for? By taking all of the violations and turning them into policy changes, the application, rather than the policy developer, decides on the access it requires. Using audit2allow correctly is much more complex, requiring a good understanding of SELinux and the existing policies and domains.
To be fair to Walsh, in a related post, he does warn:
The audit2allow manpage is even more explicit:
Using audit2allow is, unfortunately, the way that most SELinux policy is developed. There aren't enough SELinux experts—there may never be enough—to actually look at the code for applications and determine a priori what the policy should look like. So, testing applications by running them to determine what permissions they require is the only sane way to do it, error-prone though it may be.
New vulnerabilities
cups: several vulnerabilities
| Package(s): | cups | CVE #(s): | CVE-2008-3639 CVE-2008-3640 CVE-2008-3641 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 10, 2008 | Updated: | February 20, 2009 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
A buffer overflow flaw was discovered in the SGI image format decoding routines used by the CUPS image converting filter "imagetops". An attacker could create a malicious SGI image file that could, possibly, execute arbitrary code as the "lp" user if the file was printed. (CVE-2008-3639) An integer overflow flaw leading to a heap buffer overflow was discovered in the Text-to-PostScript "texttops" filter. An attacker could create a malicious text file that could, possibly, execute arbitrary code as the "lp" user if the file was printed. (CVE-2008-3640) An insufficient buffer bounds checking flaw was discovered in the HP-GL/2-to-PostScript "hpgltops" filter. An attacker could create a malicious HP-GL/2 file that could, possibly, execute arbitrary code as the "lp" user if the file was printed. (CVE-2008-3641) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
dbus: denial of service
| Package(s): | dbus | CVE #(s): | CVE-2008-3834 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 10, 2008 | Updated: | May 3, 2011 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entry: The dbus_signature_validate function in the D-bus library (libdbus) before 1.2.4 allows remote attackers to cause a denial of service (application abort) via a message containing a malformed signature, which triggers a failed assertion error. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
exiv2: denial of service
| Package(s): | exiv2 | CVE #(s): | CVE-2008-2696 | ||||||||
| Created: | October 15, 2008 | Updated: | October 31, 2008 | ||||||||
| Description: | From the Ubuntu advisory: Joakim Bildrulle discovered that exiv2 did not correctly handle Nikon lens EXIF information. If a user or automated system were tricked into processing a specially crafted image, a remote attacker could cause the application linked against libexiv2 to crash, leading to a denial of service. (CVE-2008-2696) | ||||||||||
| Alerts: |
| ||||||||||
kernel: several vulnerabilities
| Package(s): | linux-2.6 | CVE #(s): | CVE-2008-1514 CVE-2008-3833 CVE-2008-4210 CVE-2008-4302 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 14, 2008 | Updated: | January 8, 2009 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Jan Kratochvil reported a local denial of service vulnerability in the ptrace interface for the s390 architecture. Local users can trigger an invalid pointer dereference, leading to a system panic. (CVE-2008-1514) The S_ISUID/S_ISGID bits were not being cleared during an inode splice, which, under certain conditions, can be exploited by local users to obtain the privileges of a group for which they are not a member. Mark Fasheh reported this issue. (CVE-2008-3833) David Watson reported an issue in the open()/creat() system calls which, under certain conditions, can be exploited by local users to obtain the privileges of a group for which they are not a member. (CVE-2008-4210) A coding error in the splice subsystem allows local users to attempt to unlock a page structure that has not been locked, resulting in a system crash. (CVE-2008-4302) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
mon: insecure temp files
| Package(s): | mon | CVE #(s): | CVE-2008-4477 | ||||||||
| Created: | October 9, 2008 | Updated: | October 17, 2008 | ||||||||
| Description: | mon has an insecure temporary file creation vulnerability.
From the Debian alert:
Dmitry E. Oboukhov discovered that the test.alert script used in one of the alert functions in mon, a system to monitor hosts or services and alert about problems, creates temporary files insecurely, which may lead to a local denial of service through symlink attacks. | ||||||||||
| Alerts: |
| ||||||||||
portage: privilege escalation
| Package(s): | portage | CVE #(s): | CVE-2008-4394 | ||||
| Created: | October 10, 2008 | Updated: | October 15, 2008 | ||||
| Description: | From the Gentoo advisory: A search path vulnerability in Portage allows local attackers to execute commands with root privileges if emerge is called from untrusted directories. | ||||||
| Alerts: |
| ||||||
ruby: multiple vulnerabilities
| Package(s): | ruby | CVE #(s): | CVE-2008-3905 CVE-2008-3790 CVE-2008-3443 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | October 10, 2008 | Updated: | January 5, 2009 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries:
CVE-2008-3905 - resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. CVE-2008-3790 - The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion." CVE-2008-3443 - The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Events
OWASP Summit set for November in Portugal
The Open Web Application Security Project is announcing its European summit to be held November 4-7 in Algarve, Portugal. The theme of the conference is "Setting the AppSec [Application Security] agenda for 2009". "This venue hosts a diverse selection of training courses along with technical and business tracks, making it THE place to learn about web application security and the resources OWASP has available for use today." Click below for the full announcement.
Page editor: Jake Edge
Kernel development
Brief items
Kernel release status
The 2.6.27 kernel is out, released by Linus on October 9. For those just tuning in, 2.6.27 includes (among many other things) UBIFS, support for integrity checking in the block layer, multiqueue networking, the ftrace tracing framework, the lockless page cache, the relocation of a lot of firmware, the GSPCA webcam driver set, and a number of extended system calls. See the always-excellent KernelNewbies summary for lots more information about this release.
The 2.6.28 merge window is currently open with around 4100 changesets merged at the time of this writing. See the article below for a summary of what has been added to the kernel so far in this development cycle.
The current stable kernels are 2.6.25.18 and 2.6.26.6 which were released on October 8. Both contain a long list of important fixes throughout the kernel tree.
Kernel development news
Quotes of the week
Something like "Linus Torvalds". Except not exactly.
On Tue, 14 Oct 2008, Jean Delvare wrote: > > Marek Vasut (1): > i2c/tps65010: Vibrator hookup to gpiolib
Guys, I know we geeks aren't known for our sex-life, but do we have to make it so obvious?
Quotes of the week (part 2)
As with 2.6.16, I'll pickup maintenance when the normal -stable maintenance ends (at some point after 2.6.28 gets released in January).
It is intended to fill the niche for users who are not using distribution kernels but want to use a regression-free kernel for a longer time. It might be a small part of the userbase, but after the experiences with 2.6.16 I can say that there are quite a few users who appreciate such an offering.
Merged for 2.6.28
As of this writing, 4193 non-merge changesets have been incorporated for the 2.6.28 kernel. In other words, this merge window is just beginning, having merged probably less than half of the patches which will eventually find their way into the mainline. What we see so far are a lot of drivers and incremental improvements, but not many major changes.User-visible changes for 2.6.28 include:
- There are new drivers for Analog Devices SSM2602, AD1882A and AD1980 codecs,
Freescale MPC5200 I2S audio devices,
Texas Instruments TLV320AIC26 codecs,
Tascam US-122L USB Audio/MIDI interfaces,
Wolfson Micro WM8580, WM8900, WM8903, and WM8971 audio devices,
Blackfin SPORT peripheral interface controllers,
NVIDIA HDMI HD-audio codecs,
Toshiba RBTX4939 MIPS boards,
Atheros L2 10/100 network adapters,
Cisco 10G Ethernet adapters,
JMicron JMC250 chipset-based network adapters,
QLogic QLGE 10Gb Ethernet adapters,
SMSC LAN95XX based USB 2.0 10/100 ethernet devices,
AFEB9260 ARM-based boards (an open source board design),
Arcom/Eurotech VIPER boards,
AT91SAM9X watchdog devices,
ITE IT8716, IT8718, IT8726, and IT8712 Super I/O watchdogs,
W83697UG/W83697UF watchdog devices,
TLV320AIC23 codecs,
Micron MT9M111 camera chips,
Magic-Pro DMB-TH tuners,
Afatech AF9015 and AF9013 DVB-T USB2.0 receivers,
Conexant cx24116/cx24118 tuners,
DVB cards based on SDMC DM1105 PCI chip,
Silicon Laboratories SI2109/2110 demodulators,
ST STB6000 DVBS Silicon tuners,
numerous Fujifilm FinePix cameras,
ALi video camera controllers,
WM8400 AudioPlus HiFi codecs, and
SGS-Thomson M48T35 Timekeeper RAM chips.
- Support for the old Sun 4 architecture and ColdFire serial ports has
been removed.
- There is a new sysfs file (unload_heads) which can be
used by a user-space process to tell an ATA disk to retract its heads
and prepare for an impact. When used in conjunction with an
accelerometer, this feature could be used to attempt to preserve a
disk in a falling laptop.
