CBS News talks about eBooks and how publishers seem to love the idea but have only one little problem with it: Nobody’s buying the things. Oh, well.

“At a time when many industries are still curtailing spending on high technology, there’s one industry that’s helping out IT companies: the federal government,” says CNet. The article doesn’t say how much of that increased spending will go to Open Source and Free Software.

BBC Sci-Tech “pop” story says, “Sharing songs over the internet has been a headache for the record industry, but this year the focus looks set to shift to the film industry.” Not much news here for NewsForge readers, but an interesting look at how the mainstream (in this case British) media looks at file sharing. At least this story doesn’t use the silly word “piracy” to describe people passing digital files back and forth.

– By Nico Coetzee –

I have read many articles on standards, but it never really seems to
sink in. So, I have asked some friends who are Linux users to comment on
what they feel Linux is short in the area of standards. What follows is
a short description of what my friends and I would like to see included
as a standards base in all Linux distros. Please note that some of
these might already be in the process of being addressed. What follows is
largely an end-user perspective of Linux systems.
The usual stuff: Office documents.

We desperately need a standard file format for word processor documents,
spreadsheets and presentations. HTML has many shortcomings, unless you
start to play with Java, JavaScript and other tools. These obviously
have their technical challenges in a word processor/spreadsheet/presentation environment, but maybe Java is something to look at. XML is
another alternative to consider. The aim of this standard would be to use your favorite office tools, without worrying about file formats.

Internet Software: central configuration

It would be really cool is some developers could create a single
configuration point for all your Web browsers. I personally use
Netscape, Mozilla, Konquerer and Links as my Web browsers — depending on
what system I’m using where. I would like an easy way to share my
personal configuration for these browsers from a single point. This
includes bookmark management. I believe XML is just about the perfect tool for this. I particularly like the Konquerer bookmark format. It’s easy enough to edit in Vi if you had to make minor adjustments.

The same applies to email clients, newsgroup clients, chat, etc. I was
recently in the situation where I lost a SVGA card on my wife’s PC. I had
to fall back to the on-board VGA chip, which was not very good friends
with X, so we lost the pretty GUI. I installed Pine for my wife, so that
see could at least read her email, but I had to go through all the
trouble of setting up her account again. It also took me a while to let
her see all her old mail in Pine as well. As soon as the new SVGA
adapter was installed, it was again a good day and a half to get
everything back to normal. In the email’s case, the need for this standards is not only
account settings, but also the messages themselves.

Window managers: Some interesting needs

This must be one reason I enjoy using Linux — options times
millions! But the greatest challenge is to keep menu systems in sync.
Distributions like Mandrake have done a lot to get this right, and I
believe it’s only a matter of time before all little irritations will
be addressed.

Themes, on the other hand, are specific to a particular window manager.
Wouldn’t it be great if we had a central point from where we could
install and configure themes for all window managers, including
screensaver settings, sounds and keyboard/mouse preferences? I would
really like to see some more progress in this area.

General stuff: SysAdmin

Why does every distro have that “little” difference in where
stuff in the file system in placed? I must say, things are much better than a
couple of years back, but what is starting to irritate me and my friends
a bit is the fact that every distro still has some minor changes with
certain configuration issues. Thanks to SuSE for pulling back to the
mainstream, because it was one confusing system to admin from the
command line!

I also have a need to configure the skeleton directory ( /etc/skel )
with some nice tools. For example, I would like to easy distribute
certain default app settings to the skel directory without it being a
pain, which it is for me at this stage. Together with this should be a
tool to manage all user specific configuration files for each
application. Maybe I should illustrate with an example: We have software
package X installed. We upgrade. There are some major changes in
configuration, etc., and we need to push and integrate the new configs to
all existing user configs. This is a pain. I experienced this moving
from Netscape 4.x to 6.x.

Another final point: There should be a standard for the Linux file system hierarchy.
Together with this, Linux needs a more standard software management system, like RPM, on all systems. I believe there are pros and cons for each system, but a standard would be really nice for users. I must add that this is the single most important reason
why I have not yet tried a non-RPM based system.

Conclusion

Well, there you have it. I am sure you can think of many more areas
where we as a community can benefit from better standards. As I said,
this was a wish list from my friends. I am working on short-term
solutions for some of the stuff, like syncing bookmarks between
browsers, but it will be much easier if all systems could use a single
configuration system.

I also need to thank the developers for Webmin, which I believe is a
great tool for cross-platform sysadmin tasks. The only criticism I have
with this system is that I don’t really trust Web-based administration,
even with SSL. We need more work on the underlying system.

