Other stuff:
Daily Updates
Calendar
Linux Stocks Page
Book reviews
Penguin Gallery

Contact us
Archives/search
Use LWN headlines

Recent features:
- RMS Interview
- 2001 Timeline
- O'Reilly Open Source Conference
- OLS 2001
- Gaël Duval
- Kernel Summit
- Singapore Linux Conference
- djbdns

Here is the permanent site for this page.

Leading items and editorials

IBM is installing a Beowulf cluster at the University of New Mexico. This cluster is claimed to be the largest such in the world, and the 24th fastest supercomputer overall (though the Jet cluster may yet surpass it in its later phases). This cluster is called "Los Lobos," which may cause confusion with the longstanding LoBoS (Lots of Boxes on Shelves) cluster running at NIH. Los Lobos will eventually be part of a nationwide network of such clusters, managed as a large "virtual cluster" and made available to researchers. (See also: articles in Wired News, LinuxPlanet, News.com, and from Reuters).

Both of these clusters highlight an increasingly obvious point: traditional supercomputers are in deep trouble. Old-style "big iron" remains unmatched for some tasks, but it simply can not compete with commodity hardware clusters in processing power for the money. For universities, most companies, and many governments there is simply no choice: the only way to get high-end supercomputer performance is via a cluster system.

Companies like HPTi and IBM have seen the money to be made in this area, and are pursuing it vigorously. Expect others to join them. With luck, this activity will lead to more free clustering software as well; the current state of the art is still somewhat primitive. Current clusters tend to run a relatively small number of highly specialized applications; future clusters should be easily usable in a more general way.

One step in that direction might be found in this announcement from Mission Critical Linux. They are preparing a cluster system which is aimed at the financial market. As a result, their PR talks about things like data integrity and high availability. The product will be available (as a two-node cluster) in June.

While Linux clustering still has some ground to cover, there is little doubt that it will get there; the market forces are that strong.

The CyberPatrol case. CyberPatrol is a web-filtering package sold by Microsystems Software, Inc. Included in the package is a list of sites to be blocked; this list was encrypted via a proprietary, closed-source scheme. As is often the case with such schemes, it was poorly done and easily cracked. Two hackers, Eddy L. O. Jansson and Matthew Skala, broke the scheme, and wrote a little utility that people could use to actually look at the CyberPatrol block list. A full analysis of the scheme is available; among other things, it uses an encryption key that is all of eight bits long.

People immediately had a field day, of course, playing with the list. As might be expected, many sites have been blocked for reasons that are, say, unclear. But Microsystems Software and its parent Mattel are not amused. They have hit the courts in an attempt to block the spread of the "cphack" program. Predictably once again, they have succeeded only in calling attention to cphack and spreading it all over the net. It's the DVD story all over again.

They are also sending subpoenas to sites that have put up the software, or that have even linked to it. Among other things, they want lists of everybody who might have downloaded cphack. So much for privacy; hit the wrong link and you can be reported, by court order, to a hostile corporation.

The CyberPatrol people are basing their actions on the reverse engineering clause in CyberPatrol's license. They have sold inferior software that is alleged to protect children; now they want to make it illegal to reveal just how bad that software is. The hood of this car is truly welded shut; it is against the law to look inside to see what you bought.

Companies like Mattel are making the case for free software in a way that the Free Software Foundation can only dream of. Every case like this one - and be sure that there will be more of them - drives home the point: proprietary software restricts freedom in increasingly dangerous ways. It really is a matter of basic freedom. As software plays an ever-larger role in all our lives, do we really want to trust ourselves to something we can't even look at?

(See also: the PoliTech CyberPatrol page and the OpenPGP.net censorship page).

Feature Article: MaxOS Linux. When we heard of yet another Linux distribution, MaxOS Linux, we started routine enquiries to get an idea of the purpose of the distribution and the people behind it. This feature article, MaxOS: A New Linux Distribution from the Ground Up, plumbs into those issues and more in a look at this new distribution out of the frozen north.

Netcraft: Apache now at 60%. The latest Netcraft survey is out. This one shows Apache running on just over 60% of the web for the first time; all of the other major web servers have fallen in market share.

Pre-registration for the CLIQ. Attendees for the Colorado Linux Info Quest are urged to pre-register for the conference by mail or via the secure online registration system. The latest press release anticipates an uncomfortable crowd the morning of the show. "... getting all those people registered in time to catch the keynote will be difficult, even with our automated registration system." Also, credit card payments will only be accepted for pre-registration. Check or cash will be required the day of the event.

Inside this week's Linux Weekly News:

• Security: Process hiding in Linux 2.3.X, news, reports and updates.
• Kernel: 2.3.99-pre surprises, who maintains the ethernet drivers?
• Distributions: Bochs x86 freed, CLE 0.9, deepLinux, ZipSpeak, SuSE 6.4.
• Development: NEdit 5.1 now free software, GUADEC declared a success.
• Commerce: Caldera Systems goes public, Linux stocks go down, Asynchrony's pseudo-open source scheme.
• Back page: Linux links and letters to the editor

This Week's LWN was brought to you by:

• Jonathan Corbet, Executive Editor
• Elizabeth O. Coolbaugh, Managing Editor

See also: last week's Security page.

Security

News and editorials

Some background: /proc/NNN inodes in 2.3 keep a pointer to task_struct (earlier versions used a pid computed from an inode number to look up that pointer during every fs operation). This makes /proc in 2.3 resistant against pid recycling attacks because old fds would always access the original zombified task_struct (that is garbage collected when its reference count drops to zero). Unfortunately, it makes /proc vulnerable to these attacks put upside-down: because the old task_struct pointer is stored in the inode, new fds access the old process as well until the kernel gets rid of the inode but this will not happen until all old fds are closed.

This concern was originally posted to linux-kernel, but garnered no response as of yet. A bit of careful thinking will be needed to fix this problem properly without reintroducing the older vulnerability or creating yet another new one.

Obstacles to Cryptographic Code Exportation Lifting. This LinuxMall article responds to the governmental relaxation regarding cryptographic export regulations. "While encryption restriction and patent law issues are not completely resolved yet, the playing field with the rest of the world is levelling. Better still, the Open Source and Cryptographic software communities are finally seeing real progress in these areas."

Developers Blasted on Security. Rich Pethia, director of the Computer Emergency Response Team (CERT) at Carnegie Mellon University in Pittsburgh, blasted software developers for marketing flawed software in an address to a Congressional panel covered in this Wired news article. "Pethia did not criticize any companies by name in his prepared statement to the panel." Very tactful of him ...

Building a Robust Linux Security Solution (Network Magazine). Here's a Network Magazine article on building secure Linux systems. "If you want to grant your remote users VPN access to your Linux gateway, but you don't want to install (or maintain) IPSec software on their laptops, you are in luck: PopTop is a freely available Point-to-Point Tunneling Protocol (PPTP) server that can act as an end-point for VPN sessions from standard Windows desktops." (Thanks to Flemming S. Johansen).

Security Reports

FreeBSD posted advisories this week for the orville-write port, (local root compromise) and lynx, (remote execution of arbitrary code). They provide a simple workaround for the orville-write port, but recommend removing lynx from the system altogether. "The lynx software is written in a very insecure style and contains numerous potential and several proven security vulnerabilities (publicized on the BugTraq mailing list) exploitable by a malicious server."

Lynx problems were most recently discussed in the September 23rd, 1999 LWN Security Summary, at which point SuSE and Yellow Dog Linux provided updates for this program.

Exploits for the pam-0.68-7 package are being passed around for both Red Hat 6.X and Mandrake 6.X. RPMs for pam-0.68-10 have been around for two months, guys. If you have not already updated, you need to do so now. A note to people using automated tools such as autorpm for installing Red Hat updates: Red Hat has not been linking new updates into the older directories, just providing links to the latest directory in their advisory. As a result, your tools may not be picking up all the updates that they need. The updates for pam-0.68-10 and usermode-1.18 are examples of this.

The Apache project: Jakarta Tomcat. A serious bug has been reported when Tomcat and the Apache web server are used together in order to serve Java Server Pages and Java servlets. Tomcat 3.1 beta 1 has all required fixes applied.

Commercial updates. Cisco has issued an advisory concerning their Secure PIX Firewall concerning its handling of FTP server and client commands which can lead to inappropriate connections being made across the firewall. A fix has been made for its handling of FTP server commands, while the FTP client issue still being worked on. For additional information, check out the BugTraq thread on Extending the FTP "ALG" vulnerability to any FTP client. Note that other firewall products are also likely vulnerable.

Updates

mh/nmh. See discussion in the March 9th, 2000 LWN Security Summary.

• Debian (old)
• Red Hat (old)
• FreeBSD
• TurboLinux

mtr (multi-traceroute). See discussions in the March 16th, 2000 LWN Security Summary.

• Debian (old)
• FreeBSD

dump/restore. See discussion in the March 9th, 2000, LWN Security Summary. This is the first distribution update seen for this problem.

• TurboLinux

Overall, updates for specific Linux distributions appear to be coming more slowly, not more quickly. Of equal concern, the updates that are coming out are not getting installed (witness the pam discussion above). As a result, we are all losing ground as far as security is concerned.

Resources

Security Audit FAQ update. An updated version of the Security Audit FAQ has been released. Jeff Graham asked people to note in particular that the address for FAQ submissions has changed to lsap@demit.net.

Events

Call-for-Papers ACSAC. The call-for-papers for the 16th Annual Computer Security Applications Conference (ACSAC) has been released. ACSAC will be held December 11 - 15, 2000, at the Sheraton Hotel, New Orleans, Louisiana. Deadlines for papers, panels, tutorials and case studies come up in May.

