Gentoo Weekly Newsletter 6 February 2006

-------------------------------------------------------------------------=
--
Gentoo Weekly Newsletter
http://www.gentoo.org/news/en/gwn/current.xml
This is the Gentoo Weekly Newsletter for the week of 6 February 2005.
-------------------------------------------------------------------------=
--
=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
1. Gentoo news
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20
GNOME 2.12 moved to stable
--------------------------
 =20
GNOME 2.12 was moved into stable on 22 January 2006. An updated upgrade=20
guide[1] is available. If you experience any issues, please search=20
bugzilla[2], wander into #gentoo-desktop on irc.freenode.net, or file a=20
new bug.=20

 1.=20
http://www.gentoo.org/proj/en/desktop/gnome/howtos/gnome-2.12-upgrade.xml
 2. http://bugs.gentoo.org
=20
Note: If you were helping us test 2.12 by having the packages in your=20
package.keywords file, please remove them all since we will be adding=20
newer releases such as 2.12.3 and the 2.13 beta.=20
   =20
Wi-Spy device donation
----------------------
 =20
Following up on a recent weblog entry[3], Ryan Woodings, president of=20
MetaGeek, LLC[4], has generously donated a free Wi-Spy spectrum analyzer=20
to Gentoo developer Henrik Brix Andersen[5]. The device will assist in=20
debugging the various IEEE 802.11 wireless LAN drivers available in=20
Portage. A huge thank you to Ryan for his donation.=20

 3.=20
http://planet.gentoo.org/developers/brix/2006/01/21/low_cost_2_4ghz_spect=
rum_analyzer
 4. http://www.metageek.net/
 5. [email protected]
=20
The first edition of the third-party open-source tools[6] for the Wi-Spy=20
device are now available in Gentoo Portage under=20
net-wireless/wispy-tools[7].=20

 6. http://www.kismetwireless.net/wispy.shtml
 7.=20
http://packages.gentoo.org/packages/?category=3Dnet-wireless;name=3Dwispy=
-tools
   =20
Poppler and KPDF
----------------
 =20
People interested in Gentoo's security announcements (GLSA) will have see=
n=20
the many security bugs in the xpdf code that have been discovered over th=
e=20
last year. To make fixing them easier -- so that users only have to=20
upgrade one package -- the "Poppler" library was introduced. Unfortunatel=
y=20
the Poppler library was not used by kpdf to display PDFs because some=20
patches in the KDE xpdf copy were missing in poppler. Thanks to Gentoo=20
developer Stefan Schweizer[8] who helped to get a big patch into Poppler,=
=20
almost everything needed for kpdf-integration[9] now seems to be=20
integrated.=20

 8. [email protected]
 9. http://freedesktop.org/wiki/Software_2fpoppler
=20
However upstream KPDF is not yet using Poppler because KDE 3.5 is=20
dependency-frozen, no new dependency can be added. Kubuntu has integrated=
=20
a patch by Jonathan Riddell to make KPDF use Poppler, and Gentoo is now=20
also using a -- slightly improved -- version thanks to Diego Petten=C3=B2=
[10].=20

 10. [email protected]
=20
While this is mostly important for maintainers, as it greatly simplifies=20
the security process, this change has some implications for users, too. A=
s=20
KPDF now is using Poppler directly, it creates a new dependency for=20
kdegraphics and kpdf. The poppler-bindings are already a dependency for=20
kpdf, and for kdegraphics with USE=3D"pdf"). Reducing the duplication of=20
code means that KPDF takes less time to build and occupies less space, an=
d=20
also seems notably faster than before.=20
=20
Note: Xpdf has also been ported to using Poppler. The current xpdf ebuild=
=20
in Portage uses only Poppler for rendering.
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
2. Heard in the community
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20
Web forums
----------
 =20
EVDO access for Gentoo
=20
Living in Japan, the US or anywhere else where EVDO, the broadband data=20
standard on CDMA2000 mobile phone networks is common? Here's a brandnew=20
howto for those who'd like to use an EVDO PCMCIA card in their laptops,=20
then:=20
=20
 * How-To: EVDO on Gentoo Linux[11]=20
 11. https://forums.gentoo.org/viewtopic-t-427992.html

   =20
gentoo-dev
----------
 =20
Make logrotate a global USE flag?
=20
A lengthy discussion on the merits of making logrotate a global useflag=20
happened this week. While some ebuilds offer a (local) logrotate useflag=20
it is not optimal to toggle this through a USE flag - changing log=20
handling should be a config option and not force a recompile!=20
=20
 * Make logrotate a global USE flag? [12]=20
 * Default ebuild behaviour [13]=20
 12. http://thread.gmane.org/gmane.linux.gentoo.devel/35675
 13. http://thread.gmane.org/gmane.linux.gentoo.devel/35753

