Other stuff:
Contact us
Archives/search
Links
Calendar
Daily Updates

Here is the permanent site for this page.

Leading items

The disagreement, which has since been reported widely as a "rift" in the free software world, has to do with just what the community's goals are. Perhaps the most succinct characterization of the debate would be the following:

Eric: I want to live in a world where software doesn't suck.

Richard: Any software that isn't free sucks.

Linus: I'm interested in free beer.

One would think that, since everybody is in favor of free software, there should not be much of a basis for argument here. The problem, of course, comes in when proprietary software is thrown into the mix. Free software purists do not welcome proprietary vendors; indeed, they seek to not even recognize their presence. "Open source" folks are more tolerant, seeing even proprietary systems as an endorsement of the Linux platform that will help to carry things forward in the long run.

This disagreement, at times, gets loud. It creates divisions between people who really do share many goals. And it reflects poorly on the Linux community; it makes it all too easy for those who would characterize us as "17-year-old surfers" or whatever it is this week.

LWN would like to make a few suggestions. We'll not get too far in calming down the debate, but it should at least help us to get lots of material for the letters to the editor column...

• To the free software people: Freedom means the ability to run proprietary software if, in an individual's judgement, that software is the proper tool for the job. Especially in cases where high quality free alternatives are not available, proponents of free software should remember that others have a job to do and be patient. Attempting to restrict choices in the name of freedom is inconsistent.

  The presence of proprietary software does not prevent the emergence of a free alternative. Those of us who have been at this for a while remember the epic struggles involved in building early versions of X11 with early versions of gcc. It was a pain. Why did we bother? After all, our (proprietary) Unix systems had window systems and compilers. We did it because free software is better. And, in the end, X11 and gcc won out over SunView and pcc.

• To the open source people: Freedom remains an important goal. It has everything to do with why Linux is a superior platform. The organizers of events like LinuxWorld should, in the future, make freedom part of the agenda. An event which fails to teach the principles of free software is an event which does not properly serve the Linux community. In the end, corporations, too, benefit from truly free software. Those pushing "open source" should make an effort to ensure that "free" is not ignored.

And we're winning.

Free software to the rescue in Italy. Italy's National Research Council (CNR) held a meeting in late February to evaluate free software's potential to reinvigorate Italy's engineering industries and reduce software imports. Here's a writeup of the event (in Italian and translated to English). It may well be that free software will take over in places like Europe before it does in the United States; this document gives a glimpse into how that could happen. (Thanks to Gabriele Paciucci who wrote the original document, Ricardo Russo for doing the translation, and Paolo Didonè who sent it all to us).

There is also an article (in Italian) in Il Sole 24 Ore about this gathering. Babelfish chokes on it, unfortunately, so no translation for the moment.

The 1999 Atlanta Linux Showcase has been announced. It will be three tracks of events over three days this year. See you there!

This Week's LWN was brought to you by:

• Jonathan Corbet, Executive Editor
• Elizabeth O. Coolbaugh, Managing Editor

See also: last week's Security page.

Security

News

Several ISPs were recently impacted by a program called GeoList Professional, from earthonline.com. This program scans a list of over 4000 domains for possible user names based on a dictionary-lookup scheme. The way that the scan is done results essentially in a Denial-of-Service style attack on impacted machines. Earthonline's response has been to pull the product. To see if you are in a domain that was affected by the attack, you can check this list of domain names hardcoded into the program. In the meantime, the report generated a great deal of mail on the Bugtraq list addressing how to properly configure your Mail Transfer Agent (MTA) to handle attacks of this sort. No one solution was agreed to be the best, but the discussion was interesting and enlightening ...

On the Cryptography Front, this Wired News article describes the return of the Cryptography bill to Congress. That sounds like good news, until you get to the comments that the bill was not written to benefit the individual, only industry. You can judge for yourself by going to the Thomas site and searching for "Security and Privacy Through Encryption Act" (note that the bill number in the Wired article is wrong). From a brief scan, it appears to exclude free software from export restrictions.

Security Reports

Mutt version 0.95.4 was released in order to fix some problems with mutt's temporary file name generator and some inconsistent library call handling. These problems did open up potentially serious security problems, so it is recommended that you update your mutt packages. Unfortunately, no vendor reports have yet come out, although a conversation at LinuxWorld indicated that the Debian 2.1 release was held up, in part, in order to fix this problem. The March 8th Debian changes log for Intel indicates that an updated package for mutt was uploaded to fix security problems, package mutt-0.95.3-0.2.

Gnuplot version 3.5 reportedly has a serious root compromise hole. Of course, 3.5 is a old version. The problem was fixed before the release of Gnuplot 3.7. If you are running SuSE, you may want to check for the installation of this program and remove the suid bit immediately. For even better security, SuSE users should take a look at /etc/rc.config and consider setting PERMISSION_SECURITY="secure".

Security problems with Linux kernel 2.0.35 and earlier are described in this advisory from Network Associates, Inc. The fact that earlier versions of the 2.0 kernel series are vulnerable has been already reported. However, if you've been putting off upgrading your kernel, this report should encourage you to increase the priority of that task.

Fixes for bugs in HP network-connected printers are now available. This includes a fix for the infamous nestea2 and other TCP/IP exploits. This note describes the problems and the firmware upgrades that contain the fixes in more details. As he mentions, getting these firmware upgrades should be considered mandatory for anyone running HP network-connected printers if they are exposed to any untrusted traffic.

Updates

Events

The Black Hat Briefings '99 is a computer security conference to be held July 7th and 8th in Las Vegas, Nevada, USA. This year, they've added a "white hats track" for CEOs and CIOs. One wonders if they object to segregation ... Here is the official announcement.

The CQRE [Secure] Congress & Exhibition has released its Call-For-Papers for its 1999 conference. CQRE will be held November 30th through December 2nd, 1999, in Duesseldorf, Germany.

Section Editor: Liz Coolbaugh

See also: last week's Kernel page.

Kernel development

And that is a good thing. A certain amount of grumbling about the stability of 2.2.2 has been heard in recent times; some have compared it to a development release. A lot of the problems seem to be with NFS, which could be a source of complaints for a while yet. NFS was orphaned for too long in the 2.1 cycle, it has some catching up to do. The Alpha compilation problems didn't help either. Nonetheless, 2.2.2 has worked quite well for most people who have used it, and 2.2.3 should be even better. The 2.2 series is a quality release.

Alan Cox, of course, has jumped out ahead with 2.2.3ac1. It contains quite a few fixes, including more NFS stuff.

What byte ordering will the Merced port use? This discussion - perhaps a bit premature - has been based on the assumption that Merced, like a number of other modern processor chips, will be able to operate in both big-endian and little-endian modes. A certain vocal contingent thinks that big-endian ordering should be used. Arguments for this approach cite compatibility with the (big-endian) TCP/IP protocols, as well as some things about making hex dumps easier to read.