Section Editor: Liz Coolbaugh

Secure Linux Projects
Bastille Linux
Immunix
Khaos Linux
Secure Linux

Security List Archives
Bugtraq Archive
Firewall Wizards Archive
ISN Archive

Distribution-specific links
Caldera Advisories
Conectiva Updates
Debian Alerts
LinuxPPC Security Updates
Mandrake Updates
Red Hat Errata
SuSE Announcements
Yellow Dog Errata

Miscellaneous Resources
CERT
CIAC
Comp Sec News Daily
Crypto-GRAM
Linux Security Audit Project
OpenSSH
OpenSEC
Security Focus
SecurityPortal

See also: last week's Kernel page.

Kernel development

There is a 2.3.99-pre3 prepatch (a pre-prepatch?) available, in its seventh version as of this writing. The patches are actually beginning to look like something from frozen code: this one is made up mostly of a lot of little fixes. There is also a new "hotplug" master configuration option (which controls PCMCIA and other such technologies), 3Dfx Banshee/Voodoo3 frame buffer support, nVidia Riva framebuffer support, a master configuration option for WAN devices, a USB Mustek MDC800 digital camera driver, Sun 3x support, an IEEE-1394 update, a PCMCIA Xircom Tulip ethernet driver, IDE layer tweaks, and a partial merge of NFSv3 client support.

As part of the process of getting 2.4 out, Alan Cox has posted the latest 2.4 jobs list.

The current stable kernel release is still 2.2.14. The latest 2.2.15 prepatch (2.2.15pre15) was released with a comment of "Ok this should be it. I hope." We'll see.

Will 2.4.0 be a "brown paper bag" release? Here's a Technocrat posting that raises that fear. "However, major packages won't compile on it. UDF has serious bugs, causing kernel hangs. In the 2.3.99 stage, the entire filesystem directory tree and initialisation code is being heavily re-written. The kernel configuration code is being re-organised. That is NOT where a program needs to be, when it's just about to be released as a stable package."

It is true that a number of major changes have gone into the kernel in recent times. But nobody (except this LinuxGram story) thinks that the current code will be released as 2.4.0. The quality of what goes out depends very much on the current shakedown period. The more people who test out the 2.3.99-pre kernels and report on their experiences, the better the end result will be.

The addition of master configuration options for broad subsections of the kernel code is still going on, and creating a bit of confusion. 2.3.99-pre1 added the CONFIG_IDE configuration option; if this option is not set, the entire IDE subsystem is compiled out of the kernel. A number of people are evidently missing this option when upgrading, then wondering why their systems don't boot anymore. When upgrading to the 2.3.99-pre kernels, pay attention to the new options.

A new reiserfs patch is available, see the announcement for details. The reiserfs debate continues, with its proponents still hoping to get it into the 2.4 kernel. The reiserfs folks seem to be reaching some sort of understanding with the VFS people, which is a good sign. The latest issues have to do with how reiserfs interacts with NFS; evidently it should work OK for now, but planned changes in the future could change that situation.

Ethernet disconnect. Donald Becker's name is known to just about anybody who is familiar with the kernel code. He has singlehandedly written a large parcentage of the ethernet drivers in the system. Chances are that this web page came to you by way of one of his drivers. Donald's work also did a lot to get the early Beowulf clusters off the ground. It is safe to say that he is one of the founding fathers of Linux.

It is thus unfortunate to see Mr. Becker increasingly isolated from - and in conflict with - the kernel development community. The loss of an important kernel developer seems likely. This state of affairs is the result of a conflict in working styles between Donald and most of the rest of the kernel developers. It's an example of how managing open source development is not always as easy as it might seem.

Donald likes to maintain his drivers separately from the kernel. They have their own web page, mailing lists, and release cycles. Donald's drivers are explicitly portable across kernel versions, so that even very old kernels can run modern versions of the driver if need be. His preferred mode of operation would be to simply drop new versions of the drivers into the kernel occasionally as releases dictate. He is unhappy that the driver API has changed a lot (as it has), making cross-version portability difficult. He also seems disgruntled that one of his API changes got rejected in favor of a different implementation.

Linus, instead does not like this mode of operation at all. He always prefers to see small, incremental changes to code that he can understand (and modify or reject if he thinks it's right); getting a whole new driver in one chunk does not suit him. He claims that keeping the driver development separate deprives it of a whole community of testers; putting driver changes into the kernel more often will get them exercised by everybody who installs new kernels, and not just those on the driver development lists. Linus doesn't like to see drivers filled with backward-compatiblity code, and does want to see them updated quickly to new interfaces. Finally, Linus has no qualms about changing interfaces and requiring such updates - the alternative, according to him (and many others) is a kernel that slowly fills with cruft and old, broken interfaces and becomes unmaintainable.

The reason that this issue is coming to a head (again) now is that others, such as Jeff Garzik of MandrakeSoft, have essentially taken over as the maintainers of some of Donald's drivers. To some it may look like a sort of power grab. But the developers involved feel that something had to be done, since the drivers in the kernel simply were not working.

The situation almost looks like a code fork. Donald has his versions off in one corner, while the kernel code is proceeding in a different direction under new maintainers. Depending on your point of view, it could look like an unfortunate rift caused by personality and work-style differences, or like an open source project reacting to fix something that wasn't working. Either way, it is hard on some of the people involved.

The shared memory changes are still causing problems, as reported last week. The main difficulty is an interface change; before it was possible to attach to a shared memory segment that had been removed (as long as you had its ID), the new implementation does not allow this. Anybody who has actually had to work with the unpleasant SYSV shared memory interface knows how easy it is to clutter up the system with dead shm segments that persist forever; the ability to delete them up front is a nice feature.

The latest victim of this change would appear to be XFree86 4.0, which takes advantage of this feature to avoid leaving segments around in the case of an unplanned exit. The number of complaints has been such that it appears, as of this writing, that the old behavior will be restored in 2.3.99-pre3.

The mount-time ext2 block/inode checks are going away if this patch by Ted Ts'o goes in. The check is a simple integrity check performed at mount time; it's why Linux seems to take so long to mount a disk. It has been possible to override the check for years with the check=none option, but that is not the default. The thinking now is that the check serves no useful purpose - fsck does a much more thorough job. So, in the interest of faster boots and smaller kernel code, the checks look like they are on their way out.

Overcommitting of memory by the Linux kernel continues to consume massive amounts of linux-kernel bandwidth, though very few of the participants at this point are actually developers. Memory overcommitting was covered in the March 9 LWN and not much has changed since then. One exception is the creation of the strict memory project, which hopes to inspire the creation of a patch which disables memory overcommitting.

Other patches and updates released this week include:

• modutils 2.3.10 has been released by Keith Owens.

• SUBTERFUGUE 0.1.9 was released by Mike Coleman. It would appear that the kernel patch portion of SUBTERFUGUE is being integrated into the 2.3.99 series, so it should be a part of 2.4.

• Jun Sun of MontaVista Software has announced the availability of a tool for the measurement of interrupt latencies.

• iptables 1.0.0 alpha, the user space side of the new firewalling and masquerading code, has been released. There is also a new set of HOWTOs to go along with this release.

Section Editor: Jonathan Corbet

For other kernel news, see:

• Kernel traffic
• Kernel Newsflash
• Kernel Trap
• Linux 2.5.x Porting help

Other resources:

• Kernel Source Reference
• L-K mailing list FAQ
• Linux-MM
• Linux Scalability Effort
• Kernel Newbies
• Linux Device Drivers

See also: last week's Distributions page.

Distributions

MandrakeSoft frees the Bochs x86 emulator. MandrakeSoft, parent of the Linux-Mandrake distribution, has announced their purchase of the Bochs x86 emulator and its subsequent release under the LGPL. In addition, Kevin Lawton, lead developer for both Bochs and the Plex86 project, a free alternative to VMWare, has joined the MandrakeSoft team. He will be continuing to move forward with the development of Plex86, now with access to the code base for Bochs to speed his team's implementation. "MandrakeSoft recognizes the value brought to our Linux users, by offering them an open source way to concurrently run Windows or other PC operating systems", commented Jacques Le Marois, President of MandrakeSoft.

This is certainly a wonderful example of a commercial interest paving the way for the "Right Thing" to happen. It could also be done without money, but in this case, it will happen faster and more easily with the commercial support. In the end, we will all benefit from another free software application with extensive potential uses.

Chinese Linux Extension 0.9 released. Version 0.9 of the Chinese GNU/Linux Extension has been released. This patch brings Chinese language capabilities to much of the Linux system, including GNOME and KDE; the latest version adds a lot of stuff, see the announcement for details. (Thanks to Chih-Wei Huang).

CLE is a GPL'd project, currently optimized for Red Hat and using RPM, but with a Debian port underway. Although not a distribution in and of itself, at least not yet, CLE is included in some Chinese distributions to provide full Chinese support right out of the box.

Along that same lines, Donovan Software has announced its own 64-bit Chinese Linux Distribution, covered in this (Singapore) Business Times article. The new distribution will be called the Chinese Penguin64. A website for the distribution was not provided, though it is supposed to be available for download from http://www.penguin64.org. Although it is not specified in the article, it seems likely that the Chinese Penguin64 distribution is for the UltraSparc platform, as opposed to the Alpha platform or other 64bit systems. This is a conjecture based the information on the website.

Rick Collette starts deepLinux. Rick Collette, formerly the guy behind the SPIRO-Linux distribution, has announced the launch of his new venture, deepLinux. DeepLinux will be primarily focusing on the OEM market, but will include embedded projects involving game systems and network appliances.

ZipSpeak, a Talking Linux Distribution. ZipSpeak, an "Easy-to-Use, Talking Linux Distribution", has been announced. "ZipSpeak is a talking mini-distribution of Linux for blind and visually impaired people, based on version 7.0 of the ZipSlack distribution and version 0.08 of the Speakup screen reader. ZipSpeak is designed to be easily installed on an existing MS-DOS or Windows system, so that the user can start using a talking Linux system with a minimum of difficulty."