- Improved support for ptrace() - and support for precise event-based
sampling in particular - has been added for the x86 architecture.
- The crypto subsystem has gained support for deterministic ANSI X9.31
A.2.4 pseudo-random number generation.
- The SMACK security module can now be configured to enforce mandatory
access control rules on privileged processes.
- There is a script which can be used to generate a minimal "dummy"
policy for SELinux. The smallest workable policy, it seems, is 587
lines long.
- Some sound devices can detect the presence of audio devices on input
and output jacks. The ALSA layer now allows drivers for those devices
to register those jacks and report the presence of devices attached to
sound cards through the input layer.
- Work with multiqueue networking continues; 2.6.28 will include the
ability to associate a separate queueing discipline with each internal
packet queue.
- The wireless regulatory
compliance subsystem has been merged.
- The kernel now supports the Phonet packet protocol used by
Nokia cellular modems. See networking/phonet.txt in the kernel
documentation directory for more information.
- Also added to core networking is support for the Distributed Switch
Architecture protocol, with initial support for a number of Marvell
switch chips.
- The netfilter layer has been augmented to support network namespaces.
- The ext4 system has lost the "ext4dev" name; this is a signal that the
developers are getting ready to declare it ready for production use.
Ext4 has also gained a set of static tracepoints for use with
SystemTap or other tracing tools.
- The FIEMAP
ioctl() for extent mapping has been added.
- Xen has added CPU hotplugging support.
- Version 4 of the rpcbind protocol is now supported; this enables the
kernel to offer RPC services via IPv6.
- The OCFS2 filesystem has gained a number of features, including POSIX locks, extended attributes, and use of the JBD2 journaling layer.
Changes visible to kernel developers include:
- Discard request
and request timeout handling have been added to the block layer; a
number of other internal API changes have been made as well. See this article for details.
- Video4Linux2 drivers no longer have their open() function called with the big kernel lock held. The lock_kernel() calls have been pushed down into individual drivers within the mainline tree; external drivers will need to be fixed.
The merge window is likely to remain open until approximately October 24.
Block layer: solid-state storage, timeouts, affinity, and more
The 2.6.28 merge window has seen the addition of a number of changes to the block layer. Here's a summary of the new features and APIs which have gone in.
Solid-state storage devices
There are some enhancements aimed at improving the kernel's support of solid state storage devices. One of those, the discard API, has been covered here before. This API allows high-level block subsystem users (filesystems) to indicate that a particular range of blocks no longer contains useful data. That allows the low-level device to incorporate those blocks into its garbage collection scheme and to stop worrying about their contents when performing wear leveling.
Since the initial LWN article, though, the API has changed a little. The way to issue a discard request is now:
int blkdev_issue_discard(struct block_device *bdev, sector_t sector,
unsigned nr_sects);
The end_io() parameter seen in previous versions of the API is no longer present. There is no way for callers to know when the request completes, or, indeed, if the request completes at all. Since the caller is indicating a lack of interest in the given sectors, it really should not matter what the device does thereafter.
There is a filesystem-level function for creating discard requests:
static inline int sb_issue_discard(struct super_block *sb,
sector_t block,
unsigned nr_blocks);
Here, the interface is expecting block numbers using the filesystem block size, rather than 512-byte sectors.
User-space programs can issue discard requests with the new BLKDISCARD ioctl() call. Needless to say, such operations should be done with care; about the only logical user of this ioctl() would be mkfs programs.
Block drivers which support discard requests will provide a suitable function to the block layer:
typedef int (prepare_discard_fn) (struct request_queue *queue,
struct request *rq);
void blk_queue_set_discard(struct request_queue *q,
prepare_discard_fn *dfn);
In the absence of a "prepare discard" function, discard requests for the device will fail.
The block layer has also added a flag by which drivers can indicate that a device is not rotating storage, and, thus, does not suffer from seek delays. By setting QUEUE_FLAG_NONROT (with queue_flag_set() or queue_flag_set_unlocked()), a driver tells the block layer that it is working with a solid state device. I/O schedulers can use that information to avoid plugging the queue - a useful technique for combining requests to rotating storage devices, but a useless operation when there is no seek penalty to avoid.
Request affinity
On large, multiprocessor systems, there can be a performance benefit to ensuring that all processing of a block I/O request happens on the same CPU. In particular, data associated with a given request is most likely to be found in the cache of the CPU which originated that request, so it makes sense to perform the request postprocessing on that same CPU. With 2.6.28, sysfs entries for block devices will include an rq_affinity variable. If it is set to a non-zero value, CPU affinity will be turned on for that device. According to the patch changelog, turning this feature on can reduce system time by 20-40% on some benchmarks.
Timeout handling
Robust device drivers typically have to be written to handle cases where devices fail to complete operations they have been instructed to do. In a few cases, higher-level code helps with this task; the networking layer, for example, can track outgoing packets and let a driver know when a transmit operation has taken too long. In most other drivers, though, it's up to the driver itself to notice when an operation seems to be taking too long.
Like the network subsystem, the block layer manages queues of requested operations. As of 2.6.28 the block layer will, again like networking, have a mechanism for notifying drivers about request timeouts; that, in turn, will allow a bunch of timeout-related code to be removed from the lower layers. Timeout handling in the block layer can be more complex, though, and the associated API reflects that complexity.
A block driver must register a function to handle timed-out requests:
typedef enum blk_eh_timer_return (rq_timed_out_fn)(struct request *);
void blk_queue_rq_timed_out(struct request_queue *q,
rq_timed_out_fn *fn);
The amount of time a request should be outstanding before timing out is set up with:
void blk_queue_rq_timeout(struct request_queue *q,
unsigned int timeout);
The tracking of per-request timeouts is done within the block layer; the timer for any individual request is started when that request is dispatched to the driver by the I/O scheduler. Should a request fail to complete before the timeout period passes, the driver's timeout function will be called with a pointer to the languishing request. The driver then can do one of three things:
- Figure out that, in fact, the request was completed as expected, but
that completion had not been noticed by the driver. A dropped
interrupt could bring out such a situation, for example. In this
case, the driver returns BLK_EH_HANDLED, and the request will
be marked as completed.
- Decide that the request needs more time, perhaps because it has been
re-issued by the driver. A BLK_EH_RESET_TIMER will start the
timer again for this request.
- Punt and return BLK_EH_NOT_HANDLED. The block layer currently does nothing at all when it gets this return code; future plans appear to include aborting the request within the block layer when this return value is encountered.
If things look bad, the driver may decide to abort any outstanding requests, reset the device, and start over. There are a couple of new functions which can help with this task:
void blk_abort_request(struct request *req);
void blk_abort_queue(struct request_queue *q);
These functions will abort the given request, or all requests on the queue, as appropriate. Part of that process involves calling the driver's timeout handler for each aborted request.
Other changes in brief
Some other block-layer changes include:
- The handling of minor numbers has been changed, allowing disks
to have an essentially unbounded number of partitions. The cost of
this change is that minor numbers may be attached to a different major
number, and they might not all be contiguous; for this reason, drivers
must set the GENHD_FL_EXT_DEVT flag before the extended
numbers will be used. See this
article for more information on this change.
- The prototypes of blk_rq_map_user() and
blk_rq_map_user_iov() have changed; there is now a
gfp_mask parameter. This allows these functions to be used
in atomic context.
- kblockd_schedule_work() has an additional parameter
specifying the relevant request queue.
- The new function bio_kmalloc() behaves much like bio_alloc(), but it does not use a mempool to guarantee allocations and can thus fail.
It is, all told, one of the busier development cycles for the block layer in recent times.
Patches and updates
Kernel trees
Architecture-specific
Core kernel code
Development tools
Device drivers
Filesystems and block I/O
Networking
Security-related
Page editor: Jake Edge
Distributions
News and Editorials
What is Ulteo?
Gaël Duval, founder of Mandrake-Linux, started Ulteo after he was laid off by Mandriva in 2006. The first alpha release was announced several months later.In the past two years the project has had some time to mature and with the announcement that OpenOffice.org 3.0 is available through Ulteo.com it seemed like a good time to revisit the project.
Ulteo is aimed at Windows users, and gives them a slow and easy to way to convert to Linux using the first of several several sub-projects; the Ulteo Online Desktop. Many Linux applications are available through a Java enabled web browser such as Firefox or Internet Explorer. OpenOffice.org, KPdf, Kopete, Skype, Thunderbird + Enigmail, Gimp and Digikam, Inkscape and Scribus and many other applications are available in the Online Desktop without installing any new software on the PC. A subscription to Ulteo Premium provides extra storage for documents and other benefits.
