Twitter (FxNxRl)
Ads / Sponsors
Google Search
More Content
Site Rank
Powered by
My FOSS Work
Groups, etc.
Assisted Suicide: YouTube Helps Music Goliaths Become Irrelevant
Thursday, January 15. 2009
A few days ago, YouTube began muting the audio tracks of videos that contained "unauthorized" copyright material. Some videos will now have the notice “This video contains an audio track that has not been authorized by all copyright holders. The audio has been disabled.” displayed beneath them.
This is a good move for YouTube. It will help absolve them from any liability for "broadcasting" content that the RIAA cabal deems worthy of protection.
It's not such a good move for the RIAA and similar groups. A music track is an essential part of many videos, and we can be pretty sure that not many people who produce them are going to go to the trouble of obtaining copyright clearance. Instead, they're going to seek unencumbered music. This is going to drive up the demand for "open" music, which will in turn cause more musicians to provide the same in exchange for some small promotional credit on the video.
Thus a win-win is born. Video creators will have access to more music they can use, musicians will have a showcase for their work with a potential for global profile that would otherwise be difficult to obtain. How long will it be before this exposure results in a musician who "makes it" in the mainstream? It will only be a matter of time.
How will these musicians feel when a big label comes along to offer them a contract that pays a fraction of the revenue they actually generate while insisting that they turn their backs on their roots by joining the copyright cartel? Some will buy in to the promises and sign up, but some won't. Instead they'll seek new methods and revenue models for distributing their work. Perhaps they will make the bulk of their money from live performance, or maybe they'll find other ways to do it, but they will eventually succeed at it.
Once a successful formula has been found, those who seek to maximize revenue by controlling distribution will have lost the final step in their battle. They will have successfully spawned a revitalized industry that makes them irrelevant. This has always been inevitable, but YouTube's move will certainly accelerate the process. To me it is amazing how, blind to reality, this industry continues to find ways to kill itself off with ever greater efficiency.
Kudos to YouTube; still yet another dunce cap to the established music distribution business.
This is a good move for YouTube. It will help absolve them from any liability for "broadcasting" content that the RIAA cabal deems worthy of protection.
It's not such a good move for the RIAA and similar groups. A music track is an essential part of many videos, and we can be pretty sure that not many people who produce them are going to go to the trouble of obtaining copyright clearance. Instead, they're going to seek unencumbered music. This is going to drive up the demand for "open" music, which will in turn cause more musicians to provide the same in exchange for some small promotional credit on the video.
Thus a win-win is born. Video creators will have access to more music they can use, musicians will have a showcase for their work with a potential for global profile that would otherwise be difficult to obtain. How long will it be before this exposure results in a musician who "makes it" in the mainstream? It will only be a matter of time.
How will these musicians feel when a big label comes along to offer them a contract that pays a fraction of the revenue they actually generate while insisting that they turn their backs on their roots by joining the copyright cartel? Some will buy in to the promises and sign up, but some won't. Instead they'll seek new methods and revenue models for distributing their work. Perhaps they will make the bulk of their money from live performance, or maybe they'll find other ways to do it, but they will eventually succeed at it.
Once a successful formula has been found, those who seek to maximize revenue by controlling distribution will have lost the final step in their battle. They will have successfully spawned a revitalized industry that makes them irrelevant. This has always been inevitable, but YouTube's move will certainly accelerate the process. To me it is amazing how, blind to reality, this industry continues to find ways to kill itself off with ever greater efficiency.
Kudos to YouTube; still yet another dunce cap to the established music distribution business.
On the Enforcability of the GPL
Friday, January 2. 2009
A comment from my last post asked me to back up the claim that settlements have lent weight to the validity of the GPL. I got some feedback from a friend and did a little research of my own and here's a summary of the stuff that's easy to find.
The developers of Busybox have been busy indeed:
March 6, 2008 BusyBox Developers and High-Gain Antennas Agree to Dismiss GPL Lawsuit
March 17, 2008 BusyBox Developers Agree To End GPL Lawsuit Against Verizon
July 23, 2008 BusyBox Developers and Supermicro Agree to End GPL Lawsuit
October 6, 2008 BusyBox Developers Settle Case With Extreme Networks
The GPL Linux Kernel has been defended in a European court verdict.
Many other successful settlements in favour of the GPL are available at gpl-violations.org.
Groklaw's article "A GPL Win in Michigan" discusses how the US courts have found the GPL enforceable.
Sun Microsystems gets the GPL, even if it doesn't suit them. in a CNET article from 2005, Jonathan Schwartz is quoted as not liking the GPL because of "the GPL provision that says source code may be mixed with other code only if the other code also is governed by the GPL". Sun's rather formidable legal team gets it: you can't mix non-GPL code with GPL code and still comply with the GPL.
This is just the beginning. The SFLC has launched a suit against Cisco on behalf of the FSF. SCO descends further into bad joke status by attacking the GPL, with IBM on the other side. Any bets on who will take that one?
On the flip side, there's nothing I could find where a challenge to the GPL was successful.
The developers of Busybox have been busy indeed:
March 6, 2008 BusyBox Developers and High-Gain Antennas Agree to Dismiss GPL Lawsuit
March 17, 2008 BusyBox Developers Agree To End GPL Lawsuit Against Verizon
July 23, 2008 BusyBox Developers and Supermicro Agree to End GPL Lawsuit
October 6, 2008 BusyBox Developers Settle Case With Extreme Networks
The GPL Linux Kernel has been defended in a European court verdict.
Many other successful settlements in favour of the GPL are available at gpl-violations.org.
Groklaw's article "A GPL Win in Michigan" discusses how the US courts have found the GPL enforceable.
Sun Microsystems gets the GPL, even if it doesn't suit them. in a CNET article from 2005, Jonathan Schwartz is quoted as not liking the GPL because of "the GPL provision that says source code may be mixed with other code only if the other code also is governed by the GPL". Sun's rather formidable legal team gets it: you can't mix non-GPL code with GPL code and still comply with the GPL.