When The Big Boys Come To Town (MacDiscussion). Here's a MacDiscussion column about the arrival of new distributions for the PowerPC. "Both Debian Linux and SuSE Linux have in the works distributions that will run on all PCI or better powermacs and various other selected PPC machines. This is where things get interesting. You see, Linux PPC and Yellow Dog Linux are relatively new upstart companies when it comes to the Linux world, and they just do not have the corporate power and user base that both Debian and SuSE boast."

Of course, using the word "corporate power" in conjunction with the volunteer Debian project may seem a bit strange, but given that VA Linux, SGI and O'Reilly have issued joint Debian CDs, it is actually accurate. It will be interesting to see if distributions that are tied to a specific non-Intel platform will continue to thrive as the larger distributions expand their platform support. Note that they very well may continue to survive ... the availability of more manpower to support applications on their platform will help them and companies that heavily depend on a particular hardware platform may find they get better support from a company that also uses their platform exclusively.

LinuxWars: Distribution War III.2 (AboutLinux). AboutLinux has updated its Distribution War article to include Corel's distribution.

Bastille Linux

Caldera OpenLinux

Check out the Commerce Page for more coverage of the Caldera IPO.

Debian GNU/Linux

Sun donates Sparc system to Debian. The Debian Project has received a donation of an UltraSparc 60 dual-CPU system from Sun, accompanied by a large storage array.

Linux-Mandrake

Red Hat Linux

Slackware Linux

New -current version. Courtesy of the new developer forum, we have an announcement of another slackware-current update. "The big one this time is a glibc 2.1.3 package".

SuSE Linux

SuSE Linux 6.4 release coming early April. SuSE has announced that version 6.4 of its distribution will be released on April 3 in Germany, and "approximately two weeks later" elsewhere. SuSE claims great improvements in its YaST administration tool. 6.4 will also include XFree86 4.0 as an optional package for those who want to play with it.

Eye2Eye: Dirk Hohndel of SuSE Linux, Part II (ZDNet). ZDNet UK continues its talk with SuSE's Dirk Hohndel. "I see Windows 2000 as a big chance. If you look at the administration interface, everything changes. Many old applications don't work anymore. So, if a company is considering moving to Windows 2000, they're considering retraining their staff... moving to new applications. That is the point in time when we need to talk to them."

Trinux

TurboLinux

TurboLinux releases IA-64 distribution. TurboLinux announces that an early-release version of its IA-64 distribution is available for download.

TurboLinux unveils system for Intel's Itanium chip (News.com). News.com reports on TurboLinux's IA-64 distribution. "Even Microsoft is paying attention; it was one of the companies that downloaded the TurboLinux OS, said Lonn Johnston, TurboLinux vice president of corporate communications."

WinLinux

WinLinux 2000 ships. WinLinux 2000 is now shipping. WinLinux is a distribution which can run on top of Windows.

Section Editor: Liz Coolbaugh

Please note that not every distribution will show up every week. Only distributions with recent news to report will be listed.

Leading
Caldera OpenLinux
Debian GNU/Linux
Linux-Mandrake
Red Hat
Slackware
SuSE
TurboLinux

Also well-known
ASPLinux
Best Linux
Conectiva Linux
e-smith

Progeny
Rock Linux

Non-technical desktop
easyLinux
Icepack Linux
Independence
LibraNet
Redmond Linux
WinSlack

Education
Boston University
kmLinux
LinuxFromScratch
OpenClassroom
Red Escolar

General Purpose
Alzza Linux
aXon Linux
Bad Penguin Linux
BearOps
Black Cat Linux
BluePoint Linux
BYO Linux
CAEN Linux
Cafe Linux
ChainSaw Linux
Circle MUDLinux
cLIeNUX
Complete Linux
Console Linux
Corel Linux
CRUX
Darkstar Linux
DLite
easyLinux
Elfstone Linux
ESware Linux
Eurielec Linux
eXecutive Linux
Fried Chicken
FTOSX
FullPliant
Gentoo
Go!Linux
HA Linux
Halloween Linux
HispaFuentes
IceLinux
Ivrix
ix86 Linux
J-LINUX
JBLinux
Jurix
KRUD
KSI-Linux
Lanthan Linux
Laonux
LASER5
Leetnux
Linpus Linux
Linux Cyrillic Edition
Linux MLD
LinuxOne OS
LinuxPPP
Linux Pro Plus
Linux-SIS
LNX System
LoopLinux
LSD
Lute Linux
MageNet
Mastodon
MaxOS
minilinux
MSC.Linux

NoMad Linux
Omoikane GNU/Linux
PingOO Linux
Plamo Linux
PLD
Project Ballantain
PROSA
Rabid Squirrel
Repairlix
Root Linux
Scrudgeware
Serial Terminal
Sorcerer
spyLinux
Stampede
Stataboware
TechLinux
TimeSys Linux/RT
Tom Linux
Trinux
Turkuaz
Ute-Linux
VA-enhanced Red Hat
Vine Linux
Virtual Linux
WholeLinux
WinLinux 2000
XTeamLinux
ZipSpeak

Country-specific
Argentina
GNU/Linux Ututo
Britain
Definite Linux
Eridani
China
COSIX
Red Flag
France
Linux/MNIS
Italy
LinuxEspresso
Madeinlinux
Vedova
Spain
Linux Esware
Thailand
Kaiwal Linux
Thai Linux Extension

Related Projects
Chinese Linux Extension

Historical (Non-active)
Dualix
Gentus
Giotto
MCC Interim Linux
OS2000
Storm Linux

See also: last week's Development page.

Development projects

Application of the Week: vigor (Linuxcare). Linuxcare's application of the week this week is vigor. "While you try to get work done with vigor, the paperclip pops up random sayings inside dialog boxes. Of course, you can't continue editing your file until you click the 'OK' button and dismiss the dialog box. Some of my favorite random sayings are, 'Vigor: a compelling argument for pencil and paper,' 'Vigor: because hell was full,' and 'Vigor: putting new limits on productivity.'" (Thanks to author Brett Neely, who says "Sorry this article was a bit late. The paperclip kept interrupting me as I wrote the article!").

Browsers

Netscape's Gecko PR. Netscape has issued a press release saying that the Gecko HTML rendering engine is being adopted by a number of companies, including IBM, Intel, Liberate, NetObjects, Nokia, Red Hat, and Sun Microsystems. "Netscape Gecko is revolutionary because it gives Web developers maximum power to create more powerful Web content and Web applications. It is open source, allowing individual developers to tailor it to their own use, and is designed to operate across multiple platforms, so that it can be deployed on the widest possible range of devices. In addition, Gecko is considerably smaller than the engines of traditional browsers. "

Simultaneously, they also announced that the beta for Netscape version 6, their new Gecko-driven Internet browser, would be made available to the public in the next 25 days.

For a reaction to the latest announcement, check out the comments on Mozillazine or this CNet article.

Education

EduWare for KDE mailing list. A new mailing list has been started by KDE developer Uwe Thiem to allow teachers and programmers to get together and start coordinating projects aimed at education.

LinuxForKids has started a logo contest, for the artists of all ages. Entries are due by April 22nd and prizes are mentioned but not specified.

Linux Professional Institute newsletter. Here is the latest weekly newsletter from the LPI. They have some big news to report this time around: their "exam 102" is now complete, and will be available on April 17. This completes the LPI's exam development for its first level certification. They have also begun development on their second certification level.

Certification and the Linux Professional Institute (LinuxPower). LinuxPower interviews Evan Leibovitch about the Linux Professional Institute. "We can't stress enough that certification, in itself, is only one element in a person's skills assessment. No certification program takes the place of reference checking or thorough interviews. Anyone who hires/contracts someone solely based on certification, ours or anyone else's, is likely to be dissatisfied."

Games

Open Game Source looks at Beasts. Open Game Source looks at the game 'Beasts', which is not currently under development. "Every gamer, who has been playing for a couple of years, fondly remembers some of his old games. Invariably game programmers attempt to recreate these classics. Beasts is Kevin Turner's remake of one such game. Like many older games the premise is simple yet captivating. 'Push the blocks around and squish the beasts.'"

Heavy Gear II is on the way. Loki Games is now accepting pre-orders for Heavy Gear II for Linux, their first Linux game to support 3D-Audio using OpenAL. It is expected to start shipping on March 31st, 2000. "Get ready for the ultimate in mech experiences: a thrilling combat adventure pitting robot against robot in the distant future is waiting for you. Pit squads of your best mechanized warriors against the enemy to save Terra Nova -- but sheer firepower won't be enough. Use your guile and wits to get behind enemy lines and use your resources to their fullest, before it's too late... " (Thanks to Michael Simms at TuxGames.)

Shadowbane RPG petition. Shadowbane, the first massively-multiplayer online RPG by Wolfpack Studios, is scheduled for release this summer on the Mac and PC platforms. Wolfpack Studios is apparently following the Shadowbane for Linux Petition with interest, since providing a Linux version is a possibility. If you would purchase a copy of Shadowbane for Linux, adding your name to the petition will likely help.

Beta release of the COG Engine. The first beta release of the Cycon Online Gaming Engine (COG) has been announced. "The COG (Cycon Online Gaming) Engine is an Open Source project aimed at simplifying the creation of online video games."

Hand Helds

High Availability

Interoperability

Wine Weekly News. Well, we had problems getting through to Wine headquarters this evening, so we are linking to the Wine Kernel-Cousin instead. From what we've seen in previous weeks, the two are actually identical. So if you can't get to Wine headquarters, trying rolling over to Linuxcare and checking there instead.

Network Management

Of course, we first announced OpenNMS.org on March 9th, 2000.