Linus's answer to big-endian proponents is quite simple: "Not a chance in hell". His reasons are (1) a claim that there is never any reason to prefer one byte ordering over another, and (2) the x86 emulation mode will require little-endian ordering. Different orderings for the x86 and IA-64 native modes is not open for discussion - nobody has been pushing for that. So the question is pretty well resolved.

As an interesting aside, Linus posted this note on why he thinks that old x86 binaries running in emulation mode will actually execute faster than native IA-64 binaries. It mostly has to do with the huge expected size of the Merced binaries. He leaves us with this chilling thought... "For example, have people realized just how large something like KDE+StarOffice is? Imagine blowing that up by a factor of three or so."

Lots of patches and packages were announced:

• DIPC 1.1b is available for the 2.2 kernels. DIPC (Distributed Inter-Process Communication) is a package aimed at clustering applications; it makes the SYSV IPC mechanisms work across the net, and also provides a slick transparent shared memory capability. The DIPC folks also issued an invitation for other developers to start hacking on the system.

• GNU Queue 1.20 is out. This package is also intended for clustering applications; it provides for load balancing and (almost) process migration across cluster nodes.

• Ted Ts'o announced a new version of the serial driver, currently packaged separately from the kernel. It can be used to bring a lot of new features back into the 2.0 kernel, but it also adds support for the new 16C950 UARTs, which, according to Ted, are very nice.

• PPSkit-0.6 provides high-resolution timekeeping to the kernel. This package is still very much in an experimental state.

• Richard Gooch's Model-Specific Registers patch is at version 12. Richard has also put out a call for testers who have AMD CPU's.

• LVM 0.6 (the Logical Volume Manager patch) is out. "...still considered alpha."

• Swsusp v5 is available. This patch creates a "suspend to disk" capability for all machines - whether or not the system has APM support.

• Version 0.0.2 of the 802.1Q VLAN system is out.

"Why debate changes on linux-kernel? After all, Linus makes all the decisions in the end anyway." After hearing this point of view one time too many, Larry McVoy responded with not just one but two separate, well-written messages on why development issues need to be debated. Relying on Linus is not only a cop-out, but it's guaranteed to bring on more "Linus burnout" episodes in the future. Rather than send everything up to Linus for judgement, the onus should be on developers to insure that almost everything that gets to Linus will be judged favorably.

Implicit in all this, of course, is the question of how things will work when Linus is not there any more. Linus may have no immediate plans to move on to other things, but he served some notice at his LinuxWorld keynote: "Basically, I'm a very selfish person and I really don't care about all of you. I care about doing what I enjoy." If Linus wakes up one day and decides he's no longer enjoying himself, he may well be gone.

And remember that he has been doing this for almost ten years. That day could come sooner than many people expect.

The point of all this, of course, is that the kernel development community needs to be able to function well in Linus's absence. The better we all do at getting the important decisions made before they ever reach him, the better prepared we will be for that day when he is no longer around. Linus's departure - hopefully a long way off - will not be the end of Linux. With a proper development discipline in place, it need not even be all that traumatic.

Another article describing the new features of the 2.2 kernel can be found on the openresources.com site.

Section Editor: Jonathan Corbet

For other kernel news, see:

• LinuxHQ
• Kernel traffic

See also: last week's Distributions page.

Distributions

Like Mandrake, it is based on Red Hat 5.2. However, they've worked on making printing easier for the novice, replaced the ordinary cron with one that doesn't need the machine up 24 hours a day, optimized dial-up support, put in enhancements to LILO to get people up and running without having to read the manual first -- difficult to do if the computer is not yet up --, and added KDE (of course) and lots of applications to provide people with alternatives for the software they are accustomed to running on Windows operating systems.

We haven't had a chance to take it for a spin, but we've followed the project and its aims. Anyone who does get a chance to try it out, please let us know what you think! Good ideas and hard work are always welcome.

Debian

The Debian Event Pages, now available, contain a list of upcoming Linux-related events and Debian's plans for them.

A new mailing list, debian-commercial has been created. It is a moderated list for publishing vendor and distributor Debian-related materials.

The Debian Weekly News for last week and this week are available.

A new Package Manager for Debian? Swim was announced today by Jonathan Rosenbaum. It will be interesting to see what the reactions to the announcement are.

Joseph Carter's LinuxWorld report is now available.

LinuxPPC

Civilization: A Call to Power will be available for the LinuxPPC in the near future. This MacCentral article notes that it will probably be available sooner than the version for the MacOS. Of course, once the game is running on Linux/Intel, moving it to the PPC should hopefully be trivial ...

In amongst all of the IBM press releases, it was easy to miss their declaration of support for Linux on the PowerPC (this editor did).

Thanks to Jason Haas for providing us with LinuxPPC news this week ...

Mandrake

The latest edition of the Mandrake-News is available. It includes lots of good news about how well Mandrake is doing, plus a note about rpms for Linux kernel 2.2.2 which they have made available.

Red Hat

Check out the commerce section for news on some additional big-name investors that have lined up to put money into Red Hat.

Slackware

No updates to Slackware have been posted since February 24th.

SuSE

Some plans for improving SuSE's security were informally posted to Bugtraq. The note indicates that security-specific mailing lists for SuSE should be announced some time soon as well the introduction of OpenBSD-like security checks that run on a regular basis. This is welcome news.

Section Editor: Liz Coolbaugh

Please note that not every distribution will show up every week. Only distributions with recent news to report will be listed.

See also: last week's Development page.

Development tools

Java

From the JDK 1.2 Status Page, it appears the only hold-up left on the Intel platform is caused by a bug in the 2.0.3X kernel series. The PowerPC platform is coming along, as well. No information is yet available for the other ports. From this note, it appears that the problem is fixed as of kernel 2.2.1. It may be up to Sun to decide whether this constitutes "passing behavior". In addition, Alan Cox's release notes for Linux kernel 2.0.37pre8 indicate that he's included the fix for that problem, specifically to support the JDK 1.2 porting team. 2.0.37 is due out by the end of the month, barring any major disasters.

Some initial impressions of Java 2 (a.k.a. JDK 1.2) were posted by Russ Pridemore.

The JDK 1.2 pre-release for the PowerPC platform was announced on Monday.

Perl

A demo of PerlPoint, Tom Christiansen's perl-based (of course) presentation software, was announced on March 9th, with the goal of reducing the number of people making presentations with PowerPoint.

The Maintenance Trial 6 for 5.005_03 has been made available in Graham Barr's CPAN directory.

Python

SmallTalk

Tcl/tk

A HOWTO for writing multi-threaded extensions for Tcl was announced by David Gravereaux.

Section Editor: Liz Coolbaugh

Development projects

KDE

Linux-Magazin wrote an article on K-Office, the text of which has been made available in German, thanks to the efforts of Tom Schwaller. They are looking for people willing to translate the article into other languages, particularly French and English. Contact Martin Konold if you are interested in helping out.

If you are looking for books on KDE, you'll want to check out Robert Williams' web-site on the topic.

The first release of KCdCD, a simple CD player, was announced by Roberto Alsina.

Over thirty different updates to various KDE utilities and programs came out over the past two weeks, so we won't attempt to list them all here. Check out the kde-announce list for all the announcements.

