A Denial of Service vulnerability has been found and fixed in ruby. The vulnerability is due to the BigDecimal method mishandling certain large input values and can cause the interpreter to crash. This could be used by an attacker to crash any ruby program which creates BigDecimal objects based on user input, including almost every Rails application. This vulnerability has been assigned the CVE name CVE-2009-1904.

For upgrade instructions and information on affected ruby versions please see the ruby security team’s announcement.

All users are advised to upgrade their ruby installations immediately to avoid this problem. In the event that you are unable to upgrade your ruby installation, or are using an out-of-maintenance ruby version, there is a workaround available on github. You can either install it as a gem, or simply copy the file bigdecimal-segfault-fix.rb into config/initializers of your rails application.

via Riding Rails: DoS Vulnerability in Ruby.

The growing adoption of the Linux operating system on netbook devices has compelled Linux distributors to focus on improving startup performance. Ubuntu 9.04, which was released last month, is one distribution where these improvements are particularly noticeable.

In a presentation at the Ubuntu Developer Summit in Barcelona, developer Scott James Remnant noted that boot time decreased from 65 seconds in version 8.10 to only 25 seconds in 9.04. This is already a substantial improvement, but he believes that there is still room for more aggressive optimization. Canonical, the company behind Ubuntu, will continue pushing the limits of boot performance during the upcoming development cycle for Ubuntu 9.10, which is codenamed Karmic Koala. According to Remnant, the company aims to achieve a ten-second boot time next year for Ubuntu 10.04, the release that will follow after Karmic.

via Ubuntu aims for ten-second boot time with 10.04 – Ars Technica.

• support for fully transparent use of superpages for application memory
• support for multiple IPv4 and IPv6 addresses for jails
• csup(1) now supports CVSMode to fetch a complete CVS repository
• Gnome updated to 2.26, KDE updated to 4.2.2
• sparc64 now supports UltraSparc-III processors

For a complete list of new features and known problems, please see the online release notes and errata list, available at:

• http://www.FreeBSD.org/releases/7.2R/relnotes.html

• http://www.FreeBSD.org/releases/7.2R/errata.html

For more information about FreeBSD release engineering activities, please see:

• http://www.FreeBSD.org/releng/

Availability

FreeBSD 7.2-RELEASE is now available for the amd64, i386, ia64, pc98, powerpc, and sparc64 architectures.

FreeBSD 7.2 can be installed from bootable ISO images or over the network; the required files can be downloaded via FTP or BitTorrent as described in the sections below. While some of the smaller FTP mirrors may not carry all architectures, they will all generally contain the more common ones, such as i386 and amd64.

MD5 and SHA256 hashes for the release ISO images are included at the bottom of this message.

The purpose of the ISO images provided as part of the release are as follows:

dvd1

This contains everything necessary to install the base FreeBSD operating system, a collection of pre-built packages, and the documentation. It also supports booting into a “livefs” based rescue mode. This should be all you need if you can burn and use DVD-sized media.

disc1, disc2, disc3, livefs, docs

disc1 contains the base FreeBSD operating system and a few pre-built packages. disc2 and disc3 contain more pre-built packages. Those three can be burned to CDROM sized media and should be all you need to do a normal installation. livefs contains support for booting into a “livefs” based rescue mode but does not support doing an install from the CD itself. You would need to perform a network based install. docs contains the documentation.

bootonly

This supports booting a machine using the CDROM drive but does not contain the support for installing FreeBSD from the CD itself. You would need to perform a network based install (e.g. from an FTP server) after booting from the CD.

Note: late in the testing cycle it was discovered some machines do not recognize the i386 disc1 as bootable (they just fall through to booting off the next boot device). All affected machines did see the other discs as bootable. If you have a machine with that problem booting off either bootonly or livefs and then swapping in disc1 once sysinstall starts should work.

FreeBSD 7.2-RELEASE can also be purchased on CD-ROM or DVD from several vendors. One of the vendors that will be offering FreeBSD 7.2-based products is:

• FreeBSD Mall, Inc. http://www.freebsdmall.com/

BitTorrent

7.2-RELEASE ISOs are available via BitTorrent. A collection of torrent files to download the images is available at:

• http://torrents.FreeBSD.org:8080/

FTP

At the time of this announcement the following FTP sites have FreeBSD 7.2-RELEASE available.