This is just the beginning. The SFLC has launched a suit against Cisco on behalf of the FSF. SCO descends further into bad joke status by attacking the GPL, with IBM on the other side. Any bets on who will take that one?
On the flip side, there's nothing I could find where a challenge to the GPL was successful.
Posted by Alan Langford (developer blog)
in It's a Code, Code World
at
15:49
| Comments (0)
| Trackbacks (0)
More Controversy: the Joomla Extensions Directory (JED) and the GPL
Thursday, January 1. 2009
Back in June of 2007, the Joomla project generated a community firestorm by announcing that, based on legal opinion, it felt that all Joomla extensions were required to be released under the GPL and that it would start to encourage third party developers to comply with that interpretation.
Detractors tried to paint this as some sort of policy decision. Somehow they never quite grasped what was being said, so I think it bears being repeated. Open Source Matters, Inc. (OSM), the non-profit charged with protecting the interests of the project, sought and obtained an opinion from legal experts well qualified in this area. Their opinion was specific, clear, and — this is critically important — while not based on precedent set by court decision, was based on several lawsuits that were settled just before going to court.
This needs some elaboration to make it as clear as possible: businesses who thought that this interpretation of the GPL was wrong, and who distributed proprietary attachments to GPL products, backed down when faced with going to trial. In my opinion, the only reason why a commercial enterprise would elect to settle a case of this nature just before going to trial is because they knew that they were likely to lose. When several suits get settled this way, all in favour of the GPL, they begin to carry significant legal weight.
So OSM had two choices: communicate the requirement that extensions be GPL or adopt another license. Considering that Joomla formed as a direct result of the actions individuals who believed in the GPL, there was really only one alternative.
Free Software — as defined by the GPL — may embrace open source, but it is not the same as open source. It is designed to give users rights and freedoms that go well beyond access to the code. For developers the interpretation is simple: get on board or use code that has a different license, period.
At the time of the GPL announcement, I had decided that Joomla was the best CMS for my web development business. I had just begun to get involved with the project, and had at best contributed a patch or two. As a small business, source code is our biggest asset and I will admit I had some concerns about giving up the ability to protect that asset. But at the same time I am not so hypocritical that I think somehow we have the right to protect our code, while using hundreds of thousands of lines of code written by others without compensation.
A few days ago, the project announced that the Joomla Extensions Directory was only going to list extensions released under the GPL (JED to be GPL Only by July 2009). Predictably, this has created another round of controversy.
The difference here is that while the original position was based on legal opinion, this decision is more one of policy. The project is choosing to not promote extensions that violate the terms of the GPL.
When the first announcement was made, my Joomla involvement had just begun. Now, I'm one of the more active members of the project and part of the Development Team. While not part of the Core Team or OSM Board, which are the bodies responsible for the governance of the project, I have made some significant contributions. Every time someone downloads and installs Joomla, they benefit in some small part from my work.
It is in this context that I'm going to respond to several reactions to the JED announcement:
From my viewpoint, a great part of Joomla's success has been as a direct result of its commitment to empower the end user via the GPL. Moreover, the principles of the GPL have attracted much of the talent that the project currently has. I see companies that don't embrace these values but who continue to earn a living thanks to the project as nothing more than parasites. I'm certain that once the leeches have been pried from the JED, it will grow more quickly and become more vibrant than ever before. Time will tell.
Detractors tried to paint this as some sort of policy decision. Somehow they never quite grasped what was being said, so I think it bears being repeated. Open Source Matters, Inc. (OSM), the non-profit charged with protecting the interests of the project, sought and obtained an opinion from legal experts well qualified in this area. Their opinion was specific, clear, and — this is critically important — while not based on precedent set by court decision, was based on several lawsuits that were settled just before going to court.
This needs some elaboration to make it as clear as possible: businesses who thought that this interpretation of the GPL was wrong, and who distributed proprietary attachments to GPL products, backed down when faced with going to trial. In my opinion, the only reason why a commercial enterprise would elect to settle a case of this nature just before going to trial is because they knew that they were likely to lose. When several suits get settled this way, all in favour of the GPL, they begin to carry significant legal weight.
So OSM had two choices: communicate the requirement that extensions be GPL or adopt another license. Considering that Joomla formed as a direct result of the actions individuals who believed in the GPL, there was really only one alternative.
Free Software — as defined by the GPL — may embrace open source, but it is not the same as open source. It is designed to give users rights and freedoms that go well beyond access to the code. For developers the interpretation is simple: get on board or use code that has a different license, period.
At the time of the GPL announcement, I had decided that Joomla was the best CMS for my web development business. I had just begun to get involved with the project, and had at best contributed a patch or two. As a small business, source code is our biggest asset and I will admit I had some concerns about giving up the ability to protect that asset. But at the same time I am not so hypocritical that I think somehow we have the right to protect our code, while using hundreds of thousands of lines of code written by others without compensation.
A few days ago, the project announced that the Joomla Extensions Directory was only going to list extensions released under the GPL (JED to be GPL Only by July 2009). Predictably, this has created another round of controversy.
The difference here is that while the original position was based on legal opinion, this decision is more one of policy. The project is choosing to not promote extensions that violate the terms of the GPL.
When the first announcement was made, my Joomla involvement had just begun. Now, I'm one of the more active members of the project and part of the Development Team. While not part of the Core Team or OSM Board, which are the bodies responsible for the governance of the project, I have made some significant contributions. Every time someone downloads and installs Joomla, they benefit in some small part from my work.
It is in this context that I'm going to respond to several reactions to the JED announcement:
| Reaction | Response |
|---|---|
| Joomla needs commercial extensions in order to survive and gain acceptance from business customers. |
|
| I can't make money if my extension is GPL. |
|
| Policy makers in the Joomla project are out-of-touch idiots and something should be done! |
|
| Someone will fork my code and release a better version three weeks later. |
|
From my viewpoint, a great part of Joomla's success has been as a direct result of its commitment to empower the end user via the GPL. Moreover, the principles of the GPL have attracted much of the talent that the project currently has. I see companies that don't embrace these values but who continue to earn a living thanks to the project as nothing more than parasites. I'm certain that once the leeches have been pried from the JED, it will grow more quickly and become more vibrant than ever before. Time will tell.