Linux Games

Hopkins FBI is the name of a commercial game which will be released for Linux on March 29th. A downloadable demo is already available and patches for some known problems should be out in a couple of days. For more information, check out the Hopkins FBI site, complete with screen shots [tip courtesy of Wari Wahab].

Linux Wordprocessors, etc.

Mozilla/Netscape

Wine

Codeweaver's plans to merge TWIN and WINE into "TWINE" are mentioned in the report, but were covered in more detail on Slashdot on Monday. It is good news to see efforts in the two development areas coming closer together. The different licenses of the two efforts (LGPL for TWIN, BSD for WINE) mean that a lot of tip-toeing will be going on, trying to keep the work and the cooperation going, but both sides seem to have a very good attitude about it. CodeWeavers, from their web site, appears to have gone out of their way to anticipate possible problems and avoid them.

Zope

The Zope Documentation Project now has its mailing list up and running and is actively maintaining the Zope FAQ.

Section Editor: Liz Coolbaugh

See also: last week's Commerce page.

Linux and business

Red Hat picks up more big-name investors. Here is the press release announcing the minority investments Red Hat has obtained from Compaq, IBM, Novell, and Oracle. Thus, Red Hat continues on its path of accumulating both big-business backing and (presumably) a sizeable chunk of cash.

Perhaps the most interesting investor in the above list is Novell. Novell, of course, has been a long time Caldera backer, so it is a bit surprising to see them pumping money into Red Hat. Perhaps their purpose is to see more widespread support for Netware in some of the other distributions. How that would work with Red Hat's latter-day push toward a completely free distribution remains to be seen.

Here is an announcement for what appears to be another attempt at a Linux certification program, this one by a company called No Wonder.. "Applicants will be evaluated over the course of three months, during which time they will be responding to the questions submitted to No Wonder's personal support forum via the web. Certifications will be awarded to those who show proficiency in all areas of this process, which include: technical knowledge, problem solving, researching and follow-up skills, and personal communication ability."

Ricoh has announcedthe open source release of their PIA (Platform for Information Applications) system. It appears to be a document-processing platform based on XML. They have also set up RiSource.org as a site dedicated to their present (and, presumably, future) open source releases.

The folks at IBM's AlphaWorks wrote in to ask us to spread the word about their new, redesigned web site. AlphaWorks, ("IBM's Silicon Valley Start-Up") is, of course, the source of a number of free software goodies. They have a number of new software releases out there as well; check out their pages for details.

Siemens is going Linux. Here is an announcement (in German) stating that they will be putting Linux on their PRIMERGY servers to run as SAP R/3 platforms. (Babelfish translation available here). (Thanks to Frank Paehlke).

Folks wanting faster math functions on the Alpha may want to check out the Compaq Portable Math Library for Alpha Linux. It claims to be a drop-in replacement for the standard Alpha math library, but with much better performance. It appears to be a binary-only beta release, with registration required to actually get the code.

Intelogis has announced an open source licensing scheme for its network adaptor drivers and administration software. They are clearly hoping to get a free Linux port out of the deal, and likely will.

There's another entry in the anti-virus programs for Linux arena - this one is called AVP, from the Kaspersky Lab in Moscow. See their announcement for more.

Version 1.0 of the Qt Public License (QPL)has been announced. It still requires distribution of modifications in a separate form (patches, or managed patches via CVS, etc).

Linux has picked up a new game. This one is "Hopkins FBI." The official release is evidently at the end of this month, but a demo download is available now. See their Linux page for more information. (Thanks to Wari Wahab).

Press Releases:

• PowerQuest, DriveImage 3.0 available.
• RPK Security, Inc., Encryptonite software toolkit.
• Novell, Netware 5 NFS Services
• URLabs, Inc., I-Gear 3.0 "Content management solution."
• Mylex, new BIOS configuration utility for RAID systems.
• Cygnus Solutions, providing WINE-capable GNUPro tools to Corel.
• Netscape, Communicator 4.51 available.
• Xi Graphics, AcceleratedX version 5 available.
• Corel, announcement of their intent to make a Linux distribution.
• Intel Corporation, Linux support for its print server products.
• Infoteria, iPex XML processing engine.
• ILOG, CPlex 6.5 optimization software.
• Molecular Applications Group, GeneMine 3.5 - genetics research tool.
• Cyberstation of Victoria, Ltd., plastic laminated Linux help card.
• Silicon Graphics, Inc., open-source release of GLX code.
• Scriptics, a new version of TclPro, which has a couple of earth-shaking additions: Expect and TclX.
• Red Hat Software, Expo favorites award at LinuxWorld.
• Cobalt Networks, a new version of its RaQ server product.
• Informix, a promotional scheme wherein free licenses are available for some of their development tools.
• Bright Star Engineering, embedded Linux toolkit for ipEngine-1 single-board computer.
• Zentropix, R2D2 debugger for real-time Linux.
• Cybersource, free referral service for resellers in Australia.
• Multi-User Solutions (MUS) is now providing support services for Caldera OpenLinux.

Section Editor: Jon Corbet.

See also: last week's Linux in the news page.

Linux in the news

There was also a distinct pickup in the amount of negative press. The "who do you sue?" theme is back with a vengence. One wonders just how many of these nervous corporations have ever sued (insert name of large proprietary software vendor here) successfully. Oh well.

Meanwhile, here's this week's recommended reading:

• This article in Salon Magazine is one of the best LinuxWorld pieces we have seen thus far. Worth a read. "The basis for the decision to highlight Oracle was obvious, but the effect was unfortunate. Mark Jarvis, the Oracle VP, gave a slick presentation pushing the merits of Oracle database software, with a few obligatory references to Linux. The response from the audience was tepid -- they clearly hadn't come to LinuxWorld to listen to advertisements for Oracle software..." (Thanks to Peter Link).

• Wired News writes about Richard Stallman at LinuxWorld. "Like a Russian revolutionary erased from a photograph, he is being written out of history. Stallman is the originator of the free-software movement and the GNU/Linux operating system. But you wouldn't know it from reading about LinuxWorld. Linus Torvalds got all the ink." It's actually an interesting and sympathetic article. (Thanks to "llornkcor"). Wired News also published some letters to the editor inspired by this article.

• What should CIO's think of Linux? This ComputerWorld column attempts to give some answers. "Dear Mr. CIO: Your life is difficult enough already. You're grappling with the ever-alarming Y2K, the ever-later W2K (Windows 2000) and a variety of other crises. And now you have to deal with Linux. It's not that Linux is a bad thing. Far from it. Actually, Linux could be one of the best things to have happened to your enterprise in a long time."

• PC Quest's special Linux issue is now online. It contains a long list of Linux-related articles, and gives a good view of how Linux is being used in India.

• Microsoft has started the counterattack. Check out this ZDNet article devoted to the anti-Linux pronouncements of Microsoft's Ed Muth. "The more I study Linux, the weaker I think the value proposition is to consumers." (Thanks to Robert Graziani).

