Slashdot Mirror

Microsoft has released several new updates to address your concerns.

Apparently, yes. For the full paper you need to register though.

Red Hat has no fanboys. Fanboys are exclusively found on Gentoo, Debian and some on Slackware. All nice distributions, but all lacking good QA.

As opposed to RedHat, which shipped several major releases with broken package management?

Tell me, does RHEL3 let you run emacs-nox without X yet?

Anyone know if they fixed this rather serious problem yet?

Sorry to bother you with this note about etiquette in posts, but when you mention products and companies that people might be interested in, such as Red Hat or CentOS, please provide links. Thank you.

Deep linking is perfectly legal.

Looks like Red Hat's plans are going straight down the toilet.

So people can't link to Red Hat?

Gee, I sure hope not.

/passive aggressive

Moreover, our client does not allow others to provide links to our client's web site without permission.

Red Hat Red Hat Red Hat Red Hat Red Hat Red Hat

Fuck you, you damn pieces of shit.

You people are just horrible human beings.

Moreover, our client does not allow others to provide links to our client's web site without permission.

Red Hat Red Hat Red Hat Red Hat Red Hat Red Hat

Fuck you, you damn pieces of shit.

You people are just horrible human beings.

Moreover, our client does not allow others to provide links to our client's web site without permission.

Red Hat Red Hat Red Hat Red Hat Red Hat Red Hat

Fuck you, you damn pieces of shit.

You people are just horrible human beings.

Moreover, our client does not allow others to provide links to our client's web site without permission.

Red Hat Red Hat Red Hat Red Hat Red Hat Red Hat

Fuck you, you damn pieces of shit.

You people are just horrible human beings.

Moreover, our client does not allow others to provide links to our client's web site without permission.

Red Hat Red Hat Red Hat Red Hat Red Hat Red Hat

Fuck you, you damn pieces of shit.

You people are just horrible human beings.

Moreover, our client does not allow others to provide links to our client's web site without permission.

Red Hat Red Hat Red Hat Red Hat Red Hat Red Hat

Fuck you, you damn pieces of shit.

You people are just horrible human beings.

Ironic that Red Hat seems to miffed about people using their name. They're not so bothered that they stole The Fedora Project's name when they changed the name of their 'home' distro. Red Hat proceeded to apply for a trademark on the name which would preclude the name being used by the Feodra Project which predates their trademark application by a number of years.

Read the Fedora Project's statement here.

Moreover, our client does not allow others to provide links to our client's web site without permission.

Uh, where has any law or court opinion even suggested that one needs permission to link to a web site?

No copyright or trademark law lets Red Hat restrict me from making factual statements like, "Red Hat's web site is www.redhat.com", any more that they can prevent me from stating "Red Hat's phone number is 1-888-REDHAT1" or "Red Hat's address is 1801 Varsity Drive, Raleigh, NC 27606."

Including certain browser-parsable elements in that declaration: "Red Hat's web site is www.redhat.com" doesn't change that.

RHAT: please put down the TM crackpipe.

Just had to do this...

Good luck enforcing this or convincing a judge about this.

Basically, they found that rhgb (which is often turned off by Redhat Engineers) is wasting a lot of time and doesn't accomplish anything. Removing it would increase bootspeed.

MS05-001 - HTML Help ActiveX Control - Moderate (3)

MS05-002 - USER32.dll overflow, Kernel DDOS - Critical (1), Important (2)

MS05-003 - Indexing Service - Important (2)

MS05-004 - ASP .NET - Important (2)

MS05-008 - Internet Explorer - Moderate (3)

MS05-009 - libpng (Windows Messenger) - Moderate (3)

MS05-010 - License Logging service - Moderate (3)

MS05-011 - SMB - Critical (1)

MS05-012 - COM, OLE - Important (2), Critical (1)

MS05-013 - DHTML Editing ActiveX Control - Moderate (3)

MS05-014 - Internet Explorer (3 vulns) - Moderate(3), Critical (1), Low (4)

MS05-015 - Hyperlink Object Library - Critical (1)

In addition, Secunia lists 5 unpatched security holes and 1 partial fix:

SA8987 (09/2003) - certain device drivers - Less critical (4)

