Here s my (ninth) monthly update about the activities I ve done in the F/L/OSS world.
Debian
This was my 16th month of contributing to Debian.
I became a DM in late March last year and a DD last Christmas! \o/
This month was a little intense. I did a lot of different kinds of things in Debian this month. Whilst most of my time went on doing security stuff, I also sponsored a bunch of packages.
Here are the following things I did this month:
Uploads and bug fixes:
rails (2:5.2.4.3+dfsg-1) - fix a bunch of CVEs in Sid and Bullseye.
Sponsored ruby-ast for Abraham, libexif for Hugh, djangorestframework-gis and karlseguin-ccache for Nilesh, and twig-extensions, twig-i18n-extension, and mariadb-mysql-kbs for William.
GSoC Phase 1, Part 2!
Last month, I got selected as a Google Summer of Code student for Debian again! \o/
I am working on the Upstream-Downstream Cooperation in Ruby project.
The first half of the first month is blogged here, titled, GSoC Phase 1.
Also, I log daily updates at gsocwithutkarsh2102.tk.
Whilst the daily updates are available at the above site^, I ll breakdown the important parts of the later half of the first month here:
Spread the word/usage about this tool/library via adding them in the official RuboCop docs.
We had our third weekly meeting where we discussed the next steps and the things that are supposed to be done for the next set of cops.
Wrote more tests so as to cover different aspects of the GemspecGit cop.
Opened PR #4 for the next Cop, RequireRelativeToLib.
Introduced rubocop-packaging to the outer world and requested other upstream projects to use it! It is being used by 6 other projects already
Had our fourth weekly meeting where we pair-programmed (and I sucked :P) and figured out a way to make the second cop work.
Found a bug, reported at issue #5 and raised PR #6 to fix it.
And finally, people loved the library/tool (and it s outcome):
(for those who don t know, @bbatsov is the author of RuboCop, @lienvdsteen is an amazing fullstack engineer at GitLab, and @pboling is the author of some awesome Ruby tools and libraries!)
Continuation of GSoC for other Ruby related stuff!
Whilst I have already mentioned it multiple times but it s still not enough to stress how amazing Antonio Terceiro and David Rodr guez are!
They re more than just mentors to me!
Well, only they know how much I trouble them with different things, which are not only related to my GSoC project but also extends to the projects they maintain! :P
David maintains rubygems and bundler and Antonio maintains debci.
So on days when I decide to hack on rubygems or debci, only I know how kind and nice David and Anotonio are to me!
They very patiently walk me through with whatever I am stuck on, no matter what and no matter when.
Thus, with them around, I contributed to these two projects and more, with regards to working on rubocop-packaging.
Following are a few things that I raised:
Debian LTS
Debian Long Term Support (LTS) is a project to extend the lifetime of all Debian stable releases
to (at least) 5 years. Debian LTS is not handled by the Debian security team, but by a separate group
of volunteers and companies interested in making it a success.
This was my ninth month as a Debian LTS paid contributor. I was assigned 30.00 hours and worked on
the following things:
Uploaded a fix for CVE-2020-11082, for ruby-kaminari.
This upload was for Sid and Bullseye and this CVE was fixed in version 1.0.1-6.
Uploaded a fix for CVE-2020-10663, for ruby-json, ruby2.1, and ruby2.5.
These uploads were for Stretch and Buster and were fixed in the version 2.3.3-1+deb9u8, 2.1.0+dfsg-2+deb10u1, 2.3.3-1+deb9u8, and 2.5.5-3+deb10u2.
Other(s)
Sometimes it gets hard to categorize work/things into a particular category.
That s why I am writing all of those things inside this category.
This includes two sub-categories and they are as follows.
Personal:
This month I did the following things:
Wrote and published v0.1.0 of rubocop-packaging on RubyGems!
It s open-sourced and the repository is here.
Bug reports and pull requests are welcomed!
Integrated a tiny (yet a powerful) hack to align images in markdown for my blog.
Commit here.
Like each month, here comes a report about the work of paid contributors to Debian LTS.
Individual reports
In May, 198 work hours have been dispatched among 14 paid contributors. Their reports are available:
Abhijith PA did 18.0h (out of 14h assigned and 4h from April).
Anton Gladky gave back the assigned 10h and declared himself inactive.
Ben Hutchings did 19.75h (out of 17.25h assigned and 2.5h from April).
Dylan A ssi gave back the assigned 6h and declared himself inactive.
