New Zealand Linux

————————————————————————-
The Debian Project http://www.debian.org/
Debian GNU/Linux 4.0 updated press@debian.org
April 8th, 2009 http://www.debian.org/News/2009/20090408
————————————————————————-

Debian GNU/Linux 4.0 updated

The Debian project is pleased to announce the eighth update of its
oldstable distribution Debian GNU/Linux 4.0 (codename “etch”). This
update mainly adds corrections for security problems to the oldstable
release, along with a few adjustment to serious problems.

Please note that this update does not constitute a new version of Debian
GNU/Linux 4.0 but only updates some of the packages included. There is
no need to throw away 4.0 CDs or DVDs but only to update via an up-to-
date Debian mirror after an installation, to cause any out of date
packages to be updated.

Those who frequently install updates from security.debian.org won’t have
to update many packages and most updates from security.debian.org are
included in this update.

New CD and DVD images containing updated packages and the regular
installation media accompanied with the package archive respectively will
be available soon at the regular locations.

Upgrading to this revision online is usually done by pointing the
aptitude (or apt) package tool (see the sources.list(5) manual page) to
one of Debian’s many FTP or HTTP mirrors. A comprehensive list of
mirrors is available at:

<http://www.debian.org/distrib/ftplist>

Miscellaneous Bugfixes
———————-

This oldstable update adds a few important corrections to the following
packages:

Package Reason

libweather-com-perl Adopt to weather.com’s interface changes
optipng Fix array overflow vulnerability
pam Fix signedness error in _pam_StrTok
postgresql-8.1 New upstream bugfix release 8.1.17
sleuthkit Fix license issue
debian-installer Include the updated archive key.
debian-archive-keyring Add new archive key

Security Updates
—————-

This revision adds the following security updates to the stable release.
The Security Team has already released an advisory for each of these
updates:

Advisory ID Package Correction(s)

DSA-1622 newsx Arbitrary code execution
DSA-1712 rt2400 Arbitrary code execution
DSA-1713 rt2500 Arbitrary code execution
DSA-1714 rt2570 Arbitrary code execution
DSA-1716 vnc4 Remote code execution
DSA-1717 devil Buffer overflow
DSA-1718 boinc Validation bypass
DSA-1719 gnutls13 Certificate validation
DSA-1720 typo3-src Several vulnerabilities
DSA-1721 libpam-krb5 Local privilege escalation
DSA-1722 libpam-heimdal Local privilege escalation
DSA-1723 phpmyadmin Arbitrary code execution
DSA-1724 moodle Several vulnerabilities
DSA-1726 python-crypto Denial of service
DSA-1729 gst-plugins-bad0.10 Multiple vulnerabilities
DSA-1731 ndiswrapper Arbitrary code execution vulnerability
DSA-1732 squid3 Denial of service
DSA-1733 vim Multiple vulnerabilities
DSA-1735 znc Privelege escalation
DSA-1737 wesnoth Several vulnerabilities
DSA-1738 curl Arbitrary file access
DSA-1740 yaws Denial of service
DSA-1742 libsndfile Arbitrary code execution
DSA-1743 libtk-img Arbitrary code execution
DSA-1746 gs-gpl Arbitrary code execution
DSA-1747 glib2.0 Arbitrary code execution
DSA-1750 libpng Several vulnerabilities
DSA-1759 strongswan Denial of service
DSA-1760 openswan Denial of service

A complete list of all accepted and rejected packages together with
rationale is on the preparation page for this revision:

<http://release.debian.org/oldstable/4.0/4.0r8/>

URLs
—-

The complete lists of packages that have changed with this revision:

<http://ftp.debian.org/debian/dists/etch/ChangeLog>

The current oldstable distribution:

<http://ftp.debian.org/debian/dists/oldstable>

Proposed updates to the stable distribution:

<http://ftp.debian.org/debian/dists/oldstable-proposed-updates>

oldstable distribution information (release notes, errata etc.):

<http://www.debian.org/releases/oldstable/>

Security announcements and information:

http://www.debian.org/security/

About Debian
————

The Debian Project is an association of Free Software developers who
volunteer their time and effort in order to produce the completely free
operating systems Debian GNU/Linux.