SA9720 (09/2003) - overflow detection bypass - Less critical (4)

SA9921 (10/2003) - local exploit - Less critical (4)

SA10066 (10/2003) - HTML Help ActiveX Control (local) - Less critical (4)

SA13645 (12/2004) - partial fix (MS05-002) - Highly critical (2)

SA14061 (01/2005) - local Registry vuln - Not critical (5)

So it looks like the WS2003-EE/IIS6 combination has been subject to 12 patches in 2005 caused by 16 vulnerabilities with an average criticality of 2, plus 6 unpatched or partially patched vulnerabilities with an average criticality of 4.

Since I'll be getting rid of KDE and Mozilla vulns with RHEL because they're not really used on back-room servers, I'll toss out the IE and HTML Help ones here. That leaves 8 updates patching 10 security holes and an average severity of 2, plus 5 unpatched holes of low severity (mostly local).

Now on to Red Hat Enterprise Linux 3 Advanced Server, for which redhat.com lists 22 advisories for 2005 (more abbreviated list format):

code # vulns component
RHSA-2005:010 - 1 - VIM (not core OS)
RHSA-2005:018 - 1 - Xpdf (not core OS)
RHSA-2005:013 - 5 - CUPS
RHSA-2005:038 - 1 - Mozilla (not core OS)
RHSA-2005:019 - 2 - libtiff
RHSA-2004:635 - 1 - Ruby
RHSA-2005:043 - 3 - kernel
RHSA-2005:012 - 2 - kerberos
RHSA-2005:068 - 1 - less
RHSA-2005:059 - 1 - Xpdf (not core OS)
RHSA-2005:069 - 1 - Perl-DBI
RHSA-2005:049 - 1 - CUPS
RHSA-2005:039 - 3 - enscript (not core OS)
RHSA-2005:011 - 9 - Ethereal
RHSA-2005:105 - 2 - Perl
RHSA-2005:136 - 1 - mailman
RHSA-2005:135 - 3 - Squirrelmail
RHSA-2005:134 - 1 - xemacs (not core OS)
RHSA-2005:112 - 1 - emacs (not core OS)
RHSA-2005:104 - 1 - mod_python
RHSA-2005:009 - 3 - KDE (not core OS)
RHSA-2005:061 - 9 - Squid

So so far in 2005, RHEL3-AS has been hit with 22 patches, consisting of 53 individual vulnerabilities of unknown criticality (they didn't say). Taking out the ones effecting packages that aren't part of the base system (that don't really have any match on a backroom Windows server), that still leaves 14 updates fixing 41 vulnerabilities. Secunia, however, shows none unpatched.

The Secunia site has some good comparative charts, showing that from 1993-today, WS2003 has been hit with fewer problems, with a fewer percentage remotely exploitable, but with a highe

After RTFMing, this problem has been known since August of last year

I RTFMed, too. Seems like vulnerability was fixed in August of last year by Gentoo, Red Hat, andMandrake.

Nothing compares MS security to that of the rest of the world better than seeing how they fix the same damn vulnerability. Let this be a lesson to you. Never astroturf with facts. A quality 'turf would have been to say: "Yes, but Linux has a history of at least three times as many security problems with PNG as Microsoft"

Just visit for a downloadable fix.

Multimedia Systems Selector was already there, as was dictionary, but both have been tweaked a bit. Really, gnome has bigger problems. Try playing a mp3 off an smb share without mounting the smb share. Not allowed. Try listing the shares on a machine. Wireless suppoert is finally getting better - NetworkManager is rad

His argument is that kernels built from different source trees which happen to share some code, and a name, aren't comparable to a portable system (kernel + userland) built from a single source tree. I don't know which of you is right, but if Linux is really just a hotchpotch of different source trees for different architectures, and NetBSD is really built for all architectures from a single source tree, I'd tend to think he's got the better argument.

Actually, they can run on standard Linux kernels.

