NewsFactor Network writes “In the world of user interface design, consistency is king. A consistent user interface not only can make a product more intuitive, but also can help users be significantly more productive. Unfortunately, in “user-friendliness” is allowing users to modify the interface of an operating system extensively by applying “skins” or “themes.” I have a different proposal for what to do with most themes: Get rid of them.”

Linux Weekly News is carrying this weeks edition of the Debian Weekly News.

Anonymous Reader writes, “Kai Henning Simensen reviews Trolltech’s Qt Palmtop Environment (recently renamed to ‘Qtopia’) in this article at Embedded Linux Journal Online. This complete palmtop suite, which was selected by Sharp as the operating environment for its Zaurus Linux PDA, offers handwriting recognition, a calendar, an address book, and everything you need in a PDA.”

LinuxSecurity Contributor writes, “Several serious theoretical and practical security vulnerabilities, alleged GPL license violations, and
more were found in Astaro ‘secure’ Linux.”
http://www.linuxsecurity.com/articles/server_secur ity_article-4400.html.

Mikael Pawlo writes “According to Swedish IDG.se, the president of Microsoft Germany is outraged over the Bundestux campaign. He has sent a letter to the campaign workers – some of them members of the German parliament – stating that Microsoft is not a threat to democratic values (as argued by the campaign). Kurt Sibold also states that the only thing achieved through the campaign is a public slander of Microsoft.” You’ll need this if you don’t know German.

KDE.news reports: “The South African National Advisory Council on Innovation
(NACI)
recently
published a document
(pdf version)
with far reaching recommendations about open source and open standards.
The paper contains a narrative on the South African translation project
translate.org.za
which is translating KDE into all 11 official languages of South Africa.”

A reader writes “The Edge Report has posted an interesting article talking about the national security implications of closed source software. While the infiltration of Microsoft by Al Qaeda may have been only a rumor, the article explores a world where this could happen. And guess what? We’re living in it. It closes with a powerful statement: ‘Closed source software vendors, in the name of National Security: Open your Code!'”

TDY writes “In response to developer petition, requests and effort, Beatnik has agreed to move the Beatnik Player for interactive audio on the web to the Open Source community. With this change, the Beatnik Player will continue to get the development work it needs from the Open Source community to support the current and future browser revisions. Beatnik is finalizing the license agreement and hosting locations for the source code to be released, and will have all of this in place by the end of February. The details will be posted on sonify.org as soon as they are available.”

FreeBSD: “A race condition existed where a file could be removed between calling fstatfs() and the point where the file is accessed causing the file descriptor to become invalid. This may allow unprivileged local users to cause a kernel panic. Currently only the procfs filesystem is known to be vulnerable.”

=============================================================================
FreeBSD-SA-02:09                                            Security Advisory
                                                                FreeBSD, Inc.

Topic:          fstatfs race condition may allow local denial of
                service via procfs

Category:       core
Module:         kernel
Announced:      2002-02-06
Credits:        Stefan Esser se@FreeBSD.org>
Affects:        All released versions of FreeBSD prior to 4.5-RELEASE
Corrected:      2002-01-07 20:47:34 UTC (RELENG_4)
                2002-01-17 15:46:46 UTC (RELENG_4_4)
                2002-01-17 15:47:04 UTC (RELENG_4_3)
FreeBSD only:   YES

I.   Background

fstatfs() is a function that retrieves filesystem statistics in the
kernel.  procfs is the process filesystem, which presents a filesystem
interface to the system process table and associated data.

II.  Problem Description

A race condition existed where a file could be removed between calling
fstatfs() and the point where the file is accessed causing the file
descriptor to become invalid.  This may allow unprivileged local users
to cause a kernel panic.  Currently only the procfs filesystem is
known to be vulnerable.

III. Impact

On vulnerable FreeBSD systems where procfs is mounted, unprivileged
local users may be able to cause a kernel panic.

IV.  Workaround

Unmount all instances of the procfs filesystem using the umount(8)
command by performing the following as root:

# umount -f -a -t procfs

Disable the automatic mounting of all instances of procfs in
/etc/fstab, remove or comment out the line(s) of the following form:

proc                    /proc           procfs  rw              0       0

Note that unmounting procfs may have a negative impact on the
operation of the system: under older versions of FreeBSD it is
required for some aspects of the ps(1) command, and unmounting it may
also break use of userland inter-process debuggers such as gdb.  Other
installed binaries including emulated Linux binaries may require access
to procfs for correct operation.

V.   Solution

1) Upgrade your vulnerable FreeBSD system to 4.5-RELEASE or
4.5-STABLE, or the RELENG_4_5, RELENG_4_4, or RELENG_4_3 security
branches dated after their respective correction dates.

2) FreeBSD 4.x systems prior to the correction date:

The following patch has been verified to apply to all FreeBSD 4.x
releases dated prior to the correction date.  This patch may or may
not apply to older, unsupported releases of FreeBSD.

Download the patch and the detached PGP signature from the following
locations, and verify the signature using your PGP utility.

# fetch  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:09/fstatfs.patch
# fetch  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:09/fstatfs.patch.asc

Execute the following commands as root:

# cd /usr/src
# patch -p http://www.freebsd.org/handbook/kernelconfig.html and reboot the
system with the new kernel for the changes to take effect.

If procfs is dynamically loaded by KLD (use the kldstat command to
verify whether this is the case) and the system securelevel has not
been raised, the system can be patched at run-time without
requiring a reboot by the execution of the following commands after
patching the source as described above:

# cd /usr/src/sys/modules/procfs
# make depend && make all install
# umount -f -a -t procfs
# kldunload procfs
# kldload procfs
# mount -a -t procfs

VI.  Correction details

The following list contains the $FreeBSD$ revision numbers of the
file that was corrected in the FreeBSD source.

Path                                                             Revision
  Branch
-------------------------------------------------------------------------
src/sys/kern/vfs_syscalls.c
  HEAD                                                              1.216
  RELENG_4                                                     1.151.2.13
  RELENG_4_4                                                1.151.2.9.2.1
  RELENG_4_3                                                1.151.2.7.2.1
-------------------------------------------------------------------------

VII. References

http://www.FreeBSD.org/cgi/query-pr.cgi?pr=32681>

In this Slashdot thread, ctrimble asks: “I’m the acquisitions editor for a technical publishing company… and part of my job is to determine what books my company should publish… Market research is tough to do in tech books since you need to forcast about a year in advance. So, let me pose the question to you — what kind of books do you want? What spots do you see as needing to be filled? For that matter, do you even want dead-tree books, or are eBooks and/or online documentation sufficient?”