Posted by Alan Langford (developer blog)
in It's a Code, Code World
at
13:49
| Comments (13)
| Trackbacks (0)
Simplifying Joomla Template Layouts
Tuesday, December 23. 2008
Since the early days of Joomla 1.5, component layouts have bothered me. First there's the problematic nomenclature (which I'm probably using incorrectly). Layouts are component-specific snippets of HTML and PHP logic that generate the actual code (usually HTML) that goes to the target device. A template can override the default layout, which is just one of the many powerful features that give Joomla sites so much flexibility.
My biggest problem with layouts is that they typically embed too much logic. Why should a layout be determining what to do if a category description isn't present? Worse yet, why does it have to check access to see if an article body should be displayed or not? Surely the actual view should be responsible for this sort of thing, and the layout should be strictly concerned with how to present the information that's available.
The other problem is that layouts are ugly beasts. Most layouts need to flip between HTML and PHP dozens of times, just to do the most simple thing.
I'm not exactly a patient person. Maintaining the existing layout code in the Joomla core components is bothersome enough, but recently I started doing extensive work on a third party component, adding my own view in the process. That's when that familiar snapping sound resonated in my head. Always a sucker for diversions, I decided to follow the tangent and see if I could improve Joomla layouts.
It took about triple the expected effort, largely because the initial results were pretty exciting, and I decided to do more than a hack job. The result is JTML, and the results are described in the white paper Simplifying Joomla Template Layouts.
Every once in a while, the idea of creating a simple language for creating Joomla extensions comes up, but that is a very big job indeed, and there are many, many other things to do in the project. So it remains a bit of a dream. I'm hoping JTML is one small step in that direction.
My biggest problem with layouts is that they typically embed too much logic. Why should a layout be determining what to do if a category description isn't present? Worse yet, why does it have to check access to see if an article body should be displayed or not? Surely the actual view should be responsible for this sort of thing, and the layout should be strictly concerned with how to present the information that's available.
The other problem is that layouts are ugly beasts. Most layouts need to flip between HTML and PHP dozens of times, just to do the most simple thing.
I'm not exactly a patient person. Maintaining the existing layout code in the Joomla core components is bothersome enough, but recently I started doing extensive work on a third party component, adding my own view in the process. That's when that familiar snapping sound resonated in my head. Always a sucker for diversions, I decided to follow the tangent and see if I could improve Joomla layouts.
It took about triple the expected effort, largely because the initial results were pretty exciting, and I decided to do more than a hack job. The result is JTML, and the results are described in the white paper Simplifying Joomla Template Layouts.
Every once in a while, the idea of creating a simple language for creating Joomla extensions comes up, but that is a very big job indeed, and there are many, many other things to do in the project. So it remains a bit of a dream. I'm hoping JTML is one small step in that direction.
Posted by Alan Langford (developer blog)
in It's a Code, Code World, Open Source Software
at
17:40
| Comments (0)
| Trackbacks (0)
How to: Ubuntu PHP Remove Suhosin
Wednesday, December 10. 2008
One of my projects for the "holidays" is moving one of my servers from Gentoo to Ubuntu. During planning for this, I noticed that the Ubuntu version of PHP5 includes Suhosin. That's a problem.
The problem with Suhosin is that it's designed to stop sloppy applications from doing bad things. I'm sure it does a reasonable job of that, but in the process it can interfere with good applications (see examples for Joomla). Since I'm in the business of writing good applications, Suhosin is a bad idea. Worse yet, it can provide a false sense of security, since it can't deal with anything except typical PHP errors. As far as I'm concerned, this class of "security blanket" provides false comfort and is no replacement for auditing and testing.
The problem with Suhosin is that it's designed to stop sloppy applications from doing bad things. I'm sure it does a reasonable job of that, but in the process it can interfere with good applications (see examples for Joomla). Since I'm in the business of writing good applications, Suhosin is a bad idea. Worse yet, it can provide a false sense of security, since it can't deal with anything except typical PHP errors. As far as I'm concerned, this class of "security blanket" provides false comfort and is no replacement for auditing and testing.
Continue reading "How to: Ubuntu PHP Remove Suhosin"
Posted by Alan Langford (developer blog)
in It's a Code, Code World
at
07:54
| Comments (9)
| Trackbacks (0)
TD Bank Tries an End Run Around Site Tracking Blockers
Friday, November 21. 2008
I'm well aware of the value of site analytics. Most of my sites make extensive use of them. But at the same time I'm aware of a user's absolute right to not be tracked, be it anonymous or not. When it comes to my personal information, I'm usually happy to let most sites drop in a statistical tracking cookie, but I almost always set the lifetime of those cookies to "session only".
Basically, I'm happy to let someone know how I navigate their site, because that information is likely to result in improved usability. What I don't like is disclosing how many times I visit a site over a period of time, and what my multi-visit user patterns are like.
With browsers like Firefox and now even Internet Explorer providing easy tools to manage cookie acceptance and lifetime, more and more users who don't want to be tracked are limiting cookies. This is giving marketers a more challenging time and skewing their statistics. Poor babies.
Some marketers are fighting back. What's not commonly known is that Adobe's Flash Player lets sites store cookie-like information as well. Now Adobe hasn't quite caught up with the concept of individual liberties, so the default configuration of the Flash Player is to allow local storage without any explicit user permission. Adobe pretty much has a monopoly when it come to this sort of thing, so there's little incentive for them to change.
So now marketers who claim to seek to improve customer service have a method where they can gather data even if their customers have taken explicit steps to prevent it. News Flash: That is NOT good customer service! It's really rather offensive customer abuse.
