[LWN Logo]

Bringing you the latest news from the Linux World.
Dedicated to keeping Linux users up-to-date, with concise news for all interests

 Main page
 Linux in the news
 Linux History

Other LWN stuff:
 Daily Updates
 Linux Stocks Page
 Book reviews
 Penguin Gallery

 Use LWN headlines
 Advertise here
 Contact us

Recent features:
- RMS Interview
- 2001 Timeline
- O'Reilly Open Source Conference
- OLS 2001
- Gaël Duval
- Kernel Summit
- Singapore Linux Conference
- djbdns

Here is the permanent site for this page.

See also: last week's LWN.

Leading items and editorials

Kernel changelogs to be censored? Alan Cox stirred things up this week with his announcement of the eleventh 2.2.20 prepatch. Along with the usual set of fixes and updates, the changelog included the following:
o Security fixes
  Details censored in accordance with the US DMCA
When pressed for details, Alan responded that "file permissions and userids may constitute and be used for rights management" and that he wasn't willing to risk lawsuits and/or prison terms by releasing information that could be used for circumvention. When it comes to security problems, says Alan, "US kernel developers cannot be told. Period." He has not, as yet, responded to questions on how he can work with (US-based) Linus under such conditions.

The details, apparently, may appear on a web site that is inaccessible from the U.S. before the official 2.2.20 release happens.

Alan, of course, is trying to dramatize a point: U.S. laws on these issues are seriously messed up. It is also true that the U.S. has little reluctance to try to apply its laws to foreign nationals doing things that are legal at home. Even so, one might be forgiven for wondering if Alan is taking things a little too far here. Censored changelogs will attract a bit of attention, but are unlikely to really change much. Besides, as readers of NTK know, the U.K.'s laws are not much better than those in the U.S. with regard to things like "circumvention devices."

Also true is the fact that most of the vulnerabilities fixed have already been published: see this week's LWN security page. Even though, as Alan says "there are other security related changes" in this prepatch, the information is already out there.

Still, one can not make these points too often. That is especially true in times like these, where civil liberties are in increased danger, and proposed laws like the SSSCA could make Linux itself illegal in the U.S. The presence of the DeCSS code on the net has not shielded those who have republished it. There are dangers out there for those who work with or discuss security vulnerabilities.

There is an interesting question, here, though: if a description of a Linux kernel security vulnerability potentially violates the DMCA, what about the patch that fixes it? The patch doesn't just describe the problem, it does so in exact technical terms that will point a would-be exploiter in just the right direction.

So, for example, it is considered OK to publish a patch containing:

    -#define MAX_QUOTA_MESSAGE 75
    +#define MAX_QUOTA_MESSAGE (PAGE_SIZE + 256)
but it is a violation to put "fix potential buffer overrun in the quota code" into a changelog. Even though this problem was publicly discussed on the linux-kernel list back in September. These are, shall we say, strange times. In the long run, if the Powers That Be are determined to prevent the discussion of security vulnerabilities, they will seek a way to block the exchange of the code as well.

Sooner or later, this situation has to resolve itself. The kinds of restrictions that corporations and governments wish to put into software (and discussions about software) are in conflict with free, source-available code. Historically, in the U.S., freedom has a reasonable chance - especially where freedom of speech is involved. But we live in interesting times, to say the least.

Emacs 21 is here. The Free Software Foundation this week announced the availability of version 21.1 of the famous emacs editor. The emacs development process has been, until now, relatively invisible to the free software community as a whole, so new releases tend to bring a number of surprises with them. Your reporter, being an emacs user, was naturally curious as to what was in the new release; being also a Debian user, he was able to satisfy his curiosity with a single apt-get command. If only more disk space could be had so easily.

So what's up with version 21? Richard Stallman is quoted as follows in the announcement:

Emacs 21 is a big step forward in our long-term plan to take Emacs from a programmable text editor to a programmable word processor.

FSF development plans do tend toward a long-term nature. Those wanting to [emacs splash screen] use emacs 21 as a true word processor will be disappointed, it's not there yet. It has, however, made some definite steps in that direction. The first signs can be seen in the initial splash screen, shown on the right (click the image for a full-size version). Emacs can now display images in buffers; it is also capable, finally, of using proportional fonts. There is little user-level support for either, but elisp programmers can now get at that functionality.

Also present in the new emacs is a toolbar that appears below the standard menubar. It is, of course, customizable for emacs's various modes. It is also easily dispensed with, happily, for those of us who prefer to use the screen space for editing. And, of course, what would a toolbar be without tooltips? Emacs will now happily pop up little help windows all over the place. Perhaps more interestingly, the tooltips mechanism can also be turned on in the GUD debugger mode: move the pointer over a variable name, and a little window with the variable's value pops up.

It wouldn't be an emacs release, of course, without a ton of new features. Here's a subset, with occasional screen shots:

  • How about an ASCII art mode, which allows mouse-based creation of ASCII diagrams?

  • Color fonts are now supported outside of window mode if the underlying terminal can do it.

  • Emacs can now play audio files, though the documentation does not say much about just why one might want to do that.

  • The modeline is now mouse-sensitive.

  • Emacs now features a blinking cursor in window mode. Happily, you can turn it off.

  • There is a new confirm-kill-emacs variable that will cause the editor to ask before shutting itself down. Users who have found, to their chagrin, that it doesn't take much fat-fingering to turn C-X into C-X C-C will be pleased.

  • Buffers can now have "header lines" that remain at the top of the window, independent of scrolling. Info mode uses this feature to present a navigation bar.

  • Emacs now has wheel mouse support.

  • There is, of course, a new, improved cc-mode with a lot of fancy features. Surprisingly, they appear to have managed not to break too many user configurations this time around. In general, elisp code from version 20 seems to work well in the new release.

  • There's a nice new "diff" mode, most useful for picking the security patches out of kernel updates.

  • The gnus newsreader now handles MIME postings. It also turns smileys into cute little images that are amusing for the first couple of messages.

  • A new highlight-regexp command can be used to mark all occurrences of a given string in a buffer.

  • Incremental search now highlights upcoming matches so you know where you're going next.

  • The "zone out" mode implements a sort of internal screen saver for emacs windows.

  • A new "woman" mode exists which can format up man pages without having to resort to external programs. There is also a new shell mode that has no need for an actual shell. A compile mode with its own built-in compiler has not yet been implemented, however.

  • Cool feature: the regular expression builder allows interactive creation of complicated search strings with immediate feedback on what is matched.

  • A "C warning mode" points out things it thinks are incorrect or dangerous in C code.

  • There is a new postscript mode for those who like to talk to their printers directly.
On the other hand, the rumor that one can now boot directly into emacs from LILO or GRUB, and thus avoid the need for an operating system entirely, proves to be unfounded.

The full list of new features is far more extensive than the above - and we have not even begun to talk about the elisp-level changes. Suffice to say that emacs 21 is a major release, with a lot of cool new stuff.

The best thing of all, however, may not be an editor feature at all. As of this release, it is now possible to get the development version of the code via a CVS server on savannah.gnu.org. Opening up the emacs development process can only be a good thing for both developers and users.

The latest word from Gartner. Those of us who have followed Linux for a while have grown accustomed to hostile opinions published by the Gartner Group. Recently, though, Gartner has shown signs of coming around. The latest pronouncement from that group, published in ZDNet as What's the future of Linux?, shows continued progress in this area. Consider this quote:

Linux is being viewed as an opportunity to enable users to get out from under the yoke of proprietary platforms and high software license fees and into a much more flexible and evenhanded negotiating position. But vendors will always seek new opportunities to wedge users into proprietary solutions, so users must remain vigilant to avoid past mistakes that led to lock-in.

Licensing fees and "negotiating positions" are only a small part of what make free software worthwhile. Nonetheless, it looks like Gartner is beginning to figure out what free software really means. There may yet be hope...

Inside this LWN.net weekly edition:

  • Security: Responses to Scott Culp; possible ssh exploit.
  • Kernel: A new driver model; looking for faster pipes.
  • Distributions: More from the CLIG; Melon: Japanese Linux for the iPAQ.
  • Development: Mozilla 1.0 Manifesto, Ogg Traffic, Parma Polyhedral Library, Simple Web Service API, Crystal Space 0.90 r001, GCC 3.02.
  • Commerce: MontaVista releases high availability framework; Red Hat adds Linux Desktop Productivity Essentials training course; The new 'Lindows' operating system.
  • History: OpenBSD project founded in 1995; Red Escolar project founded in 1998; Tcl/Tk looks for a new corporate home.
  • Letters: Project Liberty, free BIOS implementations, information anarchy.
...plus the usual array of reports, updates, and announcements.

This Week's LWN was brought to you by:

October 25, 2001


 Main page
 Linux in the news
 Linux History

See also: last week's Security page.


News and Editorials

A couple of responses to Scott Culp. As might be expected, the "information anarchy" essay by Microsoft's Scott Culp drew some responses. We'll pass on a couple of them. Here's Eric Raymond's response, written in Eric's typical style.

Cryptographers and security experts have known for years that peer review of open source code is the only reliable way to verify the effectiveness of encryption systems and other security software. So Microsoft's closed-source mode of development guarantees that customers will continue getting cracked and Microsoft will continue pointing the finger of blame everywhere except where it actually belongs.

Elias Levy, meanwhile, responded in this SecurityFocus article.

A successful attacker requires three things: the opportunity to launch an attack, the capacity to successfully execute the attack, and the motivation to attack. An opportunity to launch an attack requires a vulnerable system and an access path to the system. The capability to successfully execute the attack requires knowledge of the vulnerability and the tools to exploit it. Proponents of the information dictatorship argument are targeting the second requirement of a successful attacker: his capability to launch an attack. This approach to the problem of computer security is flawed, and can only fail.

Overall, there has been a distinct lack of people rushing out to back up Microsoft's view on security disclosure. Even people who are uncomfortable with those who circulate exploit tools have remained quiet.

Make sure your ssh is current. Here's a NewsBytes article on a new ssh exploit going around.

In its February advisory, Bindview stated that it was aware of no working exploits for the overflow flaw in the SSH daemon. But last week, rumors spread in the hacker underground that scripts were available to gain "root" or system-level access to vulnerable systems. And in recent days, system operators have posted reports on security mailing lists saying they are receiving remote scans from attackers attempting to locate vulnerable systems running SSH.

There has been little in the way of confirmation of this exploit from any other source. Nonetheless, now would be a good time to check ssh/OpenSSH installations and make sure they are current. A remote root exploit based on ssh is the sort of thing that extreme nastiness (i.e. horrific Linux-based worms) is made.