• ftp://ftp.FreeBSD.org/pub/FreeBSD/
• ftp://ftp1.FreeBSD.org/pub/FreeBSD/
• ftp://ftp5.FreeBSD.org/pub/FreeBSD/
• ftp://ftp10.FreeBSD.org/pub/FreeBSD/
• ftp://ftp12.FreeBSD.org/pub/FreeBSD/
• ftp://ftp13.FreeBSD.org/pub/FreeBSD/
• ftp://ftp14.FreeBSD.org/pub/FreeBSD/
• ftp://ftp.dk.FreeBSD.org/pub/FreeBSD/
• ftp://ftp.gr.FreeBSD.org/pub/FreeBSD/
• ftp://ftp.ru.FreeBSD.org/pub/FreeBSD/
• ftp://ftp1.ru.FreeBSD.org/pub/FreeBSD/
• ftp://ftp.tw.FreeBSD.org/pub/FreeBSD/
• ftp://ftp4.tw.FreeBSD.org/pub/FreeBSD/
• ftp://ftp.uk.FreeBSD.org/pub/FreeBSD/
• ftp://ftp3.us.FreeBSD.org/pub/FreeBSD/
• ftp://ftp7.us.FreeBSD.org/pub/FreeBSD/
• ftp://ftp10.us.FreeBSD.org/pub/FreeBSD/

However before trying these sites please check your regional mirror(s) first by going to:

• ftp://ftp.<yourdomain>.FreeBSD.org/pub/FreeBSD

Any additional mirror sites will be labeled ftp2, ftp3 and so on.

More information about FreeBSD mirror sites can be found at:

• http://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/mirrors-ftp.html

For instructions on installing FreeBSD, please see Chapter 2 of The FreeBSD Handbook. It provides a complete installation walk-through for users new to FreeBSD, and can be found online at:

• http://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/install.html

Updates from Source

The procedure for doing a source code based update is described in the FreeBSD Handbook:

• http://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/synching.html

• http://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/makeworld.html

The branch tag to use for updating the source is RELENG_7_2.

FreeBSD Update

The freebsd-update(8) utility supports binary upgrades of i386 and amd64 systems running earlier FreeBSD releases. Systems running 7.0-RELEASE, 7.1-RELEASE, 7.2-BETA, 7.2-RC1, or 7.2-RC2 can upgrade as follows:

# freebsd-update upgrade -r 7.2-RELEASE

During this process, FreeBSD Update may ask the user to help by merging some configuration files or by confirming that the automatically performed merging was done correctly.

# freebsd-update install

The system must be rebooted with the newly installed kernel before continuing.

# shutdown -r now

After rebooting, freebsd-update needs to be run again to install the new userland components, and the system needs to be rebooted again:

# freebsd-update install
# shutdown -r now

Users of earlier FreeBSD releases (FreeBSD 6.x) can also use freebsd-update to upgrade to FreeBSD 7.2, but will be prompted to rebuild all third-party applications (e.g., anything installed from the ports tree) after the second invocation of “freebsd-update install”, in order to handle differences in the system libraries between FreeBSD 6.x and FreeBSD 7.x.

For more information about upgrading from FreeBSD 6.x using FreeBSD Update, see:

• http://www.daemonology.net/blog/2007-11-11-freebsd-major-version-upgrade.html

Support

The FreeBSD Security Team currently plans to support FreeBSD 7.2 until May 31st, 2010. For more information on the Security Team and their support of the various FreeBSD branches see:

• http://www.FreeBSD.org/security/

Acknowledgments

Many companies donated equipment, network access, or man-hours to support the release engineering activities for FreeBSD 7.2 including The FreeBSD Foundation, Hewlett-Packard, Yahoo!, NetApp, Internet Systems Consortium, and Sentex Communications.

The release engineering team for 7.2-RELEASE includes:

Trademark

FreeBSD is a registered trademark of The FreeBSD Foundation.

via FreeBSD 7.2-RELEASE Announcement.

We are pleased to announce the immediate availability of CentOS-5.3 for the i386 and x86_64 Architectures.

