C’est la vie writes: “Description: A cross-site scripting vulnerability was reported in the PHP-Nuke ‘friend.php’ module. A remote user can write HTML code containing malicious javascript that, if executed on another user’s browser, will execute in the security zone of a web site running PHP-Nuke. More at: SecurityTracker“

– By Jeff Field –

Scanners now are relegated to scanning documents and archiving older photographs, while digital cameras are used more and more to take photographs that can be stored on a computer, sent over the Internet, and even printed like normal photographs. Today, I review the Fujifilm FinePix 2300 USB digital camera, and how it functions under Linux.

The camera
The Fujifilm FinePix 2300 is Fujifilm’s entry-level digital camera, replacing the older 1300. The FinePix 2300 is a 2.1 megapixel digital camera, allowing pictures to be in resolutions up to 1600 by 1200 at varying levels of detail. It stores pictures on SmartMedia cards and connects to your PC with a USB port, and it is fully supported under Linux.

The FinePix 2300 is not a camera for the professional photographer. It is a sort of a digital combination of a Polaroid camera and your average consumer-level camera, able to take decent pictures and display them instantly. It does just fine taking your average picture, but someone who needs advanced features such as optical zoom should look somewhere further up the line.

Keeping its purpose in mind, I decided to use the FinePix 2300 for my everyday needs — taking pictures of friends and family (of which I will spare you), taking pictures of my home, and the one that excites me the most, taking pictures of the equipment I am testing while it is in use, not just press photos provided by the companies. I am not a photographer, so I can only tell you about the technical aspect of the camera, ease of use, compatibility, and what I think looks good enough for me. You may have a keener eye than I do, and later in this review is a link to images at Fujifilm’s Web site.

Storage
For storage, the camera uses the less-advanced SmartMedia flavor of flash media. What makes the SmartMedia less advanced is that, unlike some newer varieties of media, SmartMedia does not contain its own controller, but rather relies on the controller in the device using it. On newer, more advanced types of flash media, the card itself contains the controller, meaning that you do not have to worry about whether the device will work with the card. With SmartMedia, on the other hand, some older devices may not function properly with larger or newer cards, because it depends on the electronics of the device. This is not a problem with a newer SmartMedia device such as the FinePix 2300, which can accept SmartMedia cards up to and including 128mb cards. The FinePix 2300 ships with an eight-megabyte card, which is enough for between four and 44 images, depending on the resolution you use.

I chose to purchase a 128-megabyte SmartMedia card from NewEgg.com, where the generic SmartMedia card I bought listed for $46. Fujifilm tries to discourage you by saying it will only “guarantee operation” if you use Fuji SmartMedia, but I had no problems with my generic Mr. Flash SmartMedia, and I doubt you will either. Once I installed the 128MB card, I could hold between 166 (1600 by 1200 “fine” quality resolution) and 1300 (640 by 480) images on the camera at once. I opt to take my pictures at 1600 by 1200 because 166 pictures is still more than I think I’d ever need, unless I had to go a long time without access to a PC.

Connecting to a PC
Connecting the camera to a PC running Linux is easy, assuming you already have USB support compiled for your kernel, either through a module or built-in support. In my case, I had USB support and USB mass storage support compiled as modules. What you need to do in this case is to load usb-storage, by doing “modprobe usb-storage.” Once this is done and the camera is connected and turned on, you need to mount it. The camera’s filesystem is DOS VFAT, so you mount it with a command such as “mount -tvfat /dev/sda1 /mnt/camera,” where /dev/sda1 is the SCSI device USB-storage uses to emulate SCSI access for USB devices and /mnt/camera is where you want the camera to be mounted. Once this is done, you access the camera’s filesystem like any other disk. Images are stored in /dcim/100_fuji on the camera, a naming scheme that is DCF (Design Rule for Camera Filesystems) compliant.