Security Reports

Two kernel security bugs explained. Here is Rafal Wojtczuk's explanation (from Bugtraq) of the two security bugs found in recent Linux kernels. They are:

  • Through the use of properly constructed chains of symbolic links, a local attacker can lock up the kernel for long periods of time, thus creating a denial of service attack.

  • With the proper use of a setuid binary, the ptrace() system call can be fooled into tracing another setuid program, and thus into executing arbitrary code as root.
The second attack can be defeated on many Linux systems by getting rid of the newgrp binary, which is normally of little use anyway. The real fix, though, is to run the 2.4.12 (or later) kernel.

Note that there are, apparently, some other kernel security issues out there that have not, yet, been explained publicly.

Updates seen so far:

Two bugs with apache. Apache 1.3.22 fixes a couple of minor issues with the apache web server. The "split-logfile" program can be used to overwrite any file that is writable by the web server account, and which ends in ".log". That script tends not to be shipped with most Linux distributions. The other vulnerability could lead to the delivery of undesired directory listings in some situations.

Updates seen so far:

Debian security update to nvi. The Debian Project has released a security update to nvi fixing "a very stupid format string vulnerability" in that package. "Even if we don't believe that this could lead into somebody gaining access of another users account if he hasn't lost his brain, we recommend that you upgrade your nvi packages."

gftp can expose passwords. The Debian Project has put out an update to gftp fixing a problem in that package: it displays login passwords in plain text. In the interest of thwarting shoulder surfers, applying the update is probably a good idea.

A pile of Debian security alerts. Here's another set of alerts which have come out of Debian in the last week:

  • w3m, buffer overflow problem, with a possible remote exploit. (Update: it seems that there is no PowerPC version of this patch available; PowerPC users are advised to avoid w3m.

  • xvt, locally-exploitable buffer overflow.

  • procmail, signal handling problem with possible local exploit.
The project has also appointed two security secretaries, Matt Zimmerman and Noah Meyerhans, to help coordinate security response.

Denial of service in 6tunnel. The 6tunnel utility, used for IPv6 tunneling, has a denial of service vulnerability that allows an attacker to cause the 6tunnel server to crash. Affected users should upgrade to version 0.09 or later.

Proprietary products. The following proprietary products were reported to contain vulnerabilities:


Configuration file vulnerability in ht://Dig. The ht://Dig search engine contains a vulnerability which allows a remote user to specify an alternate configuration file. If that user is able to place a suitable file in a location where ht://Dig can read it, the system may be compromised. See the original report from the ht://Dig project for details. This vulnerability first appeared in the October 11 LWN security page.

This week's updates:

Previous updates:

OpenSSH restricted host vulnerability. Versions of OpenSSH prior to 2.9.9 have a vulnerability that can allow logins from hosts which have been explicitly denied access. The fix is to upgrade to OpenSSH 2.9.9. This problem first appeared in  the October 4 LWN security page.

This week's updates:

Previous updates: SQL injection vulnerabilities in Apache authentication modules. Several Apache authentication modules have vulnerabilities that could allow an attacker to feed arbitrary SQL code to the underlying database, resulting in a compromise of database integrity and unauthorized access to the server. See the September 6 security page for more information.

New updates:

Previous updates:

Squid httpd acceleration ACL vulnerability. This vulnerability could result in unauthorized access to the squid server. See the July 26 Security page for details.

This week's updates:

Previous updates:

Improper credentials from login. A problem with the login program (in the util-linux package) can, in some situations, cause a user to be given the credentials of another user at login. Use of the pam_limits module, in particular, can bring about this problem. In general, distributions using the default PAM configuration are not vulnerable; an upgrade is probably a good idea anyway. This problem was first reported in October 18 LWN security page.

This week's updates:

Previous updates: Security audit of xinetd and resulting fixes. Solar Designer has performed an extensive audit of xinetd, looking for certain types of security vulnerabilities. So many problems were found in the code that the resulting patch weighed in at over 100KB. This patch was only fully merged as of xinetd 2.3.3. See the September 6, 2001 LWN security page for the initial report.

This week's updates:

Previous updates:


LinuxSecurity.com has put out its Linux Advisory Watch and Linux Security Week postings, as usual.


Upcoming Security Events.
Date Event Location
November 5 - 8, 20018th ACM Conference on Computer and Communication Security(CCS-8)Philadelphia, PA, USA
November 13 - 15, 2001International Conference on Information and Communications Security(ICICS 2001)Xian, China
November 19 - 22, 2001Black Hat BriefingsAmsterdam
November 21 - 23, 2001International Information Warfare SymposiumAAL, Lucerne, Swizerland.
November 24 - 30, 2001Computer Security MexicoMexico City
November 29 - 30, 2001International Cryptography InstituteWashington, DC
December 2 - 7, 2001Lisa 2001 15th Systems Administration ConferenceSan Diego, CA.
December 5 - 6, 2001InfoSecurity Conference & ExhibitionJacob K. Javits Center, New York, NY.
December 10 - 14, 2001Annual Computer Security Applications ConferenceNew Orleans, LA

For additional security-related events, included training courses (which we don't list above) and events further in the future, check out Security Focus' calendar, one of the primary resources we use for building the above list. To submit an event directly to us, please send a plain-text message to lwn@lwn.net.

Section Editor: Jonathan Corbet

October 25, 2001

LWN Resources
Security alerts archive

Secured Distributions:
Astaro Security
Engarde Secure Linux
Kaladix Linux
NSA Security Enhanced
Openwall GNU/Linux

Security Projects
Linux Security Audit Project
Linux Security Module

Security List Archives
Bugtraq Archive
Firewall Wizards Archive
ISN Archive

Distribution-specific links
Caldera Advisories
Conectiva Updates
Debian Alerts
Kondara Advisories
Esware Alerts
LinuxPPC Security Updates
Mandrake Updates
Red Hat Errata
SuSE Announcements
Yellow Dog Errata

BSD-specific links

Security mailing lists
Linux From Scratch
Red Hat
Yellow Dog

Security Software Archives
ZedZ.net (formerly replay.com)

Miscellaneous Resources
Comp Sec News Daily
Security Focus

 Main page
 Linux in the news
 Linux History

See also: last week's Kernel page.

Kernel development

The current kernel version is 2.4.13, which was released on October 24. Linus surprised some people by including another set of VM tweaks in the final release (i.e. without testing in a prepatch), but those tweaks had already seen some use in Andrea Arcangeli's releases. Says Linus: "See if you can break it."

Alan Cox's current patch is 2.4.12-ac5. It contains a bunch of ARM updates, the latest VM tweaks from Rik van Riel, and a number of other fixes.

On the 2.2 front, Alan has released 2.2.20-pre11, with a small set of updates and some unspecified security fixes (see this week's front page) If all goes will, this version will become the official 2.2.20 release, so interested parties are encouraged to try it out.

Toward a new way at looking at devices. Interestingly, Linux kernels through 2.4.x have no unified way of keeping track of devices. There are registries which hold lists of drivers, and various other bits and pieces, including device arrays in the drivers themselves. But if you were to ask the kernel to tell you about every device plugged into the system, it would not be able to answer. Even if one of those devices were a speech synthesizer.

Getting a better handle on devices was one of the topics discussed at the Kernel Summit last March. Now Patrick Mochel has taken things forward with a proposal for a new "driver model" in the 2.5 kernel. A number of things would change under the new scheme:

  • All buses and devices will be treated as being hot-pluggable. Devices present at boot will be treated as if they had just been plugged in.

  • A new struct device structure will be created for each physical device and bus on the system. These structures will be organized into a tree which reflects the actual configuration of the hardware. A PCI bus device, thus, becomes the parent node for all devices plugged into that bus. (Way back when, struct device was used for network devices, but the 2.3.14 kernel release changed that).

  • A new virtual device driver filesystem (ddfs) type will be created. Each device in the system will export a ddfs entry, which can be used to query and change the state of the device. For example, a ddfs entry will tell whether a given device has been suspended or not.

  • Each device will have a struct device_driver which contains a small set of global operations. One of them, probe, checks for the existence of a specific device and sets it to a known state. The remove operation disconnects the driver from the device. There are also suspend and resume operations for power management functions.

  • The iobus structure will be used to track buses on the system. There will also be a struct iobus_driver containing another set of operations, mostly having to do with bus scanning and dealing with plugging and removal events.

Much of the motivation behind all this work is to do power management right. Power management is increasingly part of every computer component made, and people, rightly, want to be able to take advantage of the power management features. But doing things like suspending part or all of a system requires a detailed knowledge of that system's hardware structure. Thus this new model.

So it is not all that surprising that power management has been the topic of most of the discussion on this proposal. The initial plan called for a two-step suspend procedure: one to save device state, and one to shut the device down. It was pointed out that saving device state can involve actions like allocating memory, which can require the cooperation of other devices. So the plan now calls for a three-step suspend routine:

  1. SUSPEND_NOTIFY tells each device that a suspend is coming. No state need be saved at this point, and the device could be asked to perform further operations after this call. The driver must, however, allocate any memory it will need to save the state later on.

  2. SUSPEND_SAVE_STATE causes the driver to actually save the state of the device. It should also stop handling I/O requests at this point.

  3. SUSPEND_POWER_DOWN is the final stage, which causes the device to be physically powered down.

When the system resumes, a two-step process is followed: one to reset the devices to a known state, and one to resume the pre-suspend state and resume operation.

There was a developing conversation on higher-level response to suspend events: things like trying to save dirty buffers to disk, synchronize RAID arrays, and so on. Trying to make all that work right was beginning to look like a pretty thorny problem, until Linus stepped on the discussion by pointing out that a suspend operation need not do all that.

If somebody removes a disk or equivalent while we're suspended, that's _his_ problem, and is exactly the same as removing a disk while the disk is running. Either the subsystem (like USB) already handles it, or it doesn't. Suspend is _not_ an excuse to do anything that isn't done at run-time.

So suspend is _not_ supposed to be equivalent of a full clean shutdown with just users not seeing it. That's way too expensive to be practical. Remember: the main point of suspend is to have a laptop go to sleep, and come back up on the order of a few _seconds_.

Nobody appears to have disagreed with this position; it was one of those "Linus moments" where he points out the important thing people have been overlooking.

The new driver model is still evolving; the latest version can be found here.

On MODULE_LICENSE and EXPORT_SYMBOL_GPL. In the hopes of clearing up some confusion, Keith Owens has posted a description of the MODULE_LICENSE and EXPORT_SYMBOL_GPL macros, and exactly what the two are intended to achieve. Recommended reading.

