Gentoo Weekly Newsletter - Volume 2, Issue 5

---------------------------------------------------------------------------
Gentoo Weekly Newsletter
http://www.gentoo.org/news/en/gwn/current.xml
This is the Gentoo Weekly Newsletter for the week of February 2nd, 2004.
---------------------------------------------------------------------------
 
==============
1. Gentoo News
==============
   
 * Gentoo Managers' Meeting Summary - 12 Jan 2004 and 26 Jan 2004 
 * Gentoo Linux BugDay on Saturday, February 7 
    
Gentoo Managers' Meeting Summary - 12 Jan 2004 and 26 Jan 2004
--------------------------------------------------------------
  
Summaries and logs for the Gentoo Managers' Meetings held on 12 January 
and 26 January are now up[1]. 

 1. http://www.gentoo.org/proj/en/devrel/manager-meetings/index.xml
 
In the meeting held on the 12th, there was no agenda but an informative 
discussion occurred nonetheless. The meeting began with Nick Carpaski[2] 
making a plea for developers to use repoman, the quality management tool 
used to maintain the quality of the CVS tree. He then announced that the 
2.0.50_pre series of Portage trees is under development and needs testing. 
After this, Alexander Gabert[3] asked if developers felt there was a need 
for more hardware for testing software and releases. While there seemed to 
be a consensus that more hardware could be used, especially non-x86 
hardware, it was also noted that it was not the only bottleneck, lack of 
manpower often being the cause of an ebuild languishing in ~arch. It was 
also pointed out that if Portage could handle cross-compiling, life would 
be much easier. Discussion then turned to what should be done if more 
hardware were available, a reasonable suggestion being a compiler farm. 
The technical details are rather fuzzy, but Alexander will be generating a 
GLEP on how remote access and authentication, possibly with VPN, could be 
performed. 

 2. [email protected]
 3. [email protected]
 
The meeting held on the 26th was opened with Kurt Lieber[4] announcing a 
plan to develop an enterprise-friendly version of Gentoo. Gentoo 
Enterprise would be extremely stable, with quarterly sets of release 
ebuilds guaranteed to persist for at least a year. There was then some 
discussion on whether to have a separate Gentoo Enterprise tree or to have 
a Portage keyword; Kurt will be writing a GLEP to tackle these and other 
issues soon. Once the floor was opened, developers brouhgt up several 
ideas. First, Brian Jackson[5] suggested "server metapackages" - these 
would be like the KDE and GNOME metapackages - "emerge vmail", for 
example, would create an already-configured virtual mail system. Next, 
more discussion about a separate tree for Gentoo Server, including ideas 
about using webrsync to get past paranoid corporate firewalls, using 
xdelta, and implementing a kickstart-like installation tool, took place. 

 4. [email protected]
 5. [email protected]
    
Gentoo Linux BugDay on Saturday, February 7
-------------------------------------------
  
Once again it's the time of the month when users and developers gather on 
IRC and work together to hunt down as many bugs as possible. BugDay will 
be held next Saturday, February 7, in the #gentoo-bugs channel on 
irc.freenode.net. Good hunting! Contact Brian Jackson[6] if you have any 
questions. 

 6. [email protected]
    
=================================
2. Featured Developer of the Week
=================================
  
Featured Developer is on hiatus this week.
   
==================
3. Gentoo Security
==================
   
 * GLSA: mod_python 
 * GLSA: gaim 
    
GLSA: mod_python
----------------
  
Apache's mod_python module could crash the httpd process if a specific, 
malformed query string was sent. 
 
Mod_python is an Apache module that embeds the Python interpreter within 
the server allowing Python-based web-applications to be created. The 
Apache Foundation has reported that mod_python may be prone to Denial of 
Service attacks when handling a malformed query. Mod_python 2.7.9 was 
released to fix the vulnerability, however, because the vulnerability has 
not been fully fixed, version 2.7.10 has been released[7]. Users of 
mod_python 3.0.4 are not affected by this vulnerability. Although there 
are no known public exploits known for this exploit, users are recommended 
to upgrade mod_python to ensure the security of their infrastructure. 