Once the user becomes comfortable with Linux applications they could be ready for the Ulteo Application System which is an installable system for the PC. The Application System features automatic document synchronization/backup, automatic updates and upgrades, and all the applications included in the online desktop.
The Ulteo Virtual Desktop seems to be much the same as the Online Desktop. It is designed to run under Windows and allows the use of both Linux and Windows applications. The Virtual Desktop uses coLinux to provide the Linux desktop on Windows.
The final Ulteo product, for now at least, is the Documents Synchronizer. This, like the Virtual Desktop, is Windows software but it can be used with the Online Desktop to backup and retrieve documents, whether these are produced locally with Windows applications or with Linux applications using Online Desktop.
Ulteo is not something that will be of immediate interest to the average LWN reader. Presumably most readers are already knowledgeable about running Linux and its applications. However most of us probably do know someone who is not ready to run Linux natively. At least some of those people could start using the Online Desktop and become more familiar with various Linux applications without having to download and install those applications. Who knows where they might go after that.
New Releases
Mandriva Linux 2009 has been released
Mandriva has announced the release of Mandriva Linux 2009. "Mandriva Linux 2009 goes further in its innovations and offers a thoroughly modern and cutting-edge graphical environment: KDE 4.1. Personalizable, modular, scalable, and full of visual effects that enhance the environment, KDE's new version is usable everywhere, from the oldest hardware to the newest. Mandrivas team has gone to great lengths to integrate this new environment in a way that ensures everyone can jump right in to using it, with a customized graphical theme, careful choice of the most powerful applications, and a default configuration tuned to your system's particular hardware."
Fedora 10 Snapshot 1 Released
A snapshot of Fedora 10 (beta) is available for testing. "As part of our development schedule, we are releasing a snapshot of Rawhide in Live form. We are releasing these via bittorrent only as it is a much lighter weight method to get bits out the door than to go through our mirroring system. If you cannot use bittorrent we apologize for the inconvenience."
Announcing the General Availability of XO Software Release 8.2.0
The XO Software Release 8.2.0 was developed by OLPC engineers and the OLPC open source community. "Release 8.2 is based on a child focused graphical interface called Sugar, a Red Hat Fedora 9 Linux operating system and OLPC customized implementations of core software including power management, wireless drivers, NAND flash file system, Open Firmware, and other components."
Distribution News
Debian GNU/Linux
Bits from the Debian Eee PC team
The Debian Eee PC team reports numerous successes in getting the various Eee PC models to run Debian. Most of the work has been on getting wireless networking working with in-tree (i.e. not binary) drivers, but there has also been work done on ACPI support. They are also keeping an eye on the 5-second-boot work that Arjan van de Ven and Auke Kok are doing. Click below for the full report.Bits from the Debian CD team
The Debian CD team has been building CD and DVD images of each weekly Lenny build. Lenny is the codename for the upcoming Debian 5.0 release. Some Blu-ray images are also available for i386, amd64 and source, *jigdo only*. Grab an image and start testing.Debian bugs #600000 and #1000000 contest
The Debian project has set up a small contest, a bet on the day that bug numbers 600000 and 1000000 will be reported. "The winner(s) will be the person(s) placing her|his|their bet as close as possible to the real moment bug #600000 and #1000000 are reported."
Fedora
Fedora Board Meeting Recap 2008-10-07
Some note from the Fedora Board Meeting of October 7, 2008 are available. Topics include codecs, a trademark update, and more.First steps of the transition from Livna to RPM Fusion begins now for livna-devel users!
RPM Fusion is the merger of Dribble, Freshrpms and Livna, still in progress. "Most of the packages from Livna have been imported and build for RPM Fusion already, hence we now begin to slowly move users from Livna over to RPM Fusion by activating the RPM Fusion free and nonfree rawhide repos for users of livna's devel branch *now*." Click below for more on the status of this new "extras" repository for Fedora users.
Distribution Newsletters
Arch Linux Newsletter
The October 2008 issue of the Arch Linux Newsletter is out, with news about TeXLive in extras, netcfg in core, Arch Linux in the media, and several other topics.DistroWatch Weekly, Issue 274
The DistroWatch Weekly for October 13, 2008 is out. "Mandriva Linux, traditionally the first among the major distribution releases, boldly unveiled its latest product late last week. Shipping with KDE 4.1.2, an updated system installer, and a variety of usability enhancements, version 2009 should have been the company's best release ever. It was somewhat spoilt by a long list of known bugs that weren't fixed in time for the release - hopefully these will be corrected through post-install package updates soon, but there are those who'd argue for a postponement of a release in such situations. No similar dilemma is ever likely to face the Debian development team. If it isn't ready, it won't be released - that's the message given to the user community which has been hoping for a timely arrival of "Lenny". And while most other distributions have been quietly fixing the bugs in their own development trees, DistroWatch has compiled another package management cheatsheet - now incorporating two distro-agnostic tools, as well as source-based distributions."
Fedora Weekly News #147
This week the Fedora Weekly News looks at New Fedora 9 Re-spins, Fedora Test Day, Uberpackager Replaces Packager. The marketing beat has Fedora's Community Attracts Experienced Users and Five Second Boot of a Modified Version of Fedora. In Developments there are Unsigned Rawhide Packages an Attack Vector ?, Procedure for Re-naming a Package, Review of trash-cli Raises Generic Naming Issues, PackageKit-gstreamer-plugins Obsoletes Codeina, LXDE Feature Removal Disappointment - How to Avoid; and much more.Ubuntu Weekly Newsletter #112
The Ubuntu Weekly Newsletter for October 11, 2008 covers: Ubuntu Countdown banner for WordPress, Follow up: Xubuntu Hug Day, Ubuntu Free Culture Showcase Winners, New Ubuntu Members, Getting help from the Launchpad Team, Launchpad to be off-line, Server Team meeting summary, and much more.
Newsletters and articles of interest
Mandriva Linux 2009 'optimised' for mini laptops (vnunet)
vnunet covers the release of Mandriva Linux 2009. "Linux publisher Mandriva has released its latest distribution, Mandriva Linux 2009, offering a faster boot time and up-to-date versions of tools such as KDE, Gnome, OpenOffice and Firefox, plus an installer that optimises the platform for mini-laptops. Available immediately for download, Mandriva Linux 2009 integrates the latest innovations, from office applications to the newest virtualisation technology, according to the firm."
Distribution reviews
Foresight Kid's can inspire young minds (Linux.com)
Susan Linton looks at the Foresight Kid's Edition. "Foresight Kid's Edition captures children's attention immediately with its happy bumblebee character, smiling and waving from the lower corner of the brightly colored desktop. Distractions are kept to a minimum on the panel and desktop, with only a few icons such as Trash and Home showing. The customized Slab menu is also constructed for children, having entries for the applications of interest to youngsters in the Favorite Applications screen (main panel)."
Sidux grows on you (Linux.com)
Susan Linton reviews Sidux. "Sidux, a relatively new desktop Linux distribution, is based on Sid, the unstable developmental branch of Debian. The developers strive for an easy-to-install and easy-to-use modern Debian derivative, and pride themselves on remaining true to the principles and values of the Debian project. Despite a few inconveniences, I like Sidux a bit more each time I use it."
Page editor: Rebecca Sobol
Development
Connecting to Microsoft Exchange with OpenChange
Working with a Windows network from Linux has never been a smooth ride. While Samba, Wine and OpenOffice.org have made many components workable, connecting to the Microsoft Exchange email server has remained unreliable. Now the OpenChange developers hope to change that, providing the same capabilities as Microsoft Outlook in a range of Linux-native clients like Kontact and Evolution. OpenChange is not yet workable, but partial operation can demonstrate its potential.
If you want to connect to Exchange at the moment, you have a few options. Evolution can connect using a hack with Outlook Web Access, providing email, shared folders, calendars and contacts. But it's far from reliable; I tried to get by with it at the office, warts and all, and managed it for a couple of weeks before resigning myself to Windows. The other options are even worse -- just use the webmail client, or use the IMAP server for email and hacks such as this one to get at other data in a manner similar to Evolution. Working from home on Kubuntu, I find it easier to just use the webmail client.
OpenChange is taking a much more sensible approach. At the heart of the project is a
MAPI-compatible API, which allows clients to talk directly to Exchange and access all of its functionality. The code is still being actively developed, but some application developers have started playing around with it; the first code for Evolution came out in
January 2008. According to Brad Hards, an OpenChange and Kontact developer, "OpenChange can do most of the Exchange tasks now, though it can't currently do free/busy
".
For the curious, OpenChange developer Julien Kerihuel has written a simple command-line client. It's currently available in Ubuntu Intrepid and Debian Experimental, though you're better off compiling it yourself as it is changing quite rapidly. It isn't especially well documented, and the manpage implies some functionality that Kerihuel is still working on, but I did have some success.
