path: root/english/News/weekly/2005/41/index.wml

#use wml::debian::weeklynews::header PUBDATE="2005-10-11" SUMMARY="Security, Wiki, Mozilla, FAQ, Chroot, Patches, Hotplug, ARM, License, Kernel"
# $Id$

<p>Welcome to this year's 41st issue of DWN, the weekly newsletter for the
Debian community.  The Georgia Tech Marine Robotics Group has built an
underwater <a href="http://cyberbuzz.gatech.edu/underwater/">vehicle</a> with
Debian as the <a href="http://cyberbuzz.gatech.edu/underwater/software.htm">\
base</a> operating system.  Matt LaPlante started a <a
href="http://www.cyberdogtech.com/firewalls/">series</a> of articles that
describe the setup and configuration of a firewall based on Debian, including
DHCP, DNS, proxy services and dynamic DNS.</p>

<p><strong>Debian Security Infrastructure.</strong> The Debian project <a
href="$(HOME)/News/2005/20051004">announced</a> that the security network has
been improved by splitting off the public frontend to a new <a
href="http://lists.debian.org/debian-news/debian-news-2005/msg00047.html">\
host</a>.  This was a required step after an <a
href="$(HOME)/security/2005/dsa-816">advisory</a> recently caused the outgoing
bandwidth of the old server to be totally <a
href="http://lists.debian.org/debian-security-announce/debian-security-announce-2005/msg00206.html">\
saturated</a>.  Two more were <a
href="http://www.infodrom.org/~joey/log/?200510050938">added</a>
afterward.</p>

<p><strong>Dealing with Wiki Spam.</strong> Carlos Parra Camargo <a
href="http://lists.debian.org/debian-devel/2005/09/msg00604.html">noticed</a>
that several pages in the old <a href="http://wiki.debian.net/">Wiki</a> were
defaced by a user and restored to the last revision.  Riku Voipio <a
href="http://lists.debian.org/debian-devel/2005/09/msg00607.html">pointed</a>
to the <a href="http://wiki.debian.org/DebianWiki/DealingWithSpam">instructions</a> on
dealing with spam in the Wiki.</p>

<p><strong>Security Updates for Mozilla and Friends.</strong> With <a
href="$(HOME)/security/2005/dsa-810">DSA 810</a> the security team announced
that security problems in Mozilla, Firefox, Galeon and Thunderbird have to be
fixed by more or less using the new upstream version but <a
href="http://lists.debian.org/debian-devel/2005/09/msg00632.html">keeping</a>
the old version number.  Thanks to the work done by Eric Dorland and Alexander
Sack this hasn't
caused the problems yet that were already anticipated.</p>

<p><strong>Reviving the Debian FAQ.</strong> Javier Fernández-Sanguino Peña <a
href="http://lists.debian.org/debian-devel/2005/09/msg00667.html">called</a>
for help with maintaining the <a href="$(HOME)/doc/manuals/debian-faq/">Debian FAQ</a>.
Together with Santiago Vila he has cleaned up a lot of sections, but more
improvements are required.  Osamu Aoki (&#38738;&#26408; &#20462;)
<a
href="http://lists.debian.org/debian-devel/2005/09/msg01122.html">added</a>
that the scope of the FAQ should be limited to brief answers and defer to other
documents for the details.</p>

<p><strong>Cross-Chroot Account Information.</strong> Rob Browning <a
href="http://lists.debian.org/debian-devel/2005/09/msg00716.html">wondered</a>
how to configure multiple chroot environments so that the account databases
will stay synchronous to the host system.  An <a
href="http://lists.debian.org/debian-devel/2005/09/msg00734.html">LDAP</a>
backend as well as <a
href="http://lists.debian.org/debian-devel/2005/09/msg00763.html">schroot</a>
and <a href="http://lists.debian.org/debian-devel/2005/09/msg00737.html">\
bind mounts</a> were mentioned.  Daniel Jacobowitz <a
href="http://lists.debian.org/debian-devel/2005/09/msg00868.html">pointed</a>
to his <a href="http://return.false.org/~drow/fuse/">shadow etc</a> effort
implemented with help of fuse, the filesystem in userspace.</p>

