Domain: redhat.com
Stories and comments across the archive that link to redhat.com.
Comments · 4,506
-
Brief is now online.
They have not uploaded their full brief yet online, but promise to post it soon.
TFA now has a link to a PDF of the brief. -
Re:Honestly
Link to the brief It was at the bottom of the page.
As for my .02$ I think you should be able to patent compilers, anything else should fall under copyright. -
Re:So how does one make money in this market?
"Don't say services because services don't provide real cash flow.
Shhhh .... don't tell these guys!. -
Re:Lead the way
-
Threads: Threat or MenaceIt always surprizes me how many people say "we have to multithread our code, because computer are getting more cores," not realizing:
- There are often other ways to do it, e.g. multiple processes communicating over sockets, or multiple processes that share memory.
- Threads are hard to get right. Really, really hard.
If these people take years to get it right, what makes you think *you* can get it right in a reasonable time?
The irony is that threads are only practical (from a correctness/debugging point of view) when there isn't much interaction between the threads.
By the way, I got that link from Drepper's excellent "What Every Programmer Should Know about Memory." It also talks about how threading can slow things down.
-
Threads: Threat or MenaceIt always surprizes me how many people say "we have to multithread our code, because computer are getting more cores," not realizing:
- There are often other ways to do it, e.g. multiple processes communicating over sockets, or multiple processes that share memory.
- Threads are hard to get right. Really, really hard.
If these people take years to get it right, what makes you think *you* can get it right in a reasonable time?
The irony is that threads are only practical (from a correctness/debugging point of view) when there isn't much interaction between the threads.
By the way, I got that link from Drepper's excellent "What Every Programmer Should Know about Memory." It also talks about how threading can slow things down.
-
Re:Security Fixes until 2014
Well, Red Hat has security updates for 7 years...
From http://www.redhat.com/security/updates/errata/
:Red Hat Enterprise Linux (version 2.1): Including Red Hat Enterprise Linux AS, Red Hat Enterprise Linux ES, and Red Hat Enterprise Linux WS General Availability: May 17, 2002 Full Support (including hardware updates): May 17, 2002 -- Nov 30, 2004 Deployment Support: Dec 1, 2004 -- May 31, 2005 Maintenance Support: June 1, 2005 -- May 31, 2009
As for Novell (SUSE), from here: http://support.novell.com/lifecycle/
Novell will provide a minimum of five years General Support for platform and operating system products, including its revisions, starting with the date of a product's general availability. When General Support ends, Novell will offer extended support for a minimum of two years
-
Re:Uh oh
-
Re:Microsoft is being extraordinarily abusive.You've got to be kidding. Dr. Death? Which OS maker gives "mainstream" support for their previous version for longer than Microsoft? XP's successor (Vista) was released about 13 months ago. That's more than 2 years of continued mainstream support for XP after Vista was released and more than 7 years of mainstream support over XP's lifetime. Red Hat Enterprise Linux provides support for up to 7 years after its release.
http://www.redhat.com/security/updates/errata/ -
Red Hat's Response
-
No fix from M$? So?But a lot of other fixes can be found on the web. Here some alternatives to choose from: Or use it as a sign to get a new stylish computer which actually "just works".
-
Re:Good reporting there, submitter
Maybe you have heard about this groups of people called `distribution makers'? You can check http://www.redhat.com/, http://www.debian.org/, http://ubuntu.com/, and so on. I hear there is a whole site dedicated to simply listing linux distros! They surely are not the developers of all the code they package, you know.
The fact that the GPL is a license on distribution is a hardly a semantic point: it is essentially the whole point of the license!
You claimed that "the developer is the party bound by the license, not the user": one can but conclude that you have not even read the license (nor the many faqs out there explaining in painstaking detail what the license says...)
-
Modular fix with insmod and patch
There is a quick and dirty fix via a module. https://bugzilla.redhat.com/show_bug.cgi?id=432251#c10 The actual patch is listed here: http://home.powertech.no/oystein/ptpatch2008/ -Rob
-
Re:2.6.24.1 is Not Vulnerable
That is incorrect. There are three different vulnerabilities here, you're only accounting for one of them.