First, you need to set-up a new profile:
tom@dell-desktop:~$ mapiprofile --profile=tom.chance -w=dell-desktop \ -I=192.168.0.11 -D=BIOREG -u=tom.chance -p=mypassword --create
You can check if it has worked by listing your mailboxes:
tom@dell-desktop:~$ openchangeclient --mailbox --profile=tom.chance \ + Mailbox - Tom Chance
|---+ Calendar : (Total: 774 / Unread: 0 - Container class: IPF.Appointment) [FID: 0xdadb000000000001] |---+ Contacts : (Total: 59 / Unread: 0 - Container class: IPF.Contact) [FID: 0xdbdb000000000001] |---+ Deleted Items : (Total: 0 / Unread: 0 - Container class: IPF.Note) [FID: 0x3efc000000000001] |---+ Drafts : (Total: 0 / Unread: 0 - Container class: IPF.Note) [FID: 0xdcdb000000000001] |---+ Inbox : (Total: 474 / Unread: 0 - Container class: IPF.Note) [FID: 0x3bfc000000000001] |---+ General : (Total: 10 / Unread: 1 - Container class: IPF.Note) [FID: 0xe00240000000003]
I managed to send a test email, which I picked up in Outlook without problems. When I opened the same email in KMail, however, it has a "winmail.dat" binary file attached, which you wouldn't normally get in emails from Outlook.
tom@dell-desktop:~$ openchangeclient -p=tom.chance --to="tom.chance@bioregional.com" \ --subject="OpenChange test" --body="Hmm, did this work?" --sendmail sendmail MAPI_E_SUCCESS (0x0)
You can also interrogate folders, send emails, create and delete contacts, calendar appointments and access most of the other Exchange functionality. Kerihuel: "Openchangeclient is a test case for libmapi, it's a useful way to test if a problem is in the client application or in libmapi, and there is a plugin for sugarcrm, so it may remain in future.
" There's a proxy server using Samba too, for those who want yet another way of connecting.
For Kontact users, usable integration is probably a good 6 months away. The akonadi resource can deal with most of OpenChange's functionality, "at least a bit
", accord to Hards, though "Kontact can't currently make use of it because it isn't converted to akonadi yet.
" KDE 4.2 should come out with akonadi integration, but the OpenChange functionality might not yet be stable enough for large quantities of important data. Hards thinks KDE 4.3 is probably
"the sweet spot.
"
Until then, Ballmer's mantra remains relevant; OpenChange and its client implementations could do with developers, developers, developers. Cracking this nut could throw open Exchange to a new range of clients, and as Kontact and its peers become stable on Windows and MacOSX, an entrenched Windows server will pose less of a threat to free software migrations on desktops.
System Applications
Clusters and Grids
VIFF 0.7.1 released
Version 0.7.1 of VIFF has been announced, it is a bug fix release. "Virtual Ideal Functionality Framework is a framework for creating efficient and secure multiparty computations (SMPC). Players, who do not trust each other, participate in a joint computation based on their private inputs. The computation is done using cryptographic protocols which allows them to obtain a correct answer without revealing their private inputs. Operations supported include addition, multiplication, and comparison, all with Shamir secret shared outputs."
Database Software
PostgreSQL Weekly News
The October 12, 2008 edition of the PostgreSQL Weekly News is online with the latest PostgreSQL DBMS articles and resources.
Device Drivers
LIRC 0.8.4 released
Version 0.8.4 of LIRC, the Linux Infrared Remote Controller, has been announced. "Irman support is broken in 0.8.2. Please use 0.8.4 if you have this receiver."
Filesystem Utilities
Stable NTFS-3G 1.5012 released
Stable version 1.5012 of NTFS-3G has been announced. "The NTFS-3G driver is able now for unlimited file and directory creation and removal as the result of 13 years continuous clean-room reverse engineering, documenting the different versions of NTFS on-disk formats and implementing a safely interoperable file system driver with the over 500,000 source lines Microsoft NTFS driver by the help of hundreds of contributors over these years."
Mail Software
managesieve 0.4 released
Version 0.4 of managesieve has been announced, it includes new capabilities and bug fixes. "A ManageSieve client library for remotely managing Sieve scripts, including an user application (the interactive 'sieveshell'). Sieve scripts allow users to filter incoming email on the mail server. The ManageSieve protocol allows managing Sieve scripts on a remote mail server. These servers are commonly sealed so users cannot log into them, yet users must be able to update their scripts on them."
Networking Tools
libnetfilter_conntrack 0.0.97 released
Version 0.0.97 of libnetfilter_conntrack has been announced. "libnetfilter_conntrack is a userspace library providing a programming interface (API) to the in-kernel connection tracking state table. This library requires a linux kernel >= 2.6.18. This release includes minor fixes, some enhancements and cleanups."
Printing
CUPS 1.3.9 released
Version of CUPS, the Common UNIX Printing System, has been announced. "CUPS 1.3.9 fixes three integer overflow bugs, an incompatibility with Firefox 3, several printing bugs, and several scheduler bugs."
Web Site Development
Plone 3.1.6 released
Version 3.1.6 of the Plone web development platform has been announced. "The 6th maintenance release of Plone 3.1 is now available."
Plone 3.2a1 released
Version 3.2a1 of the Plone web development platform has been announced. "I'm proud to announce Plone 3.2a1, the first step towards an all egg-based Plone release."
Desktop Applications
Audio Applications
Ardour: Finally, "move Tracks Up/down" (and Other News)
The latest news from the Ardour multi-track audio editor project includes a new move tracks up/down capability. "Ardour has had only one way to change the order of tracks in the editor window since it began - dragging the track names around in the list of tracks attached to one side of the window. In SVN for 2.X, I've just added the new move-selected-tracks-up and move-selected-tracks-down commands, which are bound to Shift-Up and Shift-Down by default. So now you can just select one or more tracks and press a key (or two) to move them up and down."
mp3splt 0.5.2 released (SourceForge)
Version 0.5.2 of mp3splt, an mp3/ogg file splitter and its associated libraries, have been announced: "fixed bug crashing the applications on the silence split when no 'get_silence_level' function defined".
Business Applications
Chandler Desktop 1.0.2 released
Version 1.0.2 of Chandler Desktop has been announced. "The Chandler Project is an open source, standards-based information manager designed for personal use and small group collaboration. Chandler Desktop 1.0.2 is a bug fix update to the previous release, 1.0.1."
Openbravo ERP: R2.40 version is available (SourceForge)
Version 2.40 of Openbravo ERP has been announced. The description states: "Web based ERP for SMEs, built on proven MVC & MDD framework that facilitate customization & maintenance of code. Already in production, it encompasses a broad range of functionalities such as finance, supply chain, project mgmt, manufacturing & much more Openbravo ERP 2.40 is ready for general usage, including evaluation and production. We recommend existing production deployments to upgrade to this release."
CAD
Sweet Home 3D: version 1.4 released (SourceForge)
Version 1.4 of Sweet Home 3D, an interior design CAD application, has been announced. "The new features of version 1.4 include bug corrections, texture images import, export to OBJ format, Swedish localization and other enhancements".
Data Visualization
DISLIN 9.4 released
Version 9.4 of the DISLIN Data Plotting Library has been announced. "DISLIN is a high-level and easy to use plotting library for displaying data as curves, bar graphs, pie charts, 3D-colour plots, surfaces, contours and maps. Several output formats are supported such as X11, VGA, PostScript, PDF, CGM, WMF, HPGL, TIFF, GIF, PNG, BMP and SVG. The software is available for the most C, Fortran 77 and Fortran 90/95 compilers. Plotting extensions for the interpreting languages Perl, Python and Java are also supported."
Desktop Environments
GNOME Software Announcements
The following new GNOME software has been announced this week:- Libgda and Libgnomedb 3.99.5 (new features, bug fixes and translation work)
- Orca 2.24.1 (bug fixes and translation work)
KDE Software Announcements
The following new KDE software has been announced this week:- Elltube 0.2.2 (new features and bug fixes)
- KBib 0.6.5 (new features and bug fix)
- kipi-plugins 0.1.6 (bug fixes)
- libkdcraw 0.1.6 release for KDE3 (new features)
- Palapeli 0.3 (unspecified)
- Qwipe 0.1 (initial release)
- rpCalc 0.6.0 (new features)
- SMILE 0.8.4 (bug fixes)
Xorg Software Announcements
The following new Xorg software has been announced this week:- xorg-server 1.5.2 (bug fixes and code cleanup)
Desktop Publishing
GNU PDF Blog
The GNU PDF Blog for October 6, 2008 has been published. Topics include: Fixes in the Stream Module, Super Powered pdf-filter, Crypt Unit Tests Passing(now), nocheck and fork-mode and more.
