Slashdot Mirror

Good job @ pointing to a seven-year old vuln report. Thanks.

The stack smashing daemon is caught by my PaX configuration.

$ ./paxtestd
Password: (pretend that the last format-string-containing password in the paper is here. The filter is bitching at me 'cause I have too many junk characters in my post.)
*** stack smashing detected ***: paxtestd - terminated
paxtestd: stack smashing attack in function verify - terminated
Report to http://bugs.gentoo.org/
Killed
$

So, the information leak that the "runit" executable is demonstrating fails to occur.
Next time, please try to present some relevant vulns. :)

Yea, it runs on top of Debian, Mac OS X, Solaris and, no joke, Windows. ;)

Yea, it runs on top of Debian, Mac OS X, Solaris and, no joke, Windows. ;)

Yea, it runs on top of Debian, Mac OS X, Solaris and, no joke, Windows. ;)

I tested it myself, for a server with no fancy Desktop it compiles very well. Many packages are already tested and get the ~x86-fbsd keyword for installation. Also Sparc+Gentoo+FreeBSD is possible :) disi@disi-desktop ~ $ cat /usr/portage/www-servers/apache/apache-2.2.* | grep bsd KEYWORDS="alpha amd64 arm hppa ia64 ~mips ppc ppc64 s390 sh sparc ~sparc-fbsd x86 ~x86-fbsd" http://www.gentoo.org/doc/en/gentoo-freebsd.xml

I see lots of other places around the world where folks insist on segregating themselves by ethnicity and/or religion.

Yeah, I can't think of any fanatic groups of people who cling to various beliefs like so many religions, segregating themselves from others.

Excuse me while I go sacrifice a goat to Larry Wall.

The Ripper Gang is pleased to announce the final public ISO release of PCLinuxOS 2009.1. This release features kernel 2.6.26.8.tex3, KDE 3.5.10, Open Office 3.0, Firefox 3.0.7, Thunderbird 2.0.0.14, Ktorrent, Frostwire, Amarok, Flash, Java JRE, Compiz-Fusion 3D and much more. We decided to use kde3-5-10 as our default desktop as the we could not achieve a similar functionality from kde4. We will however offer kde4 as an alternative desktop environment available from the repo once we stabilize it.

That alphabet soup doesn't really inspire at all. Now, I actually know that I don't want to use Gentoo, but the first thing from the site makes it seem tempting:

We produce Gentoo Linux, a special flavor of Linux that can be automatically optimized and customized for just about any application or need. Extreme performance, configurability and a top-notch user and developer community are all hallmarks of the Gentoo experience. To learn more, read our about page.

If you REALLY like to punish your Mac... you can also get Gentoo for OSX. Of course, to some Gentoo is punishing yourself, too... but personally I love having the prefixed Gentoo environment for all my Linux-style tools, while still being able to run my Mac tools in the same terminal window.

I'm not quite ready to have that as my default shell environment though... but I do have a shortcut to start up "startprefix.sh" in a terminal window :)

Note that if there's BSD or Linux type software you just HAVE to have and can't live without, but also can't get as an OSX package or Gentoo emerge... there's always DarwinPorts, which is a version of Port for OSX. I have that as well, but I tend to use Gentoo as my first source, Port as my second.

I guess you have never tried it, I could recommend some distros that are on very mature and dont require you to learn command lines to use.

http://www.gentoo.org/

So out of all the user friendly distros you pick... Gentoo?

Why don't you use BIND?

For the same reason I'll consider using nearly any MTA except Sendmail, which is because it has a poor security history. BIND and Sendmail both hail from a time when the Internet was a much friendlier place and I consider neither trustworthy on the hostile network that the Internet has since become. I know that version 9 of BIND was a complete rewrite, yet that too has had more security issues than I would like to see.

