Gentoo Weekly Newsletter: January 20th, 2003
Next Release of Gentoo Linux to be 1.4_rc3 The next release of Gentoo Linux is expected to be released as 1.4_rc3, rather than 1.4_final. This decision was based on a number of factors, including:
Gentoo PPC developer presents at MIT The following was a late addition to this week's GWN and therefore may not appear in all translated versions. Rajiv Manglani, one of Gentoo's developers for the PowerPC platform (and an alumni of the Massachusetts Institute of Technology himself), is going to give a presentation featuring an overview of Gentoo Linux and a demo of a finished system. Curtains go up at the MIT (building no. 4, room 237) on Tuesday, 21 January 2003, from 19:00-20:00, and if you plan on attending, please RSVP to sipb-iap-gentoo@mit.edu.
ISC's dhcp package has several buffer overflow vulnerabilities which could permit an attacker to remotely execute arbitrary code. No exploits have been reported.
A buffer overrun in fnord's CGI code has been discovered. However, the affected function does not return, so it is unlikely that an exploit could be developed.
A flaw in php's wordwrap() function could, if used against user input, be subject to a buffer overfolow. No exploit has been reported.
New security bug reports this week include: Gentoo on Laptops Anybody who's ever tried to put Linux from a Firewire or PCMCIA CD drive onto their notebook PC will instantly recognise the need for support, no matter how Linux-savvy you thought you were: This is the grand art of dealing with hardware that's been misconfigured by vendors and BIOS manglers for use with pre-installed operating systems beyond the point where a simple "install from CD" manual can bail you out. Fortunately, the forums are full of threads dealing with the peculiarities of portable PCs. There's even a Gentoo-driven movement to set up an alternative to Linux-on-Laptops.net, the most famous, but infrequently updated resource for anybody looking to install Linux on something they can carry about. Here's a collection of some of the more active threads in this field, topmost the pointer to Gentoo's own "Linux-on-the-go":
Forum Surveys As the forum user base is steadily growing, the results of opinion polls are becoming more and more representative. The average Gentoo user seems to pay between 30 and 60 USD a month for a 500+ kbit/s Internet connection, lack proper chairs for their computer desks and drive around in Japanese pickup trucks. Most of these polls lack any sort of scientific value, but some of them are fun to watch. Impossible to list them all, check these popular ones and search yourself for others:
Linux PDAs: Sharp Zaurus and Gentoo A fair number of threads deal with configuration issues to connect the currently best-known Linux PDAs, the Sharp Zaurus series, via USB-networking to their Gentoo desktops. Given the growing range of models and the rather cumbersome tuning necessities of the usbdnet driver, this is hardly astonishing, but in spite of all the tools being present in the kernel sources, many people in the forums have been unable to get it to run. If you have managed and remember how you did it, here's where you could make a few people very happy:
Research solves problems A recent thread about portage 2.0.46-r6 accidently overwriting /etc/make.conf triggered some heat amongst the audience. Gentoo developer Nicholas Jones insisted that this was not an accident (bug), but rather that the poster failed to mention his unique circumstances and assumed that portage 2.0.46-r6 was at fault. It has been resolved that portage copied the original /etc/make.conf to /etc/.cfg0000_make.conf as it should with all config files residing in the /etc directory. This default behavior is configured via "CONFIG_PROTECT" in the environment settings. The thread also makes it clear that Gentoo developers encourage research before accusations. KMail with S/MIME and PGP/MIME support Stephen Boulet posted a message asking how to get KMail and OpenPGP to work properly together. Paul de Vrieze responded and noted a bug he had filed regarding the topic. A lengthy discussion ensued about the various intricacies associated with key management and signatures in general. This thread is a great resource for anyone attempting to get PGP and/or S/MIME working in KMail. Users looking for a more general HOWTO on using GnuPG to sign emails should see this week's Tips and Tricks section. Little Tool for Portage. Alastair Tse wrote: "A couple of months ago, I wrote a small tool to help me view changelogs for packages in the portage. After a while, I added various features I thought were useful, like calculating the size of a installed package, and viewing the enabled USE variables