=20
USE flag change: pdflib --> pdf
=20
Merging three existing USE flags that all basically did the same thing is=
=20
what Marius Mauch[14] had in mind when he proposed a new unified USE=3D"p=
df"=20
flag.=20

 14. [email protected]
=20
 * pdf use flags[15]=20
 15. http://thread.gmane.org/gmane.linux.gentoo.devel/35234

   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
3. Gentoo international
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20
Switzerland: Diet Pentoo released
---------------------------------
 =20
Mini-Pentoo[16] is a trimmed version of the Pentoo LiveCD[17], a=20
"penetration testing distribution" based on Gentoo Linux and maintained b=
y=20
Basel-based Michael Zanetta[18]. It features tools for auditing and=20
testing a network environment, from scanning and discovery to exploiting=20
vulnerabilities. Its 186MB fit on a mini-CD or a 256MB USB stick, and the=
=20
new version features a number of enhancements, including a 2.6.14 kernel=20
with unionfs, support for package modules like Slax, non-volatile storage=
=20
for Nessus plugins, SecurityForest's ExploitTree or config files, and=20
enhanced wireless support.=20

 16. http://www.pentoo.ch
 17. http://www.gentoo.org/news/en/gwn/20050425-newsletter.xml#doc_chap5
 18. [email protected]
=20
Figure 3.1: 'Sexiest window manager available' -- Pentoo's new=20
Enlightenment theme
http://www.gentoo.org/images/gwn/20060206_pentoo.png
=20
Note:  Gentoo developer Marcelo G=C3=B3es has written a review of Pentoo =
that's=20
worth reading if you want to know more about what it contains, and=20
check Pentoo's complete list of tools for detailed information.=20
   =20
Japan: OSC Tokyo coming up
--------------------------
 =20
GentooJP[19] is busily preparing for the next open-source conference in=20
Tokyo: the spring edition of Japan's dedicated open-source events series,=
=20
OSC[20]. The upcoming event is going to be held on 17 and 18 March at the=
=20
usual venue, the Japan Electronics College[21] in Ogikubo. Admission will=
=20
be free, please use the GentooJP mailing list=20
([email protected]) in case you'd like to offer your help at=20
the booth.=20

 19. http://www.gentoo.gr.jp
 20. http://www.ospn.jp/osc2006
 21. http://www.jec.ac.jp/sc_intro/sc_access.html
   =20
UK: EUsecwest security conference in London
-------------------------------------------
 =20
Andrea Barisani[22], Gentoo developer featured in the 9 January 2006=20
edition[23] of the GWN, will be one of the speakers at EUSecWest[24], a=20
security conference held in London on 20 and 21 February. His talk,=20
entitled "Lessons in open-source security: the tale of a 0-day=20
incident"[25], will describe how the rsync exploit (see GLSA 200312-01[26=
]=20
and GLSA 200312-03[27] for details) was handled by Gentoo and the rsync=20
maintainers. Further topics include security in open-source environments=20
with Hardened Gentoo as one of the covered examples.

 22. [email protected]
 23. http://www.gentoo.org/news/en/gwn/20060109-newsletter.xml#doc_chap2
 24. http://eusecwest.com
 25. http://www.inversepath.com/news.html
 26. http://www.gentoo.org/security/en/glsa/glsa-200312-01.xml
 27. http://www.gentoo.org/security/en/glsa/glsa-200312-03.xml
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
4. Gentoo in the press
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20
eWeek.com (29 January 2006)
---------------------------
 =20
Lee Thompson, VP at E-Trade.com, gives a flamboyant testimonial to why he=
=20
thinks that Gentoo Linux appeals so much from a technology management=20
perspective: "the rate of patches coming out of the vendor" is so much=20
faster than with any other operating system that "the amount of change=20
that you are sustaining on a Gentoo system is orders of magnitude larger.=
"=20
In his job as CEO of E-Trade, he knows that change can destabilize at=20
times, but it's still good, and worth the extra effort: "If you can=20
sustain change faster than somebody else, you're going to survive, and th=
e=20
person who can't sustain the change is not going to evolve, and they're=20
going to die off." The only thing he's missing is a dedicated Gentoo=20
flavor for production servers -- which are still running RedHat, while=20
Gentoo only powers his laptop. The article[28] contains much more than=20
just Thompson's love for Gentoo, explaining how open-source development=20
can be leveraged for commercial success at a company like E-Trade, and he=
=20
managed to stir up Steven J. Vaughn-Nichols who wrote another article at=20
Linux Watch[29] where he references Thompsons testimonial, titled "Sellin=
g=20
Linux to bean-counters."=20