Emilio Pozuelo Monfort did not manage to work LTS in May and now reported 5h work in April (out of 17.25h assigned plus 46h from April), thus is carrying over 58.25h for June.
Markus Koschany did 25.0h (out of 17.25h assigned and 56h from April), thus carrying over 48.25h to June.
Mike Gabriel did 14.50h (out of 8h assigned and 6.5h from April).
Ola Lundqvist did 11.5h (out of 12h assigned and 7h from April), thus carrying over 7.5h to June.
Evolution of the situation
In May 2020 we had our second (virtual) contributors meeting on IRC, Logs and minutes are available online. Then we also moved our ToDo from the Debian wiki to the issue tracker on salsa.debian.org.
Sadly three contributors went inactive in May: Adrian Bunk, Anton Gladky and Dylan A ssi. And while there are currently still enough active contributors to shoulder the existing work, we like to use this opportunity that we are always looking for new contributors. Please mail Holger if you are interested.
Finally, we like to remind you for a last time, that the end of Jessie LTS is coming in less than a month!
In case you missed it (or missed to act), please read this
post
about keeping Debian 8 Jessie alive for longer than 5 years.
If you expect to have Debian 8 servers/devices running after June 30th 2020, and would
like to have security updates for them, please get in touch with
Freexian.
The security tracker currently lists 6 packages with a known CVE and the dla-needed.txt file has 30 packages needing an update.
Thanks to our sponsors
New sponsors are in bold. With the upcoming start of Jessie ELTS, we are welcoming a few new sponsors and others should join soon.
Well, this time, my project is basically to write a linter (an extension to RuboCop).
This tool is mostly to help the Debian Ruby team.
And that is the best part, I love working in/for/with the Ruby team!
(I ve been an active part of the team for 18 months now :))
More details about the project can be found here, on the wiki.
And also, I have got the best mentors I could ve possibly asked for: Antonio Terceiro
and David Rodr guez
So, the program began on 1st June and I ve been working since then. I log my daily updates at
gsocwithutkarsh2102.tk.
Whilst the daily updates are available at the above site^, I ll breakdown the important
parts here:
During the first three days, I looked for a potential solution to the usage of
git ls-files in the gemspec files. This has been the most problematic thing for us.
Apart from the option of using Dir or Dir.glob, the best (closest) possible solution
(right now) is to use Rake::FileList which tries to respects the .gitignore file.
I stumbled upon this interesting gem, fast_ignore.
It is the exact thing which we want to use but unfortunately, to use it inside other
gemspec files, it should be vendored inside bundler s
code.
We had our first meeting on the
fourth day and we decided to hold meetings every Thursday for the next 12 weeks.
For the next five days, I learned more of Ruby and figured out what to do and how to do it.
If you d like to know what exactly I did in these 5 days, I d suggest you to read the daily
logs for those respective days.
During the next to two days, the first part of the project, the GemspecGit Cop, was
implemented.
This cop will correctly determine the usage of git in the gemspec files and would tell
the developers and the maintainers to replace them with pure Ruby alternatives with giving
them a proper reason to do so. Much thanks to Dana for her
help she took out time to pair-program with me!
We had our second weekly meeting
where I finally told Antonio and David that the first part is already done (\o/) and we
discussed some things and even pair-programmed :D
I took the weekend off (and something terrible happened) but anyways, I managed to get
together some time and energy to document the source code and raised this
PR #2.
And here I am on the 15th day :)
It has been a lot of fun so far! Though I am little worried on how to implement the next part
of the project as I am not sure how to check only a particalar directory for some relative
require calls.
But I think, that s okay, somehow, something will work out. And I can always ask around
others and check other cops to see how it s done! \( )/
Until next time. :wq for today.
Here s my (eighth) monthly update about the activities I ve done in the F/L/OSS world.
Debian
This month marks my 15 months of contributing to Debian.
And 6th month as a DD! \o/
Whilst I love doing Debian stuff, I have started spending more time on the programming
side now. And I hope to keep it this for some time now.
Of course, I ll keep doing the Debian stuff, but just lesser in amount.
Anyway, the following are the things I did in May.
Experimenting and improving Ruby libraries FTW!
I have been very heavily involved with the Debian Ruby team for over an year now.
Thanks to Antonio Terceiro (and GSoC), I ve started experimenting and taking more
interest in upstream development and improvement of these libraries.
This has the sole purpose of learning. It has gotten fun since I ve started doing Ruby.
And I hope it stays this way.
