http://lwn.net LWN.net is a comprehensive source of news and opinions from and about the Linux community. hourly 2 http://lwn.net/Articles/289138/rss 2008-07-08T15:07:45+00:00 jake Dan Kaminsky has found a flaw in the design of DNS that can allow cache poisoning as an <a href="http://securosis.com/2008/07/08/dan-kaminsky-discovers-fundamental-issue-in-dns-massive-multivendor-patch-released/">article at Securosis.com details</a>. This has lead to a <a href="http://www.kb.cert.org/vuls/id/800113">CERT advisory</a> as well as a coordinated release of patched DNS servers from all affected vendors. Evidently source port randomization is helpful in alleviating the problem. "<span>The issue is extremely serious, and all name servers should be patched as soon as possible. Updates are also being released for a variety of other platforms since this is a problem with the DNS protocol itself, not a specific implementation. The good news is this is a really strange situation where the fix does not immediate reveal the vulnerability and reverse engineering isn't directly possible.</span>" That last claim seems rather strong, time will tell, but it makes sense to be prepared to upgrade affected servers as soon as distributions make them available. http://lwn.net/Articles/289109/rss 2008-07-08T12:53:36+00:00 ris Free Software Magazine <a href="http://www.freesoftwaremagazine.com/columns/gnu_linux_free_software_tools_preserve_your_online_privacy_anonymity_and_security">looks at</a> some free software tools to protect freedom. "<span>Whether you are online or offline, freedom matters. Like good health you never think about it or miss it until it is under threat or actually gone. If you love freedom, you probably love free software and it has given us some terrific tools with which to defend freedom. In this article I will give an overview of some of the available resources (Freenet, Wikileaks and Tor) to protect dissident opinion, facilitate whistle blowing and promote the safe and anonymous development of free software.</span>" http://lwn.net/Articles/289098/rss 2008-07-08T12:52:50+00:00 ris <b>Debian</b> has updated <a href="http://lwn.net/Articles/289102/">bind9</a> (DNS cache poisoning), <a href="http://lwn.net/Articles/289103/">bind8</a> (DNS cache poisoning). <p> <b>Gentoo</b> has updated <a href="http://lwn.net/Articles/289100/">pcre</a> (buffer overflow). <p> <b>SUSE</b> has updated <a href="http://lwn.net/Articles/289099/">the kernel</a> (multiple vulnerabilities). http://lwn.net/Articles/289013/rss 2008-07-08T11:24:22+00:00 corbet Linux kernel developers are being encouraged to see the linux-next tree as the kernel they should use as their development base. But the unique nature of linux-next makes it difficult to use in that way. This article (from this week's Kernel Page, subscribers only) examines the evolving role of linux-next; click below for the full text. http://lwn.net/Articles/289067/rss 2008-07-08T09:31:38+00:00 corbet Google has <a href="http://google-opensource.blogspot.com/2008/07/protocol-buffers-googles-data.html">announced</a> the release of its "Protocol Buffers" code under the Apache license. "<span>Protocol Buffers allow you to define simple data structures in a special definition language, then compile them to produce classes to represent those structures in the language of your choice. These classes come complete with heavily-optimized code to parse and serialize your message in an extremely compact format.</span>" In other words, it's another XDR/RPC/pickle implementation, but tuned to Google's performance needs. http://lwn.net/Articles/289060/rss 2008-07-08T08:31:50+00:00 corbet <a href="http://www.mercurynews.com/alamedacounty/ci_9815170">This MercuryNews article</a> would appear to bring an end to the speculation on whether Hans Reiser was really guilty. "<span>Accompanied by heavily armed Oakland police, software programmer Hans Reiser on Monday led authorities to the body of his missing wife, buried in a shallow grave in the Oakland hills.