QuesarVII writes "Tavis Ormandy and Julien Tinnes have discovered a severe security flaw in all 2.4 and 2.6 kernels since 2001 on all architectures. 'Since it leads to the kernel executing code at NULL, the vulnerability is as trivial as it can get to exploit: an attacker can just put code in the first page that will get executed with kernel privileges.'"

PiSkyHi writes "I understand that if I build an application that links with a library that is licensed under GPLv2, I must also make my application GPL2. I can see that value in this for an application. But for a library, what's to stop me separating my program into a GPLv2-compliant client app that talks to the rest of my (choose my own license) application?"

mrchaotica writes "I'm in the market for a new HDTV (in the $1200-or-slightly-more range, as I won the extended-service-plan lottery and have a Sears store credit). Several of the TVs I've looked at have various 'Internet TV' features (here are Samsung's and Panasonic's). Some manufacturers appear to be rolling their own, while others are partnering with Yahoo (maybe in an attempt to create a 'standard?'). Moreover, these TVs also tend to run Linux under the hood (although their GPL compliance, such as in Panasonic's case, may leave something to be desired). Finally, it's easy to imagine these TVs being able to support video streaming services (YouTube, Netflix, Amazon, etc.) without a set-top box, but I don't know the extent to which that support actually exists. Here are my questions: 1) Is this 'Internet TV' thing going to be a big deal going forward, or just a gimmick? 2) Which manufacturers are most [open standard|Linux|hacker]-friendly? 3) Which TV models have the best support (or best potential and community backing) for this sort of thing?"

zerointeger writes "I am still fairly new to programming in C, but I was asked to extend an open source authentication module by my employer. The project is complete, testing has been done and it works as designed. The extension/patch I have created is fairly robust, as it includes configuration options, help files, and several additional files. The problem is that I have been unable to make contact with the current maintainer about having this feature added. I think the only reason I'd like to see this included is to prevent any patching of later revisions. A few others I have spoken with agree that the patch would benefit administrators attempting to push Linux onto the desktop, as we have done at the University that employs me. Has anyone else submitted patches/extensions to what seems to be a black hole?"

hardsix writes "The recent legal wrangling between a group of open source supporters led by Red Hat against the Swiss government's decision to award an IT contract solely to Microsoft appears to be going Microsoft's way. A Swiss lawyer close to the case claims that a preliminary ruling has rejected the open source group's request to overturn the Microsoft contract however the case is still ongoing and there is still room for appeal. 'The Administrative Court hasn't made its final ruling yet but even if it finds in favor of Microsoft, there is still room for appeal. No matter what the ruling will be, an appeal will likely be filed to the Supreme Court, whose final word will have substantial significance in the future for public authorities with regards to computing services,' said Swiss legal firm BCCC AVOCATS. Open source supporters argue there has to be real political will for open source projects to succeed in the public sector."

angry tapir sends along coverage from Good Gear Guide of a recent Microsoft !0-K SEC filing: "Microsoft for the first time has named Linux distributors Red Hat and Canonical as competitors to its Windows client business in its annual filing to the US Securities and Exchange Commission. The move is an acknowledgment of the first viable competition from Linux to Microsoft's Windows client business, due mainly to the use of Linux on netbooks, which are rising in prominence as alternatives to full-sized notebooks. ... 'Client faces strong competition from well-established companies with differing approaches to the PC market,' Microsoft said in the filing. 'Competing commercial software products, including variants of Unix, are supplied by competitors such as Apple, Canonical, and Red Hat.'"

Adam Wrzeski notes a piece up at Create Digital Music by musician Kim Cascone (artist's bio) on switching from Apple to Linux for audio production: "The [Apple] computer functioned as both sound design studio and stage instrument. I worked this way for ten years, faithfully following the upgrade path set forth by Apple and the various developers of the software I used. Continually upgrading required a substantial financial commitment on my part. ... I loaded up my Dell with a selection of Linux audio applications and brought it with me on tour as an emergency backup to my tottering PowerBook. The Mini 9 could play back four tracks of 24-bit/96 kHz audio with effects — not bad for a netbook. The solution to my financial constraint became clear, and I bought a refurbished Dell Studio 15, installed Ubuntu on it, and set it up for sound production and business administration. The total cost was around $600 for the laptop plus a donation to a software developer — a far cry from the $3000 price tag and weeks of my time it would have cost me to stay locked-in to Apple. After a couple of months of solid use, I have had no problems with my laptop or Ubuntu. Both have performed flawlessly, remaining stable and reliable."