“Commentary” articles are contributed by Linux.com and NewsForge.com readers. The opinions they contain are strictly those held by their authors, and may not be the same as those held by OSDN management. We welcome “Commentary” contributions from anyone who deals with Linux and Open Source at any level, whether as a corporate officer; as a programmer or sysadmin; or as a home/office desktop user. If you would like to write one, please email editors@newsforge.com with “Commentary” in the subject line.

CBS News is reporting that Napster has been sold for $8 million to German media conglomerate Bertelsmann.

From ZDNet:
“In another setback for free speech advocates, hacker magazine 2600 has lost its bid for an appeal of a ruling banning it from posting code that can be
used to crack DVD copy protections.”

From the Chronicle:
“Carnegie Mellon University announced on Thursday the formation of a group of businesses and government agencies to develop higher technical standards
for computer software that would make the software more dependable and less prone to problems such as crashing unexpectedly.”

LinuxWorld: “Even if you don’t have Exchange or an Exchange replacement as your back-end server, Evolution is still a powerful client for scheduling meetings with others who have similar tools. The Palm Pilot sync feature’s the best for Linux users, too.” Read more here.

Red Hat: “Imlib versions prior to 1.9.13 would fall back to loading images via the NetPBM package, which has various problems making it unsuitable for loading untrusted images. Imlib 1.9.13 also fixes various problems in arguments passed to malloc(). These problems may allow attackers to construct images that, when loaded by a viewer using Imlib, could cause crashes or potentially the execution of arbitrary code.

---------------------------------------------------------------------
                   Red Hat, Inc. Red Hat Security Advisory

Synopsis:          New imlib packages available
Advisory ID:       RHSA-2002:048-14
Issue date:        2002-03-15
Updated on:        2002-05-16
Product:           Red Hat Linux
Keywords:          imlib netpbm untrusted image
Cross references:  
Obsoletes:         
---------------------------------------------------------------------

1. Topic:

Updated imlib packages are now available for Red Hat Linux 6.2, 7,
7.1 and 7.2 which fix potential problems loading untrusted images.

2. Relevant releases/architectures:

Red Hat Linux 6.2 - alpha, i386, sparc

Red Hat Linux 7.0 - alpha, i386

Red Hat Linux 7.1 - alpha, i386, ia64

Red Hat Linux 7.2 - i386, ia64

3. Problem description:

Imlib versions prior to 1.9.13 would fall back to loading images
via the NetPBM package, which has various problems making it
unsuitable for loading untrusted images. Imlib 1.9.13 also fixes
various problems in arguments passed to malloc().

These problems may allow attackers to construct images that,
when loaded by a viewer using Imlib, could cause crashes 
or potentially the execution of arbitrary code.

Users are advised to upgrade to these errata packages, which
contain Imlib 1.9.13.

The Common Vulnerabilities and Exposures project (cve.mitre.org/) has
assigned the names CAN-2002-0167, CAN-2002-0168 to these issues.

[update May 16 2002]
The previous release of this errata fixed the aforementioned security
problems but had a file descriptor leak and a bug which would cause some
applications (such as the Enlightenment window manager) to hang. These
updated packages fix these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory only contains
the desired RPMs.

Please note that this update is also available via Red Hat Network.  Many
people find this an easier way to apply updates.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):



6. RPMs required:

Red Hat Linux 6.2:

SRPMS:
ftp://updates.redhat.com/6.2/en/os/SRPMS/imlib-1.9.13-3.6.x.src.rpm

alpha:
ftp://updates.redhat.com/6.2/en/os/alpha/imlib-1.9.13-3.6.x.alpha.rpmftp://updates.redhat.com/6.2/en/os/alpha/imlib-cfgeditor-1.9.13-3.6.x.alpha.rpmftp://updates.redhat.com/6.2/en/os/alpha/imlib-devel-1.9.13-3.6.x.alpha.rpm

i386:
ftp://updates.redhat.com/6.2/en/os/i386/imlib-1.9.13-3.6.x.i386.rpmftp://updates.redhat.com/6.2/en/os/i386/imlib-cfgeditor-1.9.13-3.6.x.i386.rpmftp://updates.redhat.com/6.2/en/os/i386/imlib-devel-1.9.13-3.6.x.i386.rpm

sparc:
ftp://updates.redhat.com/6.2/en/os/sparc/imlib-1.9.13-3.6.x.sparc.rpmftp://updates.redhat.com/6.2/en/os/sparc/imlib-cfgeditor-1.9.13-3.6.x.sparc.rpmftp://updates.redhat.com/6.2/en/os/sparc/imlib-devel-1.9.13-3.6.x.sparc.rpm