In search of faster pipes. Hubertus Franke and his colleagues at IBM decided to look into ways of making Linux pipes perform better. To that end, they decided to tweak two factors:

  • The size of the kernel buffer used to hold pipe data. It is normally one page (usually 4K); they experimented with buffers up to eight pages long.

  • Early awakening of readers. Normally, readers of a pipe are awakened only when a write operation completes. By waking them up after only part of the data to be written has been copied into the pipe buffer, the group hoped to improve concurrency.

The results reported are interesting: neither change improved performance on uniprocessor systems - indeed, performance often dropped. On SMP systems, instead, increasing the pipe buffer size can speed things up. The early awakening helped slightly in some cases and hurt in others; it doesn't appear to be worth the effort most of the time.

The question was raised: why not try with the single-copy pipe implementation by Manfred Spraul? The IBM crew went for it, and came up with a new set of results. Single-copy pipes are not necessarily the big win that people might expect. The single-copy patch got better lmbench results in some situations, but lagged behind the IBM patches in most tests. In fact, it lagged behind even the standard Linux pipe implementation in many cases.

The final conclusion might be that increasing the buffer size may help pipe performance in some high-end, SMP situations. Other than that, the pipe code works pretty well the way it is now.

Other patches and updates released this week include:

  • Neil Brown has posted an implementation of tree quotas for the ext2 filesystem. Tree quotas differ from ordinary disk quotas in that they are handled on a per-tree basis. All files contained within a particular directory tree are charged to the owner of the tree, regardless of who actually owns the files.

  • The Scalable Testing Platform is an automated test system for the Linux kernel produced at the OSDL.

  • Jens Axboe has posted a new version of his patch enabling DMA to high memory without bounce buffers.

  • A scheduler patch was posted by Davide Libenzi. The patch tries to get better cache efficiency by considering how long a process has been running on a particular CPU before moving it.

  • The latest PCI Hotplug driver is available courtesy of Greg Kroah-Hartman.

  • Worth a look: Martin Devera's graphical call graphs of both Linux VM implementations.

  • Here's the latest premptible kernel patch from Robert Love.

  • Version 0.2.1 of the IBM Enterprise Volume Management System has been announced by Kevin Corry.

  • The latest Stanford Checker run has identified numerous potential security bugs in the kernel resulting from inadequate checks on user-supplied parameters. Happily, the Checker team is not yet censoring its reports out of fear of the DMCA.

  • Martin Devera has announced a new version of his HTB queuing discipline module.

  • Vamsi Krishna has announced version 3.0 of IBM's Dynamic Probes kernel debugging system.

  • Keith Owens has released kdb v1.9 for the 2.4.13 kernel.

  • iptables 1.2.4 was released by Harald Welte.

Section Editor: Jonathan Corbet

October 25, 2001

For other kernel news, see:

Other resources:


 Main page
 Linux in the news
 Linux History

See also: last week's Distributions page.

Note: The list of Linux distributions has moved to its own page.


Please note that security updates from the various distributions are covered in the security section.

News and Editorials

More from the Common Linux Installer Group. Last week's LWN Distributions page took a quick look at an idea from the Common Linux Installer Group, whose goal is to design and develop a standard for Linux installers. The CLIG is led by Blue Linux, a distribution that is under development. Blue Linux is also in need of an installation routine.

Standardizing the installation routines does sound like a good idea. Blue Linux is not, and will not be the only developing distribution faced with the task of creating an installation routine. Current installers, even those released under the GPL, are saturated with hardcoded references to their parent company. Often they are tied to a particular package management system as well. These points were made in the CLIG's response, which goes on to describe in further detail how they envision a standard installer would deal with package management and still allow some individuality on the front end. CLIG proposes a layered system, with customized back ends to support package management and a customizable front end to support individualized user interfaces. Inside, the main part of the installer would be a base of reusable code.

We also received a note from Anthony W. Youngman, who is working on the Linux Standards Base, v2 which, he says, will address Linux installation. Hopefully the CLIG can work with LSB v2 so that there can be an LSB-compliant standard installer released under the GPL.

Melon Screenshot

New Distributions

Melon: Japanese Linux for the iPAQ. Longtime LWN supporter Maya Tamiya tells us about Melon, a new Japanese distribution for the iPAQ handheld. Melon is sold on a Compact Flash card, and can be booted directly from the card; it's based on the Familiar distribution. The Melon web site is in Japanese, of course, but the screenshots page is easily viewable by everybody.

Distribution News

Debian News. The Debian Weekly News for October 23 is out. Covered topics include the demise of Progeny Linux, the upcoming release (which, it turns out, will be Debian 3.0), coverage of free software, and much more.

The Debian Security Team announced the appointment of two Debian Security Secretaries, Matt Zimmerman and Noah Meyerhans.

FreeBSD Ports. There is a FreeBSD/ia64 port in progress that now boots into multi-user mode without any operator attendance. There is also FreeBSD ultra sparc port in progress. Check the FreeBSD website for more information.

Mandrake Linux News. Those of you who have been waiting for Mandrake Linux 8.1 to show up in physical form need wait no longer: MandrakeSoft has announced that the distribution is finally available from retail stores. It is packaged in four different forms, with varying amounts of software and support.

Also the release candidate of Mandrake Linux 8.1 for the Itanium processor has been announced. It contains a number of fixes and a couple of new packages; this is the last chance to look over this distribution and find problems before the official release.

There will soon be a Mandrake Linux Gaming Edition as MandrakeSoft and TransGaming Technologies have gotten together to announce the Mandrake Linux Gaming Edition, to ship on November 9. Included with the distribution will be a port of "The Sims" from Electronic Arts.

Here are 2 updates to ML 8.1 and another for ML 8.0. These are not security problems, but you may want these fixes:

  • initscripts gave incorrect options for supermount, non-rootfs filesystems were not being checked upon bootup, tmp removal in mandrake_everytime was printing a failure message, the mandrake_consmap service was being restarted by service, and the installkernel script wasn't robust enough when getting the root filesystem.
  • locales fixes missing Italian locale "it".
  • sendmail packages in ML 8.0 have long delays in sending messages due to RBL lookups that are enabled by default. Here is an update that disables RBL lookups by default, eliminating the delay.
Look for more ML 8.1 errata here.

Red Hat Linux 7.2 launches. Red Hat has announced the availability of Red Hat Linux 7.2. It contains all the usual features: ext3, 2.4.7 kernel, better admin tools, firewall configuration at install time, StarOffice, etc. Check out the announcement for the details and a list of mirror sites. There are a few unsigned packages on some mirror sites, according to this security advisory, however Red Hat says it's not a problem in this Newsbytes article.

Slackware has Emacs 21.1. Source and packages for GNU Emacs 21.1 have been added for Slackware on Intel.

SuSE News. SuSE announced the shipment of its enterprise-capable Linux distribution, SuSE Linux Enterprise Server version 7, based on the latest Linux kernel 2.4 and optimized for deployment in high-performance servers.

Terra Soft Unveils Yellow Dog Linux 2.1. We mentioned the release of Yellow Dog Linux 2.1 last week, but didn't mention the improved installer, KDE 2.2.1, 2.4.10 kernel, ext3, or the improved iBook support. Terra Soft Solutions also announced they will showcase YDL 2.1 and a Yellow briQ Node cluster running Total Impact's Centricity video rendering software at LinuxWorld Expo, Tokyo, Japan.

Minor Distribution updates

Devil-Linux. Devil-Linux has announced Devil-Linux 0.5 Beta 1, a new release with a new build system. Devil-Linux is a small, customizable Linux distribution used for firewalls/routers.

Gentoo Linux. Gentoo Linux is a high-performance ports-based x86 Linux distribution for developers and admins. It features a Python-based advanced package management system called Portage. Finishing touches are in progress on Gentoo Linux 1.0_rc6, and the team is optimistic that 1.0 final will be the next release following 1.0_rc6.

NSA Security-enhanced Linux. The third public release of the LSM-based SELinux prototype was made on October 16, 2001. This release contains several bug fixes and improvements to both LSM and SELinux and is based on the lsm-2001_10_11 patch against kernel 2.4.12. See the release notes for more details.

Redmond Linux. Redmond Linux Build 41, Release Candidate 2 is available for ftp. This version upgrades the kernel to 2.4.12-ac3 and should fix the partitioning issue many of you have noticed.

Sorcerer GNU Linux. Sorcerer GNU Linux 20011022 is available, with better support for internationalization. The install menu now contains options for customization of the key map, console font, language, and timezone.

ttylinux. ttylinux came out with a bugfix release on October 18, 2001. However on Oct. 19 a bug was found in the instructions for making a bootable ttylinux CD. It is necessary to replace "initrd=rootfs.gz" with "initrd=rootfs.gz root=/dev/ram0" everywhere.

Trustix Secure Linux. Last week we mentioned TSL Bugfix Advisory #2001-0020 for bind. However advisory #2001-0027 supersedes the previous announcement. "This is really the TSL-2001-0020 Bind bugfix advisory, but the MD5 checksums are updated for the TSL 1.1 and 1.2 packages as we forgot to sign them in the proper way."

Distribution Reviews

Caldera targets developers with latest Workstation (ZDNet). ZDNet reviews Caldera OpenLinux Workstation 3.1. "In what appears to be a shift in focus from its user-centric eDesktop 2.4, Caldera seems to be targeting its workstation distribution directly at the developer market by adding a wide variety of development tools to its already solid desktop configuration, making this latest version well-suited for corporate in-house development."

Section Editor: Rebecca Sobol

October 25, 2001

Please note that not every distribution will show up every week. Only distributions with recent news to report will be listed.


 Main page
 Linux in the news
 Linux History

See also: last week's Development page.

Development projects

News and Editorials

The Mozilla 1.0 Manifesto Brendan Eich has published The Mozilla 1.0 manifesto, and the document is currently open for comment.