Let's take that last article as a good lead-in to the negative press. It's worth reading this stuff - how else can one be prepared to refute it? Or even, in the case of legitimate criticism, to make things better?

• PC Magazine (UK) has put out an editorial which is fairly critical of Linux. Most of the complaints have to do with usability, but there is also this: "The strength of Linux is also its problem--the general public licence (GPL). While the good thing about the GPL is that everyone can know what changes are made to the kernel, that openness limits what developers will add to the kernel. Why add something that has tremendous commercial value and give it away?" (Thanks to Joe Orton).

• CIO Magazine has an editorial about Linux in the enterprise. "Right now Linux is more Woodstock than Main Street. There aren't enough vendors dedicated to the operating system, and it's kind of hard to sue the surfer in Venice Beach, Calif., who gives you poor Linux advice."

• Here's an Internet Week column saying that all the vendor announcements at LinuxWorld don't necessarily mean a whole lot. "But will Linux find its way into the enterprise and (gasp) the corporate desktop? Don't bet on it. Commercial firms are risk-averse by nature. They are more than willing to pay an OS license for the right to sue somebody if things go wrong."

• Then there is this bizarre opinion column in ComputerWorld HK. "As I understand it, the penguin mascot came to be because Linus Torvalds, the creator of Linux, happens to be particularly fond of penguins. I suppose we can all be thankful that Linus doesn?t have a thing for something really disgusting like maggots or cockroaches..." One assumes this one is meant to be humorous. (Found in LinuxWorld).

Red Hat's new investors were the subject of a few articles. Not very many. To see how times have changed, it can be amusing to go back to our October 1 issue covering Intel's Red Hat investment. Now it's just another day's event...

• The San Francisco Chronicle has an article about the new investments in Red Hat. "`Red Hat will become the premiere flavor of Linux,' said Jon Oltsik of Forrester Research, adding that `this puts Caldera in a really bad position of becoming a second- tier version of Linux.'"

• PC Week reports on the latest investments picked up by Red Hat. "Red Hat's success in lining up enterprise vendors also has made it the target of other Linux distributors that want to standardize the technology under a set of specifications called the Linux Standard Base, or LSB."

• Internet Week also has an article about the new investments.

• News.com covers the investments and speculates that an anti-Red Hat backlash may be building. "The Linux community is sensitive to any one player dominating the open source community. The members of the Linux community who are really libertarian are going to feel affronted that the vendors are starting to...pick the winner in the market"

The tension between "free" and "open source," and the role of Richard Stallman drew some interest this week. Let's aim toward the LinuxWorld articles by starting with these:

• Here's a column about Richard Stallman in the San Jose Mercury. "You may find Stallman's views outside the pale, or simply wrong. I certainly don't share all of his fundamental beliefs. But he and his colleagues have earned the right to be heard."

• EE Times ran a LinuxWorld article concentrating on tensions between free and proprietary software. "The irony of hosting those companies at a Linux show wasn't lost on some. 'What do you see at these trade shows? You see somebody from a company stand up in this room and talk about their proprietary software,' said panelist Larry Wall, creator of the Perl language. 'The issue of `free' is getting lost. It's not getting talked about.'"

• There's a lengthy article about "rifts" in the free software world. It's essentially about Richard Stallman's presence at LinuxWorld. The author doesn't quite grasp the nature of the difference of opinion and paints Stallman as anti-commercial. "By packaging an idea about software development along with value-laden judgments about capitalism and commercialism, Stallman and the FSF risk offending the very people they need to recruit to spread their ideas."

  Internet Week covers the panel discussion. "The disagreement showed the contrast between the dry pragmatism of Torvalds and the revolutionary fervor of Stallman."

  TechWeek talks about the issue, and brings in Bruce Perens as well. Quoting Eric Raymond: "My ideology is: I want software that doesn't suck. We think that's a powerful enough argument for open source without the moralistic tub thumping"

• This week's Unix Riot column in Performance Computing is mostly about LinuxWorld. "Amidst the gaudy (by open-source standards) commercialism going on in the next hall, Stallman's sentiments, while extreme, seemed anachronistically quaint." Despite evidently having been at the "continuing the revolution" panel, the author manages to miss Stallman's point entirely. (Thanks to Alberto Schiavon).

OK, time to hit the rest of the LinuxWorld articles.

• Here's Nicholas Petreley's LinuxWorld column in InfoWorld. "I've overheard a lot of excited hallway chatter about the strong commitment IBM has made to Linux. But when it came time to vote for the show awards, the attendees picked VA Research as the best computer manufacturer. These attendees have not forgotten their roots."

• Also in InfoWorld: this article about the large cluster that IBM demonstrated at LinuxWorld. "The message IBM was trying to convey to users is that Linux has some innate capabilities for linking together parallel computers working in clusters -- not just working, but working robustly using existing hardware and software available off the shelf or on the Web."

• This TechWeb article is about corporate announcements and adoption. "The number of companies using Linux will double over the next 12 months, according to a survey of 166 IT managers last week by InformationWeek Research."

• TechWeb has a summary LinuxWorld article. "While most attendees at LinuxWorld seemed pretty happy about the operating systems' spectacular success, some feared the potentially corrupting influence of money had come back into a process that had previously been ruled by a love of creating good software..."

• TechWeek covers the conference from a commercial point of view. They also have a picture from the exhibit floor. "...behind the cheerleading there was some substance as major players such as Oracle, Compaq, Sun, Computer Associates and IBM displayed their new Linux-based software and hardware."

• Le Monde has a LinuxWorld article (in French) entitled "Linux prepares its world conquest." It's a combination introductory piece and article about Linus's keynote. A partial and painful translation may be had via Babelfish. (Found in NNL).

• Internet World covers LinuxWorld. "...perhaps the most important event of the week was the release of Gnome by the Free Software Foundation and Red Hat. Gnome was praised for making a Linux machine look and feel more like a Mac or a Windows desktop. Gnome (for GNU Network Object Model Environment) comes with a word processor, spreadsheet, database, Web browser, e-mail client, and presentation manager."

• The (Christchurch, NZ) Press ran an articleabout Linus's LinuxWorld keynote. "Linus Torvalds, the 29-year-old Finnish programmer who created the Linux operating system, was greeted like a rock star..."

• There are two articles (in German) in Der Spiegel about LinuxWorld. The first appears to be about Linus and his keynote; the second is about the conference as a whole and some of the exhibitors there. (Thanks to Hartmut Oldenbuerger). Babelfish links are available for the Linus article and the conference article.

• Computer Reseller News has a LinuxWorld piece focussed on corporate announcements. Interestingly: "...Adobe will take a serious look at Linux. It would be 'a piece of cake' to port the applications, [Adobe Chairman] Warnock said."

• Here's an article in Web Review; the author was impressed by what he found on the exhibit floor. "The Corel booth is indistinguishable from a commercial booth at a show like Comdex, with attendees sitting to watch a polished presentation calculated to convince them that Linux is ready right now to run their businesses. Impressively, most of them look like they might actually have businesses."