<p><strong>Maintaining local Debian Patches.</strong> Sylvain Beucler <a
href="http://lists.debian.org/debian-devel/2005/09/msg00802.html">wondered</a>
if there was a mechanism to keep local patches applied to Debian packages even
upon an upgrade.  Francesco Lovergine <a
href="http://lists.debian.org/debian-devel/2005/09/msg00803.html">pointed</a>
him to <a href="http://packages.debian.org/apt-src">apt-src</a> that is able
to take over part of the job.  Paul Hampson <a
href="http://lists.debian.org/debian-devel/2005/09/msg01072.html">explained</a>
that using a sane version number will stop <a
href="http://packages.debian.org/apt">apt-get</a> from updating the package
from the Debian source.</p>

<p><strong>Hotplug Blacklists obsolete.</strong> Marco d'Itri <a
href="http://lists.debian.org/debian-devel/2005/09/msg00830.html">reported</a>
that the new hotplug and coldplug subsystem that has been integrated into <a
href="http://packages.debian.org/udev">udev</a> cannot handle the former
blacklisting of modules anymore but only its own.  He later <a
href="http://lists.debian.org/debian-devel/2005/09/msg01311.html">added</a>
that he has implemented support for user-supplied files in
<code>/etc/hotplug/blacklist.d/</code> in modprobe.</p>

<p><strong>Big Endian ARM Port.</strong> Lennert Buytenhek <a
href="http://lists.debian.org/debian-devel/2005/09/msg00860.html">announced</a>
the <a href="http://lists.debian.org/debian-arm/2005/08/msg00011.html">\
intention</a> to work on a big endian ARM port for consumer devices such as
the Linksys NSLU2 or Synology DS101.  Wouter Verhelst <a
href="http://lists.debian.org/debian-devel/2005/09/msg01051.html">offered</a>
his help with maintaining a build daemon within the secondary buildd <a
href="http://experimental.buildd.net/">network</a>.</p>

<p><strong>Linux Documentation Project License.</strong> Francesco Poli <a
href="http://lists.debian.org/debian-legal/2005/09/msg00503.html">discussed</a>
the freeness of the Linux Documentation Project License version 2.  Matthew
Garrett <a href="http://lists.debian.org/debian-legal/2005/09/msg00504.html">\
responded</a> positively and pointed out that only the so called dissident
test is a problem since the person who is making modifications needs to be
identified.</p>

<p><strong>Debian Linux Kernel Handbook.</strong> Jurij Smakov and others have
published the Debian Linux kernel <a
href="http://kernel-handbook.alioth.debian.org/">handbook</a> which will help
in documenting the internals of the Debian Linux kernel build process.  The
document is still work in progress with a lot of sections missing, but it's a
giant step in the right direction.</p>

<p><strong>Security Updates.</strong> You know the drill.  Please make sure
that you update your systems if you have any of these packages installed.</p>

<ul>
<li>DSA 843: <a href="$(HOME)/security/2005/dsa-843">arc</a> --
    Insecure temporary files.
<li>DSA 844: <a href="$(HOME)/security/2005/dsa-844">mod-auth-shadow</a> --
    Authentication bypass.
<li>DSA 845: <a href="$(HOME)/security/2005/dsa-845">mason</a> --
    Missing init script.
<li>DSA 846: <a href="$(HOME)/security/2005/dsa-846">cpio</a> --
    Several vulnerabilities.
<li>DSA 847: <a href="$(HOME)/security/2005/dsa-847">dia</a> --
    Arbitrary code execution.
<li>DSA 848: <a href="$(HOME)/security/2005/dsa-848">masqmail</a> --
    Several vulnerabilities.
<li>DSA 849: <a href="$(HOME)/security/2005/dsa-849">shorewall</a> --
    Firewall bypass.
<li>DSA 850: <a href="$(HOME)/security/2005/dsa-850">tcpdump</a> --
    Denial of service.
<li>DSA 851: <a href="$(HOME)/security/2005/dsa-851">openvpn</a> --
    Denial of service.
<li>DSA 852: <a href="$(HOME)/security/2005/dsa-852">up-imapproxy</a> --
    Arbitrary code execution.
<li>DSA 853: <a href="$(HOME)/security/2005/dsa-853">ethereal</a> --
    Several vulnerabilities.
<li>DSA 854: <a href="$(HOME)/security/2005/dsa-854">tcpdump</a> --
    Denial of service.
<li>DSA 855: <a href="$(HOME)/security/2005/dsa-855">weex</a> --
    Arbitrary code execution.
<li>DSA 856: <a href="$(HOME)/security/2005/dsa-856">py2play</a> --
    Arbitrary code execution.
<li>DSA 857: <a href="$(HOME)/security/2005/dsa-857">graphviz</a> --
    Insecure temporary file.
<li>DSA 858: <a href="$(HOME)/security/2005/dsa-858">xloadimage</a> --
    Arbitrary code execution.
<li>DSA 859: <a href="$(HOME)/security/2005/dsa-859">xli</a> --
    Arbitrary code execution.
<li>DSA 860: <a href="$(HOME)/security/2005/dsa-860">ruby</a> --
    Safety bypass.
<li>DSA 861: <a href="$(HOME)/security/2005/dsa-861">uw-imap</a> --
    Arbitrary code execution.
<li>DSA 862: <a href="$(HOME)/security/2005/dsa-862">ruby1.6</a> --
    Safety bypass.
</ul>