Office Applications

Siag Office 3.3.0. An updated version of the Siag Office Suite has been released. This GPL'd suite includes the spreadsheet Siag, the word processor PW, the animation program Egon, the text editor XedPlus, the file manager Xfiler and the previewer Gvu. The new version is minor, but we wanted to remind people of this package. If you are reviewing free software office packages, Siag should be on your list for consideration. The reports back that we've heard have been mixed, but the issues are somewhat stylistic. Siag was not designed to be a drop-in replacement for people accustomed to the style of the Microsoft or Corel offices suites, but may suit some technical users just fine.

AbiWord Weekly News (March 22nd). This week's AbiWord Weekly News reports good news for namespace support, the LaTex exporter and the Danish translation.

On the Desktop

KDE Development News (March 18th). The latest edition of the KDE Development News covers March 13th through March 18th, 2000. New KDE Icons, experimental Red Hat RPMs, a new programming book for KDE 2.X and more are covered.

More KDE news can be found in the LinuxUK Weekly KDE Roundup, by Jono. "It's good to see a non-core developer's perspective on what we are doing :)", commented Mosfet. Speaking of which, his site, http://www.mosfet.org/, has gone through a nice remodel and he welcomes comments. We like the new design, ourselves, since it makes it easier to link back to specific items that he puts together.

Gimp slides from GUADEC. Sven & Mitch have made available their slides from their Introduction to the Gimp talk at GUADEC. It includes information on upcoming Gimp 1.2 features. (From

GUADEC is over!. The GNOME Users and Developers Conference in Paris was declared much fun and a great success. Havoc Pennington covered the event in this week's Gnome Summary. It appears that a lot of important decisions were made at the event: a nine-person Gnome steering committee was appointed and a Gnome Foundation is being created. " All decisions will still be discussed on gnome-hackers or gnome-devel-list as appropriate. That is, the committee will basically just gather information and maybe come up with proposals, it won't be actually making decisions."

Also in this week's Gnome news was the issuance of the first Telsa Gwynne Bug Crusher Award to Jason Leach. "Telsa wrote in to nominate Jason Leach as the bug-fixing hero of the hour. Jason cleaned a number of pesky gnome-core and gnome-applets bugs out of bugs.gnome.org in a very short timeframe; moreover they were the kind of spit-and-polish bugs that really need to get fixed to give GNOME that finished, professional look."

Search Engines

ht://Dig update. Geoff Hutchison wrote in with another development update for the ht://Dig search engine. He reports that they're still working on squashing a few reported bugs for version 3.2.0b2, which will be coming out shortly. Recently, the subject of indexing double-byte/Unicode documents came up again. Though the main developers still have their hands full, they agree that they'd help anyone interested in working on this. A proposal will likely go up on CoSource.com in an attempt to solicit some interest. Last, a series of "architecture overview" documentation has started to help ease the learning curve for interested new developers, with about one new write-up a week. The documentation is archived at http://dev.htdig.org/internals/.

Science

Website Development

Zope 2.1.6 released. Zope 2.1.6 has been released. It fixes a few problems created by last week's 2.1.5 release, which contained security updates. An upgrade is recommended.

Zope Weekly News. Here's this week's Zope Weekly News, by Mike Pelletier. It covers the new zope releases, and mentions the new Spanish translation of the ZWN.

Section Editor: Liz Coolbaugh

Project Links
Gnome
High Availability
ht://Dig
KDE
MagicPoint
Midgard
Mozilla
YAMS
Wine
Worldforge
Zope

More Information
AppWatch
Freshmeat
LinuxDev

Development tools

The GNU Fortran 95 project. Toon Moone wrote in to point us at the GNU Fortran 95 project. These folks intend to take the successful g77 code and update it to the latest Fortran standard. They have a way to go yet, but never underestimate the determination of a Fortran programmer. There is code downloadable now, but don't expect it to gracefully handle your Fortran 95 code quite yet.

Java

Blackdown Java3D 1.1.3 API. The Blackdown team announced the release of the Java3D 1.1.3 API (RC1) on March 10th.

The Tritonus Java Sound API. Version 0.1.90 of Tritonus, the Java Sound API implementation for Linux was release on March 18th. New features include the Java Sound API 1.0 interface, full integration of the mp3 decoder, full-duplex recording that works and lots of new MIDI features.

Javascript 1.5 Release Candidate. Javascript 1.5 has reached the release candidate stage.

Simon Phipps, IBM's XML and Java Evangelist. IBMDeveloperWorks has published an interview with Simon Phipps, proclaimed "XML and Java Evangelist" for IBM. "I'm still looking for the source of the quotation that an American president once said: "It is easiest to persuade a man of that which is obvious." We're not telling the industry to use TCP/IP, Web servers, Java, and XML. We're observing they do use these technologies, that they do fit together, and that there is one unifying philosophy underlying them: making things work in a connected world. And we're just going out and doing it."

Multi-threading in Java programs. Neel V. Kumar talks about how easy it is to develop and use threads in Java programs. "Using multiple threads in Java programs is far easier than in C or C++ because of the language-level support offered by the Java programming language."

Perl

Perl drives the US Census Gathering. Perl News reported on the use of Perl in the US Census Bureau. "Lisa Nyman of the U.S. Census Bureau wrote in a note to the Perl advocacy list that 'The Census 2000 Internet Form is a great example of a government agency implementing essential (Constitutional even) operations with perl.'"

PerlMonth #10. The latest edition of PerlMonth is out, complete with a new column by Jeff Boes.

PHP

Python

Tcl/tk

First European Tcl/Tk User Meeting. The first European Tcl/Tk User Meeting will be held in Hamburg-Harburg on the 15th and 16th of June, 2000. Registration is open and a preliminary schedule is available.

Section Editor: Liz Coolbaugh

See also: last week's Commerce page.

Linux and business

• Caldera went public during a market that is hostile to technology stocks in general, and Linux stocks in particular. On the day that Caldera went out, VA Linux fell below $80 and Red Hat went below $60 - both small fractions of their peak values.

• Caldera's IPO had been the subject of a fair amount of less-than-friendly press coverage. To say that it lacked the hype that some of its predecessors had would be an understatement.

(See also: Caldera's press release announcing the IPO).

Do depressed Linux stock values signal the end of the party? One could easily tend toward pessimism. LWN's Linux Stock Index, which peaked at over 200, is now below 120. VA Linux systems is down below a quarter of its peak value; Red Hat, Cobalt, and Andover are below half their peaks. It must be hard times in the world of Linux business.

Or maybe not. One could just as easily say that the stock values of last December were an irrational aberration and that some sort of reality is now returning to the field. Was Red Hat ever really worth almost $20 billion? The values of most Linux stocks are still high in any sort of absolute terms. If they had reached their current values from below, how many people would really be disappointed?

The return of reality can only be a good thing. Linux will not take over the world tomorrow. No one company will ever dominate the Linux market. It makes no sense to value Linux stocks so highly, and it distorts a lot of things. It attracts companies like LinuxOne. Maybe now Linux company CEO's can dream a little less about becoming instant billionaires and get on with the business of making their companies actually work.

New Linuxcare S-1 filing Linuxcare has submitted a new S-1 (IPO) filing ending a period of silence from that direction. There is little exciting to be found therein - the price range remains $11-13. The new filing does much more strongly emphasize that the director and officers will own 57.7% of the company; states that they are now approved to use the LXCR symbol; lists, among the risk factors, that the widespread use of the term "Linux" could cause confusion; removes references to agreements with Creative Computing, Informix, and Viviance; removes the staff list showing their prominent developers; and lists expiration dates for their big contracts (all in 2000).

SourceForge - with a twist? A site called Asynchrony.com has announced its existence. Asynchrony seems to think that it can harness open source style software development methodologies for proprietary projects; it seems that perhaps they do not entirely understand what makes open source work.

Asynchrony hosts development projects, much like SourceForge does. Only, in most cases, the source code is kept proprietary; only developers who have been accepted into the project have access. Each developer is assigned a number of "shares" in the project. If and when the project makes money, it gets paid back to the developers based on how many shares they have.

Marketing and sales are handled by Asynchrony. The company also, crucially, claims ownership of all code hosted on its site.

Asynchrony may well establish itself as a way to publicise and recruit developers worldwide for proprietary projects - there might just be a market there. But, despite its pretensions, it is not hosting anything that looks like an open source development process. It is simply providing outsourcing for a number of aspects of the proprietary software business. Too bad they feel the need to splash "Linux" all over their press releases.

Corel announces first quarter results. Corel has announced its first quarter results. They lost $12.4 million on $44.1 million in revenues. The announcements includes a prediction that similar losses will prevail for the next couple of quarters as well. The press conference was characterized by an almost whiny performance by CEO Michael Cowpland, who wanted to know why his company was expected to make money when all those other Linux companies, with high market capitalizations, didn't have to.

Corel has also announced that WordPerfect Office 2000 for Linux is now shipping, and will show up in stores in early April.

TurboLinux developing custom Linux for Chinese Space Agency. TurboLinux has announced that it is developing a custom version of its distribution for the China Aerospace Corporation. No word on what will make this custom version special.

Troll Tech to preview embedded Linux GUI. Troll Tech has announced the preview of a new graphical user interface development library for embedded systems. The library evidently provides the Qt interface to applications, but runs without the X window system. There is no mention of licensing in the press release.

Lineo acquires Moreton Bay. Lineo has announced that it is acquiring Moreton Bay, an Australian firm that does a lot of virtual private network work.

SGI announces digital media SDK. SGI has announced the availability of its digital media software development kit, which works with Irix and Linux both. "dmSDK provides a bridge to enable digital media developers to migrate their applications to Linux."

eSoft and Intel sign network appliance deal. eSoft has announced a deal with Intel to provide its Linux-based "redphish" software for Intel's "Entry-level Communication Applicance Reference Design" platform. Together the two will be marketing the software to OEMs as a ready-to-go system.