The document aims to answer a number of questions concerning the upcoming Mozilla 1.0 release:

  • What: Mozilla 1.0 would be the first major version numbered release. The release would include promises to maintain compatibility with a number of APIs from which to build upon. The release would also involve a stable branch off of the cvs.mozilla.org trunk.
  • Why: There is a need for a stable long-lived branch of Mozilla. If Mozilla.or does not create such a branch, it will be done by others, and the result would be unnecessary fragmentation. There is still a need for a 1.0 management plan, input is being accepted.
  • How: There is a need for big-fixing milestones. There is also a need for reducing the bug count to "near-zero". The plan is to obtain a stable, long-lived branch. The plan involves obtaining version 1.0 through a small number of milestones. Developers are being asked to schedule their bug fixes within the boundaries of those milestones. The focus will be on stability, not new features. Commercially contributed features are to be synchronized with the milestones, and may be isolated with CVS branches or #ifdef statements.
  • When: There is a strong desire among Mozilla developers to achieve 1.0 "sooner than later". There is a desire to obtain a stable branch and offer a release "within six months". Again, the emphasis will be on attaining stability more than new features.
  • Who? Brendan Eich will get the final say on what goes into version 1.0. He will delegate layers to various other people. "First in the line of delegation, judgment, and consensus are staff and drivers, who in turn depend on porkjockeys, reviewers, module owners, bug assignees, QA contacts, triagers, and other members of the community." Bugs are being nominated for fixing by version 1.0, and guidelines have been given for that bug status.
If the 1.0 release process succeeds, Mozilla will have obtained a new level of stability, and should be a solid platform upon which to build further extensions. Of course, what open source project would be complete without an official party as part of the schedule.


Ogg Traffic #1. A new status page for the Ogg Vorbis project (free MP3 replacement) is available. Ogg Traffic gives the latest project status and is a good look at the inner workings of an open-source project.


High Availability Linux status for October, 2001. Alan Robertson sent in the October 2001 status report for the Linux High Availability project.


Xcircuit 2.3.5 released. Tim Edwards has released version 2.3.5 of the xcircuit schematic drawing package. This release includes lots of bug fixes and enhancements to the Python interface.

New gwave for October 21, 2001. A new version of gwave, the GPL'ed Waveform Viewer has been released. The changes include improved measurement from cursor positions, better log scale operation, and bug fixes.

Embedded Systems

Embedded Linux Newsletter. The LinuxDevices.com Embedded Linux Newsletter for October 18 is out, with the usual roundup of interesting embedded Linux stories.

Printing Systems

AFPL Ghostscript 7.03 Released. A new release of AFPL Ghostscript has been announced. The release includes bug fixes and performance improvements.


Parma Polyhedra Library. Version 0.1 of the Parma Polyhedra Library has been released. "The Parma Polyhedra Library is a C++ library for the manipulation of convex polyhedra. The applications of convex polyhedra include program analysis, integer and combinatorial optimization and statistical data-editing."

Web-site Development

The Simple Web Service API. ActiveState has sent out an announcement about the new "Simple Web Service API," a standardized way for programmers to implement web services in a number of scripting languages. A beta implementation is available for Perl, Python, and PHP, with Ruby and Tcl in the works.

mnoGoSearch 3.2.2 released. Version 3.2.2 of the mnoGoSearch web search engine has been released. The changes include processing for Content-language and lang, support for IBM's DB2, documentation updates, and lots of bug fixes.

Zope Members' News. The latest news from the Zope Members' site looks at the new Z SQLvMethod, Portable Holes for Zope, CMFImageDoc 0.9, Lockable Folder 0.1.0, and more.

Building a Large-scale E-commerce Site with Apache and mod_perl (Perl.com). Perrin Harkins writes about large scale E-commerce on Perl.com. "Application server vendors will insist that you need a packaged all-in-one solution for the software. Hardware vendors will tell you that you need the top-of-the-line mega-machines to run a large site. This is a story about how we built a large e-commerce site using mainly open-source software and commodity hardware. We did it, and you can do it, too."

Webalizer Version 2.01-09 released. Version 2.10-09 of the Webalizer Web log analyzer program is available for download. This version features security related bug fixes as well as support for more languages. Upgrades are strongly recommended.


This week in DotGNU. The DotGNU weekly summary has been posted by Norbert Bollow; it gives an overview of some of the initiatives within the DotGNU project and how they are progressing.

Writing DLLs for Linux apps (IBM developerWorks). Allen Wilson talks about DLL equivalents under Linux. "Plugins and DLLs are often a great way to add functionality without writing a whole new application. In Linux, plugins and DLLs are implemented as dynamic libraries. e-business consultant and architect Allen Wilson introduces dynamic libraries and shows you how to use them to change an application after the app is running."

October 25, 2001

Application Links
High Availability

Open Source Code Collections
Le Serveur Libre



Desktop Development

Audio Applications

The latest from Linux Music. This week, the Linux Music site looks at Spiral Synth Modular, Muse, GSMP, and DarkIce. The second part of Dave Phillips' article on Snd is also mentioned.


Mozilla Bug Week. A new Mozilla Bug Week has been announced for October 27 through November 4, 2001.

Galeon 0.12.5 released. The Galeon project has released version 0.12.5. Features of the release include the ability to drag tabs as well as numerous bug fixes.

Desktop Environments

This week's GNOME summary. The GNOME Summary for October 19 is out. Topics include the GNOME 2 wish list, the new Nautilus release, the Evolution cheerleader squad, and more.

GNOME Installation Guide 10/2001 has been published. A new version of the Gnome Installation Guide has been published.

GNOME Foundation Elections 2001. The GNOME Foundation has announced an election for the Foundation's board of directors. The election will be held the week of November 13-20, 2001.

KDE 3.0 Multimedia Meeting (KDE.News). Stefan Westerfeld has posted a summary of last month's KDE multimedia IRC discussion.

C Mania: KDE 3 Offers C Bindings (KDE.News). Richard Dale has committed new C bindings to KDE's CVS repository via a hacked version of kdoc.

FLTK 1.1.0b4 released. Version 1.1.0 beta 4 of the Fast Light ToolKit (FLTK) has been released. This version includes lots of bug fixes and feature enhancements.


Crystal Space 0.90 r001 released. A new release of the Crystal Space game development kit has been released. This version has the aim of stabilizing the API so that game developers need not spend so much effort catching up to changes. New features include an isometric engine, a landscape engine, and a texture generation utility. A new space demo is also included. (Thanks to Jorrit Tyberghein.)


Wine Weekly News for October 15, 2001. The October 15, 2001 edition of the Wine Weekly News is available. Topics include Debugging MFC Programs, Submitting Patches for Wine, Borland Style Imports, and DDEConnect Errors.

Office Applications

Gnumeric 0.72 released. Gnumeric 0.72 (the "oooh yummy eye candy" release) has been announced. The eye candy (much of which depends on the new guppi-0.40 release) notwithstanding, the emphasis in this release is on bug fixes and stability. "Guppi is a GNOME-based framework for graphing and interactive data analysis."

Desktop Environments

Window Managers

Widget Sets


Programming Languages


Gcc 3.0.2 released. Version 3.0.2 of the Gnu Compiler Collection has been released. GCC is available here. (Thanks to Martin Lindhe.)


TinyCOBOL. It has been brought to our attention that there is an open-source COBOL compiler project known as TinyCOBOL. The compiler is currently functional, no changes have been posted since last July's 0.54 release. (Thanks to Fred Mobach.)


Learning Command Objects and RMI (O'Reilly). William Grosso, talks about Java command objects in an O'Reilly article. "In this article, I introduce the basic ideas behind command objects. In order to do so, I drag in an example application that provides a translation service from a remote server. After introducing this application, I will show how to use command objects to structure the remote method invocations (RMI) made from a client program. As part of this article, I will introduce a fairly general framework for encapsulating remote method calls in command objects."

Threading lightly : Sometimes it's best not to share (IBM developerWorks). Brian Goetz discusses Java threading details on IBM's developerWorks. " Writing thread-safe classes is difficult. It requires a careful analysis of not only the conditions under which variables will be read or written, but also of how the class might be used by other classes. Sometimes, it is very difficult to make a class thread-safe without compromising its functionality, ease of use, or performance. Some classes retain state information from one method invocation to the next, and it is difficult to make such classes thread-safe in any practical way."


Perl Debugging for Beginners (O'Reilly). John Callender talks about Perl debugging in an O'Reilly article. "Debugging is a specialized skill and it takes practice to become adept at it. Debugging is somewhat like car repair; an experienced mechanic can ask a few questions, listen to the engine for a second, and immediately tell you what's wrong with your car and what it will take to fix it. Meanwhile, a novice mechanic will pull apart the transmission when the real problem is a broken light on the dashboard."

P5EE Project, Mailing List Started (use Perl). A new mailing list has been set up to discuss P5EE, a Perl API that is similar to Java's J2EE.

Perl 6 : Not Just For Damians (Perl.com). Piers Cawley looks at the differences between Perl 5 and Perl 6 on Perl.com.


PHP Weekly Summary for October 22, 2001. The October 22, 2001 edition of the PHP Weekly Summary is out. Topics include: "Extension authors, PHP on Netware, PHP 4.1.0 RC 1, PHP for Win32 via Cygwin, PHP and MySQL 4.0.0, ext/skel, CVS reorganization, fix to snapshots, new 'overload' extension."

PHP-GTK 0.1.1 released. A new version of PHP-GTK is available, with lots of changes.

Peeking at Pear (O'Reilly). Chris Coleman examines Pear. "If you have ever programmed in Perl, chances are you have heard of CPAN, the Comprehensive Perl Archive Network. As you know, it's an easy way to add functionality to Perl. Most Perl programmers can't see how they ever lived without it.

PHP has a similar capability. It's called Pear: the PHP Extension and Add-On Repository. Pear is a framework and distribution system for reusable PHP components."


Python 2.2.b1 released. The first beta of Python 2.2 has been released. See the announcement for a description of what's new.

This week's Python-URL. Dr. Dobb's Python-URL for October 24 is out, with the latest from the Python development community.

PyXPCOM - Python bindings for Mozilla XPCOM technology. ActiveState has announced the first release of the Python bindings for the Mozilla XPCOM (Cross-Platform COM) technology. "Although this is the first public release of these extensions, they are being used extensively in the Komodo project, ActiveState's cross- platform, multilanguage IDE based on Mozilla. Thus the functionality and stability of this package is remarkably high for a first release." This project is being released under the Mozilla Public License (MPL).


This week on the Ruby Garden. The latest topics on the Ruby Garden include discussions on #exception, Python modules for Ruby, and more.


OOPSLA 2001 Trip report. John McIntosh summarizes the events at the OOPSLA 2001 Smalltalk conference.
"Some of the questions to ask ourselves are:
What to do with the 17 year old geek Linux kids, how do we reach them, what do we say?
Why do I have five spell checkers on my machine, but none accessible from email?


This week's Tcl-URL. Here's Dr. Dobb's Tcl-URL for October 22, with the latest from the Tcl/Tk development community.

Tcl/Tk 8.3.4 Final Release. Version 8.3.4 of the Tcl language and Tk toolkit has been announced. This release features lots of bug fixes, patches, and improved HURD support. (Thanks to David Welton.)


