Mailing List Archive

Gentoo Weekly Newsletter 18 October 2004
---------------------------------------------------------------------------
Gentoo Weekly Newsletter
http://www.gentoo.org/news/en/gwn/current.xml
This is the Gentoo Weekly Newsletter for the week of 18 October 2004.
---------------------------------------------------------------------------

==============
1. Gentoo News
==============

2004.3 release coming your way: LiveCD test builds for x86 and PPC
avalable soon
-------------

Watch out for beta versions of the upcoming 2004.3 LiveCDs this week: Both
x86 and PPC architectures are on the brink of releasing previews, and will
eagerly await bug reports at Gentoo's bugzilla as soon as the test builds
hit the mirrors. Comments from testers are highly welcome before marking
the respective architectures ready for release.

New lead translator for Japanese GWN
------------------------------------

The GWN extends its gratitude to a long-time contributor, Japanese lead
translator Katsuyuki Konno who is leaving the team this month, to be
followed by Tomoyuki Sakurai[1]. The Japanese version of the GWN has been
in existence from the fourth issue of the English language publication,
and it hasn't skipped a single issue ever since then, making Japanese one
of the first and most reliable of the various alternative GWN languages.
1. cherry@trombik.mine.nu

==================
2. Gentoo security
==================

LessTif: Integer and stack overflows in libXpm
----------------------------------------------

Multiple vulnerabilities have been discovered in libXpm, which is included
in LessTif, that can potentially lead to remote code execution.

For more information, please see the GLSA Announcement[2]
2. http://www.gentoo.org/security/en/glsa/glsa-200410-09.xml

gettext: Insecure temporary file handling
-----------------------------------------

The gettext utility is vulnerable to symlink attacks, potentially allowing
a local user to overwrite or change permissions on arbitrary files with
the rights of the user running gettext, which could be the root user.

For more information, please see the GLSA Announcement[3]
3. http://www.gentoo.org/security/en/glsa/glsa-200410-10.xml

tiff: Buffer overflows in image decoding
----------------------------------------

Multiple heap-based overflows have been found in the tiff library image
decoding routines, potentially allowing to execute arbitrary code with the
rights of the user viewing a malicious image.

For more information, please see the GLSA Announcement[4]
4. http://www.gentoo.org/security/en/glsa/glsa-200410-11.xml

WordPress: HTTP response splitting and XSS vulnerabilities
----------------------------------------------------------

WordPress contains HTTP response splitting and cross-site scripting
vulnerabilities.

For more information, please see the GLSA Announcement[5]
5. http://www.gentoo.org/security/en/glsa/glsa-200410-12.xml

BNC: Input validation flaw
--------------------------

BNC contains an input validation flaw which might allow a remote attacker
to issue arbitrary IRC related commands.

For more information, please see the GLSA Announcement[6]
6. http://www.gentoo.org/security/en/glsa/glsa-200410-13.xml

=========================
3. Heard in the community
=========================

Web forums
----------

KDE and GPG

Security comes at a price: When packages supposedly collaborating with
each other for providing GnuPG and S/MIME support in the KDE mail client
are being updated without coordination upstream, things may occasionally
break:

* KDEPIM 3.3.1 failing on gpgme[7]
7. http://forums.gentoo.org/viewtopic.php?t=236628

gentoo-user
-----------

KDE and broken DNS

Several Gentooers noticed that after upgrading glibc on their systems, DNS
sporadically quit working inside KDE. One helpful poster provided a link
back to KDE's bugzilla that had a bug report specifically for Gentoo, but
it had no solution. So what is the culprit? When doing large system
upgrades such as perl, glibc, etc. you should be sure to do a
revdep-rebuild[8] to help solve issues like the above. It's not a magic
fix for everything, but it can certainly reduce hair-pulling for strange
events like these.
8. http://www.gentoo.org/doc/en/gentoolkit.xml#doc_chap5

* kooky kde behaviour[9]
9. http://thread.gmane.org/gmane.linux.gentoo.user/102980

Resuming emerge on a notebook

Many people have an issue with long running emerges on their notebooks:
Between work and home they have to cancel and completely restart the
compilation of some larger packages.

* How to restart an emerge[10]
10. http://thread.gmane.org/gmane.linux.gentoo.user/103221

Filesystem automounter

Having trouble getting autofs to work on your Gentoo system? Here's a
thread discussing alternative program recommendations for mounting
filesystems.