Some time in the past few months, TD Bank decided to join the ranks of companies who have elected to bypass their customer's wishes. I recently connected to my online banking site, and got asked for permission to allocate local storage to an invisible bit of Flash. So I cranked open the page and found this link: https://easyweb46w.tdcanadatrust.com/dojo111/dojox/storage/Storage.swf?baseUrl=/dojo111/dojo/. At least its name reflects its purpose.
Anyone familiar with the big Canadian banks has become accustomed to dealing with these arrogant behemoths, protected from significant international competition by legislation, and reading from some version of a dictionary where the meaning of "service" is very different from the commonly accepted definition. Really the only surprising thing is that they haven't found a way to charge me 25 cents per byte of information that they want to store on my computer.
But you don't have to be subject to corporate whims. These things are configurable. Don't go looking through your browser, plugins or program settings for the control panel, though. Follow this link to your Flash Player control panel. This looks like a screen shot of what a control panel might look like, but don't be confused: it's a live presentation of your current settings. Click on the second tab, "Global Storage Settings". There's a reasonably good explanation of the settings below the panel, but if you move the slider to the left until it reads "None", then every site that tries to save data in flash will have to get your approval first. If you don't want to be asked, set the "Never Ask Again" check box. Then go to the last tab, "Website Storage Settings" to take a look at which sites have left tracking codes on your computer. Delete all the ones you don't trust.
Now you have control of your information again.
Basically, I'm happy to let someone know how I navigate their site, because that information is likely to result in improved usability. What I don't like is disclosing how many times I visit a site over a period of time, and what my multi-visit user patterns are like.
With browsers like Firefox and now even Internet Explorer providing easy tools to manage cookie acceptance and lifetime, more and more users who don't want to be tracked are limiting cookies. This is giving marketers a more challenging time and skewing their statistics. Poor babies.
Some marketers are fighting back. What's not commonly known is that Adobe's Flash Player lets sites store cookie-like information as well. Now Adobe hasn't quite caught up with the concept of individual liberties, so the default configuration of the Flash Player is to allow local storage without any explicit user permission. Adobe pretty much has a monopoly when it come to this sort of thing, so there's little incentive for them to change.
So now marketers who claim to seek to improve customer service have a method where they can gather data even if their customers have taken explicit steps to prevent it. News Flash: That is NOT good customer service! It's really rather offensive customer abuse.
Some time in the past few months, TD Bank decided to join the ranks of companies who have elected to bypass their customer's wishes. I recently connected to my online banking site, and got asked for permission to allocate local storage to an invisible bit of Flash. So I cranked open the page and found this link: https://easyweb46w.tdcanadatrust.com/dojo111/dojox/storage/Storage.swf?baseUrl=/dojo111/dojo/. At least its name reflects its purpose.
Anyone familiar with the big Canadian banks has become accustomed to dealing with these arrogant behemoths, protected from significant international competition by legislation, and reading from some version of a dictionary where the meaning of "service" is very different from the commonly accepted definition. Really the only surprising thing is that they haven't found a way to charge me 25 cents per byte of information that they want to store on my computer.
But you don't have to be subject to corporate whims. These things are configurable. Don't go looking through your browser, plugins or program settings for the control panel, though. Follow this link to your Flash Player control panel. This looks like a screen shot of what a control panel might look like, but don't be confused: it's a live presentation of your current settings. Click on the second tab, "Global Storage Settings". There's a reasonably good explanation of the settings below the panel, but if you move the slider to the left until it reads "None", then every site that tries to save data in flash will have to get your approval first. If you don't want to be asked, set the "Never Ask Again" check box. Then go to the last tab, "Website Storage Settings" to take a look at which sites have left tracking codes on your computer. Delete all the ones you don't trust.
Now you have control of your information again.
Joomla 1.5.8 is... is what??
Tuesday, November 11. 2008
Shortly after the release of "Joomla!" 1.5.8, I found myself in this release announcement on techcebu.net. It appears to be a bad case of double-translation, from English to Italian (or perhaps Hebrew) and back to English again. The text was just too hilarious to not repost.
11Nov JOOMLA 1.5.8 RELEASED
Joomla 1.5.8 Released
The Joomla Project is entertained to foretell the unmediated availability of Joomla 1.5.8 [Wohnaiki]. This promulgation contains a sort of fault fixes and digit moderate-level section fixes. It has been around digit months since Joomla 1.5.7 was liberated on Sept 9, 2008. The Development Working Group’s content is to move to wage regular, regular updates to the Joomla community.
Download
Click here to download Joomla 1.5.8 (Full package) »
Click here to encounter an update package. »
Instructions
New installation and technical requirements
Upgrade from an existing Joomla 1.5 version
Migration from Joomla! 1.0.x
Want to effort intend Joomla? Try the online demo. Documentation is acquirable for beginners.
Release Notes
Check the Joomla 1.5.8 Post-Release Notes to wager if there are essential items and adjuvant hints unconcealed after the release.
View instance release notes for Joomla 1.5.7 or release notes for Joomla 1.5.6.
Security
Two moderate-level section issues were immobile in this release:
o Default filtering for content
o Filtering for Web Link descriptions
For additional information, visit the Joomla Security Center.