An introduction to SyncML (IBM developerWorks). Scott Stemberger looks at SyncML, an open industry spec for data synchronization. "In recognition of the fact that as the number of unique devices and the desire to access different enterprise resources proliferates, the SyncML initiative was formed to provide a uniform synchronization protocol for connecting multiple devices over any network to any data store. This article provides an overview of the open industry specification for data synchronization -- SyncML -- designed to meet the needs of the mobile user and their any-device, any-network synchronization needs."

Effective XML processing with DOM and XPath in Perl (IBM developerWorks). Parand Tony Darugar examines DOM and Xpath on IBM's developerWorks. "Based on an analysis of several large XML projects, this article examines how to make effective and efficient use of DOM. Developer/author Tony Daruger provides a set of usage patterns and a library of functions to make DOM robust and easy to use. Though the DOM offers a flexible and powerful means for creating, processing, and manipulating XML documents, some aspects of DOM make it awkward to use and can lead to brittle and buggy code. This article suggests ways to avoid the pitfalls. Perl code samples demonstrate the techniques."

The Slippery Soap (O'Reilly). Martin Gudgin and Timothy Ewald look at SOAP on O'Reilly's XML.com. "SOAP 1.1 has become a de facto standard, with broad industry support from many vendors, large and small, providing client and server implementations. The specification defines a set of conventions for exchanging XML messages, including rules for encoding data structures, an extensibility mechanism, a binding to the HTTP protocol, and conventions for RPC style invocations."

Section Editor: Forrest Cook

Language Links
Caml Hump
g95 Fortran
Gnu Compiler Collection (GCC)
Gnu Compiler for the Java Language (GCJ)
IBM Java Zone
Free the X3J Thirteen (Lisp)
Use Perl
O'Reilly's perl.com
Dr. Dobbs' Perl
PHP Weekly Summary
Daily Python-URL
Python Eggs
Ruby Garden
MIT Scheme
Why Smalltalk
Tcl Developer Xchange
O'Reilly's XML.com
Regular Expressions

 Main page
 Linux in the news
 Linux History

See also: last week's Commerce page.

Linux and Business

MontaVista releases high availability framework. MontaVista Software has announced the release of its High-Availability Framework, version 2.0, for Hard Hat Linux. The framework is intended for the creation of fault-tolerant systems on CompactPCI platforms; things like "switching equipment, service provider systems, streaming media and VoIP."

Red Hat adds Linux Desktop Productivity Essentials training course. Red Hat has announced the addition of a course in "desktop productivity essentials" to its training offerings. It's a three-day course aimed at people with no Linux experience.

Ximian adds vendors to Red Carpet. Ximian has announced the addition of a number of vendors to its "Red Carpet" update service. Red Carpet users will be able to use the service to get at Wine from CodeWeavers, game demos from Loki, the Opera browser, VMWare Workstation, and StarOffice from Sun.

Opera Software has sent out its own announcement on its presence in Red Carpet.

The new 'Lindows' operating system. A company called Lindows.com has announced the forthcoming availability of its "Lindows" operating system, said to be able to run both Linux applications and "many popular Windows software titles." It runs Linux underneath it all, with the addition of an enhanced Wine layer for Windows software.

IBM releases WebSphere Commerce for Linux. IBM has announced the release of WebSphere Commerce 5.1 for Linux on Intel processors. The Red Hat and SuSE distributions are supported.

Borland launches Kylix 2. Borland has announced the release of Kylix 2 for Linux.

VA Linux Systems filing 10-K (Annual Report). VA Linux Systems has filed its annual report with the SEC. For those willing to wade through a bunch of difficult language, there is a lot of information on the company to be found therein.

Linux Stock Index for October 18 to October 24, 2001.
LSI at closing on October 18, 2001 ... 24.35
LSI at closing on October 24, 2001 ... 25.34

The high for the week was 25.34
The low for the week was 24.35

Press Releases:

Open source products & services

Distributions and bundled products

Proprietary Products for Linux

Products and Services Using Linux

Products With Linux Versions



Personnel & New Offices

Linux At Work


Section Editor: Rebecca Sobol.

October 25, 2001


 Main page
 Linux in the news
 Linux History

See also: last week's Linux in the news page.

Linux in the news

Recommended Reading

SSSCA gets a hearing Oct. 25 (NewsForge). NewsForge looks at the upcoming hearing on the SSSCA, which, apparently, is set for next week. "Eben Moglen, chief counsel for the Free Software Foundation, is succinct: 'SSSCA is a deliberate attempt to destroy free software.'"

Governor Calls for 'Cyber Court' (Wired). Wired News reports on upcoming U.S. attempts to "fix" computer security through legislation. "Gov. James Gilmore (R-Virginia), the commission 's chairman, said Wednesday that federal judges have been far too sluggish in approving search warrants and eavesdropping of online miscreants. Instead, Gilmore told the House Science committee , the commission will recommend that a 'cyber court' be created with extraordinary powers to authorize electronic surveillance and secret searches of suspected hackers' homes and offices."

Net security: An oxymoron (News.com). News.com interviews Peter G. Neumann. "The open-source movement is not inherently guaranteed to come up with secure software unless there is significant discipline in the development, distribution, operation and administration of the resulting systems. So it's important to realize that we have a lot of weak links, all of which have to be addressed. The idea that hiding the source code is going to solve the problem is utterly ridiculous."

Word to the Wise: Writer 638C (LinuxPlanet). Here's a Linux Planet story about OpenOffice. "After last week's review of StarOffice 6.0 beta, a few people asked me how it compared to OpenOffice. There seems to be the assumption that there is a divergence between the two office suite applications. I am telling you now, there is hardly any difference in performance or interface between OpenOffice and its parent-child StarOffice. Certainly not in the Writer component of each suite, which is what I focused on for the purposes of this review."


Introducing HP's 'CoolBase' platform (LinuxDevices). LinuxDevices.com has an introduction to HP's CoolBase platform, which is available under the GPL. "At HP Labs, we've used CoolBase to prototype several compelling applications. We've prototyped an Internet Radio that can be controlled from any web-enabled device-including a PDA, cell phone, or even your PC. We also used beacons and our Esquirt software loaded on HP personal digital assistants to create a virtual tour guide for the Exploratorium, a science museum in San Francisco, California."

Ockman: Staff cuts make Penguin Computing profitable (NewsForge). NewsForge talks with Penguin Computing founder Sam Ockman. "Ockman, a veteran Open Source advocate, said the cuts were needed to insure profitability: 'It's a shame, but it's what has to be done. The number one thing is to continue the company for our customers and be profitable every month. We're a profitable company with this restructuring.'"

Sharp announces November availability of Linux/Java PDA (LinuxDevices). LinuxDevices.com has a look at the latest gadget from Sharp. "Sharp Electronics today announced November availability of developer units of the Zaurus SL-5000D, which represents the first robust Linux-based PDA from a major consumer electronics corporation."

Sony plans to launch Linux PlayStation 2 in U.S. (CNN). CNN covers Sony's announcement that Linux for the PlayStation 2 will be available in the U.S. "During the presentation, another Sony employee demonstrated Linux running on the PlayStation 2 platform, running the X-Windows graphical user interface. Show attendees were also shown demonstrations of upcoming applications. They included a word processing program, a spreadsheet program, and an MP3 player running on the system."


Can Linux systems be implemented across the enterprise today? (TechWeb). TechWeb is running a short debate on whether Linux is ready for "enterprise" use. "Each of our stores has a half-dozen computers running Linux. These systems, which provide a variety of services to our customers and associates, are linked via in-store LANs connected to our headquarters. Because of Linux's Unix orientation, the operating system lends itself to remote administration, which has worked well for us. Our stores span 42 states and are staffed by nontechnical people."


Implementing devfs (developerWorks). IBM developerWorks finishes its series on setting up devfs with a detailed, technical article on making it all work. "So, if you happen to be using a non-devfs kernel module, you'll need to create a device node in /dev manually. The problem with this approach is that this new device node will be ignored by devfsd, meaning that the next time you reboot, it will disappear. Our solution to this problem is to have the /dev-state/compat directory; if you have a non-devfs module, simply create your old-style device nodes in /dev-state/compat and they will be manually added to the devfs filesystem at boot time, thanks to the considerate steps of our handy init wrapper."


Midgard Lights An Open-Source 'LAMP.' (CMS Watch). The CMS Watch site has a review of Midgard. "The most important application for Midgard -- the one that turns Midgard from an application framework into a relatively useful content management system -- is the administrative front end."


TransGaming Interview (GameSpyDaily). GameSpyDaily interviews Gavriel State, CEO of TransGaming. "Once we have reached our subscriber goals, we will be releasing the WineX code under the much more liberal Wine license, and we will continue releasing code that way if our subscription numbers meet our targets. Thus, by subscribing, our users not only get the features and services they want to see right now, but they also help to establish the commercial viability of the Street Performer Protocol, which will have profound implications for the future of the entire information economy."

Interview: Russell King (KernelTrap). KernelTrap interviews kernel hacker Russell King. "The Linus 2.4 kernels are almost production quality, but there's still some work to do on them. Alan Cox's 2.4-ac branch is basically there. I switched the ARM community from Linus' kernels to Alan's around 2.4.8, mainly because I wasn't happy about the direction Linus was taking."


Section Editor: Forrest Cook

October 25, 2001


 Main page
 Linux in the news
 Linux History

See also: last week's Announcements page.



Hacking Billy the Big Mouth Bass. For those who have not had the pleasure...Billy the Big Mouth Bass is an obnoxious toy in the form of a singing, moving fish. One of those things children use to drive parents nuts. Now there is a site dedicated to hacking Billy with Linux out there - worth a look. Billy can be made to say anything you might want. There is source available, of course...

The ACM Forum on Legal Regulation of Technology. The ACM Forum on Legal Regulation of Technology is a new mailing list for the discussion of the interaction between law and technology. "Legal scholars have been discussing these issues for some time, but computer scientists have not been nearly as active in the debate. The forum seeks to bring technologists into the debate. Although we welcome the contributions of legal scholars, the forum belongs to technologists and has a technology-centric view." The list is patterned after the (required reading) RISKS list, and is moderated by Edward Felten.


The third Real-Time Linux Workshop. The Third Real-Time Linux Workshop has been announced for November 26 to 29 in Milan, Italy. The list of participants includes a large cross-section of the real-time Linux community. See the announcement for details.

Conference: The Business of Open Source Software. A conference called "The Business of Open Source Software" has been announced for November 25 in Ottawa.. The keynote speaker will be Eric Raymond.

linux.conf.au final CFP. The final call for papers has gone out for linux.conf.au, to be held in Brisbane, Australia next February. Those who would like to present at the conference need to get their abstracts in by the end of October.