• InfoWorld has an article about commercial databases on Linux. "As the flood of vendors announcing Linux support at this week's LinuxWorld continues, Oracle, Sybase, and Informix have, as expected, all laid out plans to extend support of the Linux platform on the database level."

• Another article about Linus's LinuxWorld keynote may be found on TechWeb. "...Linux creator Linus Torvalds faced a crowd so friendly it would have made the pope jealous."

• The (Raleigh) News & Observer has an article about LinuxWorld. "To listen to the hackers talk about it, the game with Microsoft is virtually over." (Thanks to John Thacker).

• Two articles in Italian may be found in La Repubblica. the first is a basic introductory piece clearly inspired by LinuxWorld (they give the LinuxWorld logo as that for Linux as a whole); the second is about the GNOME 1.0 release. Babelfish translations available for the intro article and the GNOME article. (Thanks to Massimo Marengo).

• Macleans Magazine ran an article about LinuxWorld. They are a print publication; all that's available online is this abstract. (Thanks to Francis Wong).

• Here's a TechWeb wrapup on the conference, which is mostly a summary of corporate announcements.

Finishing out the LinuxWorld department: here are a few pieces that seem to have been inspired by the conference, even if they don't cover it directly.

• This InfoWorld column is about Linux on the desktop. "...there are still major philosophical issues regarding how a community-based effort such as Linux can continue moving forward and avoid splintering, especially now that it has started to reach critical mass. While efforts to avoid breaking off into multiple directions have been somewhat successful to this point, the entrance of major commercial players and the fiscal issues that will arise may completely change the Linux landscape over the next few years."

• TechWeb writes about Linux certification. "Hairdressers have certification programs, so why shouldn't Linux engineers?"

• Multimédium has run an article (in French) about Corel's distribution intentions. It is somewhat cynical in tone, pointing out that Corel has made few decisions about what graphical interface the distribution will have, or what software will be bundled. Babelfish translation available here. (Found in NNL).

• Inter@ctive Week talks about graphical interfaces on Linux. "...the contenders for the popular user interface under Linux remain KDE and Gnome, and at the moment, Linux experts agree, KDE is in the lead."

• PC Week has run an article about the Linux Standard Base.. "Intel Corp. and Silicon Graphics Inc. are attempting to formalize the unorganized LSB effort initiated by Dan Quinlan of Transmeta Corp., the San Jose company that employs the inventor of Linux, Linus Torvalds. Officials at Hewlett-Packard Co. and Compaq Computer Corp. said they would likely support the effort as well when it becomes more organized."

• CRN also ran an article about certification. "Linux, spreading like wildfire across parts of the computer industry, has sparked an effort by Linux vendors, resellers and computer scientists for a formal Linux certification program."

• The Industry Standard has run an article about the Linux Standard Base. It's evidently based on Daniel Quinlan's talk at LinuxWorld. "Quinlan needs to strike a balance. If the standards body exerts too much control, it might blunt innovation. But without standards, developers won't be assured their applications will run on every version of Linux."

A few introductory pieces:

• Here's A beginner's installation guide to the Linux operating system, published in the Bangkok Post. "If you're a complete beginner to computers and not willing to pay your dues studying manuals and reading lengthy help files, you might want to pass on Linux. That said, there is nothing really all that complicated about installing or running Linux: it's no more difficult than installing and running DOS with Windows 3.1..." (Thanks to Frank Skagemo).

• PC Magazine has put out a very long series about Linux. It includes a great deal of introductory material, and a comparison of four distributions.

• The Milwaukee Journal Sentinel has run a fairly standard introductory article on Linux. "A recent study by First Albany Corp. and the technology consulting firm META Group said Windows NT won't face 'serious competition' from Linux for at least four years. The study said Linux first must overcome 'very compelling weaknesses,' foremost of which is the 'Linux culture.'" (Thanks to Mitchell Blank Jr.)

• Here's a Linux installation article in the "Newtown Bee." "If you have not used at least three versions of PC/MS DOS, don't even consider leaping into Linux. The characterization of Linux as being 'DOS on Steroids' falls short. It is closer to 'DOS on Amphetamines'."

Various other business-oriented articles from this week:

• Forbes Magazine asks about why Intel is investing in Linux. "Intel... is investing in Linux companies because it needs to expand the demand for its chips. With Windows 2000 being delayed, Intel hopes that the trend towards Linux will still keep the demand for its chips intact."

• ZDNet has published a response to Jesse Berst's Don't bet on Linux column from last week. "This is all about making computer technology serve our needs, and not about betting on an underdog. I'm sure Bill is not going away. Just because Microsoft is in a position of dominance, just like IBM before them, doesn't stop Linux and other open source products from taking a major position in the technology landscape."

• This article in Fairfax IT is about SGI's recent open source moves. "The commitment to embrace and extend open source includes the following elements: ... Making Linux the desktop of choice for a wide range of work-station uses."

• Fairfax IT also has an article about SGI's hardware plans in Australia. "Paul Rushton has been appointed to the role of Australian business planning director in charge of the new range of Windows NT and Linux workstations. He intends to develop strategies to push the technology, once the exclusive preserve of high-performance computing enclaves, into the lives of everyday users."

• MSNBC has run a story about Microsoft's real monopoly - office suite software. "Because in all likelihood, you won't be able to view that important Word document or spreadsheet unless you have at least one box in your office running Microsoft Windows and Microsoft Office. So, like a few Linux shops I know of, you keep a Windows box around - because without one, you couldn't do business." (Thanks to Ramana Juvvadi).

• Inter@ctive Week writes about The Fall of Microsoft and the Rise of Linux. "Some Linux strengths, including its small footprint and efficient code base, are strong counters to areas in which Windows NT and the forthcoming Windows 2000 have been heavily criticized. Indeed, many backers believe Linux represents the complete antithesis of NT."

• Here's a ZDNet UK article about W2K and Linux. "...for decision makers contacted by IT Week, Linux is already being considered as a contingency server operating system in the event of Microsoft losing its case against the US Department of Justice." (Thanks to David Killick).

• News.com covers Microsoft's attack on Linux. "While the software giant dismisses the 'open source' operating system as ill-adapted to the marketplace, the company simultaneously holds it up to be a competitor--convenient while Microsoft is fighting off monopoly accusations from the Justice Department." (Found in Slashdot).

• Fairfax IT's OpenLine column talks about IBM's moves and also features a conversation with Caldera's Ransom Love. "Red Hat is tied into a demographic as where Linux is with regards to the technology - they're focused on the developer market. Seventy-two per cent of their market share is 16- to 22-year-olds. The other end of the spectrum is the business market and they have a whole other set of requirements. They deploy business solutions and what is critical is tested, proven integrated and stable solutions."

Finally, a few articles which were hard to categorize elsewhere:

• Byte Magazine is back, now under the CMP umbrella. So now we're once again treated to Jerry Pournelle's Linux installation problems. "Properly installed, Linux and the application 'Samba' can get all your computers talking to each other with less fuss and a lot more efficiency than the NetBEUI networking protocol that Microsoft networks uses by default.... There are other advantages to Linux, which we'll get to when I actually get it running; alas I didn't get that far this month."