Components
Articles: Remove brackets around Last Updated fellow and time, Start Publishing fellow corrections for another than UT1 00:00, impact counts precise for Articles, adding a expanse after a draped telecommunicate address
E-mail addresses: Correctly draped when presented in Section and Category descriptions
Categories: Edit picture aright shows for Articles without Title links, Print picture precise today on prototypal tender for Blog Layout
Sections: Plural and signifier modify correction, Category unification right ended, Router changes reverted to edition 1.5.6 so Article ID does not attach to the Article slug
Frontpage: Article naming correction, rectified sort of Links
Contacts: Image pass rebuke when Image Directory is configured
RSS Feed: Corrected spelling of Category in Category feed
User: Added isInternal checking on referer values
Weblinks: Language strings
Modules
Feed: Target concept validation, module progress correction
Login: ItemID is cured on redirect
Menu: Changing Menu Link Type today functions properly, Section Language string, Article Reset fix working
Related Items: Keyword matched functions aright and filters characters appropriately
Stats: Corrected Time
Sections: No dominance constant entireness correctly
Search: Form validates aright for Transitional xHTML
Legacy
Return evidence additional for Legacy Menu Check
Templates
Beez: Lengthened E-mail Content Popup, Search fix today entireness when pressed, countersign set entireness correctly, corrections to Beez HTML folders, User info tender corrected
JA_Purity: Added absent module strings
Administrator
Console: Added “Welcome to Joomla!” aggregation and Joomla Security RSS feeds to Administrator Console
Installation: Proper redaction of factor directories, choice entries for Templates and Languages are today precise for uninstall
Media Manager: Changed choice for newborn sites to alter Flash multi-file uploader cod to contradictoriness with Flash 10
Installation: Remove unclear nonachievement communication most module files for spreading installations, Administrator Modules today aright uninstall INI files
Sample data: Updated programme feeds to saucer to liberated code accord sites, comprehensive corrections and updates to distribution content
System
API: JFolder::files and JFolder::folders corrections for Search, absent Method additional to JRecordSet, Database Class aright quotes obloquy not using extend notation, JTableUser matches using the precise sort of fields
Cache: Correct undefinable uncertain in Cache Class
Language file: Corrected wording, precise artefact of PDF fonts autarkical of module choices, individual module progress corrections in en-GB.ini
Menu: Performance improvements for sites with some schedule items
Users: Temporary Users are today healthy to logout, bonded prescript crapper today be utilised when redaction statement details
Added PHP 4 sympathy for isInternal checking
Statistics
Statistics for the 1.5.8 promulgation period:
Joomla 1.5.8 contains:
o 71 issues immobile in SVN
o 26 commits
Tracker state resulted in a gain modification of 4 astir issues:
o 65 newborn reports
o 130 closed
o 66 immobile in SVN
* At the instance the 1.5.8 promulgation was packaged, the tracker had 114 astir issues:
o 44 open
o 44 confirmed
o 24 pending
Joomla! Bug Squad
Thanks to the Joomla Bug Squad for their sacred efforts work reports, sterilisation problems, and applying patches to Joomla. If you encounter a fault with Joomla, find discover more aggregation here on how to inform the bug.
Active members of the Joomla Bug Squad during this terminal promulgation wheel include: Ian MacLennan and Mark Dexter co-leads; Airton Torres, river Zijlstra, Akarawuth Tamrareang, Alan Langford, suffragist Ferrara, Amy Stephen, saint Eddie, Elin Waring, Ercan Ozkaya, Charl camper Niekerk, Gergo Erdosi, Hannes Papenberg, Jennifer Marriott, Jens-Christian Skibakk, Jonah Braun, carpenter LeBlanc, Kevin Devine, Marijke Stuivenberg, Mati Kochen, Mickael Maison, Robin Muilwijk, prophet Moffatt, Shantanu Bala, Toby Patterson, and Wilco Jansen.
A hearty recognize to the newest members of the Joomla Bug Squad: Dan Walker, Eduardo Diaz, and Tibor Toth.
11Nov JOOMLA 1.5.8 RELEASED
Joomla 1.5.8 Released
The Joomla Project is entertained to foretell the unmediated availability of Joomla 1.5.8 [Wohnaiki]. This promulgation contains a sort of fault fixes and digit moderate-level section fixes. It has been around digit months since Joomla 1.5.7 was liberated on Sept 9, 2008. The Development Working Group’s content is to move to wage regular, regular updates to the Joomla community.
Download
Click here to download Joomla 1.5.8 (Full package) »
Click here to encounter an update package. »
Instructions
New installation and technical requirements
Upgrade from an existing Joomla 1.5 version
Migration from Joomla! 1.0.x
Want to effort intend Joomla? Try the online demo. Documentation is acquirable for beginners.
Release Notes
Check the Joomla 1.5.8 Post-Release Notes to wager if there are essential items and adjuvant hints unconcealed after the release.
View instance release notes for Joomla 1.5.7 or release notes for Joomla 1.5.6.
Security
Two moderate-level section issues were immobile in this release:
o Default filtering for content
o Filtering for Web Link descriptions
For additional information, visit the Joomla Security Center.
Components
Articles: Remove brackets around Last Updated fellow and time, Start Publishing fellow corrections for another than UT1 00:00, impact counts precise for Articles, adding a expanse after a draped telecommunicate address
E-mail addresses: Correctly draped when presented in Section and Category descriptions
Categories: Edit picture aright shows for Articles without Title links, Print picture precise today on prototypal tender for Blog Layout
Sections: Plural and signifier modify correction, Category unification right ended, Router changes reverted to edition 1.5.6 so Article ID does not attach to the Article slug
Frontpage: Article naming correction, rectified sort of Links
Contacts: Image pass rebuke when Image Directory is configured
RSS Feed: Corrected spelling of Category in Category feed
User: Added isInternal checking on referer values
Weblinks: Language strings
Modules
Feed: Target concept validation, module progress correction
Login: ItemID is cured on redirect
Menu: Changing Menu Link Type today functions properly, Section Language string, Article Reset fix working
Related Items: Keyword matched functions aright and filters characters appropriately
Stats: Corrected Time
Sections: No dominance constant entireness correctly
Search: Form validates aright for Transitional xHTML
Legacy
Return evidence additional for Legacy Menu Check
Templates
Beez: Lengthened E-mail Content Popup, Search fix today entireness when pressed, countersign set entireness correctly, corrections to Beez HTML folders, User info tender corrected
JA_Purity: Added absent module strings
Administrator
Console: Added “Welcome to Joomla!” aggregation and Joomla Security RSS feeds to Administrator Console
Installation: Proper redaction of factor directories, choice entries for Templates and Languages are today precise for uninstall
Media Manager: Changed choice for newborn sites to alter Flash multi-file uploader cod to contradictoriness with Flash 10
Installation: Remove unclear nonachievement communication most module files for spreading installations, Administrator Modules today aright uninstall INI files
Sample data: Updated programme feeds to saucer to liberated code accord sites, comprehensive corrections and updates to distribution content
System
API: JFolder::files and JFolder::folders corrections for Search, absent Method additional to JRecordSet, Database Class aright quotes obloquy not using extend notation, JTableUser matches using the precise sort of fields
Cache: Correct undefinable uncertain in Cache Class
Language file: Corrected wording, precise artefact of PDF fonts autarkical of module choices, individual module progress corrections in en-GB.ini
Menu: Performance improvements for sites with some schedule items
Users: Temporary Users are today healthy to logout, bonded prescript crapper today be utilised when redaction statement details
Added PHP 4 sympathy for isInternal checking
Statistics
Statistics for the 1.5.8 promulgation period:
Joomla 1.5.8 contains:
o 71 issues immobile in SVN
o 26 commits
Tracker state resulted in a gain modification of 4 astir issues:
o 65 newborn reports
o 130 closed
o 66 immobile in SVN
* At the instance the 1.5.8 promulgation was packaged, the tracker had 114 astir issues:
o 44 open
o 44 confirmed
o 24 pending
Joomla! Bug Squad
Thanks to the Joomla Bug Squad for their sacred efforts work reports, sterilisation problems, and applying patches to Joomla. If you encounter a fault with Joomla, find discover more aggregation here on how to inform the bug.
