Debian Weekly News - October 11th, 2005
Welcome to this year's 41st issue of DWN, the weekly newsletter for the Debian community. The Georgia Tech Marine Robotics Group has built an underwater vehicle with Debian as the base operating system. Matt LaPlante started a series of articles that describe the setup and configuration of a firewall based on Debian, including DHCP, DNS, proxy services and dynamic DNS.
Debian Security Infrastructure. The Debian project announced that the security network has been improved by splitting off the public frontend to a new host. This was a required step after an advisory recently caused the outgoing bandwidth of the old server to be totally saturated. Two more were added afterward.
Dealing with Wiki Spam. Carlos Parra Camargo noticed that several pages in the old Wiki were defaced by a user and restored to the last revision. Riku Voipio pointed to the instructions on dealing with spam in the Wiki.
Security Updates for Mozilla and Friends. With DSA 810 the security team announced that security problems in Mozilla, Firefox, Galeon and Thunderbird have to be fixed by more or less using the new upstream version but keeping the old version number. Thanks to the work done by Eric Dorland and Alexander Sack this hasn't caused the problems yet that were already anticipated.
Reviving the Debian FAQ. Javier Fernández-Sanguino Peña called for help with maintaining the Debian FAQ. Together with Santiago Vila he has cleaned up a lot of sections, but more improvements are required. Osamu Aoki (青木 修) added that the scope of the FAQ should be limited to brief answers and defer to other documents for the details.
Cross-Chroot Account Information. Rob Browning wondered how to configure multiple chroot environments so that the account databases will stay synchronous to the host system. An LDAP backend as well as schroot and bind mounts were mentioned. Daniel Jacobowitz pointed to his shadow etc effort implemented with help of fuse, the filesystem in userspace.
Maintaining local Debian Patches. Sylvain Beucler wondered if there was a mechanism to keep local patches applied to Debian packages even upon an upgrade. Francesco Lovergine pointed him to apt-src that is able to take over part of the job. Paul Hampson explained that using a sane version number will stop apt-get from updating the package from the Debian source.
Hotplug Blacklists obsolete. Marco d'Itri reported
that the new hotplug and coldplug subsystem that has been integrated into udev cannot handle the former
blacklisting of modules anymore but only its own. He later added
that he has implemented support for user-supplied files in
/etc/hotplug/blacklist.d/
in modprobe.
Big Endian ARM Port. Lennert Buytenhek announced the intention to work on a big endian ARM port for consumer devices such as the Linksys NSLU2 or Synology DS101. Wouter Verhelst offered his help with maintaining a build daemon within the secondary buildd network.
Linux Documentation Project License. Francesco Poli discussed the freeness of the Linux Documentation Project License version 2. Matthew Garrett responded positively and pointed out that only the so called dissident test is a problem since the person who is making modifications needs to be identified.
Debian Linux Kernel Handbook. Jurij Smakov and others have published the Debian Linux kernel handbook which will help in documenting the internals of the Debian Linux kernel build process. The document is still work in progress with a lot of sections missing, but it's a giant step in the right direction.
Security Updates. You know the drill. Please make sure that you update your systems if you have any of these packages installed.
- DSA 843: arc -- Insecure temporary files.
- DSA 844: mod-auth-shadow -- Authentication bypass.
- DSA 845: mason -- Missing init script.
- DSA 846: cpio -- Several vulnerabilities.
- DSA 847: dia -- Arbitrary code execution.
- DSA 848: masqmail -- Several vulnerabilities.
- DSA 849: shorewall -- Firewall bypass.
- DSA 850: tcpdump -- Denial of service.
- DSA 851: openvpn -- Denial of service.
- DSA 852: up-imapproxy -- Arbitrary code execution.
- DSA 853: ethereal -- Several vulnerabilities.
- DSA 854: tcpdump -- Denial of service.
- DSA 855: weex -- Arbitrary code execution.
- DSA 856: py2play -- Arbitrary code execution.
- DSA 857: graphviz -- Insecure temporary file.
- DSA 858: xloadimage -- Arbitrary code execution.
- DSA 859: xli -- Arbitrary code execution.
- DSA 860: ruby -- Safety bypass.
- DSA 861: uw-imap -- Arbitrary code execution.
- DSA 862: ruby1.6 -- Safety bypass.