for an ebuild." The tool is called etcat: Portage Information Extractor. Nick Jones said that recent versions of portage do also provide information on Changelog entries with the --changelog command-line option. Akemashite Omedetou Gozaimasu ...or happy new year in Japanese. Friday night saw the first GentooJP New Year's Celebration, an event that is almost certain to become a tradition, at least for this year's 15 inaugural participants. Everybody who's anybody in Tokyo's bustling Gentoo scene was there, downing large quantities of beer and sake while trying hard not to spill anything on the laptops lying around, munching happily away at Kimchi-Nabe (fish of all denominations swimming in a bowl of Korean spicy cabbage...) and talking shop, of course, what else is there. Sadly missing were Gentooists from the Kansai area, including a number of prominent ebuilders from Osaka and Kyoto, who are of course much more seriously working people and never seem to make it to drinking events in Tokyo. [NB: The GWN team invites you to keep us informed about similar events in your countries.] A Forum for Gentoo Users in China While the mainstream user base on the official Gentoo Forums is slowly growing out of proportion, the inability to display Chinese has lead to a few frustrated comments by Gentooists from China. Until the official forums can add support for CJK character sets, Chinese Gentooists may want to check out the bustling community active in a Chinese Gentoo forum on LinuxSir.com. Combining what they like to call "DIY Linux", the forum gathers users of both Gentoo and Linux-from-scratch under one umbrella. It is hosted on Linux,Sir!, one of the larger Chinese-language techie communities, emanating that typical BBS-style mix of technical support and entertainment centered around various Linux distributions. LinuxSir currently accomodates roughly 7500 users, predominantly from Shanghai, Chengdu, Dalian, but also from outside mainland China, of course. The popularity of the Gentoo forum is second only to Redhat, but towering over Debian, SuSE, Mandrake and Turbolinux, in spite of their better-known CJK support and adaptability to Chinese users. The software used for Linux,Sir! (vBulletin) is MySQL-based just like forums.gentoo.org, and defaults to GB2312 encoding (Simplified Chinese character set). The following stable packages were added to portage this week
The Gentoo community uses Bugzilla (bugs.gentoo.org) to record and track bugs, notifications, suggestions and other interactions with the development team. In the last 7 days, activity on the site has resulted in:
The current list of developers' open bugs may be found at the Gentoo Bug Count Report. The developers and teams who have closed the most bugs this week are:
The developers and teams who have been assigned the most new bugs this week are:
Using GnuPG to digitally sign emails GNU Privacy Guard (GnuPG) is an open source version of the commercial Pretty Good Privacy (PGP) software for creating digital signatures. This weeks Tips and Tricks will cover the creation of a key, exporting your key to a public keyserver, and finally adding your digital signature to email.
Now that your key has been made, it needs to be exported to a public keyserver. While this is not required, it's the easiest way for others to get your public key information and verify your information. To send your key, you'll first need to know your Key ID.
Now you can export your key.
Now that your key has been created and published, you can start using it to sign emails. You'll need to remember your Key ID for this step. If you don't remember it, see the above code listing (Finding your Key ID). Use the following steps to set up encryption in Evolution:
When you compose a message, press p to sign or encrypt. To only sign your email, select s. Then you can send your message and it will be signed with your digital signature. The above tips will help you get up and running with gpg, but it is not by any means a complete guide. You should also read GnuPG's excellent documentation section to learn more about important concepts like key revocation, key signing and webs of trust. The following developers recently left the Gentoo team:
The following developers recently joined the Gentoo team:
The following developers recently changed roles within the Gentoo project.
9. Subscribe to the GWN mailing list Would you prefer to receive the GWN via email? Subscribe to our mailing list by sending a blank email to gentoo-gwn-subscribe@gentoo.org. Interested in contributing to the Gentoo Weekly Newsletter? Send us an email. Please send us your feedback and help make GWN better. The Gentoo Weekly Newsletter is also available in the following languages: |
|