In my opinion, BIND is written for functionality first and security second. History has shown that security needs to be a fundamental design goal from the beginning; trying to write a program and then secure it later as vulnerabilities are found is problematic at best and causes a lot of preventable problems. Good security is not an afterthought. I just don't see security as an integral part of BIND's design, not when compared to alternatives like djbdns or maradns. For example, from its very first release, maradns has always used a cryptographically secure RNG to randomize query IDs and source port numbers and was never once vulnerable to cache poisoning attacks. BIND didn't start doing this until people started exploiting it. I've just seen too many issues like that which were better solved by more proactive approaches. I really can't rigorously prove to you that one solution is inherently superior to some other solution, especially since your needs and priorities may differ from mine, but I can explain why I have strong preferences that contribute to what I will and won't do.

BIND is also bigger and more complex than what I actually need. I have never felt like there was some must-have feature provided by BIND, so there is really no compelling reason for me to use it. Even so, using a daemon whose authors more proactively consider security issues is just one step. I take other measures, including but not limited to a well-configured software firewall (Linux kernel/iptables) that is itself behind a hardware firewall/router, a PaX/Grsecurity kernel that provides things like non-executable stacks and randomized memory addresses and chroot jails that are much harder to break, and userland measures like compiling the daemon with SSP. Many of those are part of running a Gentoo system with the Hardened profile, which also implies a hardened toolchain. A source-based distribution is definitely not for everyone, but it offers some very good options like this and I'm quite happy with it. I also use Logsentry and a few other tools to help me keep an eye on things.

Yes I'm paranoid, but it's because I believe in preparedness and I've seen too many examples of what happens when administrators don't consider attacks to be an eventuality. I'm rather "old school" in a few ways; for example, I do not believe in after-the-fact removal tools (i.e. for rootkits) at all. Once a system has been compromised, the only way to ever trust it again is to wipe the drives and reinstall from known good media. Between the two, I consider the idea that I may have put an excess of effort into locking down the system (and in the process expanded my skill) to be far more acceptable than the idea of regretting that I didn't do enough. I know there is no such thing as absolutely perfect security, so I think about my threat model and I consider a system "secure" when the effort required to have a hope of breaking into it far exceeds (by a ridiculous margin) any value that might be obtained by doing so. To give a poor analogy, it doesn't make any sense to spend one million dollars in order to earn one thousand dollars. Unless it's a personal vendetta, attackers do understand this and they greatly prefer to go after the low-hanging fruit. The standard these days is so low that it doesn't even take very much to place yourself out of that category.

We don't have to imagine. Thanks to the diversity of FOSS and the strength of the ability to bundle and innovate at will, there is Gentoo Linux and Open Embedded (which is based on Gentoo's Portage software installation and management tool.)

Ummm... No. OpenEmbedded is debian-based, and has what is essentially a shrunk down version of apt, called ipk.

Just wanted to get the facts straight. But your comments on the diversity of FOSS and all that stand of course.

We don't have to imagine. Thanks to the diversity of FOSS and the strength of the ability to bundle and innovate at will, there is Gentoo Linux and Open Embedded (which is based on Gentoo's Portage software installation and management tool.)

Ummm... No. OpenEmbedded is debian-based, and has what is essentially a shrunk down version of apt, called ipk.

Just wanted to get the facts straight. But your comments on the diversity of FOSS and all that stand of course.

But that's the beauty of Linux. Linus may be "a geek, a developer" and may indeed be out of touch with what companies need, but that's okay because RedHat and Novell stepped up to fill that need. Meanwhile Daniel Robbins created a distro for those who either like to tweak and build bleeding edge systems or who need systems that don't have to be rebuilt every couple of years when the packages are all out of date. Mark Shuttleworth built a distro for people who want a version of Linux that just works right out of the box. Klaus Knopper had the great idea to create a distro you can run from a CD instead of installing on a hard drive.

This is cool because you can use the right distro for the job at hand. We use Gentoo where I work because we can keep our servers up to date with minimal downtime -- we don't have to rebuild our servers every time we want to upgrade. I run Slack at home because, well, it's what I learned first. I've got a hard drive install of Knoppix on a laptop because I couldn't boot from CD on that particular machine, so I pulled the hard drive, mounted it in an external enclosure, booted Knoppix on another machine and followed the instructions for a hard drive install using the USB drive, then reinstalled the hard drive in the laptop. I knew Knoppix was very good at automatically detecting hardware, so I felt Knoppix would have a good chance of working on the first install (it did).