 7. http://www.modpython.org/pipermail/mod_python/2004-January/014879.html
 
 * Severity: Low 
 * Packages Affected: <=dev-pithon/mod_python-2.7.9 
 * Rectification: emerge sync; emerge -pv 
">=dev-python/mod_python-2.7.10;" emerge ">=dev-python/mod_python-2.7.10" 
 * GLSA Announcement[8] 
 8. http://article.gmane.org/gmane.linux.gentoo.announce/282

GLSA: gaim
----------
  
Various overflows in the handling of AIM DirectIM packets was revealed in 
GAIM that could lead to a remote compromise of the IM client. 
 
Gaim is a multi-platform and multi-protocol instant messaging client. It 
is compatible with AIM , ICQ, MSN Messenger, Yahoo, IRC, Jabber, 
Gadu-Gadu, and the Zephyr networks. Yahoo changed the authentication 
methods to their IM servers, rendering GAIM useless. The GAIM team 
released a rushed release solving this issue, however, at the same time a 
code audit[9] revealed 12 vulnerabilities. Due to the nature of instant 
messaging many of these bugs require man-in-the-middle attacks between the 
client and the server. But the underlying protocols are easy to implement 
and attacking ordinary TCP sessions is a fairly simple task. As a result, 
all users are advised to upgrade their GAIM installation. 

 9. http://www.securityfocus.com/archive/1/351235
 
 * Severity: Normal 
 * Packages Affected: <=net-im/gaim-0.75-r6 
 * Retification: emerge sync; emerge -pv ">=net-im/gaim-0.75-r7"; emerge 
-">=net-im/gaim-0.75-r7" 
 * GLSA Announcement[10] 
 10. http://article.gmane.org/gmane.linux.gentoo.announce/283

=========================
4. Heard in the Community
=========================
  
Web Forums
----------
  
Portaris Nearing Completion
 
On and off since December, stonent[11] has been working on getting Portage 
to run on Solaris, in order to provide a usable interface for updating an 
operating system quite different from Linux, much like Portage for Mac OS 
X[12]. Between him, developer Genone and a few other Solarists, it looks 
like they're making some real progress:

 11. http://forums.gentoo.org/profile.php?mode=viewprofile&u=26546
 12. http://www.metapkg.org/
 
 * Getting portage running under Solaris 9 (Portaris!)[13] 
 13. http://forums.gentoo.org/viewtopic.php?t=113387
 
Gentoo RaQ/Qube
 
News from the MIPS front: Developer kumba[14] chose the Alternative 
Architecture forum for his announcement of a working Cobalt RaQ and Qube 
version of Gentoo Linux:

 14. http://forums.gentoo.org/profile.php?mode=viewprofile&u=3883
 
 * Cobalt RaQ/Qube Systems -- Testing Needed[15] 
Gentoo 2004 - Test Stages
 
Another thread rounding up testers, this one for the imminent shipment of 
Gentoo 2004 edition CDs:
 
 * [gentoo-announce] new test stages/isos (20040128) available[16] 
 15. http://forums.gentoo.org/viewtopic.php?t=130794
 16. http://forums.gentoo.org/viewtopic.php?t=127764
    
gentoo-user
-----------
  
SpamAssassin lacking? 
 
A few SpamAssassin users felt that in the past few weeks, it has not been 
as effective as it used to be. Are the spammers changing techniques or are 
SA's rulesets just behind? Check out some opinions and a few suggestions 
here[17]. 

 17. http://thread.gmane.org/gmane.linux.gentoo.user/63677
 
GnuPG Signing Mailing List Messages 
 
Does it make sense to sign your public email posts with GnuPG/PGP. Check 
out the  debate[18]. 

 18. http://thread.gmane.org/gmane.linux.gentoo.user/63602
    
=======================
5. Gentoo International
=======================
  
Germany: Oberhausen GLUG on 4 February 2004
 
The Ruhrgebiet crowd is meeting again, this time at the Gasthof 
Harlos[19]. As usual, a coordination thread is in the German forum[20].

 19. http://www.gasthof-harlos.de/
 20. http://forums.gentoo.org/viewtopic.php?p=700267#700267
 
Germany: Linuxtag Preparations Under Way
 
Still three months to go before the actual event, but Gentoo's 
exhibitors-to-be at the next LinuxTag in Karlsruhe[21], Europe's biggest 
annual Open Source meeting, are already gathering their troops[22]. The 
LinuxTag is going to be held from 23 to 26 June this year, make room for 
that in your calenders. Coffee in the adjacent zoological garden 
(accessible from the venue) is known to be more than just decent, and 
Karlsruhe's quite pleasant setting and location almost on the French 
border is probably an excellent excuse for neighbouring country dwellers 
to come visit the German Gentooists... 

