Security Holes Fixed in OOo 2.2.0

According to Computing, OOo suffers from trio security holes found by Next Generation Security Software and iDefence, and also posted in Debian Security Information. Due to this security holes, OOo 2.2.0 release schedule was postponed (read my previous post) for about a month. Well, be glad, since the security holes has already been fixed in the latest RC (OOo 2.2.0-rc4) and it's ready to be downloaded. Please read the Security Page for more detailed information about the security issues.

Louis Suarez-Potts has confirmed in his email that the release team is planning to release OOo 2.2.0 on March 28 (one month from the original schedule). I hope this time it will be correct.

Reunion at PIM

I had a reunion with my friends and also lecturers from UKDW at PIM just know. The reunion was held after quite a long discussion on the mailing list about where and when, but finally it's decided. There were quite a lot of people who came to this reunion and we have lots of talks there, discussing about lots of things.

I went there alone, since i stayed in my auntie's house which is near from PIM. The trip took me about 10-15 minutes and it wasn't as crowded as usual (i didn't know why), but that relieves me. Some of my colleagues went together with Edi Topan, who was willing to pick up some of them at Taman Anggrek Mall (and drive them back to their boarding house of course) hehehe

Now i'm waiting for the photos from them :D

Experience Upgrading Slackware-Current

Even though i have used Slackware-Current since 10.1 on my laptop up to now, the upgrade process was never as complicated as this time (Slackware 11.0 to -Current). I have just finished upgrading to -Current just now and i'm so relieved. I know that the process will be more difficult than previous process since the changes are major and there's a lot of changes in many packages, including the toolchain.

As usual, i read the WARNING and CHANGES_AND_HINT note as my primary guide. I also prepare the UPGRADE note since it's also noted in the two previous notes. Other file that i use is the -Current Changelog itself as it has the most detailed information regarding each package changes, so i guess it's mandatory to open the file also.

I followed the instructions given in the CHANGES_AND_HINTS, but i guess the note must be updated a little bit, since i'm having problem while configuring Xorg after the upgrade process, since i didn't have Expat package which is required to do some other process related to configuring the fonts (probably caching and setting the font path) which is done by the Slackware installer script.

The process itself was smooth, except for some small minor problem (i did lost my username account. Luckily the root account was still there, so i just have to re-create my own username and set the home directory to my previous home directory). I didn't know why, but it happened to me while upgrading. It must be my mistake while doing the process, but it's fixed. Next problem came when i wanted to run the graphical desktop. It always gives me an error message:

unable to open default font "fixed"

I thought this was due to lack of Expat package while i was installing the fonts, so i removed the fonts, and reinstalled all the fonts and then the problem was gone. Next problem was the default window manager. I usually used KDE and when i type startx, usually it showed KDE Splash Screen (i used Circular splash screen with Moodin engine), but now it showed an xterm and terminal. That was weird. When i click on the desktop, i realized this was not KDE. It was twm. So i switched to root user and call pkgtool utility to change the default desktop, but it's not working. I wonder why. Next, i tried to issue xwmconfig to change the default desktop using my local account and finally it worked. Now KDE starts up when i ran the startx command.

I still have some TODO list though:
- Compile the kernel with the latest GCC, so i can install NVidia driver (because NVidia installer will only work if i use the same GCC version being used to compile the kernel). I'm still using generic NVidia driver (nv) for now.

- Remove unneeded package (Slackware-Current does remove some package, so i still have to remove unneeded package, for example hotplug, kernel 2.4, pcmcia-cs, xmms). Yes, they decided to remove xmms as it has no progress anymore (the developer are working on xmms2, while we have audacious and amaroK which works also).

- Optimize the new system as it's a combination of packages since Slackware 10.1. This one will take quite some time and i don't know if i will have time to do this.

Upgrading to Slackware-Current is quite complicated, but it's still worthed for me. My advice to those who would like to upgrade to Slackware-Current: BACKUP ALL YOUR DATA FIRST!!! (Did i stress that enough?). Yes, backup is the most critical steps that you will have to take before doing something that have possibility to broke your system. Next is READ THE NOTES!!!. Those notes were made to be read, not to be ignored and it's worthed to read that notes, as you will get a step by step instructions on how to complete the process.

Remember, Slackware-Current will have the most updated packages, but it's not for people who would like to have stable system, as it might broke your system while upgrading. It's better for you to stick to Slackware 11.0 and wait for the final release before making the upgrades.

At least, i will have nice weekend as i don't have to tackle with serious problem due to the upgrade process :D

UPDATE (15:30): I have compile the latest kernel (2.6.20.3) and installed NVidia driver, but the NVidia logo didn't showed up, i wonder why. Perhaps it's because of the usage of new GCC version. Well, that's ok for now. At least i have the same kernel version with the GCC being used to compile the kernel.