<p><strong>New or Noteworthy Packages.</strong> The following packages were
added to the unstable Debian archive <a
href="http://packages.debian.org/unstable/newpkg_main">recently</a> or contain
important updates.</p>

<ul>
<li><a href="http://packages.debian.org/unstable/net/connect-proxy">connect-proxy</a>
    -- Establish TCP connection using SOCKS4/5 and HTTP tunnel.</li>
<li><a href="http://packages.debian.org/unstable/games/dangen">dangen</a>
    -- Shoot 'em up game where accurate shooting matters.</li>
<li><a href="http://packages.debian.org/unstable/games/fruit">fruit</a>
    -- Chess engine, calculate chess moves.</li>
<li><a href="http://packages.debian.org/unstable/gnome/gtkhtml3.8">gtkhtml3.8</a>
    -- HTML rendering/editing library - bonobo component binary.</li>
<li><a href="http://packages.debian.org/unstable/devel/japitools">japitools</a>
    -- Java API compatibility testing tools.</li>
<li><a href="http://packages.debian.org/unstable/kde/keurocalc">keurocalc</a>
    -- Universal currency converter and calculator.</li>
<li><a href="http://packages.debian.org/unstable/graphics/lprof">lprof</a>
    -- Hardware Color Profiler.</li>
<li><a href="http://packages.debian.org/unstable/science/mozilla-biofox">mozilla-biofox</a>
    -- Extension of bioinformatics tools to Mozilla and Firefox browsers.</li>
<li><a href="http://packages.debian.org/unstable/x11/tilda">tilda</a>
    -- Terminal with first person shooter console likeness.</li>
<li><a href="http://packages.debian.org/unstable/x11/wmii">wmii</a>
    -- Lightweight tabbed and tiled X11 window manager.</li>
</ul>

<p><strong>Orphaned Packages.</strong> 8 packages were orphaned this week and
require a new maintainer.  This makes a total of 199 orphaned packages.  Many
thanks to the previous maintainers who contributed to the Free Software
community.  Please see the <a href="$(HOME)/devel/wnpp/">WNPP pages</a> for
the full list, and please add a note to the bug report and retitle it to ITA:
if you plan to take over a package.</p>

<ul>
<li> <a href="http://packages.debian.org/unstable/libdevel/heaplayers">heaplayers</a>
     -- High-performance memory allocators.
     (<a href="https://bugs.debian.org/332536">Bug#332536</a>)
     </li>
<li> <a href="http://packages.debian.org/unstable/perl/libend-perl">libend-perl</a>
     -- Generalized END {}.
     (<a href="https://bugs.debian.org/333186">Bug#333186</a>)
     </li>
<li> <a href="http://packages.debian.org/unstable/libs/libhoard">libhoard</a>
     -- Fast memory allocation library.
     (<a href="https://bugs.debian.org/332538">Bug#332538</a>)
     </li>
<li> <a href="http://packages.debian.org/unstable/perl/libhtml-table-perl">libhtml-table-perl</a>
     -- Perl module for creating HTML tables.
     (<a href="https://bugs.debian.org/333188">Bug#333188</a>)
     </li>
<li> <a href="http://packages.debian.org/unstable/perl/libintl-perl">libintl-perl</a>
     -- Uniforum message translations system compatible i18n library.
     (<a href="https://bugs.debian.org/333190">Bug#333190</a>)
     </li>
<li> <a href="http://packages.debian.org/unstable/perl/libperlmenu-perl">libperlmenu-perl</a>
     -- Menu and Template (curses-based) UI for Perl.
     (<a href="https://bugs.debian.org/333193">Bug#333193</a>)
     </li>
<li> <a href="http://packages.debian.org/unstable/perl/libterm-prompt-perl">libterm-prompt-perl</a>
     -- Perl extension for prompting a user for information.
     (<a href="https://bugs.debian.org/333194">Bug#333194</a>)
     </li>
<li> <a href="http://packages.debian.org/unstable/perl/libtest-reporter-perl">libtest-reporter-perl</a>
     -- Sends test results to cpan-testers@perl.org.
     (<a href="https://bugs.debian.org/333195">Bug#333195</a>)
     </li>
</ul>