New or Noteworthy Packages. The following packages were added to the unstable Debian archive recently or contain important updates.
- connect-proxy -- Establish TCP connection using SOCKS4/5 and HTTP tunnel.
- dangen -- Shoot 'em up game where accurate shooting matters.
- fruit -- Chess engine, calculate chess moves.
- gtkhtml3.8 -- HTML rendering/editing library - bonobo component binary.
- japitools -- Java API compatibility testing tools.
- keurocalc -- Universal currency converter and calculator.
- lprof -- Hardware Color Profiler.
- mozilla-biofox -- Extension of bioinformatics tools to Mozilla and Firefox browsers.
- tilda -- Terminal with first person shooter console likeness.
- wmii -- Lightweight tabbed and tiled X11 window manager.
Orphaned Packages. 8 packages were orphaned this week and require a new maintainer. This makes a total of 199 orphaned packages. Many thanks to the previous maintainers who contributed to the Free Software community. Please see the WNPP pages for the full list, and please add a note to the bug report and retitle it to ITA: if you plan to take over a package.
- heaplayers -- High-performance memory allocators. (Bug#332536)
- libend-perl -- Generalized END {}. (Bug#333186)
- libhoard -- Fast memory allocation library. (Bug#332538)
- libhtml-table-perl -- Perl module for creating HTML tables. (Bug#333188)
- libintl-perl -- Uniforum message translations system compatible i18n library. (Bug#333190)
- libperlmenu-perl -- Menu and Template (curses-based) UI for Perl. (Bug#333193)
- libterm-prompt-perl -- Perl extension for prompting a user for information. (Bug#333194)
- libtest-reporter-perl -- Sends test results to cpan-testers@perl.org. (Bug#333195)
Removed Packages. 17 packages have been removed from the Debian archive during the past week:
- doc-debian-ko -- Debian FAQ and other documents to Korean
Bug#327764: Request of maintainer, orphaned, outdated - php3 -- server-side, HTML-embedded scripting language
Bug#330656: Request of maintainer, superseded by php4/php5 - busybox-cvs -- Tiny utilities for small and embedded systems
Bug#331153: Request of QA, RC-buggy, superseded by busybox - login.app -- A login application designed with the NeXTStep look in mind
Bug#256681: Request of QA, inactive upstream, alternatives exist - gupsc -- GNOME client for the Network UPS Tools Package (nut)
Bug#263613: Request of QA, abandoned upstream, alternatives exist - cantus -- GNOME tool to mass-rename/tag mp3 and ogg files
Bug#287985: Request of QA, outdated, better alternatives - xml-soap -- SOAP (Simple Object Access Protocol) implementation in Java
Bug#307284: Request of QA, superseded by axis - chastity-list -- blacklists for SquidGuard
Bug#321594: Request of QA, abandoned upstream, very outdated - cyrus-imapd -- CMU Cyrus mail system (administration tool)
Bug#330696: Request of maintainer, obsolete - pd-externals -- PD external collection
Bug#331385: Request of maintainer, few users; out-of-date; buggy - bidwatcher -- Tool for watching and bidding on eBay auctions
Bug#331684: Request of maintainer, broken; security issues - ghc5 -- GHC - the Glasgow Haskell Compilation system
Bug#331701: Request of maintainer, superseded by ghc6 - nhc98 -- aNother Haskell Compiler (the nhc98 Haskell Compiler)
Bug#331704: Request of maintainer, obsolete - oftpd -- Secure anonymous FTP server
Bug#332186: Request of maintainer, dead upstream; security issues - jpilot-mail -- Mail plugin for jpilot (Palm Pilot desktop)
Bug#332636: Request of maintainer, has never been part of a stable release; RC bugs - libosip -- Session Initiation Protocol (SIP) library
Bug#331167: Request of maintainer, superseded by libosip2 - python-gtkextra -- Python module for the GtkExtra widget set extension
Bug#279541: Request of QA, obsolete, unneeded
Want to continue reading DWN? Please help us create this newsletter. We still need more volunteer writers who watch the Debian community and report about what is going on. Please see the contributing page to find out how to help. We're looking forward to receiving your mail at dwn@debian.org.
To receive this newsletter weekly in your mailbox, subscribe to the debian-news mailing list.
Back issues of this newsletter are available.
This issue of Debian Weekly News was edited by Marc Haber and Martin 'Joey' Schulze.