ers81239 writes "I've recently become a Linux administrator within the Department of Defense. I am surprised to find out that the DoD actually publishes extensive guidance on minimum software versions. I guess that isn't so surprising, but the version numbers are. Kernel 2.6.30, ntp 4.2.4p7-RC2, OpenSSL 9.8k and the openssh to match, etc. The surprising part is that these are very fresh versions which are not included in many distributions. We use SUSE Enterprise quite a bit, but even openSUSE factory (their word for unstable) doesn't have these packages. Tarballing on this many systems is a nightmare and even then some things just don't seem to work. I don't have time to track down every possible lib/etc/opt/local/share path that different packages try to use by default. I think that this really highlights the trade-offs of stability and security. I have called Novell to ask about it. When vulnerabilities are found in software, they backport the patches into whatever version of the software they are currently supporting. The problem here is that doesn't give me a guarantee that the backport fixes the problem for which this upgrade is required (My requirements say to install version x or higher). There is also the question of how quickly they are providing the backports. I'm hoping that there are 100s of DoD Linux administrators reading this who can bombard me with solutions. How do you balance security with stability?"

JimLynch writes "Back in 2006, when I was writing for ExtremeTech, I reviewed a version of Ubuntu with a religious theme: Ubuntu Christian Edition. At one point it seemed as though Ubuntu CE had been discontinued but I was pleased to note today that it has apparently been brought to life again and so I decided to do a full review Ubuntu CE 5.0 for DLR."

LinuxScribe writes "Red Hat, Mozilla, Novell, Oracle, and Sun are among the 50-plus member Open Source for America coalition that will be officially announced today by Tim O'Reilly at OSCON. The OSA will be a strong advocate for free and open source software, and plans to boost US Federal government support and adoption of FOSS. From their website: 'The mission of OSA is to educate decision makers in the US Federal government about the advantages of using free and open source software; to encourage the Federal agencies to give equal priority to procuring free and open source software in all of their procurement decisions; and generally provide an effective voice to the US Federal government on behalf of the open source software community, private industry, academia, and other non-profits.'"

An anonymous reader writes "Linux distributions track upstream projects, releasing a particular version with each official release. But how far behind the latest versions do these releases linger? Scott Shawcroft did an interesting new study into this relationship between distributions and upstream projects. Shawcroft says: 'Over the last 10 months I've been working on Linux evolution research. Similar to distrowatch, I track the current versions of packages in a number of distributions and the current upstream version. Based on that data I then graph a number of metrics to understand the relationship between upstream and downstream.' His presentation on the topic scheduled for [this] week's open source convention, OSCON, should provide an interesting insight into that relationship. Currently he is tracking 20 projects including the Linux kernel, Firefox, GCC, OpenSSH and GNOME on Arch, Debian, Fedora, Gentoo, openSUSE, Sabayon, Slackware, and Ubuntu."

griffjon writes "In an interview, Nicholas Negroponte claims that the biggest mistake OLPC made was the revolutionary Red Hat-based Sugar desktop environment — instead, he says, they should have built Sugar as an application that ran on a 'vanilla' Linux OS. Some disagree."

dgun writes "I recently put together a new PC. When I purchased the motherboard, I noticed that it came with an instant-on OS, a small GNU/Linux distro called Splashtop. I assumed that the OS was on a ROM chip on the motherboard. To my great annoyance, when I tried to boot to this OS, a message said that it was not installed. It turns out that motherboard comes with an install disk for this GNU/Linux OS — that you can only run from Windows, to install Splashtop on the hard drive. First of all, doesn't installing it on the hard drive defeat the point of having an instant-on OS? If I wanted to dual-boot a small GNU/Linux OS, there are plenty that I could choose from. Second, if distributing GPL'ed software by means that completely preclude it from being used without Windows is not a violation of the GPL, should it not be?"

phantomfive writes "Red Hat has made it onto the S&P 500, an important measure of the stock market. It is replacing CIT, which is expected to go bankrupt after the government refused to bail them out. Red Hat is the first Linux company to make it on to the S&P 500. While this means little directly for the company, it is an indication of the importance Linux is taking on in the world."

Trailrunner7 writes "A new flaw in the latest release of the Linux kernel gives attackers the ability to exploit NULL pointer dereferences and bypass the protections of SELinux, AppArmor and the Linux Security Module. Brad Spengler discovered the vulnerability and found a reliable way to exploit it, giving him complete control of the remote machine. This is somewhat similar to the magic that Mark Dowd performed last year to exploit Adobe Flash. Threatpost.com reports: 'The vulnerability is in the 2.6.30 release of the Linux kernel, and in a message to the Daily Dave mailing list Spengler said that he was able to exploit the flaw, which at first glance seemed unexploitable. He said that he was able to defeat the protection against exploiting NULL pointer dereferences on systems running SELinux and those running typical Linux implementations.'"

christian.einfeldt writes "Halloween has come early for Linux-loving gamers in the form of the scary Penumbra game trilogy, which has just recently been ported natively to GNU-Linux by the manufacturer, Frictional Games. The Penumbra games, named Overture, Black Plague and Requiem, are first-person survival horror and physics puzzle games which challenge the player to survive in a mine in Greenland which has been taken over by a monstrous infection/demon/cthulhu-esque thing. The graphics, sounds, and plot are all admirable in a scary sort of way. The protagonist is an ordinary human with no particular powers at all, who fumbles around in the dark mine fighting zombified dogs or fleeing from infected humans. But the game is remarkable for its physics engine — rather than just bump and acquire, the player must use the mouse to physically turn knobs and open doors; and the player can grab and throw pretty much anything in the environment. The physics engine drives objects to fly and fall exactly as one would expect. The porting of a game with such a deft physics engine natively to Linux might be one of the most noteworthy events for GNU-Linux gamers since the World of Goo Linux port."