Red Hat Linux 7.0:

SRPMS:
ftp://updates.redhat.com/7.0/en/os/SRPMS/imlib-1.9.13-3.7.x.src.rpm

alpha:
ftp://updates.redhat.com/7.0/en/os/alpha/imlib-1.9.13-3.7.x.alpha.rpmftp://updates.redhat.com/7.0/en/os/alpha/imlib-cfgeditor-1.9.13-3.7.x.alpha.rpmftp://updates.redhat.com/7.0/en/os/alpha/imlib-devel-1.9.13-3.7.x.alpha.rpm

i386:
ftp://updates.redhat.com/7.0/en/os/i386/imlib-1.9.13-3.7.x.i386.rpmftp://updates.redhat.com/7.0/en/os/i386/imlib-cfgeditor-1.9.13-3.7.x.i386.rpmftp://updates.redhat.com/7.0/en/os/i386/imlib-devel-1.9.13-3.7.x.i386.rpm

Red Hat Linux 7.1:

SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/imlib-1.9.13-3.7.x.src.rpm

alpha:
ftp://updates.redhat.com/7.1/en/os/alpha/imlib-1.9.13-3.7.x.alpha.rpmftp://updates.redhat.com/7.1/en/os/alpha/imlib-cfgeditor-1.9.13-3.7.x.alpha.rpmftp://updates.redhat.com/7.1/en/os/alpha/imlib-devel-1.9.13-3.7.x.alpha.rpm

i386:
ftp://updates.redhat.com/7.1/en/os/i386/imlib-1.9.13-3.7.x.i386.rpmftp://updates.redhat.com/7.1/en/os/i386/imlib-cfgeditor-1.9.13-3.7.x.i386.rpmftp://updates.redhat.com/7.1/en/os/i386/imlib-devel-1.9.13-3.7.x.i386.rpm

ia64:
ftp://updates.redhat.com/7.1/en/os/ia64/imlib-1.9.13-3.7.x.ia64.rpmftp://updates.redhat.com/7.1/en/os/ia64/imlib-cfgeditor-1.9.13-3.7.x.ia64.rpmftp://updates.redhat.com/7.1/en/os/ia64/imlib-devel-1.9.13-3.7.x.ia64.rpm

Red Hat Linux 7.2:

SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/imlib-1.9.13-3.7.x.src.rpm

i386:
ftp://updates.redhat.com/7.2/en/os/i386/imlib-1.9.13-3.7.x.i386.rpmftp://updates.redhat.com/7.2/en/os/i386/imlib-cfgeditor-1.9.13-3.7.x.i386.rpmftp://updates.redhat.com/7.2/en/os/i386/imlib-devel-1.9.13-3.7.x.i386.rpm

ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/imlib-1.9.13-3.7.x.ia64.rpmftp://updates.redhat.com/7.2/en/os/ia64/imlib-cfgeditor-1.9.13-3.7.x.ia64.rpmftp://updates.redhat.com/7.2/en/os/ia64/imlib-devel-1.9.13-3.7.x.ia64.rpm