• In ComputerWorld: The Secret of Linux. "Linux is just software.Not a revolutionary paradigm shift. Not the end of the software industry or even Microsoft. Not a religion, at least not for corporate IT people. Just another piece of software. Is it the product of radical free-software fanatics? Maybe. Who cares? The politics of Linux's programmers matters not at all to a computer."

• Internet Week talks about the joys of fsck. "The reboot question in Windows is a bit of a double-edged sword. On the one hand, this is one OS that definitely forces you to reboot far too often. On the other hand, it recovers fairly well from sudden resets and shutdowns. For those playing with everyone's favorite OS du jour, Linux, this is definitely not the case."

• Should Linux be written in Java? asks an article on the Javalobby.org site. "Today, if I were to cast my gaze upon the current expanses of the software industry horizons, I would cast Linux as the young Luke Skywalker, a straight shooter fighting evil for the sake of good. I would cast Java as Han Solo, a helpful, reckless scoundrel and mercenary-turned-hero, moved to do good by Skywalker's example." (Thanks to Rob Landley).

• Web Review has put out The Insider's Guide to Zope, an overview of this system. "A few short months after Zope was released as Open Source, developments are churning along at a furious pace, and the Zope community promises to advance the platform on many fronts simultaneously."

• They also have an article on the GIMP. It's a fairly brief overview. "GIMP is a step in the right direction for Linux, making it more accessible and useful for the non-techie community, and helps to pave the path for a non-Microsoft-based world."

• Developers try to keep Linux from forking proclaims a relatively low-clue article in Internet Week. "Michael Tiemann, founder of Cygnus Solutions, a company that makes Linux-development tools, said Linux has defenders besides Torvalds. For instance, Ray Norda, founder of Linux vendor Caldera, already has two lawsuits against Microsoft going right now. If Microsoft or any other large software vendor tried to take off with a proprietary version of Linux, Norda would have the means and motivation to go after them legally for breaking the General Public License, which Linux developers must sign."

• The Journal of Commerce ran a column about the difficulties of getting going with Linux. The authors problems were mitigated somewhat by his discovery of the Gimp. "Even though it's only in its version-1.01 release, the Gimp is in many respects superior to Photoshop. It has a much simpler user interface and it does some things I always wished Photoshop could do, like being able to copy more than one image to the clipboard at a time. And the price is right."

Section Editor: Jon Corbet

See also: last week's Announcements page.

Announcements

Resources

Dan Kaminsky has written a paper on why open source software is "the optimum economic paradigm for software." He's seeking feedback for the next revision.

A new version of the Linux/Alpha FAQ is out. It should eventually find its way onto alphalinux.org; meanwhile it's available on the author's site.

A new list for Linux and aviation applications has been announced. See the announcement for more information and signup details.

A review of "Internet Complete", a Sybex book, has been made available by Rob Slade, the reviewer. The summary judgment seems to be negative, due to poor materials in some sections of the book. He offers "Zen and the Art of the Internet" or "The Internet Book" as other books with similar themes but overall better quality.

The Linux Newbie Administrator Guide has been updated, contents are roughly doubled since the last release. Have a look and see what they have been up to.

A site called "B.AZAR" has put up a lengthy study (in French) on network data processing solutions. It includes an extensive section on Linux with reviews of distributions, office suites, and "groupware." It can be read in English via Babelfish. (Found in NNL).

Events

Sean Reifschneider, from tummy.com, has made available his reports for the second, third and fourth days at LinuxWorld, along with more pictures:

• LinuxWorld Day 2, March 2, 1999
• LinuxWorld Day 3, March 3, 1999
• LinuxWorld Day 4, March 4, 1999

More LinuxWorld Pictures. The folks from AbiSource have put up a LinuxWorld photo page. It suffers from excessive volume and little organization, but still has some good stuff.

Windows refund activities have not stopped altogether. Here's a page put together by "Just Jeff" which advocates taking things to a new level: PC manufacturers who refuse to abide by the EULA and give refunds are to be taken to small claims court. (This site is hosted on Tripod, so don't be surprised by obnoxious popup ads...)

Web sites

User Group News

A new user group is forming in the Red Deer, Alberta, Canada area. See the announcement if you would like to participate.

There is interest in starting a user group in the Burlington, Vermont area. Please see the announcement and get in touch with the instigator if you're interested.

A new user group is also being formed in Hampton Roads, Virginia. See the announcement for details.

Help wanted

The folks at Linuxpower.org are looking for people to help them out in expanding their site. In particular, they are looking for writers to submit material. If you think you can help them out, check out their announcement and drop them a note.

Software Announcements

Our software announcements are provided courtesy of FreshMeat

See also: last week's Back page page.

Linux links of the week

The MetaChart is an accumulation of comparison information between Linux and Windows NT. Not perhaps the most fun everyday reading, but it can be a good source for advocacy material.

Section Editor: Jon Corbet

Letters to the editor

To: editor@lwn.net
Subject: Distribution Inconsistencies FUD
Date: Thu, 04 Mar 99 18:12:59 -0800
From: Dan Benson <bensond@ssds.ucdavis.edu>


I am going to have to disgree with Conrad Sanderson's letter 
to the editor in regards to inconsistencies between GNU/Linux
distributions.  This is indeed a very serious problem.  The LSB
wouldn't have formed if it were not a problem.  I think it is 
an even more serious issue now than ever before.  Let's face it
commercialism in the GNU/Linux community is here.  Companies
have and will port to GNU/Linux.  In fact, many companies
have annouced the various distributions they will be supporting.   
This has created a whole new problem.  If the LSB and it's 
participants are not successful then other "not so big" distributions
will most likely have to conform to the distributions that these
companies are supporting. In my mind this takes away a very large
chunk of free out of freeware.  Sometimes (actually, most of the time)
I think Richard Stallman has it all together and the rest of us 
are nuts.  

Plus, libraries are not the only issue here.  For example, some 
distributions choose to use sysV startup scripts whereas others
prefer bsd based scripts.  This minor detail is not a problem 
for more UNIX types but for a company to support both cannot be 
expected.  A good solution to this would be the way FreeBSD 
handles it, but this is just my opinon.  

Obviously, the LSB isn't the best solution.  The little guy who
wants to be different is always going to get screwed.  But, 
I will say this, I would much rather prefer the LSB making 
the decisions than the most popular GNU/Linux distribution.  

In affect, the Linux community has created not just a single 
UNIX based operating system, but rather several of them.  Even
worse I can't even do something like 'uname -a' to find out what
is being run on a particular machine.

I use GNU/Linux religously, but I am also not blind to the sort 
of problems it faces.  

-Dan

Date: Sat, 27 Feb 1999 14:19:42 +0000
From: Thomas Hudson <thudson@cygnus.com>
To: lwn@lwn.net
Subject: Kudos to Trident

 I'm writing you to let you know of a recent hardware company's
 exceptional support to the GNU/Linux community.