 21. http://www.linuxtag.org/2004/index.html
 22. http://forums.gentoo.org/viewtopic.php?t=126538
   
===========
6. Bugzilla
===========
  
Summary
-------
  
 * Statistics 
 * Closed Bug Ranking 
 * New Bug Rankings 
    
Statistics
----------
  
The Gentoo community uses Bugzilla (bugs.gentoo.org[23]) to record and 
track bugs, notifications, suggestions and other interactions with the 
development team. Between 23 January 2004 and 29 January 2004, activity on 
the site has resulted in: 

 23. http://bugs.gentoo.org
 
 * 608 new bugs during this period 
 * 327 bugs closed or resolved during this period 
 * 16 previously closed bugs were reopened this period 
 
Of the 4936 currently open bugs: 107 are labeled 'blocker', 193 are 
labeled 'critical', and 360 are labeled 'major'. 
    
Closed Bug Rankings
-------------------
  
The developers and teams who have closed the most bugs during this period 
are: 
 
 * Gentoo Sound Team[24], with 31 closed bugs[25]  
 * Core System Packages Team[26], with 23 closed bugs[27]  
 * Net-Mail Packages[28], with 16 closed bugs[29]  
 * Python Gentoo Team[30], with 15 closed bugs[31]  
 * AMD64 Porting Team[32], with 14 closed bugs[33]  
 24. [email protected]
 25. 
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&ch
field=bug_status&chfieldfrom=2004-01-23&chfieldto=2004-01-29&resolution=FIX
ED&[email protected]
 26. [email protected]
 27. 
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&ch
field=bug_status&chfieldfrom=2004-01-23&chfieldto=2004-01-29&resolution=FIX
ED&[email protected]
 28. [email protected]
 29. 
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&ch
field=bug_status&chfieldfrom=2004-01-23&chfieldto=2004-01-29&resolution=FIX
ED&[email protected]
 30. [email protected]
 31. 
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&ch
field=bug_status&chfieldfrom=2004-01-23&chfieldto=2004-01-29&resolution=FIX
ED&[email protected]
 32. [email protected]
 33. 
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&ch
field=bug_status&chfieldfrom=2004-01-23&chfieldto=2004-01-29&resolution=FIX
ED&[email protected]

New Bug Rankings
----------------
  
The developers and teams who have been assigned the most new bugs during 
this period are: 
 
 * Core System Packages Team[34], with 28 new bugs[35]  
 * Gentoo KDE Team[36], with 17 new bugs[37]  
 * Net-Mail Packages Team[38], with 12 new bugs[39]  
 * AMD64 Porting Team[40], with 12 new bugs[41]  
 * x86 Kernel Team[42], with 10 new bugs[43]  
 34. [email protected]
 35. 
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_s
tatus=REOPENED&chfield=assigned_to&chfieldfrom=2004-01-23&chfieldto=2004-01
-29&[email protected]
 36. [email protected]
 37. 
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_s
tatus=REOPENED&chfield=assigned_to&chfieldfrom=2004-01-23&chfieldto=2004-01
-29&[email protected]
 38. [email protected]
 39. 
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_s
tatus=REOPENED&chfield=assigned_to&chfieldfrom=2004-01-23&chfieldto=2004-01
-29&[email protected]
 40. [email protected]
 41. 
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_s
tatus=REOPENED&chfield=assigned_to&chfieldfrom=2004-01-23&chfieldto=2004-01
-29&[email protected]
 42. [email protected]
 43. 
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_s
tatus=REOPENED&chfield=assigned_to&chfieldfrom=2004-01-23&chfieldto=2004-01
-29&[email protected]

==================
7. Tips and Tricks
==================
  
Improving DNS Lookups
 
This week's tip shows you how to improve DNS lookups by using multiple 
nameservers. This is useful if you've ever had your primary DNS server 
become unreachable for any reason.
 
Nameservers are listed in /etc/resolv.conf, one per line. 
 