-
This flaw is CVE-2008-0600
Upstream patch for the vulnerability tickled by that specific exploit is here
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=712a30e63c8066ed84385b12edbfb804f49cbc44
Red Hat tracking bug (Enterprise Linux 5 is affected, but 4,3, and 2.1 are not)
https://bugzilla.redhat.com/show_bug.cgi?id=432251
Fedora tracking bug
https://bugzilla.redhat.com/show_bug.cgi?id=432229 -
This flaw is CVE-2008-0600
Upstream patch for the vulnerability tickled by that specific exploit is here
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=712a30e63c8066ed84385b12edbfb804f49cbc44
Red Hat tracking bug (Enterprise Linux 5 is affected, but 4,3, and 2.1 are not)
https://bugzilla.redhat.com/show_bug.cgi?id=432251
Fedora tracking bug
https://bugzilla.redhat.com/show_bug.cgi?id=432229 -
Re:Microsoft has given everyone a bad name.
-
Re:Ubuntu as well?In fact, I mentioned it in my initial bug report on 12-5-07
;-): https://bugzilla.redhat.com/show_bug.cgi?id=410031
The same issue is likely to affect a huge number of services, like apache (with a rogue user using their personal webpage, or a remote attacker exploiting php code injection in poorly written php code). -
Re:Ubuntu as well?
on several systems, in a small amount of time?
In general, these systems probably don't even give users shell access, and even then, password cracking is probably out of the picture. And brute forcing a password over ssh? thats probably troublesome too, it would be hard to get over about 50 attempts/second.
On the other hand, there are a whole bunch of local vulnerabilities that can be exploited, after a system is compermised. In some cases, a weak php include vulnerability could potentially allow the apache user to execute suid root applications through such vulnerabilities as: https://rhn.redhat.com/cve/CVE-2007-5964.html on a default configuration of rhel5/fedora5-7.
Every system has it's vulnerabilities. -
The study is is flawedI've been browsing Microsoft's study and there is quite a bit of silliness in it. It doesn't mention anywhere, regarding the non-microsoft OSs, what vulnerabilities were counted and what was the source of those reports. It only mentions, regarding linux distributions, that he manually left out OpenOffice and the GIMP. No more no less. Following that, I searched for what the study mentions quite a bit (Red Hat/Ubuntu's security advisories) and this was what I found:
Browsing those, the first thing that pops out is that it covers all bugs originating from all the software that aren't installed in the default installation. I mean, Ubuntu's page lists advisories on PostgreSQL, MySQL, tetex, perl, PHP, emacs, CUPS, Thunderbird, ImageMagick, vim, etc... Is the idiot considering the reports regarding those software packages as an operating system vulnerability? The very same thing applies to RHEL Desktop Workstation. It lists both KDE and GNOME advisories along with packages like, again, PostgreSQL, Firefox, ruby, pam, CUPS, tomcat, fetchmail, squirrelmal, PHP, evolution, etc... Quite a few of those packages can't even run on the same system.
-
Re:So, here's your answer:
If only someone would point that out to Microsoft.. the most obvious exception to your relationship.
No kidding. If it wasn't for Microsoft, I could have used the word "quite" instead of "often". It's not enough to have millions of beta testers (err, I mean customers) - you have to provide a way to listen to them. Collecting $99 or $249 to open a PSS ticket (and then spout worthless advice such as "do an in-place Windows reinstall" instead of providing a fix) doesn't cut it.
-
Re:Obviously they are worriedWhen all software out there is Open Source, leaks will be found and closed.
Right, because of course Free software never has security bugs. Look, I'm a paid-up card-carrying member of the FSF, which makes me about as much of a swivel-eyed zealot as they come, but even we don't make silly claims like that.
-
Re:Typical MS "Planned Obselescence"
Can you name a single open source vendor that will support you using a 7 year old version of their product? Of course you can't.
See the RHEL support policy, everything gets a 7 year support policy by default. IIRC RHEL-2.1 has at least a couple of years extension from that too.