"Suppose someone creates a very minimalist linux distro which includes a very good package management system. Suppose this package management system includes nearly all popular linux software packages.

Now suppose it were rather easy for anyone to install any number of those packages, bundle them together into one meta-package keyword, and call that a distro.

We don't have to imagine. Thanks to the diversity of FOSS and the strength of the ability to bundle and innovate at will, there is Gentoo Linux and Open Embedded (which is based on Gentoo's Portage software installation and management tool.)

"Suppose someone creates a very minimalist linux distro which includes a very good package management system. Suppose this package management system includes nearly all popular linux software packages.

Now suppose it were rather easy for anyone to install any number of those packages, bundle them together into one meta-package keyword, and call that a distro.

We don't have to imagine. Thanks to the diversity of FOSS and the strength of the ability to bundle and innovate at will, there is Gentoo Linux and Open Embedded (which is based on Gentoo's Portage software installation and management tool.)

Linux has actually TWO Sane mans of Installation. RPM, DEB. (Sorry Gentoo Users, Portage doesn't cut it.)

I have personally been running Gentoo for years now.
The only time I have run an installation was because I bought a new computer.

Portage works. It works amazingly well. Not perfectly, but good enough for me and many others.
If you have some silly philisophical complaint about the way one distro does things, that doesn't make that distro "not sane."
It sounds like you don't really understand how Portage works anyways. See this link.

I started out with RPM, but it did not suit my long term needs.
Short term, it works great. In the long term, when you decide you want package foobar 3.2.2 and your distro only has RPMs for 2.9.8, you wind up doing exactly the same processes portage does, except:
-You're doing it manually
-You get stuck in dependency hell
(Now you need foolib 2.3.5, but all your other packages are built against 2.3.4 and the two versions can't coexist. So now you need to rebuild thirty packages, manually.)
Even if portage doesn't have ebuilds for foobar 3.2.2 and foolib 2.9.8, all you wind up doing is creating two new ebuilds and letting portage do the recompiliation of all the packages built against 2.9.8 for you.

I wouldn't claim RPM is "not sane" but to say that it's beyond Portage is foolish.
Both systems work for thousands of users. Both have their places.

People usually don't sign up for Open Source or Free Software. They just do stuff, put it out there and let other people use it. To quote one Mr. Torvalds, real men just upload their important stuff on ftp, and let the rest of the world mirror it.

I have customer service skills godddammnit! Anyway, I'd hope to be able to help. Like I said, where do I sign up? Is it with Canonical, or is there a generic "Linux" marketing effort someplace?

Have you thought about starting a blog?

How about taking an active part in one or more major distribution's forum?

• http://fedoraforum.org/
• http://forums.opensuse.org/
• http://ubuntuforums.org/
• http://forums.gentoo.org/

Just publishing (in a reusable format under a nice CC License)

• market research
• technical business direction
• explainations of what is possible to the business types
• what you (as a marketing professional) learn from techies

If your work is of high quality, it would make an impact.

It's in reference to a Gentoo Stage1 install where the system is compiled mostly from scratch. It looks like it is only recommended for l337 developers now as that FAQ mentions that end-users shouldn't use it.

If they're running on Gentoo they do!

Exactly, I would not say it better.

As a member of the gentoo embedded team I would recommend the use of crossdev to generate the toolchain.
By emerging crossdev-wrappers and setting up some gentooish cross-compiler environment, it is possible to cross-compile (by simply emerging them) a lot of packages on portage.
Emerge will take care of most things leaving the most ugly cross-compile errors for you.

http://www.gentoo.org/proj/en/base/embedded/cross-development.xml

Regarding the guide, don't use the xmerge script. Just emerge crossdev-wrappers instead.
Feel free to join #gentoo-embedded on irc.freenode.net

Happy xcompiling.

Since this is on topic...and Nepomuk uses strigi components:

My problem: http://forums.gentoo.org/viewtopic-t-710966.html

I've tried contacting both strigi developers, other one doesn't respond and the other says "ask the other guy".