</span>" http://lwn.net/Articles/289031/rss 2008-07-07T15:53:48+00:00 jake An <a href="http://www.heise-online.co.uk/news/Mozilla-Foundation-developing-a-model-for-a-security-metric--/111064">article at heise online</a> describes Mozilla's new <a href="http://blog.mozilla.com/security/2008/07/02/mozilla-security-metrics-project/">security metrics project</a>, which is an attempt to measure the relative security of Firefox. "<span>One of the main factors cited is how long Firefox users are exposed to a threat while a hole remains unpatched. The developers say they want to use the security metric derived from the results to identify any problematic stage in the development and patch process.</span>" http://lwn.net/Articles/288960/rss 2008-07-07T14:23:02+00:00 jake <p> <b>CentOS</b> has updated <a href="http://lwn.net/Articles/289007/">firefox, devhelp, xulrunner, yelp</a> (multiple vulnerabilities). <p> <b>Debian</b> has updated <a href="http://lwn.net/Articles/288984/">pcre3</a> (arbitrary code execution). <p> <b>Fedora</b> has updated <b>pcre</b> (<a href="http://lwn.net/Articles/288985/">F8</a>, <a href="http://lwn.net/Articles/288986/">F9</a>: arbitrary code execution), <b>jetty</b> (<a href="http://lwn.net/Articles/288988/">F8</a>, <a href="http://lwn.net/Articles/288989/">F9</a>: multiple vulnerabilities). <b>Fedora 8</b> has updated <a href="http://lwn.net/Articles/288990/">firefox</a> (multiple vulnerabilities) which directly causes all of the following updates: <a href="http://lwn.net/Articles/288991/">devhelp</a>, <a href="http://lwn.net/Articles/288993/">gtkmozembedmm</a>, <a href="http://lwn.net/Articles/288994/">yelp</a>, <a href="http://lwn.net/Articles/288995/">gnome-web-photo</a>, <a href="http://lwn.net/Articles/288996/">kazehakase</a>, <a href="http://lwn.net/Articles/288997/">epiphany</a>, <a href="http://lwn.net/Articles/288998/">liferea</a>, <a href="http://lwn.net/Articles/288999/">epiphany-extensions</a>, <a href="http://lwn.net/Articles/289000/">openvrml</a>, <a href="http://lwn.net/Articles/289001/">galeon</a>, <a href="http://lwn.net/Articles/289002/">ruby-gnome2</a>, <a href="http://lwn.net/Articles/289003/">chmsee</a>, <a href="http://lwn.net/Articles/289004/">Miro</a>, <a href="http://lwn.net/Articles/289005/">gnome-python2-extras</a>, <a href="http://lwn.net/Articles/289006/">blam</a>. <p> <b>Mandriva</b> has updated <a href="http://lwn.net/Articles/288959/">phpMyAdmin</a> (multiple vulnerabilities), <a href="http://lwn.net/Articles/288961/">gnome-screensaver</a> (authentication bypass), <a href="http://lwn.net/Articles/288962/">sympa</a> (denial of service), <a href="http://lwn.net/Articles/288963/">squid</a> (denial of service), <a href="http://lwn.net/Articles/288965/">gnome-screensaver</a> (clipboard contents disclosure). http://lwn.net/Articles/288897/rss 2008-07-07T09:53:22+00:00 jake It often seems that the mainstream technical press focuses on various "problems" with Linux, either technical or otherwise, which is what makes this <a href="http://www.pcworld.com/article/147879/move_your_business_from_windows_to_linux.html">PC World article</a> stand out. It is a basic introduction to Linux for businesses that might be looking to switch from Windows, especially for the cost savings. "<span>If that feels like a waste of your small business's precious IT budget, and you're still looking for an alternative to Windows Vista, look no further than Linux. The latest distributions are free, easy to install, and highly customizable; they harness your existing hardware without overtaxing it; and they include a wealth of productivity applications and utilities. You may already have a closet Linux expert on staff, but if you don't, paid support is usually available at rates far less than Microsoft's.