Electronics
introducing CGRAN: 3rd party GNU Radio application support
The Comprehensive GNU Radio Archive Network site (CGRAN) has been launched. "The Comprehensive GNU Radio Archive Network (CGRAN) is a free open source repository for 3rd party GNU Radio applications that are not officially supported by the GNU Radio project. CGRAN provides a subversion repository for users to develop or submit new applications, and wiki access for full project documentation. Trac (our web interface) provides unique features such as a browser for the subversion repository and a ticket system for users to file issues with projects in CGRAN." GNU Radio is a software controlled multi-purpose radio platform.
Encryption Software
M2Crypto 0.19.1 released
Version 0.19.1 of M2Crypto has been announced. "The 0.19.1 release fixes the build when OpenSSL has been configured without EC support, thanks to Miloslav Trmac. M2Crypto is the most complete Python wrapper for OpenSSL.."
Games
Humerus 2.0 released
Version 2.0 of Humerus has been announced. "This version of Humerus has been extensively revised from the previous one. Instead of a pile of code to be cut and pasted, it is now a proper library made up of reusable classes, with detailed documentation and some example code included. What is Humerus? Humerus is a companion to the Albow widget library for PyGame. It provides a framework for games made up of a sequence of levels, including user interface and back-end logic for loading levels, saving and restoring game state and sundry other details."
Geographical Software
uDig GIS: A First Look (Linux Journal)
Linux Journal takes a look at the uDig GIS application as part of its series on geographic information systems (GIS). The article shows how to find and load GIS data, then display it in various ways in this free software application. "To those who are new to GIS I generally tell them it involves "mapping with a computer". While this description is a bit oversimplistic, it captures the broad purpose of GIS. A more accurate description is, as the folks at Quantum GIS say, that a GIS is a collection of software that allows you to create, query and analyze geospatial data. I would further add that one can integrate any kind of geographic information and then find relationships among that information, and display it how you wish."
Interoperability
Wine 1.1.6 announced
Version 1.1.6 of Wine has been announced. Changes include: "Beginnings of schannel implementation using GnuTLS. Many fixes from various code analysis tools. Support for X11 desktop work area. Fixes for Richedit tables. More complete JavaScript support. Various bug fixes."
Mail Clients
Claws Mail 3.6.1 is out
Version 3.6.1 of Claws Mail has been announced. "New in this release: Added /View/Fullscreen option. Re-ordering of the filtering/processing condition and actions lists is now possible using drag'n'drop. Updated Brazilian Portuguese and French translations."
Medical Applications
MedinTux needs French to English translators to spread worldwide (LinuxMedNews)
LinuxMedNews introduces the medical application, MedinTux. The MedinTux interface is written in French and the project is looking for translators. "MedinTux is a powerful medical software, multiuser (using MySQL for data storage), easy-to-use (thanks to Qt development toolkit), complete, working from the GP to the hospital. Its unique design makes it the most customisable software you can dream of."
Multimedia
Elisa Media Center 0.5.14 released
Version 0.5.14 of Elisa Media Center has been announced. "The Elisa team is happy to announce the release of Elisa Media Center 0.5.14, code-named "El Bosc Vertical". The focus during this release cycle has been put on Windows functionalities and bug fixing (a good dozen closed)."
Music Applications
Virtual MIDI Piano Keyboard 0.2.1
Version 0.2.1 of Virtual MIDI Piano Keyboard has been announced. "This is a maintenance release, fixing a crash in Windows when playing certain MIDI files and connecting a player output to VMPK input. The reset all button now also resets the internal controllers states. The number of keys is now constrained to reasonable limits within the MIDI notes range. The "grab keyboard" feature is now an optional runtime setting, as a workaround for some broken X11 window managers and desktops."
Office Applications
Task Coach: Release 0.71.1 available (SourceForge)
Version 0.71.1 of Task Coach has been announced. "Task Coach - Your friendly task manager. Task Coach is a simple open source todo manager to manage personal tasks and todo lists. Often, tasks and other things todo consist of several activities. Task Coach is designed to deal with composite tasks. This release fixes a major bug in 0.71.0 (could not open older task files with e-mail attachments)."
Office Suites
OpenOffice.org 3.0 released
OpenOffice.org 3.0 has been released. "Right from the opening screen, OpenOffice.org 3 has a fresh new look, with a new start screen, new splash screen, new icons, and a host of usability improvements." Click below for the announcement which contains an overview of the new features in this release.
Meeks: Measuring the true success of OpenOffice.org
Michael Meeks has taken a detailed look at contributions to OpenOffice.org and come away worried. "Crude as they are - the statistics show a picture of slow disengagement by Sun, combined with a spectacular lack of growth in the developer community. In a healthy project we would expect to see a large number of volunteer developers involved, in addition - we would expect to see a large number of peer companies contributing to the common code pool; we do not see this in OpenOffice.org. Indeed, quite the opposite we appear to have the lowest number of active developers on OO.o since records began: 24, this contrasts negatively with Linux's recent low of 160+. Even spun in the most positive way, OO.o is at best stagnating from a development perspective."
Science
mpmath 0.10 released
Version 0.1.0 of mpmath, a pure-Python library for arbitrary-precision floating-point arithmetic, has been announced. "Additions in 0.10 include plotting support, matrices and linear algebra functions, new root-finding and quadrature algorithms, enhanced interval arithmetic, and some new special functions. Many speed improvements have been committed (a few functions are an order of magnitude faster than in 0.9), and as usual various bugs have been fixed. Importantly, this release fixes mpmath to work with Python 2.6."
Video Applications
Gnash 0.8.4 released
Version 0.8.4 beta 3 of Gnash, a free Flash player, has been announced. From the release notes: "Keep Adobe happy with our users and our users happy with us by changing "Flash player" into "SWF player" everywhere. Adobe claims "Flash" as a trademark and had asked a Linux distributor to fix it. The popular SWF Twitter badge now renders correctly. Fix parsing of urls containing multiple question marks Fix support for movies embedding multiple sound streams Support for loading PNG and GIF images added. Improved rendering of SWF movies because of the less visible changes listed below. Support for writing RGB/RGBA PNG images and JPEG images. Works with Potlatch OpenStreetMap editor New 'flvdumper' utility for analyzing FLV video files. XPI packaging support for Mozilla & Firefox."
Web Browsers
Firefox 3.1 beta 1 is now available for download
The first beta of Firefox 3.1 is available for testing. "This milestone is focused on testing the core functionality provided by many new features and changes to the platform scheduled for Firefox 3.1."
Geode in Firefox 3.1: Lost in Linux (Linux Magazine)
Linux Magazine reports that the Geode geolocation feature of Firefox 3.1 will not be available to Linux users. While privacy advocates may be perfectly happy with that outcome, there may be others who would find the feature useful. It certainly seems to run counter to the whole idea of a free and open browser. "Mozilla Labs presents the following scenario: When you open the Firefox browser, it knows where you are and immediately opens websites for nearby restaurants, stores and other attractions. Mozilla developers have already integrated this feature, as the Geode plug-in, in the current beta version of Firefox 3.1. It is based on proprietary software from a company called Skyhook."
Languages and Tools
C++
dlib C++ Library: 17.10 Released (SourceForge)
Version 17.10 of dlib has been announced. "The dlib C++ library is a modern general purpose C++ toolkit with a focus on portability and program correctness. It comes with extensive documentation and thorough debugging modes. The library provides a platform abstraction layer for common tasks such as interfacing with network services, handling threads, and creating graphical user interfaces. Additionally, the library implements many useful algorithms such as data compression routines, linked lists, binary search trees, linear algebra and matrix utilities, machine learning algorithms, XML and general text parsing, and many other general utilities. This release was focused on fixing bugs and improving usability."
Caml
Caml Weekly News
The October 7-14, 2008 edition of the Caml Weekly News is out with new articles about the Caml language.
Java
IcedTea6 1.3 released
Version 1.3 of IcedTea6 has been announced, it includes new features, bug fixes and security fixes. "The IcedTea6 project provides a harness to build the source code from OpenJDK6 using Free Software build tools and provides replacements libraries for the binary plugs with code from the GNU Classpath project."
Whiteoak 2.1 released (SourceForge)
Version 2.1 of Whiteoak has been announced. "The Whiteoak programming language is a backward compatible extension of Java 6, that supports: structural subtyping (AKA: structural conformance), virtual fields and constructors, mixin-like/trait-like composition of objects and more. Whiteoak 2.1 has been officially released. This release includes both a command-line compiler as well as an Eclipse plugin."
