From LinuxSecurity: “At this Microsoft page , one Scott Culp, advertised to us as the “Manager of the Microsoft Security Response Center”, exhorts people to stop publishing information on computer security vulnerabilities. Culp’s rant is a transparently self-serving and dishonest attempt to shift the onus for epidemics like Code Red, Lion, and NIMDA away from where it belongs, which is squarely on Microsoft’s shoddy architecture and negligent engineering.”

Mayhem from www.linuxathome.net writes “You can download the pre6 patch from here.”

pre6:
 - Stephen Rothwell: APM idle time handling fixes, docbook update, cleanup
 - Jeff Garzik: network driver updates
 - Greg KH: USB updates
 - Al Viro: UFS update, binfmt_misc rewrite.
 - Andreas Dilger: /dev/random fixes
 - David Miller: network/sparc updates

pre5:
 - Greg KH: usbnet fix
 - Johannes Erdfelt: uhci.c bulk queueing fixes

From LWN, the Gnome summary for the week ending October 19th: GNOME 2 most wanted features lists, new Nautilus release available, Gnomehide now available, GNOME core and GNOME utils GNOME 2 porting efforts, new GNOME website underway, and much more.

ftp://ftp.kernel.org/pub/linux/kernel/people/alan/linux-2.4/. Intermediate diffs are available from http://www.bzimage.org. Changelog below.Cox writes about 2.4.12-ac5: ” Basically this one is for ARM users or people seeing hiccups with VIA audio.”

And about ac4: “Catching up on the backlog. This one might be a little less stable than ac3, so stability freaks should wait.”

2.4.12-ac5
o SA1100 cleanups (Nicolas Pitre)
o Assabet updates (Russell King)
o Update ARM simpad architecture (Russell King)
o ICS IDE updates (Russell King)
o Make ISA dma support in the core optional (Russell King)
o Fix SA1100 cache performance problem (Russell King)
o Update SA1100 stork pcmcia update (Russell King)
o Update the ARM Cerf platform (Russell King)
o Keyboard/pm include cleanup (Russell King)
o Update ARM default configurations (Russell King)
o ARM include updates (Russell King)
o Fix isofs packing on the ARM (Russell King)
o ADFS file sytstem updates (Russell King)
o Fix compile failure on ARM ecoscsi (Jean-Luc Leger)
o SA1100 and EP7211 irda drivers (Russell King,
“Blue Mug”)
o ISIcom device table (Andrey Panin)
o 1.15 test VIA audio driver (Jeff Garzik)
o Switch most other drivers to generic BLK*64 (Christoph Hellwig)
o Fix DTC3280 driver (Casper Boon)
o Mini-acpi support for using ACPI apic/cpu (Andrew Henroid,
tables (needed for some new IBM stuff)
Richard Schaal,
| You must use a command line option to enable Jun Nakajima,
| this for now Arjan van de Ven)
| (Submitted by IBM but written by Intel)

2.4.12-ac4
o Workaround for gcc 3.0.x spin_unlock problem (Hartmut Schirmer)
o Hog stop VM update (Rik van Riel)
o Update segment reload avoidance code (Andi Kleen)
o shmfs remount fixups (Christoph Rohland)
o Fix broken bits of ifdef stuff (Jean-Luc Leger)
o Updates to xircom_tulib_cb driver (Ion Badulescu)
o Revert problematic tulip rx missed patch (Jeff Garzik)
o USB updates (Greg Kroah-Hartmann, David Nelson,
David Brownell)
o Recognize the 830MP ide and support it (Michael Clark)
o Fix yellowfin duplex bug (Val Henson)
o APM updates (Stephen Rothwell)
o USB net driver updates (David Brownell)
o Fix merge glitch in md driver (Neil Brown)
o Fix sa1100fb condition checking error (Russell King)
o Add device table to the sx driver (Andrey Panin)
o Add lots more rep nop points to the kernel
for the poor old Pentium IV (Arjan van de Ven)
o Add device tables to moxa drivers (Andrey Panin)
o Joystick fix for USB joystick hats (David Megginson)
o Add $PIR support for serverworks CSB5 (Tim Hockin)
o Take hfs catalog lock static (Adrian Sun)
o Fix an elf overflow check (Al Viro)
o Update M68K scsi drivers
o Update M68K ide drivers
o Add EXPORT_NO_SYMBOLS to motioneye (Stelian Pop)
o Fix m68k to be bigendian for audio (Jes Sorensen)
o Fix “cd tray won’t close” ide cd bug (Jens Axboe)
o Remove an unneeded lance ident (Dave Jones)
o Sony pi driver update (Stelian Pop)
o Issue “FLUSH_CACHE” commands to ide devices
on shutdown (Tim Hockin)
o Add pci table to applicon driver (Andrey Panin)
o Use set_current_state in the input layer (Arnaldo Carvalho
de Melo)
o Swap list locking update (Hugh Dickins)
o Update to aic7xxx 6.2.4 (Justin Gibbs)