CentOS-5.3 is based on the upstream release EL 5.3.0, and includes packages from all variants including Server and Client. All upstream repositories have been combined into one, to make it easier for end users to work with. And the option to further enable external repositories at install time is now available in the installer.

This is just an announcement email, not the release notes. The Release Notes for CentOS-5.3 can be found on-line at :http://wiki.centos.org/Manuals/ReleaseNotes/CentOS5.3and everyone is encouraged to look through them once. Also worth browsing through at the CentOS FAQ’s athttp://wiki.centos.org/FAQ

+++++++++++++++++++++++
ArtWork update:

CentOS-5.3 brings in a completely new artwork stack. A big thanks to Alain Reguera Delgado, Ralph Angenendt, Marcus Moeller and everyone on the Artwork SIG for bringing us the best, most comprehensive artwork set yet. Also a big thanks to all the translation teams for their contributions to the installer artwork.

+++++++++++++++++++++++
Contrib repos are back:

Given the widespread requests for user contributed packages directly being hosted within the centos repositories, the contribs repository is now back with CentOS-5.3. There are no packages yet, but over the next few weeks we hope to have a policy and process in place that allows users to submit and manage packages in the contrib repo.

+++++++++++++++++++++++
Upgrading from CentOS-5.2 ( or CentOS-5.0 / 5.1 ):

If you are already running CentOS-5.2 or an older CentOS-5 distro, all you need to do is update your machine via yum by running :

‘yum update’

Running ‘yum list updates’ before doing the update is recommended, so you can get a list of packages that are going to be updated. To check you are indeed on CentOS-5.3, run : ‘rpm -q centos-release’ and that should return: ‘centos-release-5-3.el5.centos.1′

+++++++++++++++++++++++
Upgrading from CentOS-2.1 or CentOS-3.x or CentOS-4.x:

The only recommended way to update from an earlier version of CentOS is to download and run a fresh install. In some cases, running the installer with the ‘upgradeany’ option might also achieve the desired results, however you are strongly recommended to look at the CentOS Wiki where hints and notes about potential upgrade paths from CentOS-4/3/2.1 to CentOS-5 are provided.

+++++++++++++++++++++++
Downloading CentOS-5.3 for new installs:

When possible, consider using torrents to run the downloads. Not only does it help the community and keeps mirrors from running up high bandwidth bills, in most case you will find its also the fastest means to download the distro. There are present over a thousand people already seeding CentOS-5.3 and its possible to get upto 100mbps downloads via 
these torrents.

– Via BitTorrent :
CD:
http://mirror.centos.org/centos/5.3/isos/i386/CentOS-5.3-i386-bin-1to6.torrent
http://mirror.centos.org/centos/5.3/isos/x86_64/CentOS-5.3-x86_64-bin-1to7.torrent

DVD:
http://mirror.centos.org/centos/5.3/isos/i386/CentOS-5.3-i386-bin-DVD.torrent
http://mirror.centos.org/centos/5.3/isos/x86_64/CentOS-5.3-x86_64-bin-DVD.torrent

– Via direct download:
Due to bandwidth considerations the CentOS Project does not publish ISOS directly from our network machines. However direct downloads are available from external mirrors over http, ftp and rsync, and a geoip based list is available athttp://isoredirect.centos.org/centos/5/isos/ to give you the best predictable match ( and only lists mirrors that are 
updated already, so you dont need to waste time looking for a sync’d mirror )

Some mirrors also publish DVD images that can be downloaded directly. Refer to the mirrors list page athttp://www.centos.org/mirrors for more details Mirrors that offer DVD’s are clearly marked on the page.

sha1sum for these ISOS:

i386:
4b454d76d06daa0b1772115e9b95c9465a4cecb0 CentOS-5.3-i386-bin-1of6.iso
0da3292ea1d90639714a5e7d77812568bc01ec05 CentOS-5.3-i386-bin-2of6.iso
77e867eb736b58f31cdd25c4835643ab795979e2 CentOS-5.3-i386-bin-3of6.iso
949ee93440e736c8414fb8b571178970a31e6675 CentOS-5.3-i386-bin-4of6.iso
5eafdea33c18f623bb9299ae624b8c8a12132bfa CentOS-5.3-i386-bin-5of6.iso
90ae5387a38f8ec805d877cc5525ae8dedc7f810 CentOS-5.3-i386-bin-6of6.iso
b7f85a3a493e3051e50515ef881214929c88a5f3 CentOS-5.3-i386-bin-DVD.iso
a0c640ae0c68cc0d9558cf4f8855f24671b3dadb CentOS-5.3-i386-netinstall.iso