Python
Mock 0.4.0 released
Version 0.4.0 of Mock has been announced. "Mock 0.4.0 has just been released, the first release in about ten months (but worth the wait). Mock is a simple library for testing: specifically for mocking, stubbing and patching."
posix_ipc 0.1 is available
The initial release of the Python posix_ipc package has been announced. "The package posix_ipc provides a Python interface to POSIX shared memory and named semaphores on platforms that support them (i.e. most Unices)."
python-aspects 1.2 released
Version 1.2 of python-aspects has been announced, one new function has been added. "aspects.py is a lightweight and low-level library for intercepting function calls. Functions and methods (also in Python standard library and third party code) can be wrapped so that when they are called, the wrap is invoked first. Depending on the wrap, the execution of the original function can be omitted, or the function can be called arbitrarily many times. Wraps are able to modify the call arguments and the return values of wrapped functions and handle exceptions. There can be many wraps on the same function. The wraps can be enabled, disabled and removed in any order."
Python-URL! - weekly Python news and links
The October 14, 2008 edition of the Python-URL! is online with a new collection of Python article links.
Tcl/Tk
Tcl-URL! - weekly Tcl news and links
The October 15, 2008 edition of the Tcl-URL! is online with new Tcl/Tk articles and resources.
IDEs
ZK: 3.5.1 released (SourceForge)
Version 3.5.1 of ZK has been announced. "ZK is Ajax framework. 100% Java, no JavaScript. With event-driven, 170+ components, and markup languages, development as simple as programming desktops and authoring HTML/XUL pages. ZK supports JSF, JSP, J2EE, and scripting in Java, Ruby, Groovy... Over 6 new features and 28 bugs fixed. New Tree style, Session fixation protection suppor[]ted."
Libraries
Pantheios: 1.0.1 (beta 165) released (SourceForge)
Version 1.0.1 beta 165 of Pantheios, an Open Source C/C++ Logging API library, has been announced. "Release 1.0.1 beta 165 incorporates: Substantial reworking of contract API, reflected throughout the headers, implementation, example and test files".
Miscellaneous
Bouml: 4.7 released (SourceForge)
Version 4.7 of BOUML has been announced, it includes various improvements. "BOUML is a free UML 2 tool box allowing you to specify and generate code in C++, Java, Idl, Php and Python. BOUML runs under Unix/Linux/Solaris, MacOS X and Windows. It is very fast and doesn't require much memory to manage several thousands of classes."
Page editor: Forrest Cook
Linux in the news
Recommended Reading
Linux at 17 - What Windows promised to be (the Register)
The Register reflects on the history of Linux. "Linux is what Windows had once promised to be - at least in terms of cross-platform support. In the wake of the PowerPC alliance from IBM, Apple, and Motorola in 1991, Microsoft made a commitment to support Windows NT 3.51 on PowerPC chips. Windows eventually added support for Digital's Alpha NEC's and SGI's MIPS chips. Workstation maker Intergraph ported Windows NT 3.51 to its Clipper chips and said it was creating a port to Sparc chips from Sun. Neither ports saw the light of day."
Livin' La Vida Linux (ZDNet)
Samba hacker Jeremy Allison reflects on free formats and free software over at ZDNet. He looks at the evolution of storage during his life and looks down the road to see freedom playing a large role. "In short, encoding my CD's in a free format gave me the freedom to do what I wanted with the music I had already bought. In the same way, using Free Software gives device manufacturers the freedom to create the devices they think will be the most popular, without any restrictions on what those devices should do or how they should look. There's no proprietary operating system owner who insists on their consumer 'experience' being done a certain way. No commandments insisting that certain software components must be included in the device, which is to propagate control of proprietary media formats and web browsers, not to give device designers the flexibility they need."
Trade Shows and Conferences
Linux Summit will preview new advanced file system (SearchEnterpriseLinux.com)
SearchEnterpriseLinux.com previews presentations by Ted Ts'o and Chris Mason at the Linux Foundation End User Collaboration Summit that starts on October 13. "But changing the file system to fix the scalability and functional limitations of ext3, the default file system in many popular Linux distributions, requires a significant education outreach. Because the consequences of data loss are so severe, data center managers are reluctant to trust their data to new file systems, Ts'o said. New-system information needs to be shared well ahead of time, including a roadmap of coming features so IT professionals know what to expect, he said. That's where the Linux Foundation's event hopes to make inroads."
Companies
Linux opportunity buried in Unix market share data (CNET)
Over at CNET, Matt Asay sees opportunities for Linux in the recent news that IBM claimed 35% of the Unix server market for second quarter of 2008. "For those wondering how big Red Hat and Novell can become on operating-system revenue alone, keep that $61 billion number in mind. Most of that $61 billion is hardware-related, but it meant approximately $650 million in Linux server sales for Red Hat and Novell over the past year. As Linux eats into Unix, Red Hat and Novell can expect to grow linearly with it."
Linux Adoption
Differing trends for Linux on netbooks
There appear to be some opposing trends involving Linux on Netbooks. PC World's article Netbooks Will Boost Adoption of Linux, Says Novell CTO notes: "A surge in demand for netbooks is helping drive business for Linux, as the devices are designed to be low-cost with smaller storage, according to Novell's chief technology and strategy officer for Linux. " People typically don't care what operating system is on the netbooks, because they don't buy them to run a suite of applications like Microsoft Office, but to be on the Web using a Web browser," Nat Friedman said in an interview with IDG News Service."
Laptop Mag's article
Ubuntu Confirms Linux Netbook Returns Higher than Anticipated quotes Canonical's marketing manager
Gerry Carr:
"We dont know what the XP return rates are. But I will say that the return rate is above normal for netbooks that offer open-source operating systems, Carr echoed. Carr highlighted a few reasons why Ubuntu-running netbooks are returned more often. Unclear selling is happening, typically online. The customer will get their netbook sent to their home and they imagine to find something like a Microsoft desktop, but they see a brown Ubuntu version. They are unwilling to learn it and they were expecting to have Windows.
"
Linux in The Economic Meltdown (IT Management)
IT Management's Matt Hartley considers the effects of the recent economic woes on Linux adoption. "Considering the state of the US finances, I would point out that spending money on a computer pre-loaded with an OS that can be, even to this date with Vista, hit with malware with little to stop it seems rather foolish to me. Now consider industries where the bulk needs of a workstation can adequately be upheld with most common Linux distributions. Unfortunately the joy might stop there if that company is already using an in-house IT staff. Why? Because so many of them here in the States are Windows only, thus making a switch to a new platform a move to fire and rehire your IT staff."
Linux at Work
Video and photos show Linux booting on the Brazilian voting machines (BR-Linux.org)
BR-Linux.org has pictures and video of Brazilian Linux-powered voting machines. "Just 10 days ago, 130 million brazilian voters were turned into users of one of the largest Linux deployment worldwide: the 400,000 electoral sections in all of the 5,563 brazilian municipalities were running electronic voting machines, and the Linux kernel was running in all of them." (Thanks to Augusto Campos)
Legal
Beta blockers? (Nature)
The sub-title for this article is Proprietary data formats may be legally defensible but open standards can be a better spur for innovation. "Dan Cohen, director of GMU's Center for History and New Media, and Sean Takats, a GMU history professor, are also directors of Zotero: open-source software developed by the history centre that lets researchers organize and share their digital information iTunes style, whether it is in the form of citations, documents or web pages. Zotero is free and popular, and has attracted some 1 million downloads since its launch in October 2006. Thomson makes the proprietary bibliography software EndNote, and claims that Zotero is causing its commercial business "irreparable harm" and is wilfully and intentionally destroying Thomson's customer base." (Thanks to jerbol)
Interviews
Interview: Miguel de Icaza (DesktopLinux.com)
DesktopLinux.com features an interview with Miguel de Icaza. "GNOME project co-founder Miguel de Icaza discusses the release of Mono 2.0, in this detailed interview with Henry Kingman, executive editor of DesktopLinux. The conversation spans Mono's history, current state, and future, with stops along the way for updates on Moonlight and Mono Develop."
Resources
Running the Chromium browser on Ubuntu 8.04 with CrossOver Chromium (HowtoForge)
HowtoForge presents a tutorial on running the Chromium browser under Ubuntu 8.04. "Chromium is an open-source browser project that is the basis for Google's Chrome browser. Right now, Chromium doesn't support Linux natively, but Codeweavers has created a Linux port called CrossOver Chromium that can be installed free of charge. This guide shows how to install CrossOver Chromium on Ubuntu 8.04."
Reviews
Multi-Head, Multi-User Killer GNU/Linux App Languishes (LinuxMedNews)
LinuxMedNews looks at multi-head, the killer application in health care. "Multi-head, multi-user systems running off a single PC. This is where multiple displays, keyboards and mice can be attached to a single PC with multiple users all working simultaneously from one system unit. This can dramatically lower the cost of an individual workstations as well as the cost to support individual workstations. This setup is becoming more and more viable as hardware power increases."