How can that be, when Linux kernels prior to 2.6 were commonly acknowledged not to scale beyond 8 CPUs? I'm not familiar with the SGI systems, but I do know the famous IBM mainframes that 'run Linux' actually run a proprietary IBM operating systems called z/OS on the hardware, which then hosts Linux virtual machines (not all that different to running Linux in a VM hosted by, for example, Windows). The fact that Linux advocates carry on about 'Linux on the mainframe' being able to run multiple VMs (when it's really z/OS) makes me sceptical of claims that stock Linux has been running on 512-way systems when getting past the 8-way scalability level was such a notable achievement for 2.6.

Consider that the 512-way systems from SGI have been around since before the 2.6 Linux kernel was released. If those systems are running standard Linux kernels, why was the ability to scale beyond 8 CPUs such a big achievement for 2.6? This isn't a redundant question, I'm really curious. These two things together just don't make sense to me.

And let's see your numbers to show Linux isn't as scalable as Windows Solaris or UnixWare. I don't think you have any idea.

Just look at the commercial offerings, which are backed by the reputations of the vendors. Red Hat's "top of the line" product scales "up to 16 CPUs", where as Solaris has long been supported on 128-way systems, and Microsoft's Windows Datacenter Server supports 128-way machines with partitions of up to 64 CPUs. These are all production systems, and not theoretical or prototype claims. Even so, maybe the problem with scalability is down to Red Hat and not to Linux itself?

This isn't true. You can link BSD-licensed or other similarly GPL-compatible code to GPL'ed libraries to your heart's content.

A answer by fsf on exactly this issue can be found here. An elloboration on GPL compatibility can be found here.

GPL is a one way street. If you modify the source (including linking to a GPL (note: not the LGPL), you have one choice about how you can license the redistribution of your work, i.e. the GPL.

Now, discussing the Linux kernel, opinions are not in any way varied by the copyright _owners_. As illustrated by Linus. If you want a different opinion then the actual owner of the copyrights, you need to talk to a lawyer and accept the risk associated with copyright violation.

I hope this clears up any misconceptions you may have. happy coding!

I'm more impressed by Bruce Tiemann. Lots of people can write compilers, but Bruce flashed 11 sticks and 9 balls!

Where indeed.

I mean, it's not like we (I work for Red Hat) make the source freely available on our own FTP server, or put it in the same tree that gets rsync'd to every RH mirror on the planet.

Oh, wait. We do.

Ulrich Drepper is a RedHat employee and only affiliated with the FSF as much as he happens to be the GNU C library maintainer. However, he is known to have quite an anti-FSF stance and accused RMS of trying to steer glibc development according to his agenda before (see the second half of this announcement).

So this is not really the FSF who are taking this stance, but a concerned developer.

Michael

You can get them here: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/. Yes, it is only srpms, but that's what GPL requires. It is not all that challenging (just time consumig) to build a distro from them.

All of RedHat's products are published under the GPL

Where can I download the source for RedHatEnterprise Linux then?

Don't base your life view on assumptions, people.

Ulrich Drepper posted this to the libc-alpha (Glibc) mailing list today. "Some people might have heard about Sun's release of the Solaris sources under their dubious license. This license is obviously intended to be incompatible with the GPL. Therefore:

Nobody who intends to contribute to glibc must look at anything but the public header files of the Solaris libc and related libraries.

(Emph. mine) Don't fall for the Solaris trap!

A better comparison would be the length of time it takes for the fix to make it into, e.g., the mainline Red Hat release. I don't know how long that usually is, but the reality is that testing takes time, so if Red Hat do extensive testing before releasing patches, there will be a significant gap.

No there won't. Security fixes are fast tracked and available here essentially on the same time frame as patch releases to the general public.

Yeah, but 2/3 of those sites are built on table-based layouts (old school methods). If you're reading a CSS book or already know CSS (for creating layouts), then you're not doing table-based layout.

Not to raise the hair on your back, but I wouldn't call any of those sites "good design". While they might be very usable and well-structured (not the markup), it doesn't take long to realize that they weren't created by somebody with a background in graphic design. Just compare to any of the sites in the CSS Vault.

Or if you want a similar theme, check out Red Hat or Suse (Novell).

I just took a closer look at the Open Source Web Design site, I like that idea. I can't help but think that they need to implement one of their templates on their own site.