Bitnit writes "Phoronix has released a major update to their automated Linux benchmarking software, the Phoronix Test Suite, and more interestingly they have released their own distribution that's designed for hardware testing and benchmarking on Linux. With PTS Desktop Live they provide this Linux distribution that's to run only from a live environment off a DVD / USB key and then allows their benchmarking software to run — and only that — on this standardized software stack, which makes hardware comparisons a lot easier."

CalTrumpet writes "Our research group recently spoke at Black Hat USA on the topic of cloud computing security. One of the interesting outcomes of our research was the discovery that the combination of virtualization technologies and public system images results in a problem for random number generation on guest operating systems. This is especially true for Linux, since its PRNG uses only a small set of entropy-gathering events, and virtual Linux images often generate SSH host keys within seconds of their initial boot. The slides are available; the PRNG vulnerability material begins at slide 63."

apokryphos writes "Novell has just announced the release of SUSE Studio 1.0 — a user-friendly Web service that allows you to create your customized Linux distribution as a live CD, USB, Xen, or VMware image. Users have control over adding any repositories, packages, and files to the distribution. A new user can do the full creation and customization of the software appliance in roughly ten minutes. It also includes a Flash-based 'test drive' service, which allows you to try out your appliance in a Web browser before downloading it."

str8edge sends word that Lance Davis, the CentOS project administrator who had mysteriously gone absent, has now returned and is working with the development team to get things back on track. From their announcement: "The CentOS Development team had a routine meeting today with Lance Davis in attendance. During the meeting a majority of issues were resolved immediately and a working agreement was reached with deadlines for remaining unresolved issues. There should be no impact to any CentOS users going forward. The CentOS project is now in control of the CentOS.org and CentOS.info domains and owns all trademarks, materials, and artwork in the CentOS distributions. We look forward to working with Lance to quickly complete all the agreed upon issues. More information will follow soon."

diegocgteleline.es writes "Valerie Aurora, a Linux file system developer and ex-ZFS designer, has posted an article with great insight on how Btrfs, the file system that will replace Ext4, was created and how it works. Quoting: 'When it comes to file systems, it's hard to tell truth from rumor from vile slander: the code is so complex, the personalities are so exaggerated, and the users are so angry when they lose their data. You can't even settle things with a battle of the benchmarks: file system workloads vary so wildly that you can make a plausible argument for why any benchmark is either totally irrelevant or crucially important. ... we'll take a behind-the-scenes look at the design and development of Btrfs on many levels — technical, political, personal — and trace it from its origins at a workshop to its current position as Linus's root file system.'"

hugmeplz writes "The third annual Pwnie Awards took place last night at Black Hat in Las Vegas, and a full list of the winners has been posted. 'Most Epic Fail' honors went to the notorious Twitter/Google Apps hack from earlier this month that raised all sorts of questions about cloud computing security. Red Hat got skewered with the 'Mass 0wnage' award, also known as the 'Pwnie for Breaking the Internet,' for issuing a version of OpenSSH that left a backdoor open to hackers. The Linux development team earned 'Lamest Vendor Response' recognition for 'continually assuming that all kernel memory corruption bugs are only Denial-of-Service.' Naturally, Microsoft didn't slip past judges' eyes. Its vulnerability that enabled the Conficker worm to do its thing earned honors as the 'Most Overhyped Bug.' On the more positive side, the Pwnie Awards recognized security pros Wei Yongjun, sgrakkyu, Sebastian Kramer and Bernhard Mueller for accomplishments such as discovering bugs and demonstrating exploits. The Pwnie for Best Song went to Doctor Braid for his song Nice Report. Solar Designer snagged the Lifetime Achievement Award, for among other things, being the first to demonstrate heap buffer overflow exploitation, according to the Pwnie Awards Web site."

pdkl95 writes "I have been using some small, simple desktop label printers for quite a while now. Unfortunately, it's rapidly becoming clear that my printing needs are for something far more 'industrial strength.' Several of the label printers have failed, and they never really had the management features I wanted. So, does anybody have recommendations on label printers, that can hold up to a quite heavy load? The catch is that I'm printing to them from CUPS under Linux, and it seems like specialty-printers are a windows-centric field."

An anonymous reader writes "Lance Davis, the main project administrator for CentOS, a popular free 'rebuild' of Red Hat's Enterprise Linux, appears to have gone AWOL. In an open letter from his fellow CentOS developers, they describe the precarious situation the project has been put in. There have been attempts to contact him for some time now, as he's the sole administrator for the centos.org domain, the IRC channels, and apparently, CentOS funds. One can only hope that Lance gets in contact with them and gets things sorted out."