Active members of the Joomla Bug Squad during this terminal promulgation wheel include: Ian MacLennan and Mark Dexter co-leads; Airton Torres, river Zijlstra, Akarawuth Tamrareang, Alan Langford, suffragist Ferrara, Amy Stephen, saint Eddie, Elin Waring, Ercan Ozkaya, Charl camper Niekerk, Gergo Erdosi, Hannes Papenberg, Jennifer Marriott, Jens-Christian Skibakk, Jonah Braun, carpenter LeBlanc, Kevin Devine, Marijke Stuivenberg, Mati Kochen, Mickael Maison, Robin Muilwijk, prophet Moffatt, Shantanu Bala, Toby Patterson, and Wilco Jansen.
A hearty recognize to the newest members of the Joomla Bug Squad: Dan Walker, Eduardo Diaz, and Tibor Toth.
Posted by Alan Langford (developer blog)
in It's a Code, Code World
at
08:06
| Comments (0)
| Trackbacks (0)
"IBM May Quit Technology Standards Bodies" WSJ Screams
Monday, October 6. 2008
Some days I wonder about the entire field of journalism. The quoted phrase above is from an article headline in the Wall Street Journal (September 23, 2008, they don't deserve an actual link). The headline is not inaccurate, but it is close to the most ludicrously sensational interpretation of the facts that is possible.
This is what the actual IBM press release has to say on the point: "The tenets of IBM's new policy are to: Begin or end participation in standards bodies based on the quality and openness of their processes, membership rules, and intellectual property policies."
Thus an equally useless headline might be "IBM May Join Technology Standards Bodies." I thought Journalism was supposed to add value for the reader, but it seems that even for otherwise reputable organizations, it's really all about sensational headlines that add value to the advertising department. "Reputable" in this context is now officially meaningless. Sad.
I've noticed a lot of general criticism of standards processes over the past few weeks, and I think this release from IBM is largely responsible for firing up the discussion. For the most part, the criticism is justified. It seems that standards processes are either needlessly academic and somewhat out of touch with reality, or deeply buried in corporate politics and patent complications, which has a tendency to result in crappy standards. IBM's policy release sort of touches on this with another tenet: "Collaborate with standards bodies and developer communities to ensure that open software interoperability standards are freely available and implementable." The problem with this is that IBM seems to want to set itself up as some benign intermediary between the standards process and the people who need to use the standards. Call me silly, but it seems more appropriate that the developer communities should be an integral part of the standards process, not some second-hand "collaborative resource".
The essence of the problem is funding. Participation in the standards process isn't cheap. Not only does membership cost, but participants typically absorb the costs of time, travel, and communications. Standards bodies need a funding model that ensures accessibility based on merit and relevance, rather than dollars. I don't know what that model is, but is can't be based on revenue from selling standards documents, either. The prospect of having to pay real money in order to ensure compliance with a standard is, in most cases, equally ridiculous and stupid.
This is what the actual IBM press release has to say on the point: "The tenets of IBM's new policy are to: Begin or end participation in standards bodies based on the quality and openness of their processes, membership rules, and intellectual property policies."
Thus an equally useless headline might be "IBM May Join Technology Standards Bodies." I thought Journalism was supposed to add value for the reader, but it seems that even for otherwise reputable organizations, it's really all about sensational headlines that add value to the advertising department. "Reputable" in this context is now officially meaningless. Sad.
I've noticed a lot of general criticism of standards processes over the past few weeks, and I think this release from IBM is largely responsible for firing up the discussion. For the most part, the criticism is justified. It seems that standards processes are either needlessly academic and somewhat out of touch with reality, or deeply buried in corporate politics and patent complications, which has a tendency to result in crappy standards. IBM's policy release sort of touches on this with another tenet: "Collaborate with standards bodies and developer communities to ensure that open software interoperability standards are freely available and implementable." The problem with this is that IBM seems to want to set itself up as some benign intermediary between the standards process and the people who need to use the standards. Call me silly, but it seems more appropriate that the developer communities should be an integral part of the standards process, not some second-hand "collaborative resource".
The essence of the problem is funding. Participation in the standards process isn't cheap. Not only does membership cost, but participants typically absorb the costs of time, travel, and communications. Standards bodies need a funding model that ensures accessibility based on merit and relevance, rather than dollars. I don't know what that model is, but is can't be based on revenue from selling standards documents, either. The prospect of having to pay real money in order to ensure compliance with a standard is, in most cases, equally ridiculous and stupid.