</span>" http://lwn.net/Articles/288892/rss 2008-07-07T09:12:42+00:00 corbet The GNOME Foundation has <a href="http://www.gnome.org/press/releases/2008-07-stormy-executive-director.html">announced</a> that it's long search for an executive director is over: Stormy Peters has accepted the job. "<span>The past year there has seen tremendous growth in the number of devices that ship with GNOME- mass-market laptops, phones, and even GPS devices. Hiring Stormy as executive director will help GNOME capitalize on this momentum, exactly at a time when more of the world is realizing the value of combining free and open source software with great user experiences, while also helping GNOME consolidate its traditional strengths in enterprise and other large-scale deployments.</span>" http://lwn.net/Articles/288846/rss 2008-07-06T08:33:37+00:00 corbet Gentoo Linux 2008.0 is out. "<span>Code-named 'It's got what plants crave,' this release contains numerous new features including an updated installer, improved hardware support, a complete rework of profiles, and a move to Xfce instead of GNOME on the LiveCD.</span>" http://lwn.net/Articles/288825/rss 2008-07-05T21:06:42+00:00 corbet The <a href="http://lwn.net/Articles/288824/">2.6.26-rc9</a> kernel prepatch is out. "<span>Enough changes that we needed another -rc, and the regression list isn't emptying fast enough either (probably because a number of people, including reporters, are vacationing).</span>" Along with the fixes there's a new driver for cameras which implement the standard USB video class spec. The <a href="http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.26-rc9">long-format changelog</a> has the details. http://lwn.net/Articles/288799/rss 2008-07-05T11:56:20+00:00 corbet Datamation <a href="http://itmanagement.earthweb.com/osrc/article.php/3757241/KDE+4.1+Beta+2:+Two+Steps+Forward,+One+Step+Back.htm">reviews the second KDE 4.1 beta</a>. "<span>However, if the second beta of 4.1 is any indication, it will be only partly successful in quieting user dissent. On the one hand, KDE 4.1 includes the first 4.x versions of several major KDE applications, which goes a long way toward improving the user experience. And, in both other programs as well as the desktop, the second beta sports countless improvements in functionality and design. On the other hand, not only are many of the interface changes that people complain about still there, but the new Folder View raises a whole new set of issues about how users organize their desktops.</span>" http://lwn.net/Articles/288684/rss 2008-07-04T13:11:42+00:00 ris TechWorld <a href="http://www.techworld.com.au/article/224689/first_look_koffice_2_0_alpha_8">takes a look</a> at KOffice 2.0 Alpha 8. "<span>KOffice 2.0 Alpha 8 ships as a suite of applications. In addition to the familiar word processor (KWord), spreadsheet (Kspread) and charting (Kchart), and presentation applications (KPresenter), KOffice has a wealth of tools for content design, manipulation and display. For the creative professional, there's Krita a fully-fledged graphic design and image manipulation tool, Karbon14 a Scalable Vector Graphics editor, and Kivio for flowcharts and diagrams. Also included is Kexi for database development (touted as "Microsoft Access for Linux"), and KPlato for project management. Other tools are KnetAttach, a network folder wizard, Kformula for mathematical formula editing, and a thesaurus.</span>" (Found on <a href="http://dot.kde.org/1215168947/">KDE.News</a>) http://lwn.net/Articles/288711/rss 2008-07-04T13:11:16+00:00 ris <b>SUSE</b> has updated <a href="http://lwn.net/Articles/288720/">sudo, courier-authlib, gnome-screensaver, clamav, php5, ImageMagick, GraphicsMagick, mtr, bind, pcre, tomcat, squid, freetype2</a> (various issues). <p> <b>Mandriva</b> has updated <b>php</b> (multiple vulnerabilities: <a href="http://lwn.net/Articles/288710/">2007.1</a>, <a href="http://lwn.net/Articles/288712/">Corporate 4.0</a>, <a href="http://lwn.net/Articles/288713/">2008.0</a>, <a href="http://lwn.net/Articles/288714/">2008.1</a>, <a href="http://lwn.net/Articles/288715/">Corporate 3.0, Multi Network Firewall 2.0</a>, <a href="http://lwn.net/Articles/288716/">Corporate 4.0</a>). <p> <b>Fedora 8</b> has updated <a href="http://lwn.net/Articles/288718/">ruby</a> (multiple vulnerabilities). <p> <b>Debian</b> has updated <a href="http://lwn.net/Articles/288719/">wordpress</a> (several vulnerabilities).