Events: October 25 - December 13, 2001.
Date Event Location
October 25, 2001XMLEdge International Developer Conference & Expo 
October 25 - 26, 2001The Open Group Quarterly ConferenceAmsterdam, Netherlands
October 25, 2001LinuxDaysLuxembourg
October 27, 2001LUGOD Linux Demonstration(Davis Food Co-Op)Davis, CA
October 30 - November 1, 2001LinuxWorld GermanyFrankfurt, Germany
October 30 - 31, 2001tech-u-wear 2001(Madison Square Garden)New York City
November 5 - 10, 2001Annual Linux Showcase(ALS)(Oakland Marriott City Center)Oakland, California
November 6 - 10, 2001Annual Linux Showcase and ConferenceOakland, CA
November 6 - 8, 2001LinuxWorld MalaysiaKuala Lumpur, Malaysia
November 6, 2001Java Information Days, EuropeParis
November 7, 2001Java Information Days, EuropeAmsterdam
November 8, 2001NLUUG Annual Autumn conferenceDe Reehorst, Ede, Netherlands
November 8 - 9, 2001XFree86 Technical Conference(Oakland Convention Center)Oakland, CA
November 8, 2001Java Information Days, EuropeFrankfurt
November 8, 2001Embedded Linux Expo & Conference(Sheraton Reston Hotel)Reston, VA
November 9, 2001Open Source in Banking and Finance(OSBAF)(Baltimore Engineering Society)Baltimore, Maryland
November 9, 2001Java Information Days, EuropeZurich
November 10 - 16, 2001SC2001Denver, Colorado
November 12, 2001Third Annual Beowulf BashDenver, Colorado
November 17, 2001Lightweight Languages Workshop 2001(LL1)(MIT Artificial Intelligence Lab)Cambridge MA
November 25, 2001The Business of Open Source Software(BOSS)(Ottawa Public Library)Ottawa Ontario, Canada
November 28 - 30, 2001Linux-Kongress 2001(University of Twente)Enschede, The Netherlands.

Additional events can be found in the LWN Event Calendar. Event submissions should be sent to lwn@lwn.net in a plain text format.

Web sites

Openinformatics.org. A new web site called Openinformatics.org is being developed. The operators state: "The purpose of this website is to help scientists to become more aware of Open Source Software: what it is and how it may help them in their scientific research, as well as what OSS tools are avaible to them; and to encourage software developers to release their code in an Open Source model to make the software better." The site also features a repository of open source scientific software.

User Group News

Due to reduced staffing, LWN has discontinued the LUG table. We regret any inconvenience that this may cause.

Section Editor: Forrest Cook.

October 25, 2001



Software Announcements

Here are this week's Freshmeat software announcements. Freshmeat now offers the announcements sorted in two different ways:

The Alphabetical List and Sorted by license


Our software announcements are provided courtesy of FreshMeat


 Main page
 Linux in the news
 Linux History

See also: last week's Linux History page.

This week in Linux history

Six years ago the OpenBSD project was started.

Three years ago (October 29, 1998 LWN): The Red Escolar (Scholar Net) project was announced. This was a plan to install Linux throughout 140,000 schools in Mexico and was led by Arturo Espinosa. Nowadays, after gaining experience improving Gnome for the Red Escolar project, Arturo continued his work on Gnome in the United States, working for Helix Code (now Ximian). The Red Escolar project has been bogged down in politics and is suffering from a lack of funds and a lack of knowledgeable people.

There was a development kernel release 2.1.126. However the release had a number of compilation and lockup problems, so most avoided it and waited for 2.1.127.

Debian got congratulations on their port of Debian to the Netwinder two years ago. The Netwinder, however, has remained an infrequently used device, not quite living up to the promise we thought it had back then.

Corel announced its support for the Wine project, choosing it as a platform to bring their products to Linux and promising an infusion of new developers to the project as well. Although Corel has since gone over to the dark side, Wine is flourishing. The latest release is dated October 4, 2001.

Opera Software was having trouble creating a Linux version of its browser using volunteer developers for a proprietary project.

"If they wanted to tap into all that enthusiasm, opening up the source is the only way I know how to do that," said Eric Raymond, whose pioneering work in open-source development helped spur Netscape into freeing the source code of its Communicator browser. -- Wired News

Fortunately Opera has since resolved those problems and Opera for Linux is now available.

Two years ago (October 28, 1999 LWN): To no one's surprise, licensing problems between Qt and the GPL were in the spotlight two years ago, with Corel's development as the catalyst. Corel liked using Qt for developing the software they added to the Corel Linux distribution, but their developers were much less likely to be aware of potential licensing conflicts when mixing the Qt with GPL'ed code from Debian. Of course, such problems have now been largely eliminated by the dual-licensing of Qt under the GPL, a possibility not even under discussion then.

Comdex has had a standing policy of not admitting any person under the age of eighteen to the exhibit floor. That policy came under scrutiny, spawning much debate.

"There are some realities in this marketplace that Comdex is ignoring," said Lavers, a long-time Microsoft contractor who recently signed on as an equal partner at Matrixcubed, which son Mike launched at age 14 (a programmer at 3, he already had 11 years experience, explains Lavers the elder).

"Today's Internet marketplace includes active participation, contributions, and leadership from younger and younger people." -- Wired News

This year's Comdex registration page says "Note: No one under 16 is admitted." Other computer conferences have successfully removed such age restrictions, and events such as this do have much to offer interested teens, but Comdex seems to be moving in the wrong direction.

Miguel de Icaza quit his job in Mexico and moved to the United States, to build the company called Helix Code, with Nat Friedman and "secret investors". Today Ximian (the renamed Helix Code) is doing well producing GNOME and other applications.

One year ago (October 26, 2000 LWN): Ajuba Solutions was acquired by Interwoven. Ajuba was the corporate champion of the scripting language Tcl/Tk, and put in a large part of the total development effort. Some Ajuba (Tcl/Tk) developers stayed at Ajuba, doing proprietary XML stuff for Interwoven, who had no interest in Tcl/Tk and no plans to support it. ActiveState has taken over Tcl/Tk sponsorship. Then as now, Dr. Dobb's Journal is sponsoring the "Tcl-URL!" project.

KDE 2.0 was released.

Cliff and Iris Miller, the founders of TurboLinux, left that company and started Mountain View Data, where they remain.

LynuxWorks filed for an IPO. They are still a privately held company however.

A new site called KernelTrap showed up on the Web. It remains a good source of information about (Linux) kernel hacking.

Section Editor: Rebecca Sobol.

October 25, 2001

LWN Linux Timelines
1998 In Review
1999 In Review
2000 In Review
2001 In Review


 Main page
 Linux in the news
 Linux History

See also: last week's Letters page.

Letters to the editor

Letters to the editor should be sent to letters@lwn.net. Preference will be given to letters which are short, to the point, and well written. If you want your email address "anti-spammed" in some way please be sure to let us know. We do not have a policy against anonymous letters, but we will be reluctant to include them.

October 25, 2001

From:	 Aldrin Martoq <amartoq@dcc.uchile.cl>
To:	 <mjhammel@graphics-muse.org>
Subject: Thanks for "On the Desktop"
Date:	 Fri, 19 Oct 2001 15:08:51 -0300 (CDT)
Cc:	 <letters@lwn.net>


	This letter is just for thank you for all the good stuff you put
into "On the Desktop" section of lwn.net.

	I followed your column every day, you did a *very good job*, from
the beggining to the end. "On the Desktop" is one of the kind of sections
that was missing on lwn... I'm very sorry that the column is not there now.

	Well, I Hope the best for you and lwn...

Greetings from Santiago de Chile,


Dar es dar, y no marcar las cartas simplemente dar.
Dar es dar, y no explicarle a nadie no hay nada que explicar.
-- Fito Paez, "Dar es dar"

From:	 "Jay R. Ashworth" <jra@baylink.com>
To:	 letters@lwn.net
Subject: Project Liberty
Date:	 Tue, 23 Oct 2001 14:17:16 -0400
Cc:	 brian@apache.org, tim@ora.com, doc@searls.com, esr@thyrsus.com,
	 risks@risks.org, privacy@privacy.org

In last week's Linux Weekly News, there was some preliminary coverage of
Project Liberty, an "open" alternative to Microsoft's Hailstorm, which
is -- very roughly -- an a attempt to embed Passport into everything on
the planet.

The short version is: a repository of information about your person,
life, and preferences which can be accessed by people and companies you
authorise, to provide authentication that you are you, and information
about, for example, your purchase default desires (credit card numbers,
which card to use, do you prefer first class or coach, etc).

Now, this is, fundamentally, not an especially bad idea.

But how it is implemented is -- given the sort of information which it
might end up holding -- pretty crucial to your personal privacy: do you
want anyone except your doctor and your pharmacist knowing that you
have a prescription for protease inhibitors?  (Drugs used to control
AIDS and related conditions.)

You probably don't even want your *health insuror* to know that, even
though perhaps you want them to know *other* things about you, and
therein lies the major problem:

Hailstorm will be run by Microsoft.

And we all know how pristine Microsoft's track record is for placing the
interests of individuals above that of large corporations off of whom
Microsoft makes lots of money.  Right?

So here comes Project Liberty, an "open" alternative to this. They've
not much design done yet, I don't think, so we don't know what
*specific* goals PL will be aiming towards. But that's good, because it
means that this is the exact time for private individuals to be casting
their bets on what they think is important: personal privacy and control
are good choices there, IMHO.

I know that in our New World, it's almost unpatriotic to be concerned
about personal privacy, but you know what?  That's a wrongheaded, short
sighted, and dangerous outlook to have.  Our country became something
to be proud of, protect, and defend precisely *because* it attempted to
secure such liberties to the people against government control, and
corporations should be given no extra leash -- they work for *us*, in
the final analysis, just like the government.

But the most fundamental tenet of Project Liberty's operation must be,
for it to succeed, that it will always favor the desires and interests
of those one billion people whose identities it likes to tout it's
representation of *over* the interests of the corporations with all the

From a design standpoint, it must make it possible to break down your
information to a sufficiently fine granularity to allow you to
authorize access for someone to only the data which you want them to
have... and indeed, to make it as difficult as possible for different
providers to cross-correlate the information the hold privately about
you with one another.  (Why do I get my cablemode service from one
company, my wireless Internet from someone else, and my cellphone
service from yet another company?  Because I *can*, and because it one
bill is late, I don't get cut off from all three.  Do I want to give
that flexibility up?  Certainly not.)

