Slashdot Mirror

At this point libz is pretty stable.

Maybe you can pick a better example, the zlib site itself mentions more than one release just in the year 2010.

Isn'z zlib LGPL?

No

This does not affect the users directly, but it is a major pain for integrators/porters. OO.o has a terrible habit of bundling all of the 3rd-party software packages, that it uses, into its own source tree. I'm talking about (probably missed some):

• agg
• bash
• bitstream-vera
• bsh
• bison
• boost
• curl
• db42
• dmake
• expat2
• freetype
• icu
• jpeg
• firefox (or some other Mozilla-based browser)
• libmspack
• libsndfile
• libtextcat
• libwpd
• libxslt
• neon
• nss
• nspr
• python
• sane-backends
• STLport
• unixODBC
• unzip
• vigra
• xmlsec1
• xt
• zip
• zlib

If they could, I'm certain, they would've bundled Java too, but — fortunately — Sun's license prohibits that... Now I realize, that this is done to offer "a single package" to those, who build it on their own, but nobody does. Everybody gets these from their OS' integrators. And the pain for us is enormous, because to force OO.o build to stop its silly ways is a serious undertaking. For some of the above packages there is --with-system-foo configure-flag, but not for all, and the default is to always use the bundled one, so support for the external ones bitrots quickly...

Most of the local builds don't bother and so end up wasting disk space and CPU-time rebuilding packages, which are external to OO.o. The end results are also bloated, duplicating stuff, that's already installed on the users' systems and without bug-fixes, which have already gone into each of the respective package since its most recent "bundling" into OO.o tarballs.

Download a source tarball and see for yourself... Something like: tar tjf OOo_OOG680_m9_source.tar.bz2 | grep 'z$'. No other software project does this on this scale and for good reasons — it is Just Wrong[TM]. OO.o better clean up their act in this respect...

Hard Drive DVD ROM Case

Other software:

0. Install DSL to hard disk, reboot, and configure

1. Upgrade (Apps->Tools) to gnu utils

2. Install gcc

3. Install zile (MyDSL) for editing convenience

4. Other software (for building natively and installation):

http://www.kernel.org/pub/linux/kernel/v2.7/linux-2.6.23.tar.bz2

ftp://alpha.gnu.org/gnu/grub/grub-1.95.tar.gz

ftp://ftp.gnu.org/gnu/bison/bison-2.4.tar.bz2

ftp://ftp.gnu.org/gnu/m4/m4-1.4.tar.bz2

http://www.oberhumer.com/opensource/lzo/download/lzo-2.02.tar.gz

http://www.zlib.net/zlib-1.2.3.tar.gz

http://www/perl.com/CPAN/src/perl-5.8.8.tar.bz2

http://ftp.gnu.org/gnu/autoconf/autoconf-2.61.tar.bz2

http://ftp.gnu.org/gnu/libtool/libtool-1.5.24.tar.gz

http://xorg.freedesktop.org/archive/X11R3/src/everything/index.html

`grep bz2 index.html | sed s/^.*\.bz2\"\>// | sed s/\<.*// | sed s,^,http://xorg.freedesktop.org/archive/X11R7.3/src/everything/,`

http://gitweb.freedesktop.org?p=xorg/util/modular.git;a=blob_plain;f=build-from-tarballs.sh

http://downloads.sourceforge.net/expat/expat-2.0.1.tar.gz

http://downloads.sourceforge.net/libpng/libpng-1.2.24.tar.gz

http://www.fontconfig.org/release/fontconfig-2.5.0.tar.gz

http://download.savannah.gnu.org/releases/freetype/freetype-2.3.5.tar.bz2

http://xcb.freedesktop.org/dist/libxcb-1.1.tar.bz2

ftp://xmlsort.org/libxslt/libxslt-1.1.22.tar.gz

ftp://xmlsort.org/libxslt/libxml2-2.6.30.tar.gz

http://xcb.freedesktop.org/dist/xcb-proto-1.1.tar.bz2

http://www.paldo.org/paldo/sources/pthread-stubs/libpthread-stubs-0.1.tar.bz2

http://www.paldo.org/paldo/sources/xau/libXau-1.0.3.tar.bz2

http://www.paldo.org/paldo/sources/xproto/xproto-7.0.11.tar.bz2

(from TFA) This isn't a big problem in terms of code -- the two files from libarc used are under 1500 lines put together, and one is a heavily-edited copy of inflate.c from zlib, which is public domain.