'Jini in a Nutshell' released. O'Reilly and Associates has announced the release of Jini in a Nutshell. They have put one chapter on the net for those who want to sample the book.

SCO announces new corporate structure. SCO has announced a corporate restructuring that will, it claims, better enable it to pursue Linux opportunities (among other things).

In a separate release, SCO also announced that its second quarter results will be "significantly lower" than expected. They blame the post-Y2K period for their problems...

Teamware Office for Linux 5.3 Edition 2. Teamware Office is a commercial product from Fujitsu that has been ported to Linux and is available on a free trial basis. Checking out the product comparison page, it has an interesting list of features, including its own web server, backup softare, billing software and more. Not all features are currently working on Linux, but if you've been stymied in your Linux transition by the absence of an equivalent for a proprietary package in these areas, you may want to take a look.

Some folks were amused by the Perl OS spoof we mentioned in the March 9 LWN. In a "truth is stranger than fiction" move, a company called Aestiva has announced a thing called "HTML/OS" - claimed to be the first operating system for the web. "Development is done with HTML, the "Hypertext Markup Language" documents which form the basis for all Web sites. This kind of focus on the Web cannot be accomplished with conventional operating systems since they are hardware-centric, not Web-centric." Upon a closer look, HTML/OS appears to not be an operating system at all, but another processing language which can be embedded into web pages. Sort of like PHP, except that the language is BASIC... But it does run under Linux.

Section Editor: Jon Corbet.

Press Releases:

Open Souce Products:
• Interphase has announced the availability of Linux drivers for its fibre channel adapters. An (unspecified) open source license is claimed for these drivers.

  Commercial Products for Linux:

• Adaptec has announced that its Ultra160 SCSI controllers are supported under Linux on IA-64 systems.

• Agate Technologies, Inc. (FREMONT, Calif.) announced it will soon be releasing its next generation new HotChip, a "hot swap" IDE Plug & Play ASIC (Application Specific Integrated Circuit) chip with software driver, to support the Linux operating system on Intel-based systems.

• Bowstreet (San Francisco) announced the Bowstreet Business Web Factory 2.0, a B2B platform that lets companies grow their businesses on the web.

• Digi International Inc. (MINNEAPOLIS) announced the availability of its DataFire SYNC 2000 Driver Development Kit (DDK).

• GNUware announced the release of PackageIT! 1.0 containing the over 500 megabytes of Linux programs in RPM format for use on most any Linux machine supporting RPM.

• I-Link, Inc. (DRAPER, Utah) announced GateLink open-API programming platform, a "pioneering step in IP Telephony communications".

• Linux Technologies (KANSAS CITY, Kan) announced its suite of packaged open source desktop software applications. Applications are available in several categories including office, business, scientific, network, graphics, games, and multimedia.

• Mortgage Builder Software has announced the availability of its loan origination system for Linux.

• A company called Multiple Zones has announced the opening of its online Linux store.

• QAD announced immediate availability of QAD MFG/PRO version 9.0 enterprise applications for Red Hat Linux 6.0.

• WZIS Store now has WZOLE 4.0N for Linux/X86 (the N means non-commercial). WZOLE stands for Wei Zhong Oriental Language Environment, and this version is free of charge for non-commercial and personal use.

• Zapex Technologies (MOUNTAIN VIEW, Calif.) introduced the ZL-330 Linux-based MPEG-2/Dolby encoder for satellite, video server, Digital Video Broadcast (DVB), and cable applications.

  Products Using Linux:

• EBIZ Enterprises Inc. (SCOTTSDALE, ARIZONA--OTTAWA, ONTARIO) announced its new line of dual boot workstations based on the Corel LINUX OS and Microsoft Windows 98. When turned on, the new dual boot systems initially start in Corel LINUX OS, with a menu-driven option to work in either the Corel LINUX OS or Microsoft Windows 98 operating system.

• EBIZ has announced a new line of server systems - with TurboLinux installed - that will be available from TheLinuxStore.com.

  Java Products:

• Compuware Corporation (SAN JOSE, Calif.) announced the introduction of NuMega DevPartner 2.0 Java Edition.

• Insignia Solutions (FREMONT, Calif.) announced that its has joined the Digital Video Broadcast (DVB) Project to market its accelerated Jeode platform as the premier Java solution for digital set-top box and television applications.

• Java World (SOMERS, N.Y.) called IBM's Java Developer Kit 1.1.8 for Linux the "Best Free Product".

• Level 8 Systems, Inc. announced Geneva Message Queuing for Java.

  Products with Linux Versions:

• AltaVista Company (PALO ALTO, Calif.) announced the immediate availability of AltaVista Search Engine 3.0 for e-business.

• Cohesion Systems, Inc. (WOODSIDE, Calif) announced a new product and pricing structure for their database driven design capture products for Verilog/VHDL, Analog/Full Custom IC, and PCB design environments.

• ConnectCom Solutions, Inc. announced the shipment of its AdvanSys ASB3950U2W "two-in-one" Ultra2 Small Computer Systems Interface (SCSI) board. Drivers are available to support Linux.

• Cycore (SAN MATEO, Calif.) announced the release of Cycore Cult3D 5.0, which delivers the ability to insert 3D graphics into any Microsoft Office or Adobe Acrobat (PDF) document.

• Firstwave Technologies, Inc. (ATLANTA) announced support of Oracle database technology and the Linux and Unix operating systems for Firstwave eRM, a web-based suite of customer/partner relationship management applications.

• Hewlett-Packard Company (SAN FRANCISCO) unveiled the HP Garage Program. The HP Garage Program, supports start-ups in building, running, marketing and financing their businesses.

• ITtoolbox (PHOENIX) announced the launch of Open IT Exchange (OpenITx), a new Internet community hub that lets IT professionals collaborate with each other.

• JNI Corporation (SAN DIEGO) announced it has started shipping the FibreStar FCE2-6410 and FCE2-6412, dual-port PCI-to-Fibre Channel host bus adapters for use in storage systems, servers and other devices.

• JPHI America Inc. (MINNEAPOLIS) announced the launch an upgraded version of its SuiteResponse CRM (customer relationship management) solution, Service 5.01.

• McAfee (SANTA CLARA, Calif.) announced it is shipping new versions of the McAfee VirusScan product for e-businesses and consumers.

• Neoware Systems, Inc. (KING OF PRUSSIA, Pa.) announced that its new NeoStation 3000C and 2300 information appliances have been awarded prestigious PC Magazine Editors' Choice awards.

• NetCentrex (SANTA CLARA, Calif.) unveiled its NetCentrex Platform, a 100% IP Telephony solution.

  Partnerships, Investments and Acquisitions:

• Actuate Corporation announced it has acquired EnterpriseSoft, a developer of Java software products. Actuate plans to support customers and resellers developing applications based around the Java and Linux platforms.

• Digital Island, Inc. (SAN FRANCISCO) announced that Linuxcare, Inc. uses its network services to deliver customer support to Global 1000 companies.

• Eagle Wireless International, Inc. (LEAGUE CITY, Texas) announced the acquisition of etoolz, Inc., a San Antonio-based research and development organization specializing in the development of innovative Java and Linux-based hardware and software technologies for the communications industry.

• Elfstone Software (ROYAL OAK, Mich.) announced a partnership with Frank Kasper and Associates, a distributor of Linux software.

• HotDispatch.com (SAN JOSE, Calif.) launched a new online developer support service with IBM developerWorks, a fast, free online resource dedicated to developers focused on open industry standards.

• Interphase Corporation (DALLAS) announced that LAND-5 Corporation has selected Interphase PowerSAN adapters to provide Fibre Channel SAN connectivity for networks running the Linux operating system.

• Lineo, Inc. (LINDON, Utah) announced an agreement with Coresoft Technologies to deliver a Linux-based computer telephony solution.

• Merlin Software Technologies Inc. (ALTAMONTE SPRINGS, FLORIDA) announced an agreement with Italsel, the leading software distributor in Italy. Italsel will distribute Merlin's PerfectBACKUP+ Linux backup and crash recovery software to its retail channel.

• Microtest, Inc. (PHOENIX) formed a strategic alliance with the Tokyo Electro Acoustics Company (TEAC) to market a new line of network attached storage appliances. TEAC's Data Storage Product Division (DSPD), responsible for continental Europe, will embed Microtest's DiscZerver technology in its new network attached optical servers.

• Moreton Bay LLC and Progressive Systems, Inc. announced their joint development of an embedded firewall appliance solution based on the Progressive Systems Phoenix Adaptive Firewall, which is both ICSA and Linux Labs certified, and the Moreton Bay NETtel embedded Linux Internet VPN router.

• Pervasive Software Inc. (AUSTIN, Texas) announced that it has signed a distribution agreement with Abits Software to distribute Pervasive's Tango 2000 e-business application development software and Pervasive.SQL 2000 database in Latin America.

• Renegade Inc. (TAMPA, Fla.) announced that it has become a Business Partner-Value-Added Reseller for Caldara Systems, Inc.

• A company called sTupidPC has announced that it has received approval as a Red Hat reseller.

• Worldwide Online Corp. (Toronto) announced that the company will join IBM's "Service Provider for e-business" initiative of IBM PartnerWorld, an initiative developed to enable the next generation of Service Providers.

  Linux products at work:

• InfoExpress (Los Altos, CA) released this press release about Sybase using the InfoExpress VTCP/Secure virtual private network (VPN) solution which runs on Red Hat Linux 5.2.

• HostPro (NAMPA, Idaho) announced it is using the Cobalt RaQ 3 server appliance to provide web hosting.

• Neal Nelson & Associates reported that Alcatel used its Linux-based test bed to put all of Alcatel's products through high stress, real-life testing in a controlled lab environment.