* autofs, supermount, submount... which is best for Gentoo?[11]
11. http://article.gmane.org/gmane.linux.gentoo.user/103026

gentoo-dev
----------

xorg-x11-6.8.0-r1 ready to go stable on all archs

Donnie Berkholz[12] announced that xorg-x11-6.8.0-r1 is ready to go stable
on x86 and asked all arch maintainers to follow shortly thereafter, unless
there is a good reason not to mark it stable. Reason for this is to have
marked it stable before the portage snapshot for the 2004.3 release will
be taken.
12. spyderous@gentoo.org

* xorg-x11-6.8.0-r1 ready to go stable on all archs[13]
13. http://thread.gmane.org/gmane.linux.gentoo.devel/22006

init script optimizations?

Discussions about more or less dangerous optimizations to speed up the
boot sequence.

* init script optimizations?[14]
14. http://thread.gmane.org/gmane.linux.gentoo.devel/22100

HPPA dev box is now online at OSU

Mike Frysinger[15] got his HPPA development-box set up on OSU where it is
accessible for every Gentoo developer who need to test ebuilds on HPPA.
15. vapier@gentoo.org

* HPPA dev box is now online at OSU[16]
16. http://thread.gmane.org/gmane.linux.gentoo.devel/22107

rsync speed and space taken

Discussions about the size of the Gentoo portage tree.

* rsync speed and space taken[17]
17. http://thread.gmane.org/gmane.linux.gentoo.devel/21962

Support for UTF-8 in the console

Mike Frysinger was looking for feedback from people using UTF-8 fonts and
keymaps in the console, and asked them to test a new patch.

* support for UTF8 in console[18]
18. http://thread.gmane.org/gmane.linux.gentoo.devel/22173

GLEP23 - Updates and call for further discussion

GLEP 23 deals with Portage and how it handles the ACCEPT_LICENSE clause:

* GLEP23 - Updates and call for further discussion[19]
19. http://thread.gmane.org/gmane.linux.gentoo.devel/22173

=======================
4. Gentoo International
=======================

Germany: Munich Gentoo Linux User Group Event
---------------------------------------------

Last Saturday, 15 October, MGLUG's Gentooistas[20] and other Linux users
from Munich's general LUG[21] (celebrating its 10th anniversary this year)
and neighboring Erding LUG[22] had organized a joint event with "Berkeley
in Munich"[23], the local BSD community. Labeled "First Open-source
Infotainment Day", the organisers had brought together speakers exploring
the structural differences between Linux and FreeBSD, introducing TeX
desktop publishing, and other topics. One presentation was dedicated to
"Gentoo Linux from an ISP's viewpoint", and installations of both Gentoo
Linux and FreeBSD were offered during the event, too. The meeting started
early and continued over lunch at the premises of a Munich-based job
training center[24], and a few impressions of the event can be viewed at
the MGLUG's photo gallery[25].
20. http://www.mglug.de
21. http://www.muc-lug.de
22. http://www.lug-erding.de
23. http://www.berklix.org/bim
24. http://www.bfipeters.de/
25. http://www.mglug.de/gallery/aktivitaeten

Figure 4.1: Gentoo Linux users and friends in Munich
http://www.gentoo.org/images/gwn/20041018-mglug.jpg

Italy: To Smau or not to Smau
-----------------------------

It has a reputation for being the largest and most important IT fair in
Italy, but some Italian Gentooists seem to be skeptical about its
usefulness. Nevertheless, a few Gechi[26] members are openly thinking of
attending the Smau this year[27], held at the Milano trade fair ground
from Thursday 21 October to Monday 25 October 2004. Never mind that
weighing the pros and cons at this thread in the Gentoo forums[28] only
has "half-naked dancers" on the plus-side of the balance sheet - you'll
still be able to meet one or the other Gentooist among the almost 400,000
visitors expected at the event.
26. http://www.gechi.it
27. http://www.smau.it/smau2004/english/docs/exhibition_what.php
28. http://forums.gentoo.org/viewtopic.php?t=233447

======================
5. Gentoo in the press
======================

The Age (12 October 2004)
-------------------------

In a rather disturbingly titled article in Australia's leading newspaper
for the Victoria district[29], "Microsoft scores well on security
analysis", the Victorian open-source activist Con Zymaris did his best to
convince author Rob O'Neill of the virtue of open-source security
advisories, but wasn't entirely successful. If getting shot as a messenger
of security flaws really is a considerable risk down under, Gentoo may
want to stand less tall, but in reality, of course, having the highest
number of security advisories of all open-source projects and commercial
vendors is not bad at all.
29.
http://www.theage.com.au/articles/2004/10/11/1097406487760.html?oneclick=true