Ensuring that the provision of the convenience of "single-sign on"
won't deprive me of rights and conveniences I now have won't
necessarily be easy for the Project Liberty folks.

But if they don't do it, and stick to it, then I will not -- and you
should not -- give them any more quarter than Microsoft.  Regardless of
whom they have on their side.

-- jr 'I regret that I have but one asterisk for my country' a
Jay R. Ashworth                                                jra@baylink.com
Member of the Technical Staff     Baylink                             RFC 2100
The Suncoast Freenet         The Things I Think
Tampa Bay, Florida        http://baylink.pitas.com             +1 727 804 5015

   "Usenet: it's enough to make you loose your mind."
     -- me
From:	 Alex Owen <owen@cus.org.uk>
To:	 <letters@lwn.net>
Subject: Open source BIOS/Firmware
Date:	 Thu, 18 Oct 2001 10:54:51 +0100 (BST)


I would like to comment on your article of October 18, 2001 entitled "Open
Source BIOS Projects".

We must remember what BIOS stands for "BASIC INPUT OUTPUT SYSTEM" or
something like that! The BIOS in CP/M and DOS communicated with the
hardware such that "drivers" were unheard of, the BIOS
provided the hardware drivers. What many of us now use the
BIOS for is booting. This is in fact the job of Firmware not a BIOS. BIOS
in the days of operating system including optimised drivers is obsolete.
What is required to boot a system is only Firmware.

The three projects you describe have different goals but I believe you
misinterpreted those goals. Here is my interpretation.

Free implementation of BIOS code to allow a warm glow that no
proprietary code is needed. This is essentially implementing as obsolete
paradigm under a "free" licence. :-(

This is not really a BIOS project but an LINUX in ROM project. Why not put
the OS in ROM then booting is quick and easy... BUT this ties the machine
to one OS. :-(

Again a misnomer as this is really a FIRMWARE project not a BIOS project.
In my opinion this is the way forward. This project aims to produce a free
implementation of the OpenFirmware standard. It is not a BIOS as it is not
intended to be used by the OS after booting is complete. It is OS
independent and indeed CPU independent! Yes the same card with the same on
board boot code (Fcode) can be used by different CPU types! OpenFirmware
provides a rich command line interface allowing booting over the serial
port (yes down-loading the kernel over the serial interface!!!) network
booting and booting from ROM or disk. This is a flexible and platform
independent STANDARD which in my humble opinion can only be the way
forward. Sadly I have not seen an implementation on i?86 machines probably
because windows does not demand it... but then windows does not really
need a BIOS some other boot Firmware would do!

I hope this has opened the eyes of some LWN readers who have been unlucky
enough to only experience i?86 hardware!

Yours faithfully
Alex Owen

From:	 "Oleg P. Philon" <ophil@gomelug.agava.ru>
To:	 letters@lwn.net
Subject: long awaited 2.5 test kernel, sort of
Date:	 Sat, 20 Oct 2001 13:01:40 +0300

More and more talks arise about opening next experimental kernel
tree. It's seems to me, strictly from user's perspective, that Linus,
intentionally or not, already create a new situation in his venerable
project. This situation slightly resembles testing distribution in Debian
development. For those not familiar with debian, this testing woody set
of packages sits between the outdated stable potato and the most fresh
and quick moving unstable sid distro. Also, debian users have the choice
from 3 distros, with different degree of stability and actuality. This
partly solves the problem of long periods between releases.

So, back to kernel. It seems to me, we already have testing kernel
long long ago. Recall all big changes, dropped in stable kernel since
his initial release. Alan Cox called 2.4.10pre as "2.5 in disguise".
Besides that, a really unstable and experimental patches are in a separate
testing directory at ftp.kernel.org for all willing to try.

This situation, from my user's point of view, more naturally accomodates
the principles of open development. So called stable releases issued
more often, have wider users base, and eventually more eyeballs to spot
the potential problems. All that more careful users have to do, is to
keep a couple of point point numbers behind and apply only really needed
selected patches.

        Auf Wiederlesen            ophil aka Dr. Anticommunii
Oleg P. Philon		http://gomelug.agava.ru/articles
Linux Lab, Gomel, Belarus	mailto:ophil@gomelug.agava.ru
http://anticommunist.narod.ru	mailto:anticommunist@narod.ru
From:	 Leon Brooks <leon@brooks.fdns.net>
To:	 scott.culp@microsoft.com
Subject: Anarchy
Date:	 Thu, 18 Oct 2001 07:38:11 +0800
Cc:	 letters@lwn.net

> if there hadn't been security vulnerabilities in Windows®, Linux, and
> Solaris®, none of them could have been written.

Linux is a registered trademark of Linus Torvalds. You come across as 
uneducated when you don't acknowledge that in your article.

> Code Red. Lion. Sadmind. Ramen. Nimda.

You seem to have forgotten these:

    SirCam Michaelangelo Happy99 Stoned  LoveLetter AntiCMOS Qaz
    EmpireMonkey FunLove Valentine Sorry Hybris Magistr Melissa and
    208 other current viruses listed at http://www.wildlist.org/WildList/

My point? These are *all* specific to Microsoft software, and in particular 
to Windows and Visual BASIC derivatives. The problem is Microsoft software, 
not bug reporting.

If Microsoft's vulnerability were simply proportional to the number of 
accounted desktop users, one would expect one Solaris virus, about six Linux 
viruses and maybe twelve Mac viruses. You can only scrape together a combined 
total of three non-Windows viruses for your examples, and on top of that 
there is good evidence that the real Linux desktop presence is around 
threefold the accounting figures. Methinks the man protesteth overmuch.

> We can and should discuss security vulnerabilities, but we should be
> smart, prudent, and responsible in the way we do it.

Absolutely! Notify the vendor first, give them an amount of time proportional 
to the severity (maybe a week, this _is_ the internet age) and then tell 
everyone so that individuals can take appropriate action. If there is already 
an exploit for the vulnerability in the wild, scratch the vendor time 

Remember that even though CodeRed was leveraging a Microsoft-only flaw, as 
usual, *everyone* had to deal with the side-effects, as usual. UNIX/Linux 
based automated software based on full disclosure helped both to absorb the 
attack and to speed the spread of  awareness to impacted administrators.

Consider a home-builder that erects easy-to-burgle homes. Full disclosure of 
his flawed methods would indeed help seriously dumb burglars, but any half 
competent burglar would either already know, or would better be able to 
figure out the weakness from a vague description than any householder would. 
Meanwhile, hereinbefore naive homeowners are aware that there is a problem, 
and have enough information to design a defense.

Moreover, each defense may well be different, which means that a burglar 
can't expect to meet, deal with and systematise an attack against a 
factory-ordained workaround. Finally, other home-builders including 
owner-builders can study the weakness and avoid it or repair it in their own 

>  the evidence is more far conclusive than that. Not only do the worms
> exploit the same vulnerabilities, they do so using the same techniques
> as were published - in some cases even going so far as to use the same
> file names and identical exploit code.

Aren't you glad that the black hats chose a standardised attack instead of 
devising their own - probably harder to detect and/or deal with - methods? As 
for the code design, sometimes form follows function.

> Providing a recipe for exploiting a vulnerability doesn't aid
> administrators in protecting their networks.

It certainly aids me. I can try the exploit against my own systems to 
determine the extent of their vulnerability.

>  we do need to make it easier for users to keep their systems secure, and
> Microsoft acknowledged this very point in a recent major security
> announcement

You might want to think about the very same feature appearing in Mandrake 
Linux over a year ago, and a much more detailed version of it appearing in 
their 8.1 release, which pre-dated the Microsoft announcement and has been in 
preparation since before CodeRed struck.

Mandrake, like many Linux distributors, publish their own vulnerabilities 
early. A scan of those vulnerabilities is informative: very few of them offer 
carte-blanche access to a standard installation, the vast majority are only 
invokable in very special circumstances and give very limited access. Many, 
maybe even most Microsoft vulnerabilities result in total submission of your 
system to alien invaders.

> Security vulnerabilities are here to stay.

Scott, I'm glad you took the time to clarify Microsoft's attitude to 
security, but please don't expect that sentiment to be echoed by every 
developer on the internet.

As is the case in my own home town, people are switching more and more to 
fast-responding design-safe Open Source systems, as they read between the 
lines of presentations like your ``It's Time to End Information Anarchy'' and 
notice that the focus is on blame-sharing, and the worry is about loss of 
vendor control. Regardless of our pontifications, in practical terms it seems 
to be drawing on time to end information imperialism.

Cheers; Leon
From:	 Zygo Blaxell <zblaxell@feedme.hungrycats.org>
To:	 letters@lwn.net
Subject: Microsoft's latest FUD
Date:	 Sat, 20 Oct 2001 02:45:36 -0400

>First, let s state the obvious. All of these worms made use of security
>flaws in the systems they attacked, and if there hadn t been security
>vulnerabilities in Windows®, Linux, and Solaris®, none of them could have
>been written. This is a true statement, but it doesn t bring us any closer
>to a solution. While the industry can and should deliver more secure
>products, it s unrealistic to expect that we will ever achieve perfection.
>All non-trivial software contains bugs, and modern software systems are
>anything but trivial. Indeed, they are among the most complex things
>humanity has ever developed. Security vulnerabilities are here to stay.

This is what I have come to expect from the people who release web server
software which is broken in the most fundamental ways.  The security flaws
that the recent IIS worms use arise from utterly trivial programming
errors that could have been avoided by anyone who had sound knowledge
of the overall architecture of the IIS system and how the components
interact with each other...assuming that such knowledge even exists, or
is humanly possible to possess.

The technical expertise and time resources required to discover and
exploit the recent IIS flaws vastly exceeds the respective requirements
to prevent the flaws in the first place.  Almost all of the flaws appear
either in the implementation of a Microsoft-specific feature, or in
the interaction of a common feature found in many operating systems
and tools with a Microsoft-specific feature.  No other vendor builds so
many potentially dangerous features into their products, enables them
by default, and then whines in public when nasty people abuse them.

Microsoft's refusal to give up on their operating system, email, and
web server projects and replace them with mature, industry-standard,
peer-reviewed software tools leads to a lot of repetition of the same
boring incorrect implementations of unsafe application architectures, as
developers who work on Microsoft code must deal with subtle implementation
details that are unique to Microsoft systems.  In extreme cases, Microsoft
products must work around quirks in their dependent components that
do not exist--and cannot even _conceptually_ exist without significant
implementation effort--in other, more mature systems.