• Unify Corporation (SAN JOSE, Calif) and Honeywell Security Products announced that Honeywell Security Products NexSentry StarGaze received an award. NexSentry StarGaze is a next-generation security management system developed using Unify's application development environment for Linux.

  Personnel:

• 1mage Software, Inc. (ENGLEWOOD, Colo.) announced the appointment of James J. Capeless to its Board of Directors.

• Integrated Software & Devices Corporation (SAN JOSE, Calif.) a provider of embedded Linux, Royal Linux and VxWorks software solutions, announced that Art Swift has joined the company as its president and chief operating officer.

• nStor Technologies (SAN DIEGO) announced the appointment of Jonathan Ash as Vice President Marketing.

• OMNIS Technology Corporation (SAN CARLOS, Calif) announced that Bryce J. Burns, an experienced software operations executive, has joined its board of directors. Mr. Burns currently heads the Business Planning and Release Management Group of Novell, Inc. Previously, Burns served as executive vice president and chief operating officer of Caldera Systems, Inc.

• Piranha, Inc. (DALLAS) announced two appointments to Piranha's Board of Directors and the assignment of Nathan McClintock as President of Piranha's wholly owned subsidiary Zideo.com. Piranha, Inc. is a digital workflow technology company providing data compression technology, created on the Linux operating system.

  Other:

• Andover.Net (ACTON, Mass.) announced its network of sites now has more than 3,000,000 unique visitors and over 60,000,000 page impressions on a monthly basis.

• Arkeia Software (CARLSBAD, Calif.) announced that it has expanded its reseller network to now include online software vendors specializing in the Linux operating system.

• Gannett Media Technologies International (Cincinnati) a systems integrator and software developer serving the printing and publishing industry, announced the completion of 19 Linux-based Digital Collections DC3 L-Systems.

• The Linux Business Expo has put out this press release talking about the companies that will be exhibiting at the conference in April.

• Maximum Linux has put out this silly press release drawing attention to its April 11 launch date.

• Navarre has announced that it distributed 33% of all Linux software sold in the second half of 1999.

• Netgem (NEUILLY-SUR-SEINE, France) announced new records in revenues for its second year of commercial operations. Netgem's technology operates on a Linux-based open software platform and a thin-client access device.

• Sair Linux & GNU released this newsletter which recaps several of their more recent press releases.

• SmartForce has announced a series of Linux training courses aimed at Linux Professional Institute and RHCE certification.

Section Editor: Rebecca Sobol.

See also: last week's Linux in the news page.

Linux in the news

LinuxPlanet ran this review of Napster clients for Linux. It's a good discussion of why more openness would be good for the music industry in general. "...without bootlegs, the Grateful Deal and Phish would be playing the blues in some dumpy bar in South San Francisco. Indeed, with the band's official support of sharing performances, it could be argued that the real source of everything Open Source is the Grateful Dead."

The Atlantic writes about software quality or the lack thereof. "The current version of GNU Emacs, version 20.5, comes with many, many additional features -- you can more or less run your computer with it. But -- this is a key point -- you can remove the bells and whistles without breaking the program. By contrast, Microsoft's purpose in expanding Windows is to clamp the new pieces and the old into a seamless whole. Indeed, an important issue in the Microsoft antitrust trial is whether Internet Explorer can be extracted from Windows without crippling the rest of the operating system" (Thanks to Phil Austin).

The American Prospect has run a special issue with several articles on open source. These include Storming the gates by Nathan Newman and Innovation, Regulation, and the Internet by Lawrence Lessig. "The law in open code means that no actor can gain ultimate control over open-source code. Even the kings can't get ultimate control over the code. For example, if Linus Torvalds, father of the Linux kernel, tried to steer GNU/Linux in a way that others in the community rejected, then others in the community could always have removed the offending part and gone on in a different way. This threat constrains the kings; they can only lead where they know the people will follow."

Caldera

Here's USA Today's take on the Caldera IPO. "Industry watchers say that while the market for Linux is still strong, the field is getting crowded, and most Linux companies are unprofitable and have meager revenues. Investors are growing cautious about the prospects for companies that sell what is essentially a free operating system."

News.com looks at Caldera's IPO. "Despite the performance differences, Caldera plans to follow in the footsteps of other publicly traded Linux companies that have used their high stock valuations to acquire other firms in an effort to expand as quickly as possible..."

Here's another News.com take. "While those prices represent an 80 plus percent increase, the company's share price has yet to jump in initial trading like shares of rival Red Hat, the first Linux seller to go public, or fellow Linux companies Cobalt Networks, Andover.Net and VA Linux Systems. Whether or not this means the investor momentum behind Linux is fading, there likely will be a great deal of speculation and analysis over the stock's performance today."

ZDNet chimed in with this article about the delay in Caldera's IPO. "The raised range of Caldera's five million shares signals strong demand for the offering, which may enjoy the Linux euphoria that vaulted Red Hat (Nasdaq: RHAT) and VA Linux (Nasdaq: LNUX) shares."

Here's an Upside column which is skeptical about many current IPOs, and Caldera in particular. "Caldera could have a great future eventually, once it proves itself. Right now, I don't think Caldera is ripe for an IPO. It was really formed in its current state in late 1998 and still has not finished building its management team. If it didn't have the Linux buzzword behind it, I sincerely doubt it would be going public now."

News.com reports on Caldera's IPO process. "That schedule means the IPO likely will take place the same day Caldera releases a new version of its desktop edition of Linux, called eDesktop. The version is part of a two-tier strategy Caldera is taking with its software, aiming one version at servers and one at client computers."

Here's the Deseret News' take on the Caldera Systems IPO. "David Menlow, president of IPOfinancial.com, an IPO newsletter for individual investors, said Caldera is 'at the upper end of the stocks we expect to do well at the beginning.' But, industry insiders agree Caldera will have to do more than make a good first impression."

ZDNet UK sneers at the Caldera Systems IPO. "Put simply, there's nothing terribly distinguishing about Caldera, which is why we're in for a potential so-so IPO. VA Linux and Red Hat have gobbled up much of the mind share, and there may not be room for many more players. Caldera said growing a brand is one of its biggest priorities. And it will need a strong brand to rise above the noise."

Distributions

Upside takes a look at MandrakeSoft. "MandrakeSoft, the company Duval, Lemarois and a few other inside developers built up to take advantage of this phenomenon, has followed a similar trajectory, adding 50 employees in the less than a year. If anything, the company's quick ascent is a sobering indication that the Linux operating system market may be the easiest online marketplace to crash since amateur pornography."

LinuxMall.com looks at the new BSDi. "While highly complimentary, [BSDI marketing director] Rose takes a more challenging tone; he hopes to see BSDI supplant Linux as an operating system by 2001. He gave away no plans to 'steal' people from Linux and acknowledged that many developers write code for both. Instead, he wants to present a 'more compelling case' than Linux in terms of higher visibility, technical support and better services."

Business

Here's News.com's take on the Los Lobos cluster. "Though UNM and its partners in the National Computational Science Alliance intend to use LosLobos for scientific purposes, IBM has its own, more commercial agenda. It believes LosLobos will help researchers adapt this 'cluster' approach to running IBM software for business tasks such as email, database hosting, instant messaging or e-commerce..."

News.com looks at the Netpliance Linux hack. "Netpliance didn't appear to be too worried about the hacks, either. Instead, they're thinking about tapping into the kind of engineering expertise that's hard to hire at start-up companies. 'We are interested in putting together a program to collaborate with the Linux community that essentially harnesses their knowledge,' said Munira Fareed, a spokeswoman for the company."

Here's an article on LinuxMall.com looking at a new Internet TV product. "This year, the Irish can witness every minute of the fashion atrocities Americans commit in their name, thanks to a company based in France called NetGem. NetGem uses a Linux-based open software platform and a thin-client access device to bring the Internet, email, and all the news fit to post to Irish consumers through a box they already have in their homes--the television."

The Ottawa Citizen looks at Corel's latest results. "[Corel CEO Michael Cowpland] urged analysts and shareholders to be patient while waiting for revenues from new Linux-based products, though he admitted the timing 'is not easy to nail.' 'It's not really affecting the values of all the other companies in Linux so I don't see why we should be the only company that has to be currently profitable when none of the others are.'"

News.com looks at VA's latest acquisitions. "VA Linux plans more acquisitions to bolster its Linux computer line, its services and its programming talent, [CEO Larry] Augustin said. Linuxcare, a seller of technical support and consulting services for Linux planning an initial public offering next week, would make sense as an acquisition, but 'I don't think we've had any detailed discussions,' Augustin said."

Here's a TechWeb article about Linux in electronic business applications. "In a CRN survey of 200 solution providers, 49 percent said they will be deploying more e-business solutions on the Linux platform. Forty-one percent said their Linux deployments will stay the same, 8 percent said they were not sure and 2 percent said they expect to deploy fewer e-business solutions on Linux."

For those who haven't already seen it, here's the New York Times article about IBM and Linux. "Yet IBM's strategy can succeed only if Linux, which is distributed free, does become a genuine alternative to Windows or Solaris, thereby putting real pressure on their prices. And Linux has a long way to go.... Even IBM, which plans eventually to use Linux as its unifying Unix platform (shelving AIX), says Linux's true ascendance may not come for five years or so -- until Linux is built up to become more powerful and reliable." (The New York Times is a registration-required site). (Thanks to Marty Leisner).

This osOpinion column sees some potential pitfalls ahead for Linux. "In the United States, a manufacturer of a product ultimately assumes liability for the product that it sells. But in the case of GPL'ed software, no one can be held accountable for the case in which the use of the software results in the loss of life or damage to property or goods. A court might well decide that the use of Open Source software is illegal in the U.S. since no one can be held accountable."