<p><strong>Removed Packages.</strong> 17 packages have been <a
href="http://ftp-master.debian.org/removals.txt">removed</a> from the Debian
archive during the past week:</p>
 
<ul>
<li> doc-debian-ko -- Debian FAQ and other documents to Korean
     <br><a href="https://bugs.debian.org/327764">Bug#327764</a>:
     Request of maintainer, orphaned, outdated
<li> php3 -- server-side, HTML-embedded scripting language
     <br><a href="https://bugs.debian.org/330656">Bug#330656</a>:
     Request of maintainer, superseded by php4/php5
<li> busybox-cvs -- Tiny utilities for small and embedded systems
     <br><a href="https://bugs.debian.org/331153">Bug#331153</a>:
     Request of QA, RC-buggy, superseded by busybox
<li> login.app -- A login application designed with the NeXTStep look in mind
     <br><a href="https://bugs.debian.org/256681">Bug#256681</a>:
     Request of QA, inactive upstream, alternatives exist
<li> gupsc -- GNOME client for the Network UPS Tools Package (nut)
     <br><a href="https://bugs.debian.org/263613">Bug#263613</a>:
     Request of QA, abandoned upstream, alternatives exist
<li> cantus -- GNOME tool to mass-rename/tag mp3 and ogg files
     <br><a href="https://bugs.debian.org/287985">Bug#287985</a>:
     Request of QA, outdated, better alternatives
<li> xml-soap -- SOAP (Simple Object Access Protocol) implementation in Java
     <br><a href="https://bugs.debian.org/307284">Bug#307284</a>:
     Request of QA, superseded by axis
<li> chastity-list -- blacklists for SquidGuard
     <br><a href="https://bugs.debian.org/321594">Bug#321594</a>:
     Request of QA, abandoned upstream, very outdated
<li> cyrus-imapd -- CMU Cyrus mail system (administration tool)
     <br><a href="https://bugs.debian.org/330696">Bug#330696</a>:
     Request of maintainer, obsolete
<li> pd-externals -- PD external collection
     <br><a href="https://bugs.debian.org/331385">Bug#331385</a>:
     Request of maintainer, few users; out-of-date; buggy
<li> bidwatcher -- Tool for watching and bidding on eBay auctions
     <br><a href="https://bugs.debian.org/331684">Bug#331684</a>:
     Request of maintainer, broken; security issues
<li> ghc5 -- GHC - the Glasgow Haskell Compilation system
     <br><a href="https://bugs.debian.org/331701">Bug#331701</a>:
     Request of maintainer, superseded by ghc6
<li> nhc98 -- aNother Haskell Compiler (the nhc98 Haskell Compiler)
     <br><a href="https://bugs.debian.org/331704">Bug#331704</a>:
     Request of maintainer, obsolete
<li> oftpd -- Secure anonymous FTP server
     <br><a href="https://bugs.debian.org/332186">Bug#332186</a>:
     Request of maintainer, dead upstream; security issues
<li> jpilot-mail -- Mail plugin for jpilot (Palm Pilot desktop)
     <br><a href="https://bugs.debian.org/332636">Bug#332636</a>:
     Request of maintainer, has never been part of a stable release; RC bugs
<li> libosip -- Session Initiation Protocol (SIP) library
     <br><a href="https://bugs.debian.org/331167">Bug#331167</a>:
     Request of maintainer, superseded by libosip2
<li> python-gtkextra -- Python module for the GtkExtra widget set extension
     <br><a href="https://bugs.debian.org/279541">Bug#279541</a>:
     Request of QA, obsolete, unneeded
</ul>

<p><strong>Want to continue reading DWN?</strong> Please help us create this
newsletter.  We still need more volunteer writers who watch the Debian
community and report about what is going on.  Please see the <a
href="$(HOME)/News/weekly/contributing">contributing page</a> to find out how
to help.  We're looking forward to receiving your mail at <a
href="mailto:dwn@debian.org">dwn@debian.org</a>.</p>

#use wml::debian::weeklynews::footer editor="Marc Haber, Martin 'Joey' Schulze"