Once you mount the camera, you can copy files to and from it like any other drive; you can even see how much free space there is on it. The only downside to this is that you must remember the camera is not powered by the USB bus, and so it uses the battery power even when connected to a PC. If, like me, you are near an outlet most times you are using the camera, you may consider picking up a 5V AC adapter to work with the camera so you do not waste batteries. Interestingly, because the camera acts as any other drive, you can use it as a portable storage device between PCs that support USB mass storage devices, an interesting benefit.

Battery life
According to the manual, with 50% flash use and standard alkaline batteries, you can take approximately 240 shots with the LCD on, and 730 with the LCD off. My problem is that I have a tendency to leave the camera on when I am not taking pictures, which drains the battery, but if you are careful with this, then it should be less of a problem. Still, the camera seems to go through batteries relatively quickly, and I would recommend picking up an AC adapter and some rechargeable batteries when you purchase the camera.

Ease of use and documentation
I found the camera itself to be very easy to use. The setup function was simple, allowing you to set things such as the date and the resolution images will be taken and stored in. Taking pictures is as easy as with any camera as long as you have it in camera mode, and not preview, which is easy to accidentally select. The menus you can use to change the flash and other settings while taking a picture can be somewhat confusing due to their use of symbols instead of text, but once you read the manual and figure out what everything means, it becomes clear.

The manual included with the camera covers all aspects of the camera’s use, which is useful to me because I am a novice photographer. The manual is well written and easy to understand. I found it was necessary to read the manual in order to discover such features as red-eye elimination, and the various other flash settings, as well as how to use the digital zoom, so I suggest you take a few minutes to read the manual before using the camera.

Image quality
The image quality on the camera, to me at least, seemed very good. Taking pictures in most environments proved no problem, although I tend to take pictures of computer equipment and not people. Fuji, however, has some sample images available on its product page for the 2300, and those images were consistent to the level of quality I encountered when photographing equipment. Overall, I found little difference between “fine” and “basic” compression settings (these translate into 1/5 and 1/20 compression ratios at 1600 by 1200) and so most of my shots are taken in basic, although your tastes may differ. The lower the setting, the lower the file size, and though I have plenty of storage on the camera, it takes much less time to copy and work with the smaller files.

While discussing image quality, I will also touch on the digital zooming available on the camera. The digital zoom on the FinePix 2300 is the only type of zoom available, and it adds noticeable pixels to the pictures. If you think you will need zoom, I would suggest looking at a higher model with optical zoom, which uses the lens instead of just digitally enlarging the image.

Conclusion
The Fujifilm FinePix 2300 is an excellent entry-level digital camera for Linux users, an excellent first step into digital photography. The only feature I missed was optical zoom, not that I found it terribly important. Overall, the FinePix 2300 did everything I needed from a digital camera, allowing me to take pictures to send to friends and family easily. As I’m home over the holidays I will be using this camera to take pictures of friends and family, and in conjunction with my laptop running Mandrake can show them the pictures as they are taken. I was able to find the FinePix 2300 online for about $220 before shipping at Pricewatch and MySimon, and I have seen it at local retailers for a slightly higher price.

IDG (on CNN) predicts the factors that will change PCs the most in 2002. Among them: Peer-to-peer networking, next generation instant messaging, and distributed computing.

Anonymous Reader writes, “S. Claus takes issue with user demands. He insists that from now on, wish lists should be submitted in well-formed XML, and offers good and unusual last-minute suggestions for the computer bookworms on your list. Read it here at DesktopLinux.com.”

CNet has a package of stories on mainstream tech leader types. Among those mentioned is Microsoft’s Bill Gates, and his criticism of Open Source licensing. It’s a rehash of a June interview where Gates is asked about Linux and Open Source, in which he criticizes Open Source for not creating the jobs that commercial software does.

jocelyn@rocklinux.org writes, ROCK Linux announces the release of version 1.5.12 (DEV). This release is based on the Linux Kernel 2.4.14, glibc 2.2.4, binutils 2.11.92.0.10 and gcc 2.95.3. A list of download sites is available at http://www.rocklinux.org/getting.html. Changelogs are at http://www2.rocklinux.org/changelog/. For documentation and information about ROCK Linux, please visit the ROCK Web site http://www.rocklinux.org.