ZDNet (12 October 2004)
-----------------------

David Berlind at ZDnet props Linux against Mac OS X[30] in his quest for
the future ruler of the desktop: "Today, even the most reputable and
recommended distributions of desktop Linux, such as Gentoo and Xandros,
are not the no-brainers that OS X and Windows--in that order--are."
Interestingly enough, he seems quite confident that Linux will eventually
be persistent enough for popular acceptance as a desktop OS: "However,
it’s only a matter of time before desktop Linux follows precisely the same
path as server Linux did when it worked its way from the pockets of early
adopters and risk takers into gaining the widespread affection of server
administrators."
30. http://news.zdnet.com/2100-9590_22-5406365.html

Central Command, Inc. (press release 13 October 2004)
------------------------------------------------------

Gentoo figures as one of the supported distributions in a press release by
Central Command, Inc.[31], a privately held company in Ohio providing
anti-virus software that is going to be offered as a server-side
application bundled with the services of Outblaze Ltd., a global provider
of hosted email headquartered in Hong Kong.
31. http://www.centralcommand.com/13102004.html

===========
6. Bugzilla
===========

Summary
-------

* Statistics
* Closed bug ranking
* New bug rankings

Statistics
----------

The Gentoo community uses Bugzilla (bugs.gentoo.org[32]) to record and
track bugs, notifications, suggestions and other interactions with the
development team. Between 10 October 2004 and 16 October 2004, activity on
the site has resulted in:
32. http://bugs.gentoo.org

* 796 new bugs during this period
* 310 bugs closed or resolved during this period
* 38 previously closed bugs were reopened this period

Of the 7252 currently open bugs: 124 are labeled 'blocker', 245 are
labeled 'critical', and 525 are labeled 'major'.

Closed bug rankings
-------------------

The developers and teams who have closed the most bugs during this period
are:

* Gentoo's Team for Core System packages[33], with 28 closed bugs[34]
* Gentoo X-windows packagers[35], with 17 closed bugs[36]
* Java team[37], with 16 closed bugs[38]
* Gentoo Games[39], with 14 closed bugs[40]
* AMD64 Porting Team[41], with 11 closed bugs[42]
* osx porters[43], with 10 closed bugs[44]
* Gentoo KDE team[45], with 10 closed bugs[46]
* Gentoo Linux Gnome Desktop Team[47], with 10 closed bugs[48]
33. base-system@gentoo.org
34.
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-10-10&chfieldto=2004-10-16&resolution=FIXED&assigned_to=base-system@gentoo.org
35. x11@gentoo.org
36.
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-10-10&chfieldto=2004-10-16&resolution=FIXED&assigned_to=x11@gentoo.org
37. java@gentoo.org
38.
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-10-10&chfieldto=2004-10-16&resolution=FIXED&assigned_to=java@gentoo.org
39. games@gentoo.org
40.
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-10-10&chfieldto=2004-10-16&resolution=FIXED&assigned_to=games@gentoo.org
41. amd64@gentoo.org
42.
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-10-10&chfieldto=2004-10-16&resolution=FIXED&assigned_to=amd64@gentoo.org
43. osx@gentoo.org
44.
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-10-10&chfieldto=2004-10-16&resolution=FIXED&assigned_to=osx@gentoo.org
45. kde@gentoo.org
46.
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-10-10&chfieldto=2004-10-16&resolution=FIXED&assigned_to=kde@gentoo.org
47. gnome@gentoo.org
48.
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-10-10&chfieldto=2004-10-16&resolution=FIXED&assigned_to=gnome@gentoo.org

New bug rankings
----------------

The developers and teams who have been assigned the most new bugs during
this period are:

* Gentoo Linux Gnome Desktop Team[49], with 27 new bugs[50]
* Java team[51], with 25 new bugs[52]
* Gentoo Toolchain Maintainers[53], with 24 new bugs[54]
* Gentoo's Team for Core System packages[55], with 23 new bugs[56]
* osx porters[57], with 19 new bugs[58]
* AMD64 Porting Team[59], with 18 new bugs[60]
* Gentoo X-windows packagers[61], with 17 new bugs[62]
* Gentoo Kernel Bug Wranglers and Kernel Maintainers[63], with 15 new
bugs[64]
49. gnome@gentoo.org
50.
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-10-10&chfieldto=2004-10-16&assigned_to=gnome@gentoo.org
51. java@gentoo.org
52.
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-10-10&chfieldto=2004-10-16&assigned_to=java@gentoo.org
53. toolchain@gentoo.org
54.
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-10-10&chfieldto=2004-10-16&assigned_to=toolchain@gentoo.org
55. base-system@gentoo.org
56.
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-10-10&chfieldto=2004-10-16&assigned_to=base-system@gentoo.org
57. osx@gentoo.org
58.
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-10-10&chfieldto=2004-10-16&assigned_to=osx@gentoo.org
59. amd64@gentoo.org
60.
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-10-10&chfieldto=2004-10-16&assigned_to=amd64@gentoo.org
61. x11@gentoo.org
62.
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-10-10&chfieldto=2004-10-16&assigned_to=x11@gentoo.org
63. kernel@gentoo.org
64.
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-10-10&chfieldto=2004-10-16&assigned_to=kernel@gentoo.org