7. Verification:

MD5 sum                          Package Name
--------------------------------------------------------------------------
cef433f2ca3991ed5d1fcdb438875c87 6.2/en/os/SRPMS/imlib-1.9.13-3.6.x.src.rpm
6c81098c2bd8aecee5925b5c9563059e 6.2/en/os/alpha/imlib-1.9.13-3.6.x.alpha.rpm
ef708eefba53428a89b098918fc1f5c9 6.2/en/os/alpha/imlib-cfgeditor-1.9.13-3.6.x.alpha.rpm
8bd564b9ca3cb563cb91b215d06245e2 6.2/en/os/alpha/imlib-devel-1.9.13-3.6.x.alpha.rpm
00d2f77314756d322c38e41256d8f75a 6.2/en/os/i386/imlib-1.9.13-3.6.x.i386.rpm
56dc49765986868bedb48c63e03115bf 6.2/en/os/i386/imlib-cfgeditor-1.9.13-3.6.x.i386.rpm
502d88a9108b35b7ab5a5192695804cf 6.2/en/os/i386/imlib-devel-1.9.13-3.6.x.i386.rpm
5c0c100d96f3bf90c83e76c21e56578c 6.2/en/os/sparc/imlib-1.9.13-3.6.x.sparc.rpm
3dfe831694c5f86b811215415b4b4323 6.2/en/os/sparc/imlib-cfgeditor-1.9.13-3.6.x.sparc.rpm
6ac62d5fcfe5e0113b91926f6234752f 6.2/en/os/sparc/imlib-devel-1.9.13-3.6.x.sparc.rpm
9a9530aaa5147d4575a9e0dd44e06562 7.0/en/os/SRPMS/imlib-1.9.13-3.7.x.src.rpm
1e998967df3844a776ee3c807d1f1470 7.0/en/os/alpha/imlib-1.9.13-3.7.x.alpha.rpm
1c601a7c31b843a13fc0e62fa5a5b7c7 7.0/en/os/alpha/imlib-cfgeditor-1.9.13-3.7.x.alpha.rpm
ce5c342b5b634ab9396ad4cda5a6cbc5 7.0/en/os/alpha/imlib-devel-1.9.13-3.7.x.alpha.rpm
e9061205148e88c2c538063b2b37ecb5 7.0/en/os/i386/imlib-1.9.13-3.7.x.i386.rpm
0479502bf31bbc04591615665a1f5dc9 7.0/en/os/i386/imlib-cfgeditor-1.9.13-3.7.x.i386.rpm
bf3443746edff3b908233f832484f71d 7.0/en/os/i386/imlib-devel-1.9.13-3.7.x.i386.rpm
9a9530aaa5147d4575a9e0dd44e06562 7.1/en/os/SRPMS/imlib-1.9.13-3.7.x.src.rpm
1e998967df3844a776ee3c807d1f1470 7.1/en/os/alpha/imlib-1.9.13-3.7.x.alpha.rpm
1c601a7c31b843a13fc0e62fa5a5b7c7 7.1/en/os/alpha/imlib-cfgeditor-1.9.13-3.7.x.alpha.rpm
ce5c342b5b634ab9396ad4cda5a6cbc5 7.1/en/os/alpha/imlib-devel-1.9.13-3.7.x.alpha.rpm
e9061205148e88c2c538063b2b37ecb5 7.1/en/os/i386/imlib-1.9.13-3.7.x.i386.rpm
0479502bf31bbc04591615665a1f5dc9 7.1/en/os/i386/imlib-cfgeditor-1.9.13-3.7.x.i386.rpm
bf3443746edff3b908233f832484f71d 7.1/en/os/i386/imlib-devel-1.9.13-3.7.x.i386.rpm
d96b563627807679e21fb1c258d73c49 7.1/en/os/ia64/imlib-1.9.13-3.7.x.ia64.rpm
f3878855b0407210ab275aeda1190b3f 7.1/en/os/ia64/imlib-cfgeditor-1.9.13-3.7.x.ia64.rpm
a2cce110cf38d3385cad931cd727a34e 7.1/en/os/ia64/imlib-devel-1.9.13-3.7.x.ia64.rpm
9a9530aaa5147d4575a9e0dd44e06562 7.2/en/os/SRPMS/imlib-1.9.13-3.7.x.src.rpm
e9061205148e88c2c538063b2b37ecb5 7.2/en/os/i386/imlib-1.9.13-3.7.x.i386.rpm
0479502bf31bbc04591615665a1f5dc9 7.2/en/os/i386/imlib-cfgeditor-1.9.13-3.7.x.i386.rpm
bf3443746edff3b908233f832484f71d 7.2/en/os/i386/imlib-devel-1.9.13-3.7.x.i386.rpm
d96b563627807679e21fb1c258d73c49 7.2/en/os/ia64/imlib-1.9.13-3.7.x.ia64.rpm
f3878855b0407210ab275aeda1190b3f 7.2/en/os/ia64/imlib-cfgeditor-1.9.13-3.7.x.ia64.rpm
a2cce110cf38d3385cad931cd727a34e 7.2/en/os/ia64/imlib-devel-1.9.13-3.7.x.ia64.rpm
 

These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at:
    http://www.redhat.com/about/contact/pgpkey.html

You can verify each package with the following command:
    rpm --checksig  <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    rpm --checksig --nogpg <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0167http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0168

The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name(s)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0167 CAN-2002-0168



Copyright(c) 2000, 2001, 2002 Red Hat, Inc.

“The GNOME 2.0 Desktop is a greatly improved user environment for existing
GNOME applications. Enhancements include anti-aliased text and first class
internationalisation support, new accessibility features for disabled users,
and many improvements throughout GNOME’s highly regarded user interface.” Details at LinuxToday.