UPDATE (16:30): I have removed all removed packages in Slackware-Current, including kernel 2.4.x, xmms, byacc, glut, gnet, gdk-pixbuf.

UPDATE (26 March 2007 09:15): I have solved the Moodin problem. Previously, the Splash screen that requires Moodin plugin won't work, since Moodin was compiled against KDE and now KDE's prefix has been changed from /opt/kde to /usr, so it will need to be rebuild, and thanks to Eric Hameleers for the updates of the SlackBuilds script. After recompiling the source, everything is back to normal again.

I also found a solution for the NVidia driver from LQ Forums. Some people had the same problem as i did and one of member posted a solution to work on this one, but i haven't tried yet. I will try to do this when i got home later on. If you are having the same problem as i did, try this sh NVIDIA-xxx.run --x-prefix=/usr --x-module-path=/usr/lib/xorg/modules (assuming that you are running Slackware-Current with new Xorg).

I also had a annoying error message at the startup about DBUS. I tried to reproduce by executing from root user and here goes the error messages:

root@laptop:/etc/dbus-1# dbus-uuidgen
dbus-uuidgen: symbol lookup error: dbus-uuidgen: undefined symbol: dbus_internal_do_not_use_create_uuid

Anybody has a solution?

Update (27 March 2007 09:09): DBUS problem solved. It seems that DBUS package from source didn't clean up very well, so it still leaves some library in their default directory (/usr/local/lib) thus it will be seen rather than the correct path in the Slackware packages (/usr/lib). Thanks to Rob Workman from LQ from the tips. The problem is solved by removing the files by issuing rm -rf /usr/local/lib/dbus-* and delete most of files in /usr/local that refers to DBUS source package (make sure you compare the files with the files listed in the Slackware packages just to make sure you didn't delete the needed file).

One more problem solved :D

Start Breaking Again

After more than 5 months of development and trial and error, finally Patrick Volkerding has decided to publicize the -current development again to the developers and other Slackware users who intended to seek for the next Slackware release (aiming for Slackware 12.0, but it will be officially called 11.1 for now).

As stated in the Changelog, dated Thu Nov 9 18:16:50 CST 2006, Patrick Volkerding already said that there will be a major renovations on the toolchain and it's true. If you see the -current Changelog, you will see lots of packages addition, removal, and upgrade. There are also some split up packages to make next Slackware release more modular (mostly from Xorg package. There are almost 300 new packages in x directory for the new Xorg 7.2 package only).

From the Changelog, it's most likely that the next Slackware release will be based on 2.6.x kernel only and it will be based on the latest stable kernel, but for now, Patrick still uses 2.6.18.8 version with SMP feature as the standard kernel. This is good news, as for the last 5 months, Slackware only update it's package for security vulnerabilities and it's considered outdated by some people, but NOT anymore. By using Slackware-current, you will get most of the latest version of each application available in default Slackware installation, like KDE 3.5.6, Xorg 7.2, GnuPG 2.0.3, XFCE 4.4.0, GIMP 2.2.13, CUPS 1.2.8, and many more.

PLEASE PLEASE READ the WARNING and CHANGES_AND_HINT note before you started to upgrade your Slackware version to -current or it may broke your system.

Yesterday, i started to list all new packages from -current and i started to download them all (slowly) and today, i will have them finished and start planning to upgrade to -current as it still have a chance to broke my system. When the upgrade finishes, i will start using -current as i did in the past.

Mozilla Firefox Release

Mozilla has released updates to their Mozilla Firefox products, 2.0.0.3 and 1.5.0.11 which contains only a small portion of changes:
* Website Compatibility: Fixed various web compatibility regressions.
* MFSA 2007-11 FTP PASV port-scanning

Since the changes are quite small, i think it won't take too much time to get the update using Live Update feature from Firefox. Just use Help > Check for Updates... menu and you will see that there's an update for Mozilla Firefox.

Month of ...

It all started when security researcher, HD Moore started to publish a browser's bug once a day for one full month in July 2006. That phenomena is now what we called Month of ... (you name it). We now have "Month of kernel bugs," a "Month of Apple Bugs," and a "Month of PHP Bugs". A newcomer has arrived, "Month of MySpace" where the author will write about bugs that happened in MySpace.