 28. http://www.eweek.com/article2/0,1895,1916587,00.asp
 29. http://www.linux-watch.com/news/NS7303540276.html
   =20
Wine Headquarter (31 January 2006)
----------------------------------
 =20
Lo' and behold: Wine, the non-emulator for non-Linux applications on=20
Linux, is actually faster than Windows XP when it comes to running Window=
s=20
applications, claims a benchmark test from WineHQ[30]. our mileage will=20
vary depending on your Linux config, Wine version and Hardware," says=20
author Tom Wickline, but it seems to hold true when the test was done wit=
h=20
Wine 0.9.5 on a Gentoo Linux system...=20

 30. http://wiki.winehq.org/BenchMark-0.9.5
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
5. Gentoo developer moves
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20
Moves
-----
 =20
The following developers recently left the Gentoo project:=20
=20
 * None this week=20
   =20
Adds
----
 =20
The following developers recently joined the Gentoo project:=20
=20
 * Zac Medico (zmedico) - Portage =20
 * Alec Warner (antarus) - Portage =20
 * G=C3=A9rald Fenoy (djay) - app-sci herd =20
   =20
Changes
-------
 =20
The following developers recently changed roles within the Gentoo project=
:
=20
 * None this week=20
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
6. Gentoo Security
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
  =20
MyDNS: Denial of Service
------------------------
 =20
MyDNS contains a vulnerability that may lead to a Denial of Service=20
attack.=20
=20
For more information, please see the GLSA Announcement[31]=20

 31. http://www.gentoo.org/security/en/glsa/glsa-200601-16.xml
   =20
Xpdf, Poppler, GPdf, libextractor, pdftohtml: Heap overflows
------------------------------------------------------------
 =20
Xpdf, Poppler, GPdf, libextractor and pdftohtml are vulnerable to integer=
=20
overflows that may be exploited to execute arbitrary code.=20
=20
For more information, please see the GLSA Announcement[32]=20

 32. http://www.gentoo.org/security/en/glsa/glsa-200601-17.xml
   =20
GStreamer FFmpeg plugin: Heap-based buffer overflow
---------------------------------------------------
 =20
The GStreamer FFmpeg plugin is vulnerable to a buffer overflow that may b=
e=20
exploited by attackers to execute arbitrary code.=20
=20
For more information, please see the GLSA Announcement[33]=20

 33. http://www.gentoo.org/security/en/glsa/glsa-200602-01.xml
    =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
7. Bugzilla
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20
Statistics
----------
 =20
The Gentoo community uses Bugzilla (bugs.gentoo.org[34]) to record and=20
track bugs, notifications, suggestions and other interactions with the=20
development team. Between 29 January 2006 and 05 February 2006, activity=20
on the site has resulted in:=20

 34. http://bugs.gentoo.org
=20
 * 830 new bugs during this period=20
 * 435 bugs closed or resolved during this period=20
 * 26 previously closed bugs were reopened this period=20
=20
Of the 9240 currently open bugs: 75 are labeled 'blocker', 169 are labele=
d=20
'critical', and 505 are labeled 'major'.=20
   =20
Closed bug rankings
-------------------
 =20
The developers and teams who have closed the most bugs during this period=
=20
are:=20
=20
 * Gentoo's Team for Core System packages[35], with 23 closed bugs[36] =20
 * Gentoo KDE team[37], with 20 closed bugs[38] =20
 * Simon Stelling[39], with 20 closed bugs[40] =20
 * Gentoo Security[41], with 14 closed bugs[42] =20
 * AMD64 Porting Team[43], with 13 closed bugs[44] =20
 * Stefano Rossi[45], with 12 closed bugs[46] =20
 * Volkov Peter[47], with 12 closed bugs[48] =20
 * Printing Team[49], with 12 closed bugs[50] =20
 35. [email protected]
 36.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2006-01-29&chfieldto=3D2006-02-05&=
resolution=3DFIXED&[email protected]
 37. [email protected]
 38.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2006-01-29&chfieldto=3D2006-02-05&=
resolution=3DFIXED&[email protected]
 39. [email protected]
 40.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2006-01-29&chfieldto=3D2006-02-05&=
resolution=3DFIXED&[email protected]
 41. [email protected]
 42.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2006-01-29&chfieldto=3D2006-02-05&=
resolution=3DFIXED&[email protected]
 43. [email protected]
 44.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2006-01-29&chfieldto=3D2006-02-05&=
resolution=3DFIXED&[email protected]
 45. [email protected]
 46.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2006-01-29&chfieldto=3D2006-02-05&=
resolution=3DFIXED&[email protected]
 47. [email protected]
 48.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2006-01-29&chfieldto=3D2006-02-05&=
resolution=3DFIXED&[email protected]
 49. [email protected]
 50.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DRESOLVED&bug_status=3DCLO=
SED&chfield=3Dbug_status&chfieldfrom=3D2006-01-29&chfieldto=3D2006-02-05&=
resolution=3DFIXED&[email protected]