I tend just to wear one hat in public: I'm a kernel developer, my
technical viewpoint is coloured by that and as a Red Hat employee I am
*still* a kernel developer!

Everybody does that: even Red Hat (see point 7). IANAL, but basically what this means is that if Windows (or Red Hat) screws up your comp, you can't hold Microsoft or Red Hat accountable. Why? Because as any geek knows, there's about a thousand things which can cause a computer screw-up, from script kiddies to accidently hitting the 'del' button, and they don't think they should be responsible, which is a perfectly reasonable position to take IMHO.

What the guy is saying is that if Windows turns out to have a problem, you can rely on Microsoft to provide updates. You *can't* legally rely on Linus Torvalds or any of the other developers to provide a solution to the problem. However, if you have an agreement with Red Hat, you can rely on them in the same way, AFAIK.

Shit, that's a lot of acronyms for one post :|.

You can pay for Microsoft products, or you can not use a computer.

I see...so you can not run Linux on said computer either?

Or MenuetOS?

I mean, I'm sure there must be some other choice for an x86 right? Or television with Internet access for that matter...

Yup, it's available in Linux too. FC3 even includes it out of the box, though if you have an ALPS touchpad (common in many laptops, including my Toshiba Satellite 3000), you need to rebuild the kernel with a patch applied from the synaptics package

To elaborate on the problem that we're trying to solve here, take a look at this post about GPL and MP3.

Real is solving this problem by licensing MP3 to the community under the RPSL (which is OSI certified), and paying for an MP3 license. It's not a perfect solution (we would like to include it in the GPL'd code), but it's better than not having MP3 playback.

I suppose many Linux users who are used to compiling and installing their own software will find this a yawner, since there's plenty of grey market software out there. However, companies that want to make a business distributing Linux-based products should really find this good news.

Rob Lanphier
Development Support Manager
RealNetworks

You could try growing Kudzu, that seems like it fends for itself pretty well. Also, you are not going to be hassled by your fellow cubicle mates asking for cuttings; they'll get them whether they want them or not. If they've got their own plants already, well that's just too bad... Best of all, if you are running Red Hat it will even configure your hardware for you, so there's a definite geek connection too... ;)

We might finally see Fedora (et al) with an mp3 player.

Fedora Core 3

Pardon me for being insistent, but "openoffice.org" is a Web address, not a name. If the company that makes it doesn't want their customers to call it "Open Office," they should change the name. (They should probably change the name in any case. "Open Office" doesn't exactly stir the soul.)

That's not being insistent, it's being stupid. OpenOffice.org is the name of the software. The original poster was correct, you tried to correct him but looked like an idiot because you were wrong and then I corrected you. It's a very simple sequence of events; do try and keep up. As for what you think of the name, nothing you've posted so far inspires me to assign any value to your opinion.

Numbers.

A meaningless non-response with nothing to back it up, almost certainly indicating that you have no basis for your opinion. This is unsurprising.

No, it was supposed to be illustrative. Reading comprehension much?

Illustrative of what? That you don't hire competent people? That you change your hardware and software platform whenever you change IT personnel? It's certainly not illustrative of anything regarding open source software.

> We use open source software because we like the support, reliability and licensing freedom.

How odd. Because it has none of those three things.

I don't normally go in for personal attacks but you're really not a very honest person, are you? Starting from the end:

For you to claim that open source software doesn't provide licensing freedom is either stupid or dishonest. Since you're apparently capable of operating a computer with at least minimal competency I find it difficult to believe that you could be stupid enough to believe what you said. So you've apparently lying. Unfortunately you chose to lie about a subject that the Slashdot audience understands reasonably well so you're not going to get very far.

As for reliability, there are plenty of studies that show the reliability of open source.

And finally, support. I don't think this will be news to anyone except (perhaps) you but paid support is available for open source software. Linux is supported by distributions such as Redhat and Novell, Apache & Tomcat are supported by companies like JBoss and Samba is supported by a truly huge list of companies in many countries. As another poster pointed out, OpenOffice.org has commercial support available from companies like Blue Point

You shouldn't bother replying to this, but if you do be sure to bring some facts to back up your position. Your blind assertions do not impress.