Anonymous Reader writes, “I just read an insteresting article over here (at DesignTechnica.com) about a new weather super computer that IBM is building. The whole goal of this super computer is to help in weather predictions and forecasts. Apparently this system is capable of achieving seven teraflops, or seven trillions of calculations per second and includes FAStT500 storage servers, SAN fabric and IBM TotalStorage Enterprise Tape Drive 3590 systems to store observational meteorological and oceanographic data and forecast results. Pretty interesting read, always surprises me how fast technology is growing.”

Luke Ehresman writes: After a long wait, SquirrelMail is finally making a new major stable
series release. The past year has been ANYTHING but uneventful for
the SquirrelMail Project. This year has seen two leadership changes,
the release of the 1.0 series, the 1.1 development series, and now
finally the much awaited 1.2.0 release (aka the “And I Still Have Not Wrapped My Wife’s Presents” release).

Release Notes: SquirrelMail 1.2.0

The “And I Still Have Not Wrapped My Wife’s Presents” Release
aka the “Miriam Noel” Release

December 25, 2001

In this edition of SquirrelMail Release Notes:
* All about this Release!!!
* Reporting my favorite SquirrelMail 1.2.0 bug
* Important Note about PHP 4.1.0
* Where are we going from here?
* About our release Aliases

All about this Release!!!

Being one of the most popular webmail clients, the developers of
SquirrelMail feel a huge desire and responsibility to continue push
the envelope and make SquirrelMail the best it can possibly be. You
will not be disappointed with this release, as it is by far the most
feature rich, and yet it is still the same sleek and unbloated and
cuddly webmail application that we have all grown to love. Here is
an incomplete list of new features and enhancements since the last
stable release.

Collapsible Folders – The folder list can be collapsed at any
parent folder. This makes folder lists with large
hierarchical structures much easier to manage and navigate.

The Paginator! – This enables quick access to any page in the
message list by simply choosing the page number to view
rather than tediously clicking “next” 50 times.

Hundreds of UI tweaks – The user interface has been given a
face-lift. The HTML has been largely overhauled, and while
it still has the same general feel, it has been made more
intuitive.

Drafts – It is now possible to compose a message and save it to
be sent at a later date with the drafts option.

New Options Page – The options page has been completely
rewritten for several reasons, the main of which was to
allow seamless integration of plugin options and to
provide uniformity throughout the entire section.

Multiple Identities – It is now possible to create different
identities (home, work, school) that can be chosen upon
sending. Each identity can have its own email address,
full name, and signature.

Reply Citations – Different types of citations are now possible
when replying to messages.

Better Attachment Handling – The plugin, attachment_common, has
been fully integrated into the core of SquirrelMail. This
allows inline viewing of several different types of
attachments.

Integration of Several Plugins – The following plugins have been
put directly into the core. As a result, be sure not to
install these as plugins, as the result may be (at best)
unpredictable: attachment_common, paginator, priority,
printer_friendly, sqclock, xmailer.

Improved support for newer versions of PHP. Note that you may
have trouble if you are running PHP version 4.0.100
(commonly distributed with Debian 3.0).

Ability to mark messages as read and unread from the message
listing.

Alternating Colors – The message list now alternates row colors
by default. This presents a much cleaner and easier to
read interface to the user.

Aside from these obvious front end features, there are hundreds of
bugs that have been fixed, and much of the code has been optimized
and/or rewritten. This stable release is far superior in all
aspects to all previous versions of SquirrelMail.

Home Page: http://www.squirrelmail.org/

Download: http://www.squirrelmail.org/download.php

ScreenShots: http://www.squirrelmail.org/screenshots.php

Reporting my favorite SquirrelMail 1.2.0 bug

Of course, in the words of Linus Torvalds, this release is
officially certified to be Bug-Free ™.