2.4.12-ac3
o Switch mpt fusion driver to use set_current_state
(Arnaldo Carvalho de Melo)
o Ext3 file system update and related fixes (Andrew Morton,
Stephen Tweedie)
o ASM m68k include updates (Richard Ziclicky)
o Netwinder audio update (Russell King)
o SA1100 documentation update (Russell King)
o ARM keyboard updates (Russell King)
o ARM include updates (Russell King)
o Fix a pcmcia/ds.c return on error case (Russell King)
o Small ARM core updates (Russell King)
o Philips USB camera driver update (“Nemosoft”)
o Add XScale pci ident (Russell King)
o SA1100 frame buffer update (Russell King)
o Update floppy.c for N_FDC=1 case (Russell King)
o Update floppy parameter support (Russell King)
o Bring -ac usb device locking in line with Linus (Greg Kroah-Hartmann)
tree
o USB initialisation fixes (Linus Torvalds)
o Use set_current_state in wireless drivers (Arnaldo Carvalho de Melo)
o Megaraid driver v 1.18 (Atul Mukker)

2.4.12-ac2
o Fix the reiserfs buffer accounting bug (Chris Mason)
o VIA rhine oops fix (Urban Widmark)
o Fix ppc build, add license tags (Paul Mackerras)
o Fix partition size handling bug (Al Viro)
o Handle BIOSes that slow the CPU more sanely (me)
o Fix pm.h include in pc_keyb.c (Mike Borrelli)
o Document some of the APM code (me)
o Reapply reiserfs big endian support (Jeff Mahoney)
o Fix misleading bootflag reporting (Thomas Hood)
o Fix a reporting bug in the promise driver (Alexander Yurchenko)
o Switch bits of scsi to use set_current_state
(Arnaldo Carvalho de Melo)
o Switch cdrom drivers to set_current_state (Arnaldo Carvalho de Melo)
o Add license tags to reiserfs (Dirk Mueller)
o SA1100 fixes (Russell King)
o Fix usb config typo (Tom Rini)
o Eurotech PC104 watchdog (Rodolfo Giometti)
o Add support for the VIA C5 processor (Dave Jones)
o Add Dave Jones to maintainers file (Dave Jones)
o Switch paride drivers to set_current_state (Arnaldo Carvalho de Melo)
o Switch USB drivers to set_current_state (Arnaldo Carvalho de Melo)
o Switch most of drivers/char to s_c_s (Arnaldo Carvalho de Melo)
o Back out a bogus aci change (Arnaldo Carvalho de Melo)
o Switch sound to use set_current_state (Arnaldo Carvalho de Melo)
o Cache reporting errata handling (Dave Jones)
o Merge some identical vm operations (Christoph Hellwig)
o Fix init/version.h comments/format oddments (Daniel Dickman)

– By Grant Gross –

News reports have Penguin Computing, the self-proclaimed leading Linux hardware vendor, laying off between a third and three-quarters of its staff this week, including CEO Martin Seyer, in an apparent effort to become profitable.

NewsForge was the first to speak with company founder, majority owner and returning CEO Sam Ockman, who said the layoffs make the company profitable now. However, there seems to be a lot of bad feelings about the layoffs, and disagreements about just how the restructuring went down. Check out the comments on the NewsForge story, or an earlier LinuxGram story to see alternate points of view.

Pending legislation

The Open Source/Free Software communities’ campaign against the proposed U.S. the Security Systems Standards and Certification Act is stepping up, with a hearing on the bill scheduled for Oct. 25. NewsForge’s Tina Gasperson reports that many organizations that could be affected by the bill don’t know its potential impact; that of requiring proprietary anti-copying controls on all kinds of hardware and software. The Free Software Foundation says this bill could outlaw Free Software and Open Source development, which several U.S. agencies have embraced.