Here's the press release:

OFFICIAL ANNOUNCEMENT: April 2007 is the Month of Myspace Bugs, Yuss!
April, 2007, will be designated the "Month of Myspace Bugs, Yuss!" Reasons:

1. Myspace is important, in that there are a bazillion users and a kajillion dollars involved.
2. "Months of Bugs" are whiny, attention-seeking ploys for acceptance. Myspace's design use is to enable whiny, attention-seeking ploys for acceptance.
3. "Months of Bugs" are annoying, so rather than suffering through another, we figured it'd be better to just create our own where we could at least direct the content a little.

What's the next "Month of ..." ?? Any ideas?

Apollo From Adobe

Adobe has released a new cross-operating system runtime called Apollo which allows developers to leverage their existing web development skills (Flash, Flex, HTML, JavaScript, Ajax) to build and deploy rich Internet applications (RIAs) to the desktop. Here's some snippet from the original site:

Apollo enables developers to create applications that combine the benefits of web applications – network and user connectivity, rich media content, ease of development, and broad reach – with the strengths of desktop applications – application interactions, local resource access, personal settings, powerful functionality, and rich interactive experiences.

All you need is download the Apollo RunTime + SDK, and Flex (optional, only if you are interested in) and if you are having some problems, you can always look for technical articles, developer videos, and sample applications. Adobe has also provide some discussion room.

New Memory Manager in PHP 5.2

I read an article in IBM DeveloperWorks about new feature in PHP 5.2 which deals with new memory manager. Here's some text from the site:

There are many improvements that have taken place in PHP V5.2, and one critical area is that of memory management. The exact quote from README.ZEND_MM states: "The goal of the new memory manager (PHP5.2 and later) is reducing memory allocation overhead and speeding up memory management."

Here are some of the key items from the V5.2 release notes:

* Removed unnecessary --disable-zend-memory-manager configure option
* Added --enable-malloc-mm configure option, which is enabled by default in debug builds to allow using internal and external memory debuggers
* Allows tweaking the memory manager with ZEND_MM_MEM_TYPE and ZEND_MM_SEG_SIZE environment variables

When used effectively, the new memory-management tools will support your debugging efforts to reclaim some of your system resources. I think this is a good article to demonstrate how memory manager works and make debugging process even more detailed than ever, since we can see how many resources left within the system.

Linux on Axioo Laptops

My uncle just bought a new laptop and by default, it was installed by Mandriva Linux which has been modified by the Axioo Team. I was surprised when i see the configuration, since it's already very complete (using SMP kernel to support dual core, ACPI modules for laptop, including batteries monitoring, bluetooth, multimedia, and many more. They even modify the boot loader with Axioo's background and they provide a nice desktop wallpaper by default. The distro is based on Mandriva Linux 2007.0, using 2.6.17 kernel if i'm not mistaken and it was great.

I hope many other vendor will dare to do the same thing as Axioo did by providing a pre-installed Linux-based operating system on their products in the future.

K3b 1.0 Final Release

After one and a half year of development time, finally the final K3b 1.0 package has been released by the author (Sebastian Trüg). K3b is a feature-rich and easy to handle CD burning application for GNU/Linux platform which is commonly being used by many people (mostly that uses KDE as their Window Manager). You can see the incomplete Changelog for more detailed changes. It's quite a big jump from the previous stable release, 0.12.17, but i guess it's worthed, since K3b is quite mature for that kind of application and i have experienced of using K3b and it worked perfectly, even though my only experiments was only burning data CD, not other operation which are available.

Here are some feature that are already implemented in K3b:
* Creating data cds
* Creating audio cds
* Creating Video CDs
* Creating mixed-mode CDs
* Creating eMovix CDs
* CD Copy
* DVD burning
* CD Ripping
* DVD Ripping and DivX/XviD encoding
* Save/load projects.
* Blanking of CDR-Ws.
* Retrieving Table of contents and cdr information.
* Writing existing iso images to CD or DVD with optional verification of the written data.
* Writing cue/bin files created for CDRWIN
* DVD copy (no video transcoding yet)
* Enhanced CD device handling

There's a nice article about K3b final release (this article was posted before K3b released 1.0 version)

Blogger Error

In the last few days, i always had an error message displayed when i tried to publish my post on my blog. I don't know why, but it wasn't mentioned in Blogger Status page. Last night, i wanted to post something but i always got the error page, so i wanted to retry it, but since i was in hurry (because i had to go to Taman Anggrek with my friend), so i didn't continue it and shut down my computer (i forgot to save it in Draft) :(
I hope blogger will fix this problem ASAP

MySQL Community Release 5.0.37

MySQL AB has released a community version of the next MySQL version, 5.0.37 last month (i didn't notice this until just now). This version was released in binary and source code version. The last binary release was 5.0.33 which was released in January and MySQL has confirmed that will keep providing binary release, but with less frequency. You can see the Release Note for detailed changes in this version compared to previous version.