==================
7. Tips and Tricks
==================

Gentoo Initscripts
------------------

This week we will have a look at some nice to know things about
initscripts that every sysadmin and user should at least have heard of
once.

By installing and administering your installation of Gentoo Linux you will
have learned about how to add services to a specific runlevel, and how to
start and stop those services.

But most users are not aware of some other nifty functions in the Gentoo
initscripts that have the potential for making their lives easier in
administering their Gentoo boxes.

Q: What to do if I can’t stop a service? What if the processes were killed
but my system thinks they are still running?

A: Execute /etc/init.d/<service> zap to reset the status of the service.


Q: How do I figure out if a service is running or not?

A: /etc/init.d/<service> status will tell you the current status of the
given service.


Q: And while we're at it, how can I see all services running?

A: rc-status lists all services that have been started and their current
status.


Q: How to restart a service?

A: /etc/init.d/<service> restart restarts the service.


Q: How do I find out what other services have to be started when I want to
use <service>?

A: /etc/init.d/<service> ineed will give you a list of services that need
to be running before this service can be started.


Q: Which services need/depend on this <service>?

A: /etc/init.d/<service> needsme lists all services that depend on the
service given.

For further information on how runlevels work in Gentoo Linux please take
a look at the Initscript guide[65] that is part of the Gentoo System
Documentation.
65. http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=2&chap=5

===========================
8. Moves, adds, and changes
===========================

Moves
-----

The following developers recently left the Gentoo team:

* None this week

Adds
----

The following developers recently joined the Gentoo Linux team:

* None this week

Changes
-------

The following developers recently changed roles within the Gentoo Linux
project:

* None this week

====================
9. Contribute to GWN
====================

Interested in contributing to the Gentoo Weekly Newsletter? Send us an
email[66].
66. gwn-feedback@gentoo.org

================
10. GWN feedback
================

Please send us your feedback[67] and help make the GWN better.
67. gwn-feedback@gentoo.org

================================
11. GWN subscription information
================================

To subscribe to the Gentoo Weekly Newsletter, send a blank email to
gentoo-gwn-subscribe@gentoo.org.

To unsubscribe to the Gentoo Weekly Newsletter, send a blank email to
gentoo-gwn-unsubscribe@gentoo.org from the email address you are
subscribed under.

===================
12. Other languages
===================

The Gentoo Weekly Newsletter is also available in the following languages:

* Danish[68]
* Dutch[69]
* English[70]
* German[71]
* French[72]
* Japanese[73]
* Italian[74]
* Polish[75]
* Portuguese (Brazil)[76]
* Portuguese (Portugal)[77]
* Russian[78]
* Spanish[79]
* Turkish[80]
68. http://www.gentoo.org/news/da/gwn/gwn.xml
69. http://www.gentoo.org/news/be/gwn/gwn.xml
70. http://www.gentoo.org/news/en/gwn/gwn.xml
71. http://www.gentoo.org/news/de/gwn/gwn.xml
72. http://www.gentoo.org/news/fr/gwn/gwn.xml
73. http://www.gentoo.org/news/ja/gwn/gwn.xml
74. http://www.gentoo.org/news/it/gwn/gwn.xml
75. http://www.gentoo.org/news/pl/gwn/gwn.xml
76. http://www.gentoo.org/news/br/gwn/gwn.xml
77. http://www.gentoo.org/news/pt/gwn/gwn.xml
78. http://www.gentoo.org/news/ru/gwn/gwn.xml
79. http://www.gentoo.org/news/es/gwn/gwn.xml
80. http://www.gentoo.org/news/tr/gwn/gwn.xml

Ulrich Plate <plate@gentoo.org> - Editor
Brian Downey <bdowney@briandowney.net> - Author
Marc Hildebrand <zypher@gentoo.org> - Author
Patrick Lauer <patrick@gentoo.org> - Author
Emmet Wagle <ewagle@email.com> - Author


--
gentoo-gwn@gentoo.org mailing list