-
RHEL is supported for 7 years
I wish I could mod you up and still reply to your post because your basic point is sound (vendors frequently stop supporting old software). However I just quickly want to say that RHEL is currently supported 7 years so yes, I can name a vendor that will support you using a 7 year old version of their product - Red Hat. (You can argue that we're talking about formats rather than programs though)
Now as to that compatiblity pack for Office 2003... Earlier last year I had reason to ask someone to install the file format the addon. The problem was that the 2007 document in question was sent with a .doc extension which meant that Word 2003 still refused to open it after the addon was in place. Changing the extension on the file to .docx solved the problem but it was annoying because I didn't already know that was all that was needed especially given that Windows doesn't show extensions by default. Once the file was renamed it worked fine. -
Re:fedora is nice
No. You, sir, are full of crap. When you look at what's actually used and widely recognized in the world of Linux (especially for desktops), you'll plainly see that there are several "mainstream" distros that garner the lion's share of attention and represent the vast majority of the installed base:
In no particular order:
(1) Red Hat Linux
(2) Fedora Linux (community bleeding-edge source for Red Hat)
(2) Mandriva Linux (used to be Mandrake)
(3) Ubuntu Linux (plus variants, Edubuntu, Xubuntu, Kubuntu, etc)
(4) SUSE Linux (owned by Novell these days)
(5) Gentoo Linux
Yes, we also have Debian, Slackware and many others that don't necessarily have huge commercial ties, but they're also the base for many commercial distros. You might be using Linux From Scratch, or one of several dozen other random distros with has an installed base of 100 users, but if that's the case you're pretty far from the average desktop or server Linux user.
My Apache logs tell the story pretty well. As Captial One might say, what's in your logfiles?
-
Re:OSS doesn't meet quality standards
The fact is that most OSS projects are ill suited to the corperate and government environment.
At least my open-source web browser warns me when I misspell "corporate" while trolling.OSS EOL's stuff long before it would be considered "tested" in something like a DoD environment.
Yeah, it's a shame the copies of RHEL5 I deployed earlier this year will only be supported until 2014. Barely any time at all to test them. -
Memory matters, too
I see a lot of comments indicating that all a programmer needs to do to scale to more cores is just multithread your algorithms. If only that were true! Unfortunately, memory access patterns become extremely important for getting good performance, and that requires some pretty sophisticated knowledge about the hardware and proper tuning is almost a black art. Once large numbers of cores are in use, scaling your software optimally is going to be very difficult. Don't delude yourself. Talented programmers are going to be very much in demand, and I suggest starting to learn everything you can about it now. For starters, Ulrich Drepper has written an incredibly detailed and helpful article available at http://people.redhat.com/drepper/cpumemory.pdf which should really help dispel any notions that this change to computing is going to be easy!
-
Re:less memory!
Pretty fascinating right? Here is a good overview of memory, from a programmer's viewpoint. The 200 cpu cycles is an optimistic figure, it is realistically higher under normal usage. Check out page 15 and on, if you're interested in the raw timing data.
Of course, latency and throughput is a different matter. The cpu can fetch a lot of data at the same time, but not faster than 200 cycles. If you don't yet see the difference, think of the example of databases: When a database makes a guarantee that it completes 1 million transactions per second, it doesn't mean that one transaction completes faster than one second. -
RedHat TrainingRedHat has put an interesting incentive on the table. Sign up for one of their mentioned classes and they'll ship you a Nintendo Wii about 6 weeks later. Note to the observant reader: this period ends after the holiday rush. As best as I've been able to work out, they've put in an order and Nintendo would have to promise they could deliver, as RedHat becomes contractually obligated to provide the student with a Wii.
Details of the offer are here. Be sure to read the fine print about when and how you sign up. Note that if you are government employee, they won't give you one as that would be seen as a gift, which may be misconstrued as a bribe.
-
Fedora Core 5 is questionable
What an appropo subject. I downloaded the FC5 isos recently, and noted that the sha1 checksums don't match with the PGP signed file. This is off of http://download.fedora.redhat.com/pub/fedora/linux/core/5/x86_64/iso/
So, either someone is messing with the isos, or Redhat screwed up. If anyone has some specific info here, it would be appreciated. -
Re:Well there you have it
RHEL 3 is still supported by RedHat, and will continue until Oct 31, 2007, check here: http://www.redhat.com/security/updates/errata/ Of course, maybe those places/people running rhel3 has chosen not to update it and it is not updated but my opinion is that RHEL3 is not out of date yet.