Linux is probably a bit big, but something small and light like eCos might run quite well. They even mention digital cameras in this text which I found with google:

http://sources.redhat.com/ml/ecos-announce/1999/ms g00000.html

The beta link that I included in my post takes you to their beta bugzilla page which is based on 2.18rc3 and using PostgreSQL. Here is their old bugzilla page which is still using PostgreSQL except with the old bugzilla release. Read their "News" section.

I don't know if you are aware that there is a PostgreSQL-aware version of Bugzilla available. Red Hat is pretty big on PostgreSQL so they maintain that version. The link leads you to a bugzilla-redhat-20031120.tar.gz tarball but there are testing a new beta based on bugzilla 2.18rc3. Check it out.

I don't know if you are aware that there is a PostgreSQL-aware version of Bugzilla available. Red Hat is pretty big on PostgreSQL so they maintain that version. The link leads you to a bugzilla-redhat-20031120.tar.gz tarball but there are testing a new beta based on bugzilla 2.18rc3. Check it out.

I do not agree!

Qt apps can look quite nice on MacOSX, okay it OpenWriter will not look as native as Apple's own 'Pages'.

Pages:
http://www.apple.com/iwork/pages/word.html

Native Mac apps often have different GUI layouting. An as you say...

> Mac people like polished apps ... Mac users like that.

OSX apps do not just use Aqua for the Widgets, they have a completely diferent approach to GUI design!

I think the Qt NWF http://people.redhat.com/dcbw/ooo-nwf.html
will be a good basis for a version of OOo that blends in with MasOSX, since:
- Qt uses more native Aqua routines in every new release
- if there is a MacOSX version of OOo using Qt-lib then it will be much easier to just ajust the GUI of OOo that it matches the OSX feel (i.e. get some nice big icon in that toolbar)

Conclusion:
Yes, I do have confidence in the Qt road to a MasOSX port of OOo, because it is a much better startingpoint than the current OOo version running on OSX:

http://www.openoffice.org/screenshots/images/swrit er_osx.png

Which is plain ugly (as you can see) and needs X11 AFAIK.

Just see how KOffice (using Qt) is doing in comparison:
http://ranger.befunk.com/screenshots/qt-mac-kword- 20040101.png
And this is only a proof-of-concept kind of quick-port. No addional GUI refactoring has been done! Since that is what every GUI apps that is ported to OSX needs!

Last screenshot to prove my last statements:
http://www.openoffice.org/screenshots/images/compa re_ms_osx.png
This is the current difference between OOoWriter-for-OSX an OSX' most used wordprocessor: MS Word. This prove 2 things IMHO:
- OSX users do massively use badly intergrated apps (i.e. MS Word)
- OOo cant get much worse...

_cies.

Flash memory has still a lot of improvements to do in the write cycles department (the number of times you can write to it before it fails), which basically hasn't changed a lot since it was introduced to these days.

I agree that the 10K figure for multi-level cell (MLC) flash memory is a bit low, but with modern wear leveling, sector remapping algorithms, and file systems, 100,000 writes per sector for single-level cell (SLC) flash isn't too bad. In practice, the only things you can't put on flash memory under a typical workstation work load are 1. a swap file (get more RAM instead) and 2. a database (but for this, you're already RAID 5ing your drives and, if you're serious, mirroring transactions off-site).

"If Linus is the only person that can change a specific part of the kernel, what good does notifying the world instead of just him do?"

Linus may be the only one who commits patches to the official kernel, but he's not the only one who writes patches.

More importantly, people in a production environment should be running a vendor-provided installation (RHEL, SuSe etc). The company that sold them the operating system and the support should also provide kernel updates, including their own patches if they think the offical ones are not coming through in time.

In other words, having a free (as in beer) GNU/Linux installation means you assume total responsibility for the OS. That includes using the freedom of the software to patch the sources and fix any security issues that arise.

I'm not running any sort of heavy duty server, so fucking forget dealing with Linux.

Umm, these days Linux runs on watches, PVRs, routers, desktops, toasters, and, yes, servers too.

It's also pretty easy to use, if you use the right distro.

The Fedora CVS is available at http://cvs.fedora.redhat.com/. Lots of goodies there!