Sam writes "A new goalpost has been set in the race for faster bootup times. MontaVista Software announced (and demonstrated at the Virtual Freescale Technology Forum) a dashboard application going from cold boot to operational in one second flat on their embedded Linux platform. Although this is unlikely to immediately benefit your average Linux user, previous real-time patches have eventually made their way into the main kernel."

twitter writes "The US Postal Service has moved its Cobol package tracking software to HP machines running GNU/Linux. 1,300 servers handle 40 million transactions a day and cost less than the last system, which was based on a Sun Solaris environment." The migration took a year. The USPS isn't spelling how big the savings are, except that they are "significant."

suka writes "In a fresh interview with derStandard.at, Ubuntu founder Mark Shuttleworth talks about GNOME 3.0 — its strengths, but also about what he thinks is missing. He also mentions ongoing talks for a common meta-release-cycle with Debian which could delay the next LTS."

dp619 writes "Mono, a framework based on Microsoft technology, has become more popular for Linux desktop applications than Java, but recent changes could strengthen Java's hand, SD Times is reporting. The story also touches on the failure of Linux distros to keep pace with Eclipse."

nerdyH writes "An architect of the Moblin Project has announced that Moblin 2.0 for netbooks and nettops is the first Linux distribution to run the X server as the logged-in user, rather than SUID'd to root. The fix to this decades-old security liability comes thanks to 'NRX' (No-root X) technology reportedly developed by Intel, Red Hat, and others in the X community, and the Moblin-sponsored 'Secure X' project. Besides making Linux netbooks a lot more snoop-proof, it seems like this could lead to an X-hosting renaissance of sorts, since you wouldn't be risking the whole system just to open up a specific user's account to remote X servers."

Zaiff Urgulbunger writes "After years of speculation, Google has announced Google Chrome OS, which should be available mid-2010. Initially targeting netbooks, its main selling points are speed, simplicity and security — which kind of implies that the current No.1 OS doesn't deliver in these areas! The Chrome OS will run on both x86 and ARM architectures, uses a Linux kernel with a new windowing system. According to Google, 'For application developers, the web is the platform. All web-based applications will automatically work and new applications can be written using your favorite web technologies. And of course, these apps will run not only on Google Chrome OS, but on any standards-based browser on Windows, Mac and Linux thereby giving developers the largest user base of any platform.' Google says that this new OS is separate from Android, as the latter was designed for mobile phones and set-top boxes, whereas Chrome OS is designed 'for people who spend most of their time on the web.'" The New York Times' coverage is worth reading, and there are stories popping up all over the web.

suka writes "During a keynote at the Gran Canaria Desktop Summit, Nokia's Quim Gil announced that a future release of Maemo is going to be built around Qt. Maemo Harmattan is going to switch away from GTK+ / Hildon, derStandard.at reports from the conference." Michael Pyne also writes with a post describing day one of the conference from a KDE perspective.

Ianopolous writes "Classic DOOM and DSL Linux Desktop inside your Java-enabled browser! The latest JPC, the fast 100% Java x86 PC emulator, is now available with online demos and downloads. JPC is open source and is the most secure way of running x86 software ever — 2 layers (applet sandbox, JPC sandbox) of independently validated security make it the world's most secure means of isolating x86 software. Visit the website to try out some classic games and play around with Linux all within your web browser. Refresh = reboot!"

angry tapir writes "Mobile carriers may start giving away netbooks for free, and Linux-based application stores could help them profit by doing so, the Linux Foundation's Jim Zemlin argued at a recent forum in Beijing. 'Selling discounted netbooks to users who buy a mobile data subscription would extend a sales strategy widely used for mobile phones. Carriers often sell phones for below retail price and let a user's subscription fees make up for the loss. AT&T already sells subsidized 3G netbooks in the US, and China Mobile has announced similar plans. Carriers worldwide are likely considering the option, which lets them charge for added services like downloads of music, videos and software, said [analyst Jack Gold]. Those downloads could come from platforms like the iPhone App Store that target mainly mobile phones today. Competition could push netbook prices down as more carriers subsidize them, which would make putting Linux on the laptops an attractive way to cut costs, said Zemlin.'"

superbubba writes "The Moblin steering committee is happy to release the Moblin v2.0 beta for netbooks and nettops for developer testing. With this release, developers can begin to experience and work with the source code of the visually rich, interactive user interface designed for Intel Atom based netbooks."

An anonymous reader writes "Phoronix has published Linux filesystem benchmarks comparing XFS, EXT3, EXT4, Btrfs and NILFS2 filesystems. This is the first time that the new EXT4 and Btrfs and NILFS2 filesystems have been directly compared when it comes to their disk performance though the results may surprise. For the most part, EXT4 came out on top."