Miscellaneous
Ideas Wanted: Creative Heat Recycling from Servers (Linux Journal)
James Gray is looking for creative ways to recycle waste server heat. "The botanical garden that is heated by Notre Dame's servers specializes in desert plants and is located in Indiana, well know for its brutal winters. The concept is simple. The waste server heat is pumped into the interior space of the garden to keep the desert-loving plants toasty warm all year long. This simple, creative step is saving the university $100,000 on cooling costs and the owner of the botanical garden, the City of South Bend, Indiana, another $70,000 on heating costs. Not only that, but the atmosphere is spared many thousands of tons of pollution from carbon emissions. That is quite a triple win-win-win arrangement."
Top Agenda Setters for 2008 (Silicon.com)
Silicon.com presents a collection of Top Agenda Setters for 2008. "Silicon.com chooses the top 50 most influential individuals in the worldwide technology and IT industries business leaders, CEOs, CIOs, techies, open source gurus, security experts, visionaries, entrepreneurs and politicos".
Page editor: Forrest Cook
Announcements
Non-Commercial announcements
EFF challenges bogus patent on Internet music files
Electronic Frontier Foundation has announced a new bogus patent challenge. "The Electronic Frontier Foundation (EFF) is challenging a bogus patent on Internet music files that could stifle new innovations in online music distribution. Seer Systems was awarded this illegitimate patent for a system and method for joining different musical data types together in a file, distributing them over the Internet, and then playing that file. But in a reexamination request filed with the United States Patent and Trademark Office (USPTO) today, EFF and the law firm Day Casebeer Madrid & Batchelder show that descriptions of this technology were published a number of times before Seer Systems made its claim--including one in a book written by Seer's own founder and the named inventor of the patent, Stanley Jungleib."
The Linux Foundation's FOSSBazaar Nearly Doubles its Membership
The Linux Foundation has announced that its Free and Open Source Software (FOSS) governance workgroup, called FOSSBazaar, has nearly doubled its membership since launching in January. "During its inaugural year, FOSSBazaar has both established an online destination where collaboration on these topics takes place (https://fossbazaar.org) and appointed full-time workgroup community leader Martin Michlmayr. Michlmayr is a well-known figure that currently serves on the Board of Directors for the Open Source Initiative (OSI). He has been involved in FOSS projects for more than 10 years, including having led the Debian project for two years. FOSSBazaar has also participated in collaborative forums this year such as the Annual Linux Foundation Collaboration Summit and OSCON."
Commercial announcements
ASF announces Apache Tuscany 1.3.2
Apache Software Foundation has announced the release of Apache Tuscany 1.3.2. "Apache Tuscany, a new Top-Level Project of the Apache Software Foundation (ASF), today announced the release of version 1.3.2 of its Service Component Architecture (SCA) for Java -- the Project's latest release since its graduation from the ASF Incubator four months ago. Apache Tuscany provides a robust, highly extensible infrastructure for building, deploying, running and managing Service Oriented Architecture (SOA) solutions, streamlining the development process of service-based application networks and addressing real business problems posed in SOA."
AtMail releases AtMail 5.5
AtMail has announced the release of AtMail 5.5. "AtMail, a leading provider of easy-to-use, Linux-based email management appliances and software, today announced the latest release to its commercial Webmail platform, AtMail 5.5. The new AtMail 5.5 version includes support for Canonical's Ubuntu Server Edition Linux-based operating system."
Atmel, Cisco and SICS collaboratively release uIPv6
Atmel Corporation has announced the release of the uIPv6 protocol stack. "Atmel(R) Corporation, Cisco and the Swedish Institute of Computer Science (SICS) today announced the availability of uIPv6, one of the world's smallest open-source, IPv6-ready protocol stack, which could enable every device, no matter how limited by power or memory to have an Internet Protocol address."
GarageGames Looking to Fund New Studios in Austin, Vancouver, and Seattle
GarageGames has announced an expansion drive. "GarageGames, creators of InstantAction.com, the website for gamers that combines the intensity of videogames with the accessibility of the web, have announced that they are looking to fund new startup studios working on original IP for InstantAction and other platforms. "We're seeing a lot of larger studios cutting back on costs and thus forced to let go of great talent," said Josh Williams, CEO of GarageGames. "There's always opportunity for good developers to start anew and we're looking to give these guys a shot to get back to their roots on a small team making games for a cutting edge platform.""
ITTIA introduces compact DBMS for portable media applications
ITTIA has announced the availability of ITTIA DB Compact edition. "ITTIA, a leading provider of embedded database software and services, today introduced Compact edition as a new member of its ITTIA DB product family. Compact is a rock-solid transactional database engine that allows embedded developers to select the exact database features to match the requirements of a particular device. Compact is an ideal database candidate for application development projects related to digital media such as portable multimedia players (PMP), digital audio players (DAP), and automotive computer systems."
Cloud Computing Adoption Model unveiled by rPath
rPath has announced a new Cloud Computing Adoption Model. "rPath today announced its Cloud Computing Adoption Model, which defines a pragmatic, five-step approach for the graduated adoption of cloud computing. The Cloud Computing Adoption Model will be rolled out on October 23, as part of an rPath webinar featuring guests Amazon Web Services, Forrester Research and MomentumSI."
New SSH Tectia Solution for Linux on IBM System z
SSH Communications Security has announced SSH Tectia Server for Linux on IBM System z. "This new version of SSH Tectia provides a unified, end-to-end security model that extends from distributed platforms, to mainframes running the Linux operating system on the IBM System z platform, and also to virtualized environments."
OpenLogic expands professional service offerings
OpenLogic has announced an expansion of its professional service offerings. "OpenLogic, Inc., a provider of enterprise open source software solutions encompassing hundreds of open source packages, today announced several new professional services packages, ranging from one day to one week engagements, that help companies quickly and cost-effectively identify, fine-tune and implement enterprise-ready open source products."
SourceForge.net launches Hosted Apps
SourceForge.net has announced the launch of Hosted Apps. "SourceForge, Inc.,the leader in community-driven content and media, has announced the launch of Hosted Apps, a new service for developers that provides instant, virtualized access to popular open source applications. SourceForge will centrally manage the infrastructure and security of Hosted Apps, allowing developers to innovate freely without being distracted by the maintenance of their project's infrastructure."
Timesys Announces Embedded Linux ReadyKits
Timesys has announced new ARM processor ReadyKits. "Timesys Corporation®, a premier provider of embedded Linux software solutions, today announced general availability of embedded Linux ReadyKits for several popular ARM-based processors. Assembled by Timesys award winning Online Linux Factory, ReadyKits enable embedded developers to have a robust Linux platform up and running on their select processor within a few hours ready to benchmark platform performance or prototype applications. Each ReadyKit comes complete with a pre-built, integrated and tested embedded Linux platform, including all sources."
New Books
Maven: The Definitive Guide - New from O'Reilly
O'Reilly has published the book Maven: The Definitive Guide by Tim O'Brien.Packt Publishing releases CUPS Administrative Guide
Packt Publishing has published the book CUPS Administrative Guide by Ankur Shah.
Resources
Linux Foundation releases LSB 4.0 beta
The Linux Foundation has announced the release of version 4.0 beta of the Linux Standards Base (LSB). "This new version of LSB promises to accomplish these goals in a more powerful way. "We have a new set of LSB tools to make it much easier for ISVs to development applications that are LSB compliant, and to test to see how portable their applications are via the Linux Application Checker," Ted T'so, Chief Platform Strategist and Fellow with the Linux Foundation, explained."
Contests and Awards
USAID Launches Open Source Development 2.0 Challenge
The U.S. Agency for International Development has announced the 2008 USAID Development 2.0 Challenge. "The Development 2.0 Challenge signals that USAID is responding to a shifting business and technology culture that goes by many names, including Web 2.0, inventive economics, wikinomics, or crowdsourcing. Just as online communities have changed the way business is done, USAID's open call for technology solutions seeks to improve the way international development is done." Grants of up to $10K will be awarded and submissions will be accepted from October 13 - December 5, 2008.
Meeting Minutes
Perl 6 Design Minutes (use Perl)
The September 24, 2008, September 17, 2008 and September 10, 2008 Perl 6 Design Meeting Minutes have been posted.
Calls for Presentations
CISSE 2008 - paper submission deadline extended
The paper submission deadline for CISSE 2008, the Fourth International Joint Conferences on Computer, Information, and Systems Sciences, and Engineering, has been extended to October 28, 2008. The conference will be held online on December 5-13, 2008. "Due to numerous deadline extension requests from potential CISSE 2008 authors, the CISSE organizing committee has decided to extend the paper submission deadline to 10/28/2008. Please note that this is a hard deadline, so that the technical committees can perform their paper reviewing duties in a timely manner."