The Slashdolt writes "After a stern criticism from Linus, the long-time kernel hacker Alan Cox has decided to walk away as the maintainer of the TTY subsystem of the Linux Kernel, stating '...I've had enough. If you think that problem is easy to fix you fix it. Have fun. I've zapped the tty merge queue so anyone with patches for the tty layer can send them to the new maintainer.'" A response to a subsequent post on the list makes it quite clear that he is serious.

frenchbedroom writes "The ongoing Debconf 9 meeting in Cáceres, Spain has brought a significant change to Debian's project management. The Debian project will now freeze development in December of every odd year, which means we can expect a new Debian release in the spring of every even year, starting with 'Squeeze' in 2010. Until now, development freezing was decided by the Debian release team. From the announcement: 'The project chose December as a suitable freeze date since spring releases proved successful for the releases of Debian GNU/Linux 4.0 (codenamed "Etch") and Debian GNU/Linux 5.0 ("Lenny"). Time-based freezes will allow the Debian Project to blend the predictability of time based releases with its well established policy of feature based releases. The new freeze policy will provide better predictability of releases for users of the Debian distribution, and also allow Debian developers to do better long-term planning. A two-year release cycle will give more time for disruptive changes, reducing inconveniences caused for users. Having predictable freezes should also reduce overall freeze time.' We previously discussed talks between Canonical and the Debian release team about fixed freeze dates."

christian.einfeldt writes "The LinuxTech.net blog points out that Linux notebooks are currently selling quite well on Amazon's list in Germany. The blog includes screenshots showing the Linux Asus and Aspire notebooks in positions 2 and 4, respectively, on that list. These machines are not netbooks, but full notebooks, albeit on the moderate to low side regarding price and performance. That LinuxTech.net blog was dated 23 July 2009, and the Asus machine is still holding second place more than one day later, while the Acer machine slipped to fifth position, despite the volatile nature of Amazon bestseller lists. While these two data points are just snapshots in time, they are consistent with other data showing that Microsoft itself attributes some of its recent weak earnings to surging sales of low-end notebooks, as well as data showing that the Linux-powered and Unix-powered computers topped Amazon's sales charts in all categories for 2007. If there is to ever be a 'year of desktop (or laptop) Linux', it won't happen all at once, but will creep up in ways similar to what we are seeing now."

Hugh Pickens writes "In the aftermath of Microsoft's recent decision to contribute 20,000 lines of device driver code to the Linux community, Christopher Smart of Linux Magazine talked to Linus Torvalds and asked if the code was something he would be happy to include, even though it's from Microsoft. 'Oh, I'm a big believer in "technology over politics." I don't care who it comes from, as long as there are solid reasons for the code, and as long as we don't have to worry about licensing etc. issues,' says Torvalds. 'I may make jokes about Microsoft at times, but at the same time, I think the Microsoft hatred is a disease. I believe in open development, and that very much involves not just making the source open, but also not shutting other people and companies out.' Smart asked Torvalds if Microsoft was contributing the code to benefit the Linux community or Microsoft. 'I agree that it's driven by selfish reasons, but that's how all open source code gets written! We all "scratch our own itches." It's why I started Linux, it's why I started git, and it's why I am still involved. It's the reason for everybody to end up in open source, to some degree,' says Torvalds. 'So complaining about the fact that Microsoft picked a selfish area to work on is just silly. Of course they picked an area that helps them. That's the point of open source — the ability to make the code better for your particular needs, whoever the "your" in question happens to be.'"

ers81239 writes "I've recently become a Linux administrator within the Department of Defense. I am surprised to find out that the DoD actually publishes extensive guidance on minimum software versions. I guess that isn't so surprising, but the version numbers are. Kernel 2.6.30, ntp 4.2.4p7-RC2, OpenSSL 9.8k and the openssh to match, etc. The surprising part is that these are very fresh versions which are not included in many distributions. We use SUSE Enterprise quite a bit, but even openSUSE factory (their word for unstable) doesn't have these packages. Tarballing on this many systems is a nightmare and even then some things just don't seem to work. I don't have time to track down every possible lib/etc/opt/local/share path that different packages try to use by default. I think that this really highlights the trade-offs of stability and security. I have called Novell to ask about it. When vulnerabilities are found in software, they backport the patches into whatever version of the software they are currently supporting. The problem here is that doesn't give me a guarantee that the backport fixes the problem for which this upgrade is required (My requirements say to install version x or higher). There is also the question of how quickly they are providing the backports. I'm hoping that there are 100s of DoD Linux administrators reading this who can bombard me with solutions. How do you balance security with stability?"