Anyway, I've got about 10000+ JPEGs off my digicams, all of them are commented - in the JPEGs internal comment field. When reading about strigi and other desktop search tools, I was thrilled - I could just search for stuff instead of my old standby jhead *.jpg | grep Comment | grep .

However, at least KDE 4.1 implementation seems to be based on some crappy database with proprietary format with no chance to import the metadata from elsewhere...and when using stand-alone strigi the whole thing doesn't seem to work. From all that I've read, I SHOULD be able to search e.g. all images that were taken with ISO >800 or whatever is in comment field (although there is apparently some confusion whether the comment is JPEG comment or EXIF comment).

Only problem that it doesn't work.

Anyway, I hate the idea of some separate "metadata-database". DB can be used for CACHING, but all the metadata should really be integral to the file itself. EXIF tags for images, ID3 tags for MP3s, and so on - that way if you copy/move the file all the attached information goes with it and requires no specific "transfer metadata too" support from the copy operation.

Anyway, has anyone on /. actually gotten strigi to work with image files/photos?

KDE is technically way ahead of Gnome, which is a bloated pile of rubbish. If you're on Gentoo just compare the number of packages and total amount of sources needed of both, KDE is smaller by an order of magnitude.

Rubbish, you're just trolling, KDE takes far longer to compile. It took me a whole weekend to compile KDE, Gnome took half that time.

Even the maintainers of the gentoo quick install guide time a Gnome compile as:

real 520m44.532s
user 339m21.144s
sys 146m22.337s

and a KDE compile as:

real 1171m25.318s
user 851m26.393s
sys 281m45.629s

Why would you think that you wouldn't need to defrag whether it was NTFS or some other type of partition? ext3, ext4, ReiserFS, and even XFS require regular defragmentation for optimal performance.

please please please let someone port portage/gentoo package management to openbsd... please... :(

You might be interested in this. (There's also this...don't know how much difference there is between FreeBSD and OpenBSD, as I've tended to just stick with Linux. It looks like the two projects are cooperating to some extent.)

please please please let someone port portage/gentoo package management to openbsd... please... :(

You might be interested in this. (There's also this...don't know how much difference there is between FreeBSD and OpenBSD, as I've tended to just stick with Linux. It looks like the two projects are cooperating to some extent.)

Have they fixed the aacraid driver yet? The new kernel doesn't do me a bit of good if all I get on boot is a continuous stream of:

aac_srb: aac_fib_send failed with status: 8195

and my disk array is not recognized.

http://lkml.org/lkml/2008/5/12/365

https://bugzilla.redhat.com/show_bug.cgi?id=450444

http://bugs.gentoo.org/show_bug.cgi?id=233364

http://bugs.centos.org/bug_view_advanced_page.php?bug_id=2911

http://marc.info/?l=linux-kernel&m=122166454808377&w=2

http://linux.derkeiler.com/Mailing-Lists/Kernel/2008-10/msg02493.html

ne might be a nice option for what he is looking for, it uses the same default shortcuts as all the "usual" crap like notepad, EDIT etc. regarding the OS there have been some solid recommendations (xubuntu, customized debian with fluxbox, busybox is a bit far fetched in my opinion), however if you really want to tinker with it and optimize your boot time, but still maintain a fully operational OS, try gentoo.

Or you can run Gentoo, and really do everything yourself. Like most other Linux distros, Slackware is a package based system - still kind-of user-friendly. By comparison, Gentoo is user-hostile.

Nah, that's too extreme. Everyone knows that the best way to learn Unix is to run Gentoo.

I can get behind that. The documentation has fallen behind lately, compared to what it once was, but is still pretty good. You might want to first make sure that you have a decent understanding of the command prompt before attempting an install...

However, for Christ's sake, do not use Gentoo as your main distro. It will drive you insane.

Here's a link to the gentoo handbook for mips: http://www.gentoo.org/doc/en/handbook/handbook-mips.xml

http://www.debian.org/
http://www.fedoraproject.org/
http://www.ubuntu.com/
http://www.opensuse.org/
http://www.slackware.org/
http://www.gentoo.org/
http://www.freebsd.org/
http://www.openbsd.org/

(because surely someone must care)

If the 2.6 is not going to change, drop it, it's redundant.