OpenID

OpenID is now a big trend in IT community, media, and forum discussion. Here's the description from Wikipedia:

It's a decentralized system to verify one's online identity. While it is not intended to prevent spam or create a trust metric, it solves the single sign-on problem without relying on any centralized website to confirm digital identity. OpenID users identify themselves with a URI or XRI which they own, such as for a blog or a home page. Since OpenID is decentralized, any website can employ OpenID software as a way for users to sign in.

If you want to get your OpenID account, you might try to get it from one of OpenID providers. I already have my own OpenID which i have just registered at GetOpenID. Why do i pick this server? Because it is the one of the few OpenID servers that supports SSL. Some countries in Asia has already their own server for OpenID, for example Philippines, China, Japan, India, Korea. Too bad, Indonesia is not listed there because we don't have that currently.

How does it work? It's not that complicated. OpenID is based on unique URL which is now a common thing nowadays as Internet is now public and the technology has been considered mature. You can use your web page, your blog, your friendster page, your MySpace page, etc as your account as long it can be considered your identity. So, instead of using usernames and password, you will now use URL as your identifier when you tried to login to site that supports OpenID (for example OpenID Wiki).

Here's one simple example : I tried to login to OpenID Wiki using my OpenID which i got from GetOpenID and when i do that, the page redirect me to my Provider page (GetOpenID) and asked for my password as proof that i have the valid account there. When i have entered my password, they confirmed that i have the valid account and redirect me back to OpenID Wiki. Next, they asked me to pick a username for that (since i can use different username than the one i specified in my OpenID account) and that's it. I'm now registered to OpenID Wiki. Of course not all site supports for OpenID currently, so let's just wait until most site supports OpenID technology, but while waiting for that time, why don't you prepare yourself and get yourself and OpenID account?


Reference:
Wikipedia
Linux.Com
OpenID Wiki

New -Stable Kernel Again

I have just upgraded my kernel into 2.6.20.2 two days ago and new -stable kernel has come out today (2.6.20.3), but with less patches compared to 2.6.20.2 which consists of a lot of patches. I think i will skip this version because most of the patches were about NETFILTER and some things that i don't need at this moment. I'll wait for the next -stable kernel or next final kernel release (2.6.21), which i doubt will be out in short time. Aside from the patches, i also didn't have time tonight to perform the compilation as i have to go somewhere tonight.

By the way, Linux Kernel Archives celebrates it's ten years of serving the community after it was announced at 13 March 1997 by Peter Anvin. They add new images also in the main page. Check it out...

New Feature in Stable Kernel?

Last night, i performed a kernel compilation and upgrade it to the latest -stable kernel (2.6.20.2) and it was very quick, since i do all the compilation in a single command, by issuing make bzImage; make modules; make modules_install which will
1) Create new kernel image
2) Compile the modules
3) Install the modules

After all of above commands were finished, i just have to copy some files to /boot directory (System.map, .config, and bzImage), rename it to reflect the kernel version and assign the correct symlink (System.map -> System.map-2.6.20.2, config -> config-2.6.20.2, vmlinuz -> vmlinuz-2.6.20.2).

Why do i choose this kind of scheme? Well, in my opinion, it's easier if we gave the version number on the file, so when we want to delete the old kernel, we can just do it by deleting the file that matches with the number, so if you have just upgraded to 2.6.20.2 and you want to delete 2.6.19, you can just type rm *2.6.19* in /boot, /lib/modules, and /usr/src (make sure that your new 2.6.20.2 kernel works first before deleting this files, since it's irreversible).

One thing that makes me curious is that there was a new question when i ran make oldconfig, which didn't suppose to be there, since it's a -stable kernel. Usually, a -stable kernel only consists of security update or bug fixes, but not new feature(s) which should be done in the next final kernel release. The question was about new feature to support 2/3 button emulation on Macintosh computers. When i traced back to the Changelog, i found this information:

commit ee3b6b5324ad82788fb051fac4765a7e6835b454
Author: Soeren Sonnenburg <kernel@nn7.de>
Date: Thu Feb 8 14:20:38 2007 -0800

enable mouse button 2+3 emulation for x86 macs

As macbook/macbook pro's also have to live with a single mouse button the following patch just enables the Macintosh device drivers menu in Kconfig + adds the macintosh dir to the obj-* to make macbook* users happy (who use exactly that since months....

Signed-off-by: Soeren Sonnenburg <kernel@nn7.de>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

I guess that it won't bite too much if this feature is being added and something goes wrong, so they just put this updates on -stable kernel (even though it's disabled by default if you enabled them in the configuration phase since i'm not using Macintosh).