Eh? The zlib license definitely doesn't read like public domain, more like the modified BSD license.

find "packages" built into other "packages"? I really hope so, so it can tell me that internet explorer is installed with zlib built in.

I was skeptical, but it turns out you're right

http://www.zlib.net/zlib_tech.html

zlib, used in PNG files
"He goes on to note that the current implementation limits its dynamic blocks to about 8 KB (corresponding to 8MB of input data); together with a few bits of overhead, this implies an actual compression limit of about 1030.3:1. ...
By way of comparison, note that a version of run-length encoding optimized for this sort of unusual data file -- that is, by using 32-bit integers for the lengths rather than the more usual 8-bit bytes or 16-bit words -- could encode the test file in five bytes. That would be a compression factor of 10,000,000:1"

This file is probably quite close to the maximum compression ratio.

Mind you RLE in BMP files uses 8 bit lengths

http://msdn2.microsoft.com/en-us/library/ms532328. aspx

Actually, I reckon a JPG with a insane quantisation matrix that chucks away all the data should be able to have an enormous compression ratio, but I'm not sure what the entropy coding limit after the DCT is.

"If you think that anyone who uses any open source app is also a software developer... and a good one at that... well, no wonder Linux isn't more popular."

In the 90's I was working for IBM, the CEO made a speech and said "all software has been written, it just needs to be managed". All of the developers snickered, but the longer I stay in the bussiness the more it appears he was right.

I have a BSc in computer science and have been contracting as a C/C++ developer since 1991, I "specialize" in Windows (ie: I know the tools better than *nix tools). I don't use GPL code in commercial software but I often use "free" stuff, particularly in multi-platform source code. eg: zlib and sqlite (interesting wording on the sqlite license).

There are plenty more examples of high quality "free stuff", all of which have been mentioned elsewhere on slashdot.

FYI, zlib is not GPL.

All well and good? I downloaded Service Pack 2 and looked at it:

strings -n 5 Update071105.exe |more

1.2.1
  deflate 1.2.1 Copyright 1995-2003 Jean-loup Gailly

Then I went and took a look at the zlib site http://www.zlib.net/

"zlib 1.2.3

July 18, 2005

Version 1.2.3 eliminates potential security vulnerabilities in zlib 1.2.1 and 1.2.2, so all users of those versions should upgrade immediately."

Sounds like Sony needs to trot back and have a whole nother look at those "security concerns"

Hey insightful fool. Would you mind explaining how the zlib buffer vulnerability being discussed could be exploited? Or even why it is a buffer overflow at all? Here's the patch: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA- 05:16/zlib.patch and here's thee source: http://www.zlib.net/ And btw, there's no way in hell to prevent oversights like this. It's not a typical, duh I used gets() type buffer overflow.

/* zlib.h -- interface of the 'zlib' general purpose compression library version 1.2.2, October 3rd, 2004

Copyright (C) 1995-2004 Jean-loup Gailly and Mark Adler

This software is provided 'as-is', without any express or implied warranty. In no event will the authors be held liable for any damages arising from the use of this software.

Permission is granted to anyone to use this software for any purpose, including commercial applications, and to alter it and redistribute it freely, subject to the following restrictions:

1. The origin of this software must not be misrepresented; you must not claim that you wrote the original software. If you use this software in a product, an acknowledgment in the product documentation would be appreciated but is not required.
2. Altered source versions must be plainly marked as such, and must not be misrepresented as being the original software.
3. This notice may not be removed or altered from any source distribution.

Jean-loup Gailly jloup@gzip.org
Mark Adler madler@alumni.caltech.edu */

A company of that size doesn't sneakily use 3rd party software.

I see. That must be why they not only use zlib, but also remove the copyright strings.
(Search for "microsoft")