So we're down to 26. I personally find a name like "Linux 28" to be cool. "Linux 41 was released today...". There's nothing wrong with big numbers: see udev.

The problem with date-based numbering is that when you go from 2008.4 to 2008.10, it looks like you missed a few releases. And if you pre-announce a release, you have to meet your deadline or else rename the release.

So they could do what Gentoo does - 2007.0, 2007.1, 2008.0, 2008.1, etc. But you still have the problem that every year, you lose count of how many releases have happened. Was there a 2007.2 or did we just go to 2008.0 because we missed the Christmas deadline due to that last-minute security bug?

They could reduce the problem by using a longer period, such as a decade. (At 6 months for a release, for example, the number will only reach 20, which is not large.) But that's somewhat arbitrary. Plus, being in the 0th decade, we don't want to have 2.6.30 be called 0.3.

To reduce the complexity on all that, just drop the dates, and what's left is a single big number. No dots, no multiple numbers, easy. Linux 112 is fine by me.

Don't forget to look into Gentoo.

-O3 is slower than -O2 or -Os in gcc-4

The behavior of gcc has changed significantly since version 3.x. In 3.x, -O3 has been shown to lead to marginally faster execution times over -O2, but this is no longer the case with gcc 4.x. Compiling all your packages with -O3 will result in larger binaries that require more memory, and will significantly increase the odds of compilation failure or unexpected program behavior (including errors). The downsides outweigh the benefits; remember the principle of diminishing returns. Using -O3 is not recommended for gcc 4.x.

http://www.gentoo.org/doc/en/gcc-optimization.xml

Just see Gentoo Upgrading Guide.

There's more information about the changes in a draft upgrade guide. There's a few key changes (as someone above mentioned as well), one being that portage will preserve existing libraries until the dependencies are rebuilt against the new ones. Another is that you can create logical sets (i.e. create a media_player set with vlc & mplayer and dependencies, and update it using `emerge -av @media_player` -- this will update everything in the set. Pretty nifty.

I don't think there's any

KDE4 - yes: http://www.gentoo.org/proj/en/desktop/kde/kde4.xml

That will probably take a very long time. I use something called emwrap. The latest version is here. It will rebuild the toolchain, system, and world all safely and optimally.

Though usually when I update profiles, I just do the 'eselect profile ...', and 'emerge -DNav world'. I haven't had a problem doing that in three years (I don't think).

Postgres v8.3 yes:
http://packages.gentoo.org/package/postgresql

KDE v4 no (not outside the KDE overlay)
http://packages.gentoo.org/package/kde-meta

OpenOffice 2.4 yes
http://packages.gentoo.org/package/openoffice

Postgres v8.3 yes:
http://packages.gentoo.org/package/postgresql

KDE v4 no (not outside the KDE overlay)
http://packages.gentoo.org/package/kde-meta

OpenOffice 2.4 yes
http://packages.gentoo.org/package/openoffice

Postgres v8.3 yes:
http://packages.gentoo.org/package/postgresql

KDE v4 no (not outside the KDE overlay)
http://packages.gentoo.org/package/kde-meta

OpenOffice 2.4 yes
http://packages.gentoo.org/package/openoffice

Tech:
I, Cringley http://www.pbs.org/cringely/pulpit/rss2.xml
Freedom to Tinker http://www.freedom-to-tinker.com/?feed=rss2
Freenode staffblog http://blog.freenode.net/?feed=rss2
Gentoo Monthly Newsletter http://www.gentoo.org/news/en/gwn/rss.xml
Xaprb (MySQL) http://www.xaprb.com/blog/feed/atom/

Games:
Cruise Elroy ("Intelligent discussion of video games") http://cruiseelroy.net/feed/
Jonathan Drain's D20 Source http://d20.jonnydigital.com/feed
Socratic Design http://socratesrpg.blogspot.com/feeds/posts/default
Stephen's Weblog (NDS homebrew) http://blog.akkit.org/feed/
StupidRanger http://feeds.feedburner.com/Stupidrangercom
Zero Punctuation http://www.escapistmagazine.com/rss/articles/editorials/zeropunctuation
Zelda Reorchestrated http://www.zreomusic.com/feed/
Used to read The Escapist, quite enjoying the magazine format, but seven or so articles all on the same day each week became too much (once a month please!). The format has changed since then, it just isn't the same.