-
Re:Windows XP SP3 please
Red Hat has a 7 year support cycle on their enterprise linux products, so if you installed RHEL 2.1 back in 2002 it is still receiving security & bug fixes and will be until 2009. In fact the most recent released fix for the 2.4 kernel it shipped with was August this year.
http://www.redhat.com/security/updates/errata/
https://rhn.redhat.com/errata/RHSA-2007-0673.html -
Re:Windows XP SP3 please
Red Hat has a 7 year support cycle on their enterprise linux products, so if you installed RHEL 2.1 back in 2002 it is still receiving security & bug fixes and will be until 2009. In fact the most recent released fix for the 2.4 kernel it shipped with was August this year.
http://www.redhat.com/security/updates/errata/
https://rhn.redhat.com/errata/RHSA-2007-0673.html -
Re:Where are the authoritative SHA1 values?
The SHA1SUM-file is signed with Fedora Projects GPG-key.
This particular key is the same key which signs all the RPMS in earlier versions so if you already run fedora you should already trust this key.
If not, you can find the key, for example, at:
http://download.fedora.redhat.com/pub/fedora/linux/core/6/i386/os/RPM-GPG-KEY-fedora -
Re:Does it run on Windows?I assert that it should be appropriate.
I tend to think of SELinux as a reference implementation rather than a working tool.
It IS possible to use it though, and in fact, I have it set up on my CentOS server here, but for desktops, a reimplementation like AppArmour is more appropriate.
If you decide to try SELinux, this presentation http://people.redhat.com/dwalsh/SELinux/Presentations/ManageRHEL5.pdf [Warning: PDF] was what got my head around it.
-
yesterday's news today5.1 was announced yesterday, along with a swarm of press releases. Its funny how Redhat doesn't mention Xen anywhere, and you really have to dig to find out its just Xen. The Redhat press releases and marketing make it sound like they developed their own virtualization layer.
Many of other distros have included Xen for quite some time.
-
FYI
The official news on the red hat site:http://www.redhat.com/about/news/prarchive/2007/sun_java.html/
because i can't find references on the sun & openjdk site. -
Re:Fedora?From here:
# Open source technologies rigorously tested and matured through the Red Hat sponsored Fedora project
# With each major version, stable application interfaces and 7 years of product support -
Hardware, Kernel & SecurityThere is probably much speculation about this as it applies to hardware as a service, especially the security of said hardware.
However, I found this to be more interesting.
GNAA Announces responsibility for kernel backdoor
GNAA Announces responsibility for kernel backdoor
By Tim CopperfieldRaleigh, NC - GNAA (Gay Nigger Association of America) this afternoon announced one of their loyal members was responsible for planting the "backdoor" inside the popular opensores operating system, Lunix (Stocks, Websites).
In a shocking announcement this afternoon, GNAA representative goat-see revealed that the mistery hacker who penetrated high-security defenses of the Lunix "source code" repository and injected viral gay nigger seed deep inside the kernel was indeed a full-time GNAA member.
"This is serious," goat-see began. This is a first event of such magnitude since GNAA opened its doors to new members in 1996. Until now, we were gathering new members by announcing our group information on a popular troll website, slashdot.org, but this is a whole new era. By injecting our holy gay nigger seed right into the Lunix kernel, we will be able to immediately collect thousands of members. "Make the most of the next six weeks," he added. "We will grow in numbers more than you can possibly imagine".
Insertion of the GNAA backdoor came right between the consideration of Novell to buy out the entire Lunix Kernel programming team, and will most likely positively affect the decision. By adding all the gay niggers working for Novell with the gay niggers developing Lunix kernel source, GNAA will be all-powerful and will begin plotting our next plans to add "backdoors" into the next favorite operating system, BeOS.
About GNAA:
GNAA (GAY NIGGER ASSOCIATION OF AMERICA) is the first organization which gathers GAY NIGGERS from all over America and abroad for one common goal - being GAY NIGGERS.
Are you GAY ?
Are you a NIGGER ?