KDE blows out the candles

Open Source GUI project KDE celebrated its fifth birthday this week. You’ve come a long way, baby. Meanwhile, Gasperson reports that a group of the KDE faithful are posting themes online while the new Themes.org is still down.

AOL doesn’t like Mozilla?

News reports have the 7.0 version of America Online still sticking with Microsoft’s IE as a browser, not AOL’s own sponsored Mozilla. Apparently, AOL will test run the Mozilla Gecko engine on its much smaller CompuServe. In other Mozilla news, the Mozilla team has released a Mozilla 1.0 Manifesto. Great bedtime reading.

Fighting words

If you don’t read Wired magazine, this will be new for you. Former Red Hat employee Russ Mitchell has an essay, Open War, about why he thinks Linux will lose the war to Microsoft. His argument: The Linux desktop isn’t here yet.

Why Microsoft will lose the war

Microsoft security guru (is that an oxymoron?) Scott Culp is blaming its products’ security problems on security companies and Web sites that publish the exploits. Does that mean customers are better off not knowing? A classic case of blaming the messenger. It didn’t take Open Source advocate Eric S. Raymond long to write a rebuttal, saying “If you can’t stand the heat …”. From ESR: “What Culp is really saying is that he doesn’t believe Microsoft will ever get its act sufficiently together for Windows or IIS to survive in a high-threat environment, so Microsoft wants to blame someone else for the problem.”

My installer is your installer

A group of Linux people pushing for a “Common Linux Installer” got some flack this week, with critics saying that would take away the individuality of the various Linux distributions. The installer people say that’s not really true, that some common functionality wouldn’t make everything look the same.

New in NewsForge

Stories that appeared first in NewsForge this week:

Robin “Roblimo” Miller compares proprietary software development to fundamentalist governments that don’t want debate. Open Source development often looks messy from the outside, but it’s very democratic.

Lutris CEO Yancy Lind responds to critics of the company’s decision to back away from support of the Enhydra.org project.

Jeff Field reviews the AMD Duron 1.1GHz chip and finds it doesn’t offer much new beyond AMD’s Athlon line.

LogError writes “Michael Korolew writes: “Every week you see another article with the headline “Internet vulnerable to hackers” “hackers on the rise” “hackers break into website” “internet vulnerable to information warfare attacks” etc. And these stories are usually typed up by so called “security experts” a lot of these experts are probably the same ‘experts’ that promoted their buggy software years ago, and their rants on “don’t hire hackers”. We have seen enough reparative articles, new security companies pop up, and newly appointed ‘computer experts’ to rival the many groups of script kiddies gangs.” Read more.”

From Slashdot: “According to Blue’s News , Mandrake and TransGaming are going to ship a new distribution of Mandrake Linux specificially aimed at gamers. It comes with The Sims and TransGaming’s WineX for compatibility with Windows games. Apparently it’s going to ship on November 9th.”

From ZDNet: “Eric Chien, chief researcher for Europe at security firm Symantec Response, said that Linux is just as vulnerable as Windows, and that the flaws exploited by Code Red and Nimda viruses were similar to bugs that the Ramen and Lion worms exploited in Linux systems. “Software will always have bugs. All it takes is a single flaw for a worm to gain access to the system. The key is how administrators and vendors respond to those bugs.””

From Slashdot: “Kerneltrap has posted the latest in-depth kernel hacker interview with Russell King, who originally ported Linux to ARM and continues to oversee ARM Linux development. Russell talks about ARM, the 2.4 kernel, the upcoming 2.5 kernel and much more..”

From LinuxFocus: “Psionic portsentry is part of the Abacus Project suite of tools (beside portsentry, the suite offers logcheck and hostsentry). It’s an IDS (Intrusion Detection System) dedicated to portscan detection and active defense. It works on many Unix flavors including Mac OS X. The main feature of an IDS is to inform the sysadmin about intrusion attempts. Portsentry goes further since it can react on an attack. The latest version (1.1) of this great tool is available from http://www.psionic.com, and by the way, version 1.0 is now part of some main Linux distributions (Debian, RedHat…).”