Posted by Alan Langford (developer blog)
in It's a Code, Code World
at
08:06
| Comments (0)
| Trackbacks (0)
The Anatomy of a Security Breach
Friday, August 15. 2008
"Joomla!" had an extremely serious security issue arise earlier in the week. I'm pretty deeply involved in the project, and I happened to be on the Bug Squad chat when the news broke. The issue was not a SQL injection problem, as many sources have assumed but reported as fact. Ironically, it had to do with defeating a session security feature. The security problem was a programming error. "Joomla!" goes through extensive procedures to defend against SQL injection, and from version 1.5 onward, such a vulnerability in the core code is highly unlikely. [Extensions are another matter. I strongly recommend that users only install open source extensions that have either been audited or that have broad community support.]
Even though this problem caused a fair bit of damage, I'm very proud of how the "Joomla!" team responded to the problem. This was a worst-case scenario: the exploit was published with no advance notification, and it was dead simple to implement.
The first we heard of it was a post on the Dutch "Joomla!" forums. One of the Bug Squad team mentioned this in chat on August 12th at 15:50 EST. We immediately took steps to verify the issue, and then once confirmed, to remove the details from the forum post. A patch was made available for testing at 16:10. A full package release was made available for testing at 18:19. Announcement of the release was made on joomla.org at 18:57, and by 19:40 update packages were also available. That's three hours and 50 minutes from report to full public release. If that's not a record I'll be surprised.
What is distressing is that a large number of security focused sites reported this as a SQL injection vulnerability, along with a variety of other erroneous or misleading information. Almost a week later, many have corrected their errors, but several have not. Considering that the "Joomla!" team responded so quickly, and that complete information was posted as the first item on the joomla.org web site before the exploit became widely known, this suggests that many of these sites simply repeated each other's misinformation, rather than taking even the smallest steps to verify the report.
Granted a sample size of one event is not sufficient to draw conclusions, but if this is any indication of how "trusted" security information sources behave, then it is no wonder that whole security field has a serious credibility issue. These kinds of reports are extremely serious matters, with a lot of potential for damage. Certainly the timeliness of information is critical, but hopefully not at the expense of accuracy. The security community has a deep obligation to perform the simplest verification of facts before rushing to publication.
Even though this problem caused a fair bit of damage, I'm very proud of how the "Joomla!" team responded to the problem. This was a worst-case scenario: the exploit was published with no advance notification, and it was dead simple to implement.
The first we heard of it was a post on the Dutch "Joomla!" forums. One of the Bug Squad team mentioned this in chat on August 12th at 15:50 EST. We immediately took steps to verify the issue, and then once confirmed, to remove the details from the forum post. A patch was made available for testing at 16:10. A full package release was made available for testing at 18:19. Announcement of the release was made on joomla.org at 18:57, and by 19:40 update packages were also available. That's three hours and 50 minutes from report to full public release. If that's not a record I'll be surprised.
What is distressing is that a large number of security focused sites reported this as a SQL injection vulnerability, along with a variety of other erroneous or misleading information. Almost a week later, many have corrected their errors, but several have not. Considering that the "Joomla!" team responded so quickly, and that complete information was posted as the first item on the joomla.org web site before the exploit became widely known, this suggests that many of these sites simply repeated each other's misinformation, rather than taking even the smallest steps to verify the report.
Granted a sample size of one event is not sufficient to draw conclusions, but if this is any indication of how "trusted" security information sources behave, then it is no wonder that whole security field has a serious credibility issue. These kinds of reports are extremely serious matters, with a lot of potential for damage. Certainly the timeliness of information is critical, but hopefully not at the expense of accuracy. The security community has a deep obligation to perform the simplest verification of facts before rushing to publication.
In Search of an Application Framework: PHP GTK Python XULRunner
Sunday, August 3. 2008
Lately I've been thinking about starting yet another project. This one needs a rich GUI that runs as a thin client, as well as more limited support for a web browser (or so I thought initially). I've gone through a bit of an eye-opening exercise while looking at the implementation, and I thought I'd record the line of exploration just in case someone else is looking at the same sort of problem. Maybe this will save a little time.
The original idea was to replace an interesting but quirky application that will remain nameless. It's a fairly large project that implements its own thin client. As I started looking at it, I realized that a lot of what it does is more related to providing the application framework than the application itself. Sometimes I still suffer from the closed-source way of thinking, and I soon began listing requirements for my own framework. A few minutes into defining my XML markup for laying out simple interfaces, I remembered that there is already a pretty good standard for that: XUL.
At the time I was thinking of using GTK+ for the GUI. I've grown somewhat fond of various GTK+ applications that I've installed over the years. These applications have offered nice rich interfaces and have been pretty reliable. A lot of them are written in Python, and the bridge between GTK+ and Python, PHP-GTK is the way to go.
The search is for something that lets me bridge XUL and GTK, be it in PHP or Python. This leads me to Gul, a fairly complete implementation of XUL for PHP-GTK.
Let's try adding the GTK to PHP. I go to the PHP-GTK site and try to figure out whether to download the binary package or the binary extensions package, read confusing and incomplete install notes, search about a bit, and as best I can tell, the easiest way to run PHP-GTK on Windows is to install a complete copy of PHP with the GTK extensions. This truly fails the cross-platform and easy-to-install tests — I can manage it, but an end user? No way. Then I take a look at Gul 2.0: lots of procedural code that relies on passing things through obscure globals with two characters. Next!
On to Python. Searches for XUL and Python lead, at best, to half-developed projects dating from 2004. Not good. Now the thinking is that maybe a fairly basic XUL module for Python won't be that much work. I look more deeply into XUL. Obviously, it's pretty capable, after all it's the base for Firefox and Thunderbird. But this makes the scope of a full implementation quite a lot bigger than I'd like.