The geeks are taking over, according to this Andover.Net column. "Money begets power and power begets money...and money begets money and power...well, you get the idea. But what of character? Geeks have always been outcasts, tormented, approached with everything from disdain, to fear, to indifference, to not approached at all. Now, suddenly, praise and power fills the void forever left by a lack of nurturing." (Thanks to Cesar A. K. Grossmann).

The Electronic Frontier Foundation has issued an alert for further comments on the Digital Millenium Copyright Act (DMCA). "The US Copyright Office in the Library of Congress has the job of ensuring that implementation of the DMCA does not negatively impact legitimate activities that should remain exempt from DMCA's prohibition on 'circumvention of technological measures that control access to copyrighted works.' The Copyright Office is asking for public comments on its proposed rules and, in this instance, for 'reply comments' on previous comments submitted in an earlier round of testimony." The comment deadline is March 31, 2000. Check it out and help if you can. (found on Slashdot)

AboutLinux did a followup on Microsoft's "seeUthere case study", which profiled a company that had a hard time with Linux. "While I am certain that they had reasons for the design decisions they made, I believe the major portion of their delays would have been eliminated by a different choice of tools, and were not per se a result of choosing Linux; but more due to design and implementation decisions."

ZDNet UK suggests that Microsoft may start giving away Windows CE given all the pressure they are feeling from Linux in the embedded arena. "Microsoft needs to tread cautiously, however. If the company were to claim that making Windows CE available to embedded licensees for free is equivalent to making it open source, then it would incur the wrath of open source advocates. Microsoft rival Sun Microsystems found this out the hard way when it initially attempted to equate its Sun Community Source Licence with the GNU public licence."

As quoted in Wide Open News: in an answer to a question from the audience at Esther Dyson's PC Forum, Steve Ballmer managed a little praise for Linux. "Without elaboration, Ballmer said Microsoft sees Linux as a serious competitor. 'We'll meet in the marketplace,' he said. 'And that will be a better thing for both us and for the Linux community.'"

Here's an article (in German) in MSNBC.de about the German Koordinierungs-und Beratungsstelle fur Informationstechnik, a governmental advisory panel, which has recommended the use of Linux in the German government. English text is available via Babelfish. (Thanks to Berthold Seidel).

Here's a Wired News article about AOL's shutdown of the "Gnutella" project's web site. "After installing the program, users would connect to other 'servant' computers, creating a chain of participating users. This architecture would allow for one-to-one or many-to-many connections, and makes it difficult for administrators to block the software, which occurred recently with Napster on college campuses."

Education

Here's an article on the LinuxMall.com site about the use of Linux in the Beacon School in New York. "There are still other benefits to using an Open Source program. [Beacon School admin Chris] Lehmann says the kids at Beacon learn much more from Linux than computer programming. The Open Source philosophy seems to be contagious."

Doug Loss and Pete St. Onge of SEUL talk about using Linux in education in this Freshmeat editorial. " One of our big dreams is that LUGs around the world will create educational outreach programs where they adopt local schools or school districts and provide the maintenance and support the schools will need. This would be beneficial to the LUGs too, of course, since they'd be creating enthusiastic new users by making Linux work smoothly for the schools. A local LUG/school relationship could make for both stronger LUGs and stronger schools, besides making Linux advocacy easier."

This week's Linuxcare "Dear Lina" column is about automatically starting up programs at boot or login time. "Debian calls the ~/.xsession file when startx, xinit, or xdm is launched, so you can have a consistent X environment. Kudos to the Debian folks for this one!"

LinuxMall.com has put up this article on getting a Linux-related job. "Don't expect to get a job using Linux in a bank, a manufacturing company, or a major retail chain. While you might get lucky, the market isn't quite there yet."

Fragments

Jesse "I always said Linux would be successful" Berst now talks about the skeleton in the Linux closet. He raises the fragmentation attack again, and talks about declining stock values as well. "Now come rumblings that Linux may not be able to sustain that momentum. That it may become another niche OS like Unix, from which it is derived. Incompatible versions -- or forking -- may jeopardize its standing in the IT community. Wall Street is already retreating."

Here's one of those Linux will fragment articles; this one is by ZDNet's Charles Babcock. "Linux advocates, such as evangelist Chris Dibona at VA Linux, and some analysts, say these doubts are unfounded. There are hidden disciplines working beneath the sometimes anarchic surface of the open source code movement to keep Linux from forming competing branches."

Finally

LinuxPlanet reviews ThinkFree Office. "ThinkFree's service premise is simple: give users free software that runs on any platform and provide free Internet-based storage. Now a user can run the application on almost any PC and files can be stored and downloaded from the Internet. This means that users of any operating system--including Linux, which is explicitly supported by ThinkFree--can access office applications remotely without having anything installed locally." (Thanks to R. McGuinness).

A potential poetic epitaph for our current age? Thomas Scoville presents a poem, "Howl.com". "I saw the best minds of my occupation destroyed by venture capital, burned-out, paranoid, postal, dragging themselves through the Cappuccino streets of Palo Alto at Dawn looking for an equity-sharing, stock option fix ..." (Found through EGR.)

Silicon.com has found some "experts" to say that Linux is not secure. "Clive Longbottom, strategy analyst at Strategy Partners, agreed with his analysis, saying the problems are preventing its adoption in secure areas. He said: 'Security needs to be built into the architecture of the operating system. This cannot happen if your source code is publicly available.' He added that the issue could lead to proprietary versions of Linux being developed."

Section Editor: Rebecca Sobol

See also: last week's Announcements page.

Announcements

Resources

LinuxMonth has posted a pair of brief articles on adding shortcuts to your desktop and more ways to add shortcuts to your desktop. They also have an article about the Red Hat Package Manager (RPM).

Linuxvision.com presented SHEBA, "The Complete Arabic/English Enterprise Global Web Solution" on a Linux server.

Events

The real news is at the end of the document: Linux Expo is merging with the Atlanta Linux Showcase.

The Extreme Linux Workshop will be held as part of the Atlanta Linux Showcase next October. A reminder call for papers has gone out; there is now less than a month before the April 17 deadline.

Web sites

EBIZ Enterprises Inc. announced the addition of the "LinuxWired Classifieds" service for www.LinuxWired.net.

User Group News

Software Announcements

Software

Our software announcements are provided courtesy of FreshMeat

See also: last week's Back page page.

Linux links of the week

In a more serious vein, the CounterPane Cryptographic Article Database is the definitive collection of current literature in the cryptographic field. Abstracts are available for the papers, and many (if not most) are available in their entirety. There is much Linux-related material there.

Section Editor: Jon Corbet

Letters to the editor

Date: Thu, 16 Mar 2000 19:51:03 +0000
From: Adam Rice <wysiwyg@glympton.airtime.co.uk>
To: woods@ucar.edu
Cc: letters@lwn.net
Subject: Re: Stallman interview

In a letter to LWN, you wrote:

> You *can* think of free software in those terms, but the reality is
> that only the religious fanatics actually do.
 
*I* think of free software in those terms, and I take great offense at being
referred to as a "religious fanatic". I have come to accept the ethical
argument for free software after many years of using it and listening to the
philosophy of Richard Stallman and others. If you'd spent any time on free
software mailing lists, you'd realise that thousands of people much smarter
than you or I have come to the same conclusion.

Of course, I don't use the ethical arguments at work, but fortunately "it's
free" is remarkably effective by itself.

> I particularly dislike people who imply that there is something evil about
> being paid to develop software or to make a profit from developing
> software.

Please go to http://www.gnu.org and read everything there, particularly the
philosophy section, before spouting your mouth off and showing your
ignorance.

> Not all of us are trust fund babies, some of us have to worry
> about putting food on the table.

I found this particularly offensive. Richard Stallman has sacrificed more
than you can possibly imagine to preserve the freedom and the joy of sharing
software.

You don't have to agree with the free software philosophy to use it. We are
not tyrants. But please, at least do us the courtesy of trying to understand
where we are coming from.

-- 
Adam Rice -- wysiwyg@glympton.airtime.co.uk -- Blackburn, Lancashire, England

Date: Thu, 16 Mar 2000 08:01:28 -0500 (EST)
From: glouis@dynamicro.on.ca
To: letters@lwn.net, woods@ucar.edu
Subject: lwn letter

Hi.
Greg Woods wrote, in this week's lwn:

> Here at work, I would like to introduce Linux into our environment,
> but to do that, I can't argue the open source religion, or my
> managers will look at me like I'm nuts. I will have to present
> practical arguments about capability, reliability and cost savings.  
> *That* is what they will listen to.

Certainly.  I was lucky; late in 1994 I put up a Linux box as the main
gateway when our company first went on the Internet, and I never had to
argue: the capability, reliability and cost saving were all so obvious
as to make argument unnecessary.  Had it been otherwise, the open-source
ideology (it's not a religion per se) would have influenced no-one.

> I particularly dislike people who imply that there is something evil
> about being paid to develop software or to make a profit from
> developing software.

Being paid to develop software is something most of the open-source and
even of the free-software folks hope for; not many of them would buy
into your claim that they call it evil.  Making a profit from developing
software is fine too.  I think what many of those people regard as evil
is taking developed software, charging a high price for it without
providing adequate support, without fixing bugs in reasonable
timeframes, and without otherwise making sure that there is some market
value in it; and by legal restrictions preventing the users from taking
any steps of their own to correct those defects.  I rather sympathize
with that moral stance, though I have for much of my own working life
been paid to develop software, and do not consider myself to be or to
have been evil as a result.

> I would say that if enough value is present in closed source
> software to make it worth the price they are asking, I'll buy it. If
> there isn't, I won't.