And the Comics:
xkcd comic & blag
Penny Arcade
and no feed, but 8-bit Theater

And a number of various personal feeds

Slashdot I just check every few hours, I can be assured there is going to be a new article to read

http://packages.gentoo.org/feed/arch/amd64 - So I know when "sudo emerge --sync" is particularly called for

http://www.desktoplinux.com/backend/headlines.rss - Occasionally informs me of things not covered on Slashdot

http://rss.slashdot.org/Slashdot/slashdot - Yup

http://feeds.feedburner.com/rawstory/gKpz - Politics

I've built this: http://www.gentoo.org/doc/en/mailfilter-guide.xml, when i was tasked with setting up mailfilter. It works great and is also scalable with some LVS if you really need it. There's always GMail for business (former Postini) mailfilter (which is pretty cheap) or a ton of similar solutions out there that will do it for you.

What the fuck are you talking about?

It's called Gentoo Linux if you are talking about a distribution that can just use rolling updates forever - once you've installed it, just update it with any new kernels and libraries and then compile appropriate applications against those. Yep, it's time consuming and sometimes there's a problem but I spend no more time messing around with my Gentoo server or solving update problems than I do with my XP machine in order to keep everything clean and updated.

I don't use Ubuntu much but I understand it too is pretty straightforward if you upgrade to a new version.

As for price, please don't go there, you know Linux is downloadable pretty much for free across the board - sure, you might pay Red Hat, Novell or some other company for a maintenance contract but again that's no different to Windows shops.

Things like this (somewhat smaller scale) already are (somewhat bigger scale) being done.

As an 'expert' system administrator (albeit unpaid) I have four servers. One is running Microsoft Windows Small Business Server 2003, one is running Microsoft Window Server 2003, one is running Ubuntu Linux 5.10 (Server), and the other is running Apple OS X Server (10.4).

I can tell you now that when I first started my company, although I was a major advocate of Linux, I soon found that I did not have the time to maintain a then Gentoo or custom LFS distribution, Debian was far too heavy to pick up, and Slackware felt a little dated. So I took a look at Microsoft Windows Small Business Server 2003, liked what I saw, and bought a Dell PowerEdge 400SC with an OEM install.

At first Small Business Server was a breath of fresh air. It was easy to maintain, with a full complement of features, having been bundled with Microsoft Exchange, Microsoft SQL Server, and Window Sharepoint Services. I actually enjoyed - yes, enjoyed - using it.

Until backup stated to fail. Until my tape drive disappeared. Until the sharepoint website database got corrupted. Until exchange monitoring failed. Until the POP connector started to thrash the CPU. Until the Windows Update website failed to check for updates.

These things happened. I'm not saying that they wouldn't happed with another system, but that is not the point, since they happened to me, and that caused me grief, and time, and money to resolve. I ended up trying to build a new system based on Microsoft Windows Server 2003, since I already had Microsoft specific data (files and tables), but this proved even more difficult to maintain.

I struggled for eighteen months, and then decided to build an Ubuntu 5.10 server. I use Ubuntu on one of my laptop, and had gently learnt the apt- way, and liked it. I set up a server with similar features to the Small Business Server, using Postfix, MySQL, and Plone, and even went some ways to transferring my sharepoint data. It works. It hasn't failed yet.

I bet the guys who took part in the survey only set up a server, installed some applications, and patched it. I bet they didn't try running a business for 18-months, just to see what it was really like.

I must say that we recently purchased an Apple PowerMac, and were so impressed we are now looking at completely switching, hence the OS X Server. It is a dream to install and configure, but we are going to run it for several months until we are satisfied that it can do the job.

Don't worry, you still have a few months before the 2.22 ebuild's are marked stable. In the meantime, make sure you write a lot of "is it ready yet?" replies to threads like this one on the Gentoo forums. Also, maybe file a bug report (or eight) informing the Gentoo developers that Gnome 2.22 has been released and that you couldn't find it in portage yet. :P