FOSS.IN/2008: CfP announced
A call for papers has gone out for FOSS.IN/2008. "Time is short, so please read through carefully and get ready with your proposals. The registration system will open from October 10, 2008. FOSS.IN is a contributor event, focusing on development efforts in FOSS from India." The event takes place on November 25-29, 2008 in Bangalore, India, abstracts are due by October 18.
Linuxchix Miniconf @linux.conf.au 2009: Call for Presentations
LinuxChix has announced that they'll be hosting the LinuxChix mini-conf at Linux.conf.au in January, 2009 in Hobart, Tasmania. This mini-conf exists to encourage women with an interest in free and open source technology to share their ideas, network and improve their presentation skills. Abstracts for talk proposals should be submitted by October 20, 2008 12:00 GMT.O'Reilly RailsConf 2009 opens Call for Participation
A call for participation has gone out for the O'Reilly RailsConf 2009. The event takes place in Las Vegas, NV on May 4-7, 2009, submissions are due by February 17.O'Reilly Where 2.0 2009 Conference opens call for participation
A call for participation has gone out for the O'Reilly Where 2.0 2009 Conference. "The earth isn't flat, and maps don't live in the glove compartment anymore. The O'Reilly Where 2.0 Conference will pinpoint how far location technology has reached, explore the boundaries of geospace, and point the way into the location frontier at the Fairmont Hotel in San Jose, CA, May 19-21, 2009. O'Reilly Media and program chair Brady Forrest invite proposals for conference sessions, workshops, demos, and panels for Where 2.0 2009." Submissions are due by December 2.
Upcoming Events
MySQL European Customer Conferences 2008
The MySQL European Customer Conferences 2008 will take place in London on Thursday, October 23, Munich on Tuesday, October 21 and Paris on Wednesday, November 19.European PGDay 2008
European PGDay 2008 will be held on October 17-18, 2008. "The conference will once again be held in the beautiful historic surroundings of the Monash University Prato Centre in Prato, a small walled town near Florence, Tuscany."
Web 2.0 Expo Europe Examines Key Industry Themes
Web 2.0 Expo Europe has been announced. "The second annual Web 2.0 Expo Europe will define the current state of Web 2.0 and, more importantly, outline its future. The three-day conference, co-produced by O'Reilly Media, Inc. and TechWeb, will attract the largest pan-European community of international technical, design, marketing, and business professionals, entrepreneurs, start-ups, and VCs building, leveraging, and driving the European Web economy. Each will bring a unique and insightful perspective to the dynamic state of innovation happening on the Web. Scheduled for October 21-23, 2008, Web 2.0 Expo Europe will be held at a new venue, the Berliner Congress Center in Berlin, Germany."
Events: October 23, 2008 to December 22, 2008
The following event listing is taken from the LWN.net Calendar.
| Date(s) | Event | Location |
|---|---|---|
| October 19 October 24 |
Colorado Software Summit 2008 | Keystone, CO, USA |
| October 20 October 24 |
15th Annual Tcl/Tk Conference | Manassas, VA, USA |
| October 21 October 23 |
Web 2.0 Expo Europe | Berlin, Germany |
| October 21 October 24 |
Systems | Munich, Germany |
| October 22 October 24 |
Hack.lu 2008 | Parc Hotel Alvisse, Luxembourg |
| October 22 October 24 |
Encuentro Linux | Concepción, Chile |
| October 24 October 26 |
Free Society Conference and Nordic Summit | Gothenburg, Sweden |
| October 25 October 26 |
T-DOSE 2008 | Eindhoven, the Netherlands |
| October 25 | Ontario Linux Fest 2008 | Toronto, Canada |
| October 26 October 31 |
IBM Information On Demand 2008 | Mandalay Bay - Las Vegas, Nevada, USA |
| October 27 October 30 |
Embedded Systems Conference - Boston | Boston, USA |
| October 29 November 1 |
10th Real-Time Linux Workshop | Colotlán, Jalisco, Mexico |
| November 3 November 7 |
ApacheCon US 2008 | New Orleans, LA, USA |
| November 5 November 7 |
OpenOffice.org Conference 2008 | Beijing, China |
| November 6 | NLUUG autumn conference: Mobile Applications | Ede, Netherlands |
| November 6 November 7 |
Embedded Linux Conference Europe 2008 | Ede, Netherlands |
| November 7 November 8 |
TwinCity Perl Workshop 2008 | Vienna, Austria |
| November 7 November 9 |
UKUUG linux conference | Manchester, UK |
| November 8 November 9 |
Hackers to Hackers Conference 05' | Sao Paulo, Brazil |
| November 8 November 9 |
FOSS.my | Kuala Lumpur, Malaysia |
| November 10 November 14 |
Python Bootcamp with Dave Beazley | Atlanta, GA, USA |
| November 11 November 14 |
DeepSec IDSC 2008 | Vienna, Austria |
| November 12 November 14 |
php|works 2008 | Atlanta, GA, USA |
| November 12 November 13 |
PacSec Applied Security Conference | Tokyo, Japan |
| November 13 November 14 |
International Hacking and Security Conference | Seoul, Korea |
| November 14 November 16 |
OpenSQL Camp 2008 | Charlottesville, VA, USA |
| November 16 November 20 |
Middle East IT Security Conference | Dubai, UAE |
| November 19 November 20 |
Linux Foundation Japan Symposium | Tokyo, Japan |
| November 20 November 21 |
FreedomHEC Taipei 2008 | Taipei, Taiwan |
| November 22 | The phpnw08 conference | Manchester, UK |
| November 22 | PGDay Rio de la Plata | Buenos Aires, Argentina |
| November 22 | Mandriva 2009 Installfest | Everywhere, World |
| November 25 November 29 |
FOSS.IN 2008 | Bangalore, India |
| November 25 November 30 |
make art 2008 | Poitiers, France |
| November 28 | Informazione geografica aperta e libera | Pontedera (PI), Italy |
| November 28 November 29 |
WhyFLOSS La Plata - Argentina | La Plata, Argentina |
| November 29 | LinuxDay in Vorarlberg (Deutschland, Schweiz, Liechtenstein und Österreich) | Dornbirn, Austria |
| December 1 | First Nuxeo Developer Day | Paris, France |
| December 1 December 2 |
Open World Forum | Paris, France |
| December 2 December 5 |
Open Source Developers' Conference 2008 | Sydney, NSW, Australia |
| December 4 December 7 |
PIKSEL08 - code dreams | Bergen, Norway |
| December 5 December 6 |
FOSSCamp | Mountain View, CA, USA |
| December 5 December 13 |
International Joint Conferences on Computer, Information, and Systems Sciences, and Engineering | Online |
| December 7 December 12 |
Computer Measurement Group Conference 2008 | Las Vegas, NV, USA |
| December 8 December 12 |
Ubuntu Developer Summit | Mountain View, CA, USA |
| December 8 | Forum PHP Paris 2008 | Paris, France |
| December 10 December 11 |
First Workshop on I/O Virtualization | San Diego, CA, USA |
| December 13 | NLLGG meeting/BSD Community Day | Utrecht, The Netherlands |
If your event does not appear here, please tell us about it.
Web sites
KDE Launches User Forum
KDE has launched the KDE Forum, which is a MyBB-based forum for users to discuss KDE-related topics. In conjunction with the adoption by KDE, MyBB has released their software under the GPLv3. "Sebastian Kügler, member of the KDE e.V. Board of Directors explains where the new KDE Forum fits into KDE communication infrastructure: 'We've come to believe that mailinglist don't cut it for all users. KDE becoming increasingly widely used should also offer those that aren't familiar with the use of email for such discussions a place. The new KDE forum complements KDE's new end-user knowledge base Userbase that has been launched last month. At the same time, we're really happy to see that after our request the MyBB team has decided to release their forum software under the terms of the GPL.'" Click below for the full announcement.
Audio and Video programs
O'Reilly Webcast - When Times Gets Tough, the Tough Get Tuning
O'Reilly will hold a webcast entitled: When Times Gets Tough, the Tough Get Tuning by Dee-Ann LeBlanc on October 21 at 10am PDT. "When you experience reduced performance, your first inclination may be to groan and open your wallet. While new hardware often can offer the best bang for your buck, it's also possible that you don't need to invest that money just yet--or at least that you can improve the performance while you look for a good deal. In this seminar, you'll learn how to break down performance into four major areas, how to determine which area(s) are causing your problems, and some tips on how to improve in each."
Page editor: Forrest Cook