Maybe there's something in XULRunner. Wow. It doesn't take much looking around to realize that XULRunner is pretty compelling. It's obviously got the GUI with a full XUL implementation. It's got scripting in Javascript, Python, even Java. It has network interfaces and support for XML-RPC and SOAP. It's extensible: all the features that make it easy to plug extensions into Firefox are part of XULRunner. It's got localization and custom skins. It's got an integrated web browser. That's about 90% of the core requirements and several bonuses right there.
Now the kicker: if you have Firefox 3.x installed, then you have XULRunner installed. Firefox knows how to do its own updates, which means the framework updates seamlessly too. Perfect.
So that's it. Forget GTK+, nice as it is. XULRunner is a fantastic way to do GUI application development.
Now all I need is a good way to map objects back to a relational database...
The original idea was to replace an interesting but quirky application that will remain nameless. It's a fairly large project that implements its own thin client. As I started looking at it, I realized that a lot of what it does is more related to providing the application framework than the application itself. Sometimes I still suffer from the closed-source way of thinking, and I soon began listing requirements for my own framework. A few minutes into defining my XML markup for laying out simple interfaces, I remembered that there is already a pretty good standard for that: XUL.
At the time I was thinking of using GTK+ for the GUI. I've grown somewhat fond of various GTK+ applications that I've installed over the years. These applications have offered nice rich interfaces and have been pretty reliable. A lot of them are written in Python, and the bridge between GTK+ and Python, PHP-GTK is the way to go.
The search is for something that lets me bridge XUL and GTK, be it in PHP or Python. This leads me to Gul, a fairly complete implementation of XUL for PHP-GTK.
Let's try adding the GTK to PHP. I go to the PHP-GTK site and try to figure out whether to download the binary package or the binary extensions package, read confusing and incomplete install notes, search about a bit, and as best I can tell, the easiest way to run PHP-GTK on Windows is to install a complete copy of PHP with the GTK extensions. This truly fails the cross-platform and easy-to-install tests — I can manage it, but an end user? No way. Then I take a look at Gul 2.0: lots of procedural code that relies on passing things through obscure globals with two characters. Next!
On to Python. Searches for XUL and Python lead, at best, to half-developed projects dating from 2004. Not good. Now the thinking is that maybe a fairly basic XUL module for Python won't be that much work. I look more deeply into XUL. Obviously, it's pretty capable, after all it's the base for Firefox and Thunderbird. But this makes the scope of a full implementation quite a lot bigger than I'd like.
Maybe there's something in XULRunner. Wow. It doesn't take much looking around to realize that XULRunner is pretty compelling. It's obviously got the GUI with a full XUL implementation. It's got scripting in Javascript, Python, even Java. It has network interfaces and support for XML-RPC and SOAP. It's extensible: all the features that make it easy to plug extensions into Firefox are part of XULRunner. It's got localization and custom skins. It's got an integrated web browser. That's about 90% of the core requirements and several bonuses right there.
Now the kicker: if you have Firefox 3.x installed, then you have XULRunner installed. Firefox knows how to do its own updates, which means the framework updates seamlessly too. Perfect.
So that's it. Forget GTK+, nice as it is. XULRunner is a fantastic way to do GUI application development.
Now all I need is a good way to map objects back to a relational database...
Posted by Alan Langford (developer blog)
in It's a Code, Code World
at
21:48
| Comment (1)
| Trackbacks (0)
« previous page
(Page 2 of 7, totaling 69 entries)
» next page
Competition entry by David Cummins powered by Serendipity v1.0
Net Neutrality
Canadian? Don't let the telcos dictate what your Internet connection does! Sign the petition here:
Syndicate This Blog
Categories
Geek Blog
On Development Teams
Amazing Code Repository Visualization (Joomla)
MySQL's Post-Oracle Future
On the Enforcability of the GPL
More Controversy: the Joomla Extensions Directory (JED) and the GPL
Simplifying Joomla Template Layouts
How to: Ubuntu PHP Remove Suhosin
Joomla 1.5.8 is... is what??
"IBM May Quit Technology Standards Bodies" WSJ Screams
In Search of an Application Framework: PHP GTK Python XULRunner
Amazing Code Repository Visualization (Joomla)
MySQL's Post-Oracle Future
On the Enforcability of the GPL
More Controversy: the Joomla Extensions Directory (JED) and the GPL
Simplifying Joomla Template Layouts
How to: Ubuntu PHP Remove Suhosin
Joomla 1.5.8 is... is what??
"IBM May Quit Technology Standards Bodies" WSJ Screams
In Search of an Application Framework: PHP GTK Python XULRunner
Links
- Related Sites
- Cool Free Stuff
- Cool Web/Developer Stuff
Administration
Top Exits
www.michaelgeist.ca (17)
www.ambitonline.com (14)
www.joomla.org (12)
www.google.com (8)
www.softwarefreedom.org (8)
www.theglobeandmail.com (8)
www.mozilla.org (7)
consumerist.com (6)
en.wikipedia.org (6)
www.canacweb.com (6)
www.ambitonline.com (14)
www.joomla.org (12)
www.google.com (8)
www.softwarefreedom.org (8)
www.theglobeandmail.com (8)
www.mozilla.org (7)
consumerist.com (6)
en.wikipedia.org (6)
www.canacweb.com (6)
Comment Submissions
All comments are moderated. If you submit comment spam, you consent to having your text edited to reflect extremely badly on the site you're attempting to promote. A spam comment is both consent and an explicit invitation to have your text edited to include insults, untruths, derogatory remarks, slurs, and so on. This consent applies even if a third party added the comment, whether or not you had any direct or indirect involvement with it. You also consent to having all communications related to any comment disclosed on this site and elsewhere.
Finally, should you choose to ignore this and undertake any action to have comments removed, you agree to compensate us and/or anyone we designate at the rate of US$2,500 per hour, in addition to any legal costs, be they reasonable or otherwise.
In short: spam at your expense and peril.
Finally, should you choose to ignore this and undertake any action to have comments removed, you agree to compensate us and/or anyone we designate at the rate of US$2,500 per hour, in addition to any legal costs, be they reasonable or otherwise.
In short: spam at your expense and peril.