Are you a GAY NIGGER ?
If you answered "Yes" to all of the above questions, then GNAA (GAY NIGGER ASSOCIATION OF AMERICA) might be exactly what you've been looking for!
Join GNAA (GAY NIGGER ASSOCIATION OF AMERICA) today, and enjoy all the benefits of being a full-time GNAA member.
GNAA (GAY NIGGER ASSOCIATION OF AMERICA) is the fastest-growing GAY NIGGER community with THOUSANDS of members all over United States of America and the World! You, too, can be a part of GNAA if you join today!
Why not? It's quick and easy - only 3 simple steps!- First, you have to obtain a copy of GAYNIGGERS FROM OUTER SPACE THE MOVIE and watch it. You can download the movie (~130mb) using BitTorrent.
- Second, you need to succeed in posting a GNAA First Post on slashdot.org, a popular "news for trolls" website.
- Third, you need to join the official GNAA irc channel #GNAA on irc.gnaa.us, and apply for membership.
Talk to one of the ops or any of the other members in the channel to sign up today! Upon submitting your application, you will be required to submit links to your successful First Post, and
-
Re:Ha ha
-
Re:The EU is UsElessThere was no way to determine a non-zero price for WMP which would be used to reduce the price of XP N; not a way that wouldn't have been very easily appealed anyway. The EC knew that. So, not only where they stupid, they knew they were being stupid. Willful stupidity is just so much better... As it is, the EU is forcing Microsoft to hand over Active Directory to its competitors for next-to-nothing. Only its NON-COMMERCIAL competitors, which is pretty much meaningless since software Freedom is about liberty, not cost. Has Red Hat, IBM, or anyone in the OIN made a similar pledge regarding non-commercial software projects? Red Hat has, and it is a whole lot broader because it includes commercial projects and is applicable world-wide: http://www.redhat.com/legal/patent_policy.html
-
Liberation Fonts
Maybe if we could just convince them to install the Liberation fonts instead:
https://www.redhat.com/promo/fonts/ -
Re:This may be true...my iPhone is still slow as hell doing anything on EDGE
Just as a quick test, Redhat takes 48 seconds to load fully on my 3G M600i, and 11 seconds on my ADSL2 line at home.
How long does your iPhone take to load the same site?
-
Re:What has to be consideredIBM in particular has lots of patents of thier own and i'm sure they could find a few that MS was somehow violating.
I was at a Redhat seminar this morning and they were talking about this exact issue. They said they belong to a consortium of companies (including IBM) who have pooled software patents for defensive purposes (I can't remember the name of the group, I want to say it's the Public Patent Foundation (www.pubpat.org) but that doesn't appear to be it). Specifically, if Microsoft tries to go against one of the members, they can search through their collection of patents, find one that MS violates, and counter sue with the desired effect of both sides either dropping it or cross licensing. Redhat's patent policy also states this (from http://www.redhat.com/legal/patent_policy.html):One defense against such misuse is to develop a corresponding portfolio of software patents for defensive purposes. Many software companies, both open source and proprietary, pursue this strategy. In the interests of our company and in an attempt to protect and promote the open source community, Red Hat has elected to adopt this same stance. We do so reluctantly because of the perceived inconsistency with our stance against software patents; however, prudence dictates this position.
-
Re:Who?
yes, this is news. Most good lawyers tend to stay out of the limelight. Mark is a good lawyer,
and has helped many things that could have become problematic for the free software community
not become problematic. You don't hear of those successes on sites like Slashdot.
I'm glad to hear Mark is joining the SFLC. The SLFC has some really great people, including one
of my personal heros, Eben Moglen, but they are very busy, and I suspect they will get busier
over time. More good, experienced lawyers like Mark can only help.
If you don't know Marks work at all then you might like to read this bit he wrote about the Microsoft/Novell deal: http://blogs.redhat.com/executive/archives/000274.html
Cheers, Tridge -
Re:Ubuntu
I appreciate that you say that you haven't used an RPM based distro for several years. I think you'd find if you tried one now that the tools (such as YUM and PUP and SMART) simplify package managament greatly. When you add to this that the quality and quantity of RPM packaging (now 5000 packages for Fedora) is going up there really isn't much of a case to make for debs and distros based on them being superior. Add to this that there are examples of "Deb-hell" if you look for them.