   =20
New bug rankings
----------------
 =20
The developers and teams who have been assigned the most new bugs during=20
this period are:=20
=20
 * Default Assignee for New Packages[51], with 71 new bugs[52] =20
 * Gentoo Games[53], with 9 new bugs[54] =20
 * AMD64 Porting Team[55], with 9 new bugs[56] =20
 * Gentoo KDE team[57], with 8 new bugs[58] =20
 * Default Assignee for Orphaned Packages[59], with 7 new bugs[60] =20
 * Gentoo Kernel Bug Wranglers and Kernel Maintainers[61], with 7 new=20
bugs[62] =20
 * Gentoo's Team for Core System packages[63], with 7 new bugs[64] =20
 * Python Gentoo Team[65], with 6 new bugs[66] =20
 51. [email protected]
 52.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2006-01-29&chf=
ieldto=3D2006-02-05&[email protected]
 53. [email protected]
 54.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2006-01-29&chf=
ieldto=3D2006-02-05&[email protected]
 55. [email protected]
 56.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2006-01-29&chf=
ieldto=3D2006-02-05&[email protected]
 57. [email protected]
 58.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2006-01-29&chf=
ieldto=3D2006-02-05&[email protected]
 59. [email protected]
 60.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2006-01-29&chf=
ieldto=3D2006-02-05&[email protected]
 61. [email protected]
 62.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2006-01-29&chf=
ieldto=3D2006-02-05&[email protected]
 63. [email protected]
 64.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2006-01-29&chf=
ieldto=3D2006-02-05&[email protected]
 65. [email protected]
 66.=20
http://bugs.gentoo.org/buglist.cgi?bug_status=3DNEW&bug_status=3DASSIGNED=
&bug_status=3DREOPENED&chfield=3Dassigned_to&chfieldfrom=3D2006-01-29&chf=
ieldto=3D2006-02-05&[email protected]

   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
8. GWN feedback
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
  =20
Please send us your feedback[67] and help make the GWN better.=20

 67. [email protected]
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D
9. GWN subscription information
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D
  =20
To subscribe to the Gentoo Weekly Newsletter, send a blank email to=20
[email protected].=20
=20
To unsubscribe to the Gentoo Weekly Newsletter, send a blank email to=20
[email protected] from the email address you are=20
subscribed under.
   =20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
10. Other languages
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
  =20
The Gentoo Weekly Newsletter is also available in the following languages=
:
=20
 * Danish[68] =20
 * Dutch[69] =20
 * English[70] =20
 * German[71] =20
 * French[72] =20
 * Korean[73] =20
 * Japanese[74] =20
 * Italian[75] =20
 * Polish[76] =20
 * Portuguese (Brazil)[77] =20
 * Portuguese (Portugal)[78] =20
 * Russian[79] =20
 * Spanish[80] =20
 * Turkish[81] =20
 68. http://www.gentoo.org/news/da/gwn/gwn.xml
 69. http://www.gentoo.org/news/nl/gwn/gwn.xml
 70. http://www.gentoo.org/news/en/gwn/gwn.xml
 71. http://www.gentoo.org/news/de/gwn/gwn.xml
 72. http://www.gentoo.org/news/fr/gwn/gwn.xml
 73. http://www.gentoo.org/news/ko/gwn/gwn.xml
 74. http://www.gentoo.org/news/ja/gwn/gwn.xml
 75. http://www.gentoo.org/news/it/gwn/gwn.xml
 76. http://www.gentoo.org/news/pl/gwn/gwn.xml
 77. http://www.gentoo.org/news/pt_br/gwn/gwn.xml
 78. http://www.gentoo.org/news/pt/gwn/gwn.xml
 79. http://www.gentoo.org/news/ru/gwn/gwn.xml
 80. http://www.gentoo.org/news/es/gwn/gwn.xml
 81. http://www.gentoo.org/news/tr/gwn/gwn.xml

  =20
Ulrich Plate <[email protected]> - Editor
Henrik Brix Andersen <[email protected]> - Author
Stefan Schweizer <[email protected]> - Author

--=20
[email protected] mailing list