---------------------------------------------------------------------------
| Code Listing 7.1:                                                       |
| Example /etc/resolv.conf                                                |
---------------------------------------------------------------------------
|nameserver 192.168.1.1                                                   |
|nameserver 10.0.0.1                                                      |
---------------------------------------------------------------------------
 
To improve DNS lookups, add multiple DNS servers (preferably on different 
subnets) and the following options to /etc/resolv.conf:
 
---------------------------------------------------------------------------
| Code Listing 7.2:                                                       |
| /etc/resolv.conf options                                                |
---------------------------------------------------------------------------
|options rotate                                                           |
|options timeout 1                                                        |
---------------------------------------------------------------------------
 
This will cause the resolver to rotate the DNS list after each query and 
to use a timeout of 1 second.
   
===========================
8. Moves, Adds, and Changes
===========================
  
Moves
-----
  
The following developers recently left the Gentoo team: 
 * none this week 
 
Adds
----
  
The following developers recently joined the Gentoo Linux team:
 
 * Nathaniel McCallum (npmccallum) - installer 
 * Chris Aniszczyk (zx) - java 
    
Changes
-------
  
The following developers recently changed roles within the Gentoo Linux 
project:
 
 * none this week 
    
====================
9. Contribute to GWN
====================
  
Interested in contributing to the Gentoo Weekly Newsletter? Send us an 
email[44].

 44. [email protected]
   
================
10. GWN Feedback
================
  
Please send us your feedback[45] and help make the GWN better.

 45. [email protected]
   
================================
11. GWN Subscription Information
================================
  
To subscribe to the Gentoo Weekly Newsletter, send a blank email to 
[email protected].
 
To unsubscribe to the Gentoo Weekly Newsletter, send a blank email to 
[email protected] from the email address you are 
subscribed under.
   
===================
12. Other Languages
===================
  
The Gentoo Weekly Newsletter is also available in the following languages:
 
 * Dutch[46] 
 * English[47] 
 * German[48] 
 * French[49] 
 * Japanese[50] 
 * Italian[51] 
 * Polish[52] 
 * Portuguese (Brazil)[53] 
 * Portuguese (Portugal)[54] 
 * Russian[55] 
 * Spanish[56] 
 * Turkish[57] 
 46. http://www.gentoo.org/news/be/gwn/gwn.xml
 47. http://www.gentoo.org/news/en/gwn/gwn.xml
 48. http://www.gentoo.org/news/de/gwn/gwn.xml
 49. http://www.gentoo.org/news/fr/gwn/gwn.xml
 50. http://www.gentoo.org/news/ja/gwn/gwn.xml
 51. http://www.gentoo.org/news/it/gwn/gwn.xml
 52. http://www.gentoo.org/news/pl/gwn/gwn.xml
 53. http://www.gentoo.org/news/br/gwn/gwn.xml
 54. http://www.gentoo.org/news/pt/gwn/gwn.xml
 55. http://www.gentoo.org/news/ru/gwn/gwn.xml
 56. http://www.gentoo.org/news/es/gwn/gwn.xml
 57. http://www.gentoo.org/news/tr/gwn/gwn.xml