Well, So apparently people are up in arms about the contest entrants for the Linux Foundation contest to produce a TV advert for Linux.

Zdnet even have an article on how FAIL some of the entries are. Whilst appealing to Linux users, they dont explain what Linux is in any way, They just go on to to emphisize the geekyness and cliqueness of us all.

Perhaps the problem could be related to the fact that not all Linux users can do video editing? I could probably come up with a better idea but not likely to be able to film and make it to well.

Perhaps this have been done perhaps by larger groups of Linux users and Filmographers alike so we get the best of both worlds? Even get a couple of Marketing gurus in would be a nice touch. Those IBM adverts we had a few years ago used to be excellent for Linux.

Found at http://wiki.debian.org/Debian_GNU/kFreeBSD_why

Here are the reasons why we think Debian GNU/kFreeBSD could be preferred to other systems such as FreeBSD and Debian GNU/Linux.

They’re not absolute truths, nor do we expect everyone to agree with them. So please don’t engage in an endless discussion trying to convince someone that Debian GNU/kFreeBSD is the best. That kind of things do us more harm than good.

Why would you prefer Debian GNU/kFreeBSD to Debian GNU/Linux?

• Cleaner or more standard kernel interfaces:
  • Single /dev implementation via devfs, instead of the 3 discordant ways of handling /dev that Linux provides.
  • OSS as the default sound system (i.e. the standard interface supported by almost every Unix-like system around).
  • OpenBSD Packet Filter (pf).

• Other nice security features, like jails.

• Support for NDIS drivers in the mainline kernel. On Linux, NdisWrapper is unlikely to make it into the mainline kernel.

• Possible support for ZFS in the mainline kernel. Due to license and patent issues, ZFS is unlikely to appear on Linux.
• kFreeBSD offers an alternative in case Linux is branded illegal by the SCO case or other threats. In legal terms, Linux sources are like a minefield. kFreeBSD is much less vulnerable to such attacks because of its less bazaar-like development model.

• kFreeBSD developers often have more interest in merging new features rather than spawning forks all along (the port to Xbox is a very good example. See the responses from Linus Torvalds and kFreeBSD developers).

• Some people say that kFreeBSD has better performance and/or stability (especially in disk/filesystem areas).
• The FreeBSD kernel might support some hardware which Linux does not support and/or the FreeBSD kernel support might be better (less bugs).

Why would you prefer Debian GNU/kFreeBSD to FreeBSD?

• If you like the Debian package system (or its package set) more than FreeBSD ports (just a matter of preference).
• If you like GNU userland more than BSDish one (again, just a matter of preference).
• If you don’t have anything against GPL or other copylefted free software licenses, you’ll appreciate that useful kernel modules like ext2fs driver, the upcoming reiserfs and xfs, or the upcoming ethernet driver for Xbox are (or will be) compiled in on the default kernel.
• If you’re concerned about running a 100% free system, our commitment to the Debian Free Software Guidelines (DFSG) guarantees that Debian GNU/kFreeBSD doesn’t contain any non-free software. In fact, we have removed some non-free binary-only drivers that are contained in the upstream FreeBSD tree, like the ath driver.

Now I found this very interesing myself as I have used both systems and liked them both. I found debian to be better in respects for configureability via apt, and FreeBSD was equally good with its ports, though time consuming compiling somewhat. FBSD generally i found handled higher loads on production servers better, though to be fair that would be a HUGE serverload and for the most part Linux would do fine.

So if this happens, I would definately be one counted in having a nosey and giving it a go. However I do wonder if it would take off enough, and have enough support behind it to keep it going (and anyone whos in sysadmin hates trying to upgrade something no longer supported!)