Fine if you can tell.  A cautionary tale:  A company for which I work
paid big bucks for ERP software in 1997.  ERP (Enterprise Resource
Planning) is complex; a thorough test is scarcely possible prior to
purchase.  When installed, the software (which had seemed to be suitable
based on demos and on interviews with other user companies) rapidly
proved to be a crock of oats that had already been through the horse.  
Much of its functionality was inaccessible to the users, owing to
software defects that the vendor was "fixing," apparently on a timescale
of years; the VAR wanted us to pay them consulting rates to assist in
debugging.  In due course we wrote that one off, mounted a much more
skeptical, critical and (we thought) thorough evaluation, bought and
installed a second ERP package, and this time we're much happier --
except that we can't run an MRP requirements calculation: it locks up in
an endless loop and generates thousands of bogus job recommendations
till the run is cancelled.  It appears, after many hours of diagnostic
effort on our part, that the product we bought can be run in any
environment other than ours.  MRP runs with an NT server, with a SCO
Unix server, on a standalone Win98 test system -- but it fails on the
high-end operating system for which we bought the ERP software, on which
it was claimed that the software was supported.  I don't think that (at
least on this second occasion) a lack of due diligence contributed
significantly to the dilemma in which we now find ourselves: buggy
software, no prospect of rapid resolution of our showstopper problem,
and no way to take action ourselves to find and correct the software
defect.  Open source would have provided us with that latter option, as
well as with access to other user/developers whose experience and
expertise could have contributed to a solution.

Caveat emptor, you say?  That worked in Roman days, when the commodities
were reasonably inspectable and the playing field was level.  Today's
closed-software emptor -- unless he's a Fortune 500 company -- has no
reasonable way to evaluate the product really thoroughly before buying,
and no reasonable recourse when the purchasing gamble fails.  The only
safe assumption, therefore, is that closed source entails a high risk of
failure that has to be factored into the cost-benefit analysis to which
you allude.

Regards..............
-- 
| G r e g  L o u i s                    | pgp:  keys.pgp.com        |
|   http://www.bgl.nu/~glouis           | id glouis@dynamicro.on.ca |
| "Knowing what thou knowest not is, in |  2BC6 4F5A 6657 FF4E 9FBC |
|   "a sense, omniscience" -- Piet Hein |  5DAA 2304 76A9 CCA6 5B45 |

Date: Fri, 17 Mar 2000 05:08:46 +0000
From: Ruben Leote Mendes <etruben@ua.pt>
To: letters@lwn.net, woods@ucar.edu
Subject: Re: Stallman interview

This is a comment on the letter written by Mr. Greg Woods published in
Linux Weekly News.

In that letter Mr. Woods wrote:
> In a recent online interview, Richard Stallman was quoted as saying:
>
>   "That movement studiously avoids mentioning idealistic concepts such
>   as freedom and community, and as a result most of the
>   newcomers have no idea that you can think of free software in those terms."
>
> You *can* think of free software in those terms, but the reality is
> that only the religious fanatics actually do.

I am very thankful that some "religious fanatics" as you call them put their
time and effort working to make sure that we gain freedom or that we keep
the little freedom that we still have. 
If it weren't for Stallman and the free software movement there would be no
Linux today and we would all be stuck with non-free solutions.

> Sure, if I have a chance to, and should I ever develop something worthy 
> of it, I would want to contribute back to the open source community, but I 
> am in no way *obliged* to do so.

No one is forcing you to do so. What Stallman is requesting is that the
people behind the movement talk about freedom so that newcomers are aware
that freedom is one (in my opinion the main) characteristic of our software.
Then they can think about it and decide if software freedom is important for 
them or not.

> I particularly dislike people who imply that there is something evil about
> being paid to develop software or to make a profit from developing
> software.

Stallman doesn't think that being paid to write software is evil and the
proof is that the Free Software Foundation hires programmers and pays them
to develop software and documentation. That last time I looked they even
had a web page that companies can use to post job openings for free software 
developers.

> Not all of us are trust fund babies, some of us have to worry about putting 
> food on the table.

I think there is enough evidence already that you can make money writing 
free software. I don't think I have to provide any references, just scroll
up and read LWN. 

-- 
Ruben Leote Mendes - etruben@ua.pt

From: Collins_Paul@emc.com
To: letters@lwn.net
Subject: Use of the term "viral" in refernce to the GPL and FDL
Date: Thu, 16 Mar 2000 07:26:33 -0500

The use of the term "viral" with reference to the GPL (and now the FDL) is
unfair and prejudicial.

The GPL is not a virus.  The GPL is written the way it is because otherwise,
others would be able to take away freedoms that you explicitly grant when
you choose to use the GPL.

If you don't like the GPL or the FDL, don't use it.

The choice is yours.

Paul.

-- 
Please note that I speak for no-one but myself.

Date: Fri, 17 Mar 2000 13:09:37 -0500
To: letters@lwn.net
Subject: Virii, Mr. Garfinkel, and users with bad habits
From: Zygo Blaxell <zblaxell@genki.hungrycats.org>


Linux viruses do not need to install themselves as root; simply getting
normal user privileges under Linux is quite enough to be a very successful
and damaging virus.  Remember that Melissa worked without any privileges
except those necessary to run itself, look up email addresses in a
directory, and send email to them.  "Unprivileged" Unix user accounts
have all those privileges and more.

Most unsophisticated (read: non-paranoid) users have the same basic
bad habits that can undermine the security of any operating system.
These users do not understand the requirement for minimal privileges, nor
do they understand the requirement modify their own behavior accordingly.
When I explain the concept of minimal privilege to new users, most of
them agree that it's a good idea in principle, but few will actually
stick to that principle in practice. =20

This is the acid test:  If you were given some amazing new program
without source code or other strictly technical mechanisms for auditing
and controlling the behavior of the program, would you _absolutely_
refuse to use it except in isolation on a stand-alone, non-networked,
dedicated piece of hardware?  If your answer is no, you are a potential
virus host, and probably a DOS threat to the Internet at large to
boot--shame on you!  If your answer is that you would go to the local
used computer vendor and buy a $50 Pentium system with no network card,
just to run the one application in the isolation it deserves, there's
hope for you yet.

Unfortunately, Linux is mostly as vulnerable to virus problems as the
Microsoft operating systems we all love to hate.  Linux is based on a
30-year-old security model which assumes that the user of the system is
the primary security threat, and a threat to other users of the system.
This used to be the case when the ratio of users to applications was
many-to-one.

Today, the ratio of users to applications is one-to-many.  Most machines
have only a single user (or 1.5 users if you count root separately)
and run dozens of different applications by different authors with
different levels of security awareness.  Sadly, the applications
themselves are now usually the greatest security threat, and a thanks to
the Internet they are a threat to other systems as well as other users.

Future operating systems must take this threat into account by
implementing access controls based not only on the user's credentials,
but also those of the application itself.  Java, with all its intrusive
type checking, code verification, and restricted linking features, is
ultimately the right idea, although not the best possible expression
of that idea.  Capabilities flags in the Linux kernel are the same idea
expressed at a different level in the application->library->OS->hardware
heirarchy.  These mechanisms need further development and better
integration by Linux distributors before we will see significant benefit
from them.  Attention marketing types:  Fear of viruses could provide
user-level demand for progress in this area.  Hint.  Hint.  ;-)

Virus detectors will never go away until all software is perfect
on its first release, all hardware never fails, and all users are
trustworthy; however, the virus detection industry as we know it today
will radically change.  We should expect generic virus prevention and
containment features (e.g. automated binary cryptographic signature
checking and much stricter and more fine-grained access controls) to
become part of the operating systems and applications we use; however,
when these systems fail (and they will always fail, sooner or later),
we'll still need some kind of virus detection software to assess the
level of damage and/or assist with cleanup after the root cause of the
problem has been eliminated.

[Insert horrible vision of future versions of Windows bundled with
Microsoft Virus Explorer here...]


Opinions expressed are my own, I don't speak for my employer, and all that.
Encrypted email preferred.  Go ahead, you know you want to.  ;-)
OpenPGP at work: 3528 A66A A62D 7ACE 7258 E561 E665 AA6F 263D 2C3D

Date: 20 Mar 2000 22:25:17 -0000
From: Eric Smith <eric@brouhaha.com>
To: letters@lwn.net
Subject: Clive Longbottom's Linux security claims

On March 20, LWN Daily referenced Silicon.com's finding that "Linux is
not secure", and specifically quoted Clive Longbottom's statement that
"Security needs to be built into the architecture of the operating
system.  This cannot happen if your source code is publicly available."

This statement demonstrates that Mr. Longbottom has no clue whatsoever
as to what makes systems secure.

It is the case that security vulnerabilities in Linux distributions are
found regularly.  The same is true of closed-source operating systems.
Fixes for vulnerabilites are issued regularly for both open-source and
closed-source operating systems.  I've only seen one article comparing
response times from the detection of vulnerabilites to the issuance of
fixes, and it showed that in most cases the fixes for open-source
operating system were available sooner than for closed-source.

The availability of source code does not inherently make an operating
system more secure.  But it does allow the security to be audited by far
more people than will audit a closed-source operating system, and it
allows for far more people to offer fixes for vulnerabilities.

One might expect that with a closed-source operating system, even if
potential vulnerabilites exist, they might be less likely to be found.
However, if you look at Microsoft's track record, it is clear that they
have suffered from *more* detected vulnerabilities than Linux or BSD
variants.

Mr. Longbottom's preference for closed-source operating systems appears
to be based on the concept of "security through obscurity".  Almost all
professional security experts agree that security through obscurity is
not very good security at all.  A proper security system or protocol is
secure even though attackers have intimate knowledge of how the system
works.

I wonder if Mr. Longbottom would make similar claims about Sun's Solaris
operating system, for which source code is also available (although it
is not "free software" or "open-source" as those terms are normally
defined).

The same Silicon.com article quotes Malcolm Beattie of Oxford University
Computer Service as saying that "the open source nature of the OS [...]
is actually its best defence."  Mr. Beattie obviously has a much better
grasp of the nature of system security than Mr. Longbottom.

Sincerely,
Eric Smith