There is a serious lack of sound architectural design and review of
implementation at Microsoft.  There are so many different interacting
layers of subsystems in IIS (even before we consider the many different
interacting layers of subsystems in the OS that IIS runs on) that it's
virtually impossible to make IIS secure.  That does not mean that it
is impossible to make secure web servers.  Microsoft has not made any
serious attempt to build a secure web server product yet, but they seem
to have concluded already that the task is impossible.

If Microsoft was truly serious about security, we would see ads for
Microsoft security patches on TV, and they would motivate ordinary
people to actually download and install them.

>If we can t eliminate all security vulnerabilities, then it becomes all the
>more critical that we handle them carefully and responsibly when they re


One of the major obstacles to widespread deployment of security fixes
is the set of current practices employed by consumers and producers of
computer software.  Certainly it is unreasonable to expect a vendor
to produce completely secure software given the current structure of
the industry; however, if the vendor is not to be held accountable for
software quality, then that accountability must be transferred to the
user, especially when third parties (i.e. the victims of virus attacks)
become involved.  Unfortunately, the vast majority of software consumers
are not aware of their obligations under this model, and we hold almost
none of them responsible, not even the organizations that leave thousands
of exploitable machines accessible from the Internet.

Part of the problem is the business model.  Microsoft's current obligation
to their customers begins when the customer pays the license fees and ends
when Microsoft ships the installation media--and even that seems to be too
onerous for Microosft, as they tend to outsource the actual collection
and delivery to hardware vendors.  This is an inappropriate model for
software that can--by the vendor's own admission--never be considered
complete.  Ongoing post-installation maintenance by the vendor is
essential--and in the closed-source business model, the vendor is in
fact the _only_ entity who is capable of cost-effectively performing
such maintenance.

Another problem arises from the fact that many software consumers
themselves do not choose to implement any mechanism at all to maintain
their software.  Given the extremely fragile nature of software,
especially when products from several vendors are integrated together
by the end user with strictly minimal technical support, it is not
surprising that many organizations adopt a policy of never upgrading
their software until the existing software is provably unusable, in order
to avoid the risk of accidentally preventing the software from working
at all.  Published security exploits are very useful for administrators
who must work under such conditions, because the exploit can be used
to prove unusability--without such proof, corrective action is often
avoided entirely, even if the vulnerability is well understood.

Nothing can be done about this class of consumers.  They will always
run the latest and greatest malware--any product on any operating
system--until sufficient legal or business pressures are exerted upon
them, or they are physically disconnected from the Internet.

Linux distributions that are distributed using a subscription-like
service are much more effective at avoiding vulnerabilities in the field.
Whenever a vulnerability is found, administrators can automatically apply
patches from the vendor--which means that the patches tend to actually
be applied much more often.  Widespread adoption of this distribution
model can significantly mitigate the spread of malware, although if
Microsoft were to implement apt-get, I would have to assume that it
could act as a _vector_ for malware until proven otherwise...

>But regardless of
>whether the remediation takes the form of a patch or a workaround, an
>administrator doesn t need to know how a vulnerability works in order to
>understand how to protect against it, 

This is IMHO the most significant sentence of Scott's entire article.
This notion is simply absurd.  There is an abundance of counterexamples.

This can only be true if the administrator is not able to implement the
fix by herself--this is certainly true for users of Microsoft products,
but not true for many other groups of people.  

It also assumes that no administrators run software that is not supported
by a vendor which is somehow connected to this "security community",
but which may be vulnerable to the same exploit.  Historically,
when one vendor makes a mistake, similar problems are found in
competing products from a few dozen other vendors.  The exploitation
details are essential information if you need to figure out if your
product-which-is-similar-to-X is, or is not, vulnerable to the same
exploit that works on product X.  Understanding the workaround is usually
not sufficient, and the patch is usually entirely useless unless it
is (expensively) reverse-engineered.

I recently talked to a number of people outside the computer industry,
almost all of whom were surprised, even shocked, to learn:

	that dozens of security vulnerabilities in widely-deployed,
	commercial-quality software are reported every week,

	that many of the exploits are simple enough to explain in a
	single sentence, even to a technically unsophisticated user, and

	that the only corrective measure that is effective against
	these attacks is a software upgrade supplied by the vendor
	(or completely disabling the offending software, which is often
	worse than the effects of the exploit itself).

The prevailing opinion among the general public is that vulnerabilities
are rare, exploits are complex, and corrective actions are a matter of
enabling or disabling a feature in a dialog box.  This ignorance is
what must change in order to improve the current sorry state of the
software industry.

Incidentally, the fact that extremely similar flaws are found in multiple
products released by different vendors was not surprising to my "control
group."  I don't know what to make of that.

>Likewise, if information anarchy is intended to spur users into defending
>their systems, the worms themselves conclusively show that it fails to do

On the contrary, deployments of system defenses are now occurring at the
highest rates in history, and awareness of security issues is now better
than ever.  At the same time, actual damages in economic and social terms
are minimal--contrast what actually happened in the last two years with
what could have happened if any one of the major recent Windoze viruses
had carried a highly destructive payload.

Vendors are now beyond merely feeling pressure to keep up to date with
security patches--they are starting to audit their own code, albeit not
very enthusiastically.  At least one previously indifferent large vendor
has recently declared that they intend to alter the installation procedure
of their software to be less vulnerable by default.  This is a milestone.

I'd say that early exploit disclosure combined with active exploitation
of well-known vulnerabilities is having _exactly_ its intended effect.

>Many people have faulted the patching process itself for the low uptake
>rate. Fair enough   we do need to make it easier for users to keep their
>systems secure, and Microsoft acknowledged this very point in a recent major
>security announcement. 

For once I don't disagree.

>Finally, information anarchy threatens to undo much of the progress made in
>recent years with regard to encouraging vendors to openly address security
>vulnerabilities. At the end of the day, a vendor s paramount responsibility
>is to its customers, not to a self-described security community. If openly
>addressing vulnerabilities inevitably leads to those vulnerabilities being
>exploited, vendors will have no choice but to find other ways to protect
>their customers.

Security vulnerabilities will be openly addressed, if not in the
security community, then in the marketplace and in the legal system.
If a vendor addresses the vulnerability by themselves, they have a
chance to put a positive "spin" on the situation ("look how attentive
we are to security problems!"  "We have a fix for that, we can accept
no liability if the customer doesn't use it.").  If a worm exposes the
problem first, the vendor has to catch up, while the customer suffers
real economic losses ("look how much money your software cost us!"
"I'm going to sue you for criminal negligence and consequential damages!").
It seems like a pretty straightforward choice to me.  

I see nothing in recent events that might change this situation--vendors
will still be motivated to fix vulnerabilities and publish patches
because if they don't, nobody else will--then nobody will buy their
products because every customer knows they'll be vulnerable to every
script kiddie on the Internet.

Vendors would probably like to avoid paying for security guards or even
taxes, but they don't often bemoan in public the absolute necessity to
do so.

>By analogy, this isn t a call for
>people for give up freedom of speech; only that they stop yelling  fire  in
>a crowded movie house.

Another wonderful analogy!

Security professionals have been yelling "fire" in crowded movie houses
for years.  Most of the actual patrons fail to pay any attention, despite
the fact that the seats are made of explosively flammable materials,
the management allows patrons to smoke cigarettes in the theatre, and
occasionally the movie is interrupted by ushers dousing patrons with fire
hoses if they are noticeably ablaze.  Patrons who do catch fire are not
offered a refund, nor a credit for those parts of the movie that they
miss, nor even so much as an apology.

If a _real_ moviehouse was run this way, its management would be in jail
by now.

>This issue is larger than just the security community. All computer users
>have a stake in this issue, and all of us can help ensure that
>vulnerabilities are handled responsibly. Companies can adopt corporate
>policies regarding how their IT departments will handle any security
>vulnerabilities they find. Customers who are considering hiring security
>consultants can ask them what their policies are regarding information
>anarchy, and make an informed buying decision based on the answer. And
>security professionals only need to exercise some self-restraint.

Companies should adopt policies regarding how their IT departments will
implement some basic security measures in the first place, including
a thorough review of the risks associated with all software that
has access to the communications infrastructure prior to deployment.
Many organizations do not do even the most basic risk assessments--they
simply plug in and install.

Consumers should compare vulnerability assessments between vendors--the
actual number of vulnerabilities is not as important as the vendor's
service track record--when was the vulnerability discovered, and when
(if) was it fixed?  Many software consumers do not compare products
at all.

Customers should make sure that their vendors do not continue to
distribute or install old versions of software with known vulnerabilities,
nor release new versions of software with old vulnerabilities.  Apparently
some vendors--and even some IT departments--don't remember to put "fixes
for all known vulnerabilities from previous releases" on the feature
wish-list for their new releases.

Customers should ask for a roadmap of security issues associated with
the products they buy--even if it is as simple as "don't even _think_
about installing this software on an Internet-connected machine", it is
important to have accurate information in order to fit the product into
a site security policy.

>For its part, Microsoft will be working with other industry leaders over the
>course of the coming months, to build an industry-wide consensus on this
>issue. We ll provide additional information as this effort moves forward,
>and will ask for our customers  support in encouraging its adoption. It s
>time for the security community to get on the right side of this issue.

I sincerely hope this effort fails.  The security community is already
clearly (and hopefully permanently) on the right side of this issue.
It does not need or want Microsoft to interfere with it.  We'd much
rather that Microsoft simply catch up to it.  Microsoft has made great
strides in this direction recently, but obviously there are still some
significant attitude problems among the managers there.

Building a Microsoft-specific closed community will not help anyone--not
even Microsoft.  It would effectively keep vulnerability information
within a group whose members all have a direct economic incentive to
keep it unpublished indefinitely.  This will slow down the rate of
vulnerability assessment and correction (because there will be less
information available to the public about these vulnerabilities),
without decreasing the rate of exploitation.  It will not slow down the
rate at which vulnerable systems are deployed in the field, nor will
it significantly slow down the rate at which exploits are released into
the field.  This is a disastrous combination.  

Maintaining the existing vendor-neutral open security community will
help everyone, even Microsoft.  Indeed, if anything, the recent Microsoft
attacks would seem to be an opportunity for Microsoft--one that they
would be stupid to ignore.  Millions of customers, all suddenly realizing
they need a software upgrade, all turning to one vendor to deliver it...
>Scott Culp is the Manager of the Microsoft Security Response Center

Zygo Blaxell (Laptop) <zblaxell@feedme.hungrycats.org>
GPG = D13D 6651 F446 9787 600B AD1E CCF3 6F93 2823 44AD

Eklektix, Inc. Linux powered! Copyright © 2001 Eklektix, Inc., all rights reserved
Linux ® is a registered trademark of Linus Torvalds