The reason that debs used to be superior was because of the Debian community working together to package Free software according to agreed high standards. It's a pity that more people don't explicitly acknowledge that Ubuntu is just a slightly tweaked distro sitting on top of all this work done by the Debian community.
-
Already fixed in some distributions
Why are vulnerabilities Slashdot-worthy? They happen almost daily, and are usually fixed quickly. This has was fixed in RHEL yesterday:
https://rhn.redhat.com/errata/RHSA-2007-0323.html
CentOS already carries this fix too. -
Fedora and RHEL fixed this months ago!
Here's the relevant updates:
Fedora Core 5:
https://www.redhat.com/archives/fedora-package-announce/2007-June/msg00629.html - 2007f, pushed June 27
FC5 had already reached EOL when 2007g came out, so it didn't get that one, but 2007f is enough to fix this issue anyway, and besides all users should upgrade to a supported release.
Fedora Core 6:
https://www.redhat.com/archives/fedora-package-announce/2007-June/msg00543.html, pushed June 25
https://www.redhat.com/archives/fedora-package-announce/2007-August/msg00391.html - 2007g, pushed August 27
Fedora 7:
https://www.redhat.com/archives/fedora-package-announce/2007-July/msg00370.html - 2007f, pushed July 19
https://www.redhat.com/archives/fedora-package-announce/2007-August/msg00379.html - 2007g, pushed August 23
RHEL (all versions all the way down to 2.1!):
https://rhn.redhat.com/errata/RHEA-2007-0689.html - 2007f, pushed July 19
(2007g has not been pushed to RHEL, but 2007f is enough to fix the NZ issue.)
All these are in the regular updates repository which is enabled by default. -
Fedora and RHEL fixed this months ago!
Here's the relevant updates:
Fedora Core 5:
https://www.redhat.com/archives/fedora-package-announce/2007-June/msg00629.html - 2007f, pushed June 27
FC5 had already reached EOL when 2007g came out, so it didn't get that one, but 2007f is enough to fix this issue anyway, and besides all users should upgrade to a supported release.
Fedora Core 6:
https://www.redhat.com/archives/fedora-package-announce/2007-June/msg00543.html, pushed June 25
https://www.redhat.com/archives/fedora-package-announce/2007-August/msg00391.html - 2007g, pushed August 27
Fedora 7:
https://www.redhat.com/archives/fedora-package-announce/2007-July/msg00370.html - 2007f, pushed July 19
https://www.redhat.com/archives/fedora-package-announce/2007-August/msg00379.html - 2007g, pushed August 23
RHEL (all versions all the way down to 2.1!):
https://rhn.redhat.com/errata/RHEA-2007-0689.html - 2007f, pushed July 19
(2007g has not been pushed to RHEL, but 2007f is enough to fix the NZ issue.)
All these are in the regular updates repository which is enabled by default. -
Fedora and RHEL fixed this months ago!
Here's the relevant updates:
Fedora Core 5:
https://www.redhat.com/archives/fedora-package-announce/2007-June/msg00629.html - 2007f, pushed June 27
FC5 had already reached EOL when 2007g came out, so it didn't get that one, but 2007f is enough to fix this issue anyway, and besides all users should upgrade to a supported release.
Fedora Core 6:
https://www.redhat.com/archives/fedora-package-announce/2007-June/msg00543.html, pushed June 25
https://www.redhat.com/archives/fedora-package-announce/2007-August/msg00391.html - 2007g, pushed August 27
Fedora 7:
https://www.redhat.com/archives/fedora-package-announce/2007-July/msg00370.html - 2007f, pushed July 19
https://www.redhat.com/archives/fedora-package-announce/2007-August/msg00379.html - 2007g, pushed August 23
RHEL (all versions all the way down to 2.1!):
https://rhn.redhat.com/errata/RHEA-2007-0689.html - 2007f, pushed July 19
(2007g has not been pushed to RHEL, but 2007f is enough to fix the NZ issue.)
All these are in the regular updates repository which is enabled by default.