 Trident Microsystems (http://www.tridentmicro.com)
 recently contacted the ALSA developer mailing list to announce that
 they had written ALSA compatible drivers for their 4D Wave PCI sound
 card chipset.  Trident has offered the source for these drivers, as
 well as complete technical documentation for the chipset.  All of
 this material has been provided voluntarily, without external
 pressure, and will be licensed under the GPL and incorporated into
 the ALSA driver suite.  See 
 http://hyppo.screwdriver.net/show.phtml?id=102919
 for the original announcement.

 The Advanced Linux Sound Architecture (ALSA) project 
 (http://alsa.jcu.cz) is
 a project designed to build an architecture for pro-quality sound and
 MIDI applications, from low-level drivers for sound and MIDI hardware
 to high level libraries and sequencers.  The project is committed to
 releasing all work under the GPL.
 
 The 4D Wave chipset is used in the following products:
 
 Company     Product Name
 =======================================
 Addonics    SoundVision (model SV 750)
 AzTech      PCI 64-Q3D
 Best Union  Miss Melody 4DWave PCI
 CHIC        True Sound 4Dwave
 HIS         4DWave PCI
 Jaton       SonicWave 4D
 Paradise    WaveAudio Interactive (Model AWT4DX)
 Promedia    Opera CyberPCI-64
 Shark       Predator4D-PCI
 Stark       PCI
 Warpspeed   ONSpeed 4DWave PCI

 
 You can read more about ALSA and the call to sound card manufacturers
 at http://alsa.jcu.cz/call.html
 
 Thanks,
 Thomas Hudson
 Cygnus Solutions

From: kentdaniels@webtv.net (kent w daniels)
Date: Fri, 5 Mar 1999 14:37:35 -0500 (EST)
To: editor@lwn.net
Subject: Platform support

GIven that Linux is platform-neutral, it is my great hope that as many
Linux users as possible will consider non-Wintel plaftorms in their
purchases.  I think supporting the opposition (AMD, PowerPC, etc.) can
strengthen Linux's market as it can deter the monopolistic business
practices of Microsoft and Intel.  I myself am a Mac user, but also
think Linux very much represents the future.  Apple is likewise
releasing a Unix-based operating system later this year.  This raises
the possibility that these two such operating systems can coexist in
way that could strengthen each other.  I also believe that Linux just
may be the best thing to happen to the Mac plaform, as now consumers
will begin to see Unix in a new light.

Date: Wed, 10 Mar 1999 14:44:58 -0500
From: John Kodis <kodis@jagunet.com>
To: editor@lwn.net
Subject: Editorial on FUD

[ Dear Editor,

  Following are some comments on the spate of "Who do you sue?"
  articles you've cited recently.  Please feel free to use this in
  your editorial column.  Thanks, and keep up the good work. ]

The Linux FUD meme seems to have shifted recently.  In months past,
authors looking for a weak spot in which to jab Linux would bring the
"there's no support" idea to bear.  This theme seems to be dying --
perhaps due to effective refutation, perhaps just due to lack of
novelty.  However, recent weeks have seen a new type of misinformation
rising to the surface.  The current FUD-of-the-week seems to be the
"who do you sue" theme, as typified by the articles you cited from
_CIO Magazine_ and _Internet Week_ (Mar 9).

This concept boggles my mind.  Has there ever been a CIO who
approached his board of directors with an IT business plan along the
lines of:

    "To improve our productivity, we'll standardize on software that's
     known to be unreliable; To insure our long-term viability, we'll
     stick to software that's only available as a binary, so that
     we're completely at the mercy of our software vendors.  

    "This way, if anything goes wrong, we can simply cease operations
     and sit back while our team of lawyers find a way around the
     "We're not responsible" clauses in all our shrink-wrapped
     software, and proceed to sue several of the largest, richest, and
     most litigious corporations in the world for damages."

I wish that authors would learn that writing FUD is like writing any
other form of fiction -- the premise has to be plausible for the story
to be entertaining.

-- John Kodis.

Date: Thu, 04 Mar 1999 22:43:01 -0300
From: Leandro =?iso-8859-1?Q?Guimar=E3es?= Faria Corcete Dutra 
To: editor@lwn.net
Subject: XFree and free riders.

	I wonder if it is Richard M Stallman's (RMS) strong ideas --
and even perhaps sometimes unreasonableness, but I suspect he's right
more often than wrong even about technical issues like EMACS vs XEmacs
and gcc vs egcs -- that generates such hate against the GNU General
Public License (GPL).

	When I read "Liz's XFree86 4.0 session notes" at 
http://lwn.net./1999/0304/a/xfree.html,
the following glared thru the text:

>         The development of X is running into finance difficulties.
> There are very big companies interested in keeping up X, but they are
> annoyed with the "free riders", that so many companies benefit and yet
> don't share in the costs.  I am optimistic that it will continue.  If
> the X effort fails, we'll continue and take over.


	The sad thing is that the free rider problem has largely been
solved by the GNU GPL, and some people refuse to use it because it's
too free or because it's too restrictive.  Even if XFree has
pragmatical reasons for not using GPL, as they need to collaborate
with some stubborn video equipment vendors, the solution has been
offered of GPL'ing everything -- and if the proposal was originally
Stallman's, The Open Group (TOG) had accepted it in principle.  But
the XFree refusal prevented this solution.

	GPL'ing the X Window System would sense because then Sun, IBM,
HP, SCO, Compaq and any other vendors, including the free riders,
would have to face a choice of releasing their source code, falling
behind the latest and greatest releases, or entering into commercial
licensing agreements with TOG, what would very probably supply the
funds necessary for continuing development.

	But it seems that people would rather risk ruining their
life's efforts than saying "I was wrong, perhaps that long-haired fat
RMS guy was right!"  If such stubbornness persists, there are many
GPL'd projects like Y or Berlin which would gladly step into XFree's
place, including backwards compatibility!

	The same solution would apply to TrollTech and its Qt product,
which could be superseded by Gtk.


-- 
Leandro Guimar„es Faria Corcete Dutra
Brasil

Date: Sat, 06 Mar 1999 16:47:19 -0800
To: editor@lwn.net
From: Matt & Kim <patawi@polarcom.com>
Subject: Linux doesn't need Corporations, Corporations need Linux.


Now that all the big companies are (apparently) jumping on the
bandwagon it seems like a good time to say something I've been
thinking about for awhile:


Linux doesn't need Corporations, Corporations need Linux.


Think about it. In less than a decade, Linux grew from an academic
curiosity to a world class operating system with some 7 (8,9,10?)
million users. This happened without major corporate involvement. Sure
RedHat has had a significant impact and many good things are coming
out of their involvement RHLabs. But RedHat is a small corporation
relative to the likes of IBM and Compaq.


Why is there such intense capital 'C' Corporate interest in Linux now?


Because they _need_ Linux, or something like it.  Computer software is
now so large and so complex it is impossible for any single company to
develop, and debug, and market, and support. For that matter, it's
probably impossible for a group of companies to do. They are
effectively at war with each other and (long term) cooperation is
against their nature.