x86_64:
7327174dc0cbb6531bc0e2f26e24788251717e91 CentOS-5.3-x86_64-bin-1of7.iso
d060ed2826a4c212eebf5e3a825ce75e77cb44e0 CentOS-5.3-x86_64-bin-2of7.iso
a0b7471ec6b742c962cc06b69624b0746025005f CentOS-5.3-x86_64-bin-3of7.iso
fe4106322d6b08344e82df8904142664a8a82522 CentOS-5.3-x86_64-bin-4of7.iso
8cb5539fa4241bc5d23798a3e2721b2ebd3b18fe CentOS-5.3-x86_64-bin-5of7.iso
8a8f32888279f701e15162dec6f52b5f5fb5effc CentOS-5.3-x86_64-bin-6of7.iso
f053b05ea8576ea7d72116fa246f914086238ca9 CentOS-5.3-x86_64-bin-7of7.iso
f8ca12b4acc714f4e4a21f3f35af083952ab46e0 CentOS-5.3-x86_64-bin-DVD.iso
e971bd1677622708348b8a65264ec360a1cc0196 CentOS-5.3-x86_64-netinstall.iso

+++++++++++++++++++++++
Pending CentOS-5.3 Updates and src.rpm’s

Updates have been issued from upstream since they released 5.3, a bulk of these updates are already released into CentOS-5.3 and are available immediately. All pending updates will be released within the next 48 hrs. To keep the initial release size smaller, the src.rpm’s are also going to be slowly released into the mirrors over the next 48 hrs along with debuginfo packages.

+++++++++++++++++++++++
Release Notes:

The distro release notes are only available online athttp://wiki.centos.org/Manuals/ReleaseNotes/CentOS5.3The release notes include important changelog info as well as notes about the installer and outcomes from test situations which the centos-qa team worked through. Its considered essential reading.

Upstream release notes are available in the NOTES/ directory of the install media. These include release specific technologies, new features in the distro and other misc infomation that can help you better utilise the distro.

+++++++++++++++++++++++
Getting Help:

The best place to start when looking for help with CentOS is at the wiki (http://wiki.centos.org/GettingHelp ) which lists various options and communities who might be able to help. If you think there is a bug in the system, do report it athttp://bugs.centos.org/ - but keep in mind that the bugs system is *not* a support mechanism.

Some Friendly URL’s :
http://www.centos.org/
http://wiki.centos.org/
http://lists.centos.org/
http://bugs.centos.org/
irc://#centos@irc.freenode.net

+++++++++++++++++++++++
A big thanks to everyone who contributed, including the translation teams, the qa team, the CentOS Developers and all the users out there. I would also like to thank all the users for their patience and help!

Enjoy this release, tell all your friends about it too.

– 
Karanbir Singh 
CentOS Project { http://www.centos.org/ } 
irc: z00dax, #centos@irc.freenode.net

Rails 2.3 is finally done and out the door. This is one of the most substantial upgrades to Rails in a very long time. A brief rundown of the top hitters:

Templates: Allows your new skeleton Rails application to be built your way with your default stack of gems, configs, and more.

Engines: Share reusable application pieces complete with routes that Just Work, models, view paths, and the works.

Rack: Rails now runs on Rack which gives you access to all the middleware goodness.

Metal: Write super fast pieces of optimized logic that routes around Action Controller.

Nested forms: Deal with complex forms so much easier.

And that’s just the tip of the iceberg. We’ve put together a complete guide for the Rails 2.3 release notes with much more information. Be sure to checkout the section on what was deprecated when you’re ready to upgrade your application.

You install 2.3 with (the final version is marked 2.3.2):

gem install rails

If you’re running on Passenger, be sure to upgrade to 2.1.2 as well. Rails 2.3 doesn’t run on older versions of Passenger!

We hope you’ll love it.

This data is available via the web: http://imapenguin.com/oss_projects

This data is also available via XML and JSON.  Need help?  Let us know.

Check it out and let us know what you think.