Yuji Carlos Kosugi <[email protected]> - Editor
AJ Armstrong <[email protected]> - Contributor
Brian Downey <[email protected]> - Contributor
Luke Giuliani <[email protected]> - Contributor
Kurt Lieber <[email protected]> - Contributor
Rafael Cordones Marcos <[email protected]> - Contributor
David Narayan <[email protected]> - Contributor
David Nielsen <[email protected]> - Contributor
Ulrich Plate <[email protected]> - Contributor
Sven Vermeulen <[email protected]> - Contributor
Hendrik Eeckhaut <[email protected]> - Dutch Translation
Jorn Eilander <[email protected]> - Dutch Translation
Bernard Kerckenaere <[email protected]> - Dutch Translation
Peter ter Borg <[email protected]> - Dutch Translation
Jochen Maes <[email protected]> - Dutch Translation
Roderick Goessen <[email protected]> - Dutch Translation
Gerard van den Berg <[email protected]> - Dutch Translation
Matthieu Montaudouin <[email protected]> - French Translation
Xavier Neys <[email protected]> - French Translation
Martin Prieto <[email protected]> - French Translation
Antoine Raillon <[email protected]> - French Translation
Sebastien Cevey <[email protected]> - French Translation
Jean-Christophe Choisy <[email protected]> - French Translation
Thomas Raschbacher <[email protected]> - German Translation
Steffen Lassahn <[email protected]> - German Translation
Matthias F. Brandstetter <[email protected]> - German Translation
Lukas Domagala <[email protected]> - German Translation
Tobias Scherbaum <[email protected]> - German Translation
Daniel Gerholdt <[email protected]> - German Translation
Marc Herren <[email protected]> - German Translation
Tobias Matzat <[email protected]> - German Translation
Marco Mascherpa <[email protected]> - Italian Translation
Claudio Merloni <[email protected]> - Italian Translation
Christian Apolloni <[email protected]> - Italian Translation
Stefano Lucidi <[email protected]> - Italian Translation
Yoshiaki Hagihara <[email protected]> - Japanese Translation
Katsuyuki Konno <[email protected]> - Japanese Translation
Yuji Carlos Kosugi <[email protected]> - Japanese Translation
Yasunori Fukudome <[email protected]> - Japanese Translation
Takashi Ota <[email protected]> - Japanese Translation
Radoslaw Janeczko <[email protected]> - Polish Translation
Lukasz Strzygowski <[email protected]> - Polish Translation
Michal Drobek <[email protected]> - Polish Translation
Adam Lyjak <[email protected]> - Polish Translation
Krzysztof Klimonda <[email protected]> - Polish Translation
Atila "Jedi" Bohlke Vasconcelos <[email protected]> - Portuguese 
(Brazil) Translation
Eduardo Belloti <[email protected]> - Portuguese (Brazil) Translation
Jo達o Rafael Moraes Nicola <[email protected]> - Portuguese (Brazil) 
Translation
Marcelo Gon巽alves de Azambuja <[email protected]> - Portuguese 
(Brazil) Translation
Otavio Rodolfo Piske <[email protected]> - Portuguese (Brazil) 
Translation
Pablo N. Hess -- NatuNobilis <[email protected]> - Portuguese 
(Brazil) Translation
Pedro de Medeiros <[email protected]> - Portuguese (Brazil) Translation
Ventura Barbeiro <[email protected]> - Portuguese (Brazil) 
Translation
Bruno Ferreira <[email protected]> - Portuguese (Portugal) 
Translation
Gustavo Felisberto <[email protected]> - Portuguese (Portugal) 
Translation
Jos辿 Costa <[email protected]> - Portuguese (Portugal) Translation
Luis Medina <[email protected]> - Portuguese (Portugal) Translation
Ricardo Loureiro <[email protected]> - Portuguese (Portugal) Translation
Aleksandr Martyncev <[email protected]> - Russian Translator
Sergey Galkin <[email protected]> - Russian Translator
Sergey Kuleshov <[email protected]> - Russian Translator
Alex Spirin <[email protected]> - Russian Translator
Denis Zaletov <[email protected]> - Russian Translator
Lanark <[email protected]> - Spanish Translation
Fernando J. Pereda <[email protected]> - Spanish Translation
Lluis Peinado Cifuentes <[email protected]> - Spanish Translation
Zephryn Xirdal T <[email protected]> - Spanish Translation
Guillermo Juarez <[email protected]> - Spanish Translation
Jes炭s Garc鱈a Crespo <[email protected]> - Spanish Translation
Carlos Castillo <[email protected]> - Spanish Translation
Julio Castillo <[email protected]> - Spanish Translation
Sergio G坦mez <[email protected]> - Spanish Translation
Aycan Irican <[email protected]> - Turkish Translation
Bugra Cakir <[email protected]> - Turkish Translation
Cagil Seker <[email protected]> - Turkish Translation
Emre Kazdagli <[email protected]> - Turkish Translation
Evrim Ulu <[email protected]> - Turkish Translation
Gursel Kaynak <[email protected]> - Turkish Translation

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQFAHnJ19QP4LZPv56cRAlEoAJ4+fvO+gJBjh7U0nTV3XDn3XxdJXQCfeiRA
wKESsGsgYQjtO0NBRIsDYMI=
=z6nt
-----END PGP SIGNATURE-----