Because _they_ need Linux. Billy Borg is assimulating everything in
sight. At the moment, Linux is the only way out. Linux is 'safe'. It
is not owned by any competitors. It is cheap, both in aquisition and
in total cost of ownerhsip. It has a well established and
communicative network of developers, debuggers, and supporters (as in
assistance) with an impressive track record. It is global and
multilingual -- for both humans and computers.


But doesn't Linux 'need' corporations: to become more than hacker's
tool? to get on the desktop? to become mainstream? to achieve world
domination?


Short answer: No.

Linux is already more than a hacker's tool. I'm not a hacker, I don't
program, I don't run a webserver, or do many other things a
"traditional" Linux user might.

Linux is already making inroads on the desktop. Look at Gnome and KDE.
Sure we're not there yet, but I don't have any doubts we won't make
it, and not too far in the future either.

Mainstream? World Domination? From where I sit, it's _inevitable_.
Linux is, or is fast becoming, technically superior to the
alternatives. The Linux development model is the only one which _can_
effectively tie the world's computer system together.

Corporate involvement could potentially make all these things happen
more quickly. I think it more likely they will slow it down as they
apply different strategies to attempt to own or dominate the biggest
piece of the Linux pie. Just look at the browser wars, MSN, and Java
for prime examples. Coming soon to a theater near you.

If Linux really wants a big boost, it should go after Governments
first.

Nothing in this document is orignal. It has all already been said at
one time or another by various people. I think (obviously) it bears
repeating.

A note on 'Linux'. Throughout this document when I use 'Linux' I
really mean the whole community of people and organizations who are
working on and using GNU Utilities, FreeBSD, XFree86, OpenSource and
all the other libertarian development efforts. Linux currently has the
highest profile and has become, to my mind, the flagship.

That's all,

<a href="mailto:matt.wilkie@gov.yk.ca">-matt</a>

Date: 6 Mar 1999 02:02:12 -0000
From: Eric Smith <eric@brouhaha.com>
To: editor@lwn.net
Subject: Cobalt web server security hole

In your 4-MAR-1999 issue, you quoted a Wired News article:

"Vivek Mehra, vice president of product development at Cobalt, said
 the hole, which could give a hacker access to a history file
 documenting a user's activities, wasn't specific to their appliance,
 but to the Linux operating system."

This statement is very inaccurate, and this is not your error or
Wired's, but rather shows that Mr. Mehra is not well versed in how his
product compares to other real-world Linux systems.  In point of fact,
this weakness *IS* specific to their appliance.

Most Linux-based web servers use the Apache web server.  By default,
they do not serve the user's home directory, so this weakness will not
be available for exploitation.  A sysadmin would have to explicity
change the "UserDir" directive in the Apache configuration file to
make this happen.  If Cobalt's product serves up user home directories
by default, that is a brain-damaged decision on their part, not a
weakness of Linux or Apache.

And this weakness of the Cobalt's default configuration doesn't only
compromise the "root" user; it could be used to attack any user's
account.

The default configuration of Apache (not that of the Cobalt product)
is generally quite good, however, there are optional modules that can
improve on it.  For example, on my server I run a module called
"disallow_id", which I have used to prevent Apache from *ever* serving
files owned by root.

Eric Smith
http://www.brouhaha.com/~eric/

Date: Tue, 09 Mar 1999 11:31:51 -0600
From: Craig Goodrich <craig@airnet.net>
To: Ellis Booker <ebooker@cmp.com>
Subject: Vendor Interests are Driving Linux...

[ref http://www.internetwk.com/columns/pers030899.htm ]

... is an excellent column; it should be required
reading for everyone in this crazy biz.  Thanks.

I do have one minor quibble, though:

> But will Linux find its way into the enterprise and (gasp) the
> corporate desktop? Don't bet on it. Commercial firms are
> risk-averse by nature. They are more than willing to pay an OS
> license for the right to sue somebody if things go wrong.

Well, OK, that's a good restatement of the conventional
wisdom, and it's hard to argue with it.  I've been hearing
it for over a year now, and Lord knows our society isn't 
getting any less litigious.  

On the other hand, though, Microsoft has [whatever -- 85%?
90%? 112%?] of the desktop OS market, with products that are 
by near-universal agreement buggy and crash-prone.  Simply 
running Word 6 for an hour on a moderately complex document
would lock up the machine and mulch the doc file back in
1993, and the newer versions are not a whole lot better,
modulo the more complex documents they're supposed to handle.

Windows NT4, Microsoft's paradigm for the enterprise, 
literally leaves a Navy ship dead in the water.  

Microsoft announces the availability of a fix for a bug that's
been in Win95 since it was Chicago.  The bug crashes the OS
when the 32-bit millisecond uptime counter rolls over at
49.7 days; nobody had noticed it in five years because nobody
_even at Microsoft_ had ever managed to keep Win95 up that long 
in the first place.

And yet -- when was the last time you heard of some corporation
suing Microsoft for lost time and productivity?  Maybe it's
happened, but in over a decade I've never heard of it.  The
corporations have simply learned to accept bugs and crashes
and lost work the way they've learned to accept theft of 
paper clips and legal pads.  And Microsoft's reputation for 
support is hardly anything to brag about....

Now, the PC revolution of the '80s involved a corporate culture
shift in the way computing was perceived.  I can still remember
columns pointing out that when all was said and done, corporations
would never entrust their mission-critical data to desktop toys.  
(Many of them did -- possibly most of them -- and it may have been
a mistake, but that's beside the point.)  Embracing Linux at the
server level, then sneaking it into engineering departments,
may lead to yet another culture shift.  

There are some fairly serious but not insuperable problems 
remaining for Linux on the average corporate desktop --
installation is infinitely easier now than it was when I started
using Linux a few short years ago, but it's still 'way over the
head of users who have never installed _anything_; office 
automation tools are few -- though Applix, Star Office, and 
Corel's forthcoming Word Perfect Suite (not to mention whatever 
Lotus does) will make the effective range of choice wider for 
Linux than it is for Windows, where MS Office so dominates the 
market that it might as well be the _only_ choice.  And then of 
course there's the longstanding problem of X configuration and 
(still!) printing.

But all of this stuff is being worked on, and at a frenetic pace.
KDE is already a polished product; Gnome is coming along quite
nicely (in fits and starts, like everything else in the open 
source field); the various distributions are competing with each 
other in painlessness and elegance of installation, and the Big 
Boys are starting to throw their weight (and their software 
engineers) around.

So I dunno.  Looking back over twenty years as a techie, the 
only dependable truths I'm left with are a) it'll always be
cheaper and faster next year, unless it's from Microsoft, and
b) all predictions about what'll happen next in this silly 
business are very likely to be wrong.

Thanks again for the column, keep up the good work --

Craig

=============================
Craig Goodrich 
Rural Village Systems
somewhere in the woods near Huntsville, Alabama

Politics for the Thinking Redneck -- http://airnet.net/craig/g4c
Linux miscellany                  -- http://airnet.net/craig/linux