However, if for some reason some bugs manage to find their way to the
surface, please report them at once (after all, they ARE uncertified
bugs!!!) The PROPER place to report these bugs is the SquirrelMail Bug
Tracker.

http://www.squirrelmail.org/bugs

Thank you for your cooperation in that issue. That helps us to make
sure that nothing slips through the cracks. Also, it would help if
people would check existing tracker items for a bug before reporting
it again. This would help to eliminate duplicate reports, and
increase the time we can spend CODING by DECREASING the time we
spend sorting through bug reports. And remember, check not only OPEN
bug reports, but also closed ones as a bug that you report MAY have
been fixed in CVS already.

Important Note about PHP 4.1.0

First of all, let me say that you all HAVE been warned: the
SquirrelMail Project Team is not supporting PHP 4.1.0 for the 1.2.0
release. Basically, SquirrelMail was in the final death throws of
this development series when the witty PHP folks decided to make the
release of 4.1.0. Of course, we greatly appreciate their hard work! 🙂

However, we were too close to the end of this whole thing to be able
to spend the week or two EXTRA that it will take to get SquirrelMail
1.2.0 PHP 4.1.0 ready. This will, on the bright side, be a major
priority amongst the team in the immediate future. At first look, it
seems that 4.1.0 support should just require a collection of
relatively minor tweaks. You can expect 4.1.0 support within 2-3
weeks, as a part of a later 1.2.X release.

Where are we going from here?

After things cool down a bit and the smoke clears from 1.2.0,
progress will begin on the Great SquirrelMail Rewrite, also known as
the 1.3 development branch. This branch will eventually become the
long talked about SquirrelMail 2.0. The major developmental emphasis
for SquirrelMail 2.0 will be in making SquirrelMail more flexible
and modular so that it might do a better job meeting the needs of
our system administrators and end-users. We are greatly anticipating
working in this area.

At the same time, we will kick start the SquirrelMail Teams. For
some time now, we have been planning a reorganization of the project
into a variety of sub-teams. Each sub-team will focus on a different
aspect of SquirrelMail Project work. These teams will hopefully help
keep the SquirrelMail project more on track and to provide some
semblance of order. This project has grown so large in the past two
years that an orderly structure is necessary if anything is to get
done effectively. The teams (as planned) are as follows:

Stable Series Team: Maintains the stable series
Development Series Team: Works on the development series

i18n Team: Handles i18n (internationalization) work

Plugin Team: Manages the mass of plugins

User Support Team: Helps users with their problems

Documentation Team: Manages the documentation

Evangelism Team: Spreads the good news of SquirrelMail

Teams will be led by one or two SquirrelMail team members. And team
members can participate in as many teams as he or she desires.

For the next few weeks, the developers will be working on bug-fixing
and making the 1.2 series rock solid. After that, about mid January,
focus will shift toward getting the teams in gear and starting work
on the SquirrelMail 1.3 development series.

About our Release Aliases

Most importantly, this release of SquirrelMail is dedicated to my
wife and the new baby that she had on 13 December 2001, Miriam Noel
Thompson. (-Paul J. Thompson)

See http://www.squirrelmail.org/wiki/SquirrelRelease for more details.

Have a Merry Christmas!
Happy SquirrelMailing!
– The SquirrelMail Project Team

Posted at LWN.net: “The file globbing (matching filenames against patterns such as “*.bak”)
routines in the glibc exhibits an error that results in a heap corruption
and that may allow a remote attacker to execute arbitrary commands from
processes that take globbing strings from user input.
Tom Parker, Global InterSec LLC, addressed SuSE Security and illustrated
an attack scenario against the BSD-derived ftp daemon that is installed
as /usr/sbin/in.ftpd in SuSE Linux distributions. The said in.ftpd should
not be confused with the Washington University ftp daemon (wu-ftpd) that
comes installed as /usr/sbin/wu.ftpd in SuSE Linux and uses its own
globbing functions.”

Slashdot readers discuss an article at Oreillynet.com in which the Russian programmer discusses the conditions of his recent release after he was arrested this summer for allegedly violating the U.S. Digital Millennium Copyright Act. “Dmitry told me that he was upset with the U.S. Attorney’s misrepresentation of his agreement with them. Specifically, Dmitry says that: He still works for Elcomsoft and has no intention of leaving anytime soon.”