This month, I opened some issues and proposed a few pull requests. They are:
Issue #802 against whenever for Ruby2.7 test failures.
Issue #8 against aggregate asking upstream for a release on rubygems.
Issue #104 against irb for asking more about Array.join("\n").
Issue #1391 against mail asking upstream to cut a new release.
Issue #1655 against rack reporting test failures in the CVE fix.
Debian LTS
Debian Long Term Support (LTS) is a project to extend the lifetime of all Debian stable releases
to (at least) 5 years. Debian LTS is not handled by the Debian security team, but by a separate group
of volunteers and companies interested in making it a success.
This was my eighth month as a Debian LTS paid contributor. I was assigned 17.25 hours and worked on
the following things:
CVE Fixes and Announcements:
Issued DLA 2191-1, fixing CVE-2020-10683, for dom4j.
For Debian 8 Jessie , this problem has been fixed in version 1.6.1+dfsg.3-2+deb8u2.
Issued DLA 2192-1, fixing CVE-2020-10663, for ruby2.1.
For Debian 8 Jessie , this problem has been fixed in version 2.1.5-2+deb8u10.
Issued DLA 2210-1, fixing CVE-2020-3810, for apt.
This update was prepared by the maintainer, Julian. I just took care of the paperwork.
For Debian 8 Jessie , this problem has been fixed in version 1.0.9.8.6.
Other(s)
Sometimes it gets hard to categorize work/things into a particular category.
That s why I am writing all of those things inside this category.
This includes two sub-categories and they are as follows.
Personal:
This month I could get the following things done:
Wrote and published my first Ruby gem/library/tool on RubyGems!
It s open-sourced and the repository is here.
Bug reports and pull requests are welcomed!
Wrote a small Ruby script (available here) to install Ruby gems from Gemfile(.lock).
Needed this when I hit a bug while using ruby-standalone, which Antonio fixed pretty quickly!
Like each month, here comes a report about the work of paid contributors to Debian LTS.
Individual reports
In April, 284.5 work hours have been dispatched among 14 paid contributors. Their reports are available:
Abhijith PA did 10.0h (out of 14h assigned), thus carrying over 4h to May.
Adrian Bunk did nothing (out of 28.75h assigned), thus is carrying over 28.75h for May.
Ben Hutchings did 26h (out of 20h assigned and 8.5h from March), thus carrying over 2.5h to May.
Emilio Pozuelo Monfort did not report back about their work so we assume they did nothing (out of 28.75h assigned plus 17.25h from March), thus is carrying over 46h for May.
Markus Koschany did 11.5h (out of 28.75h assigned and 38.75h from March), thus carrying over 56h to May.
Mike Gabriel did 1.5h (out of 8h assigned), thus carrying over 6.5h to May.
Ola Lundqvist did 13.5h (out of 12h assigned and 8.5h from March), thus carrying over 7h to May.
Evolution of the situation
In April we dispatched more hours than ever and another was new too, we had our first (virtual) contributors meeting on IRC! Logs and minutes are available and we plan to continue doing IRC meetings every other month.
Sadly one contributor decided to go inactive in April, Hugo Lefeuvre.
Finally, we like to remind you, that the end of Jessie LTS is coming in less than two months!
In case you missed it (or missed to act), please read this
post
about keeping Debian 8 Jessie alive for longer than 5 years.
If you expect to have Debian 8 servers/devices running after June 30th 2020, and would
like to have security updates for them, please get in touch with
Freexian.
The security tracker currently lists 4 packages with a known CVE and the dla-needed.txt file has 25 packages needing an update.
Thanks to our sponsors
New sponsors are in bold.
We are very excited to announce that Debian has selected nine interns to work
under mentorship on a variety of
projects with us during the
Google Summer of Code.
Here are the list of the projects, students, and details of the tasks to be performed.
Project: Android SDK Tools in Debian
Student(s): Manas Kashyap, Raman Sarda, and Samyak-jn
Deliverables of the project: Quality assurance including bug fixing, continuous
integration tests and documentation for all Debian Med applications that are known
to be helpful to fight COVID-19
Project: BLAS/LAPACK Ecosystem Enhancement
Deliverables of the project: Continuous integration tests for all Debian Med
applications, QA review, and bug fixes.
Project: Systemd unit translator
Student: K Gopal Krishna
Deliverables of the project: A systemd unit to OpenRC init script translator.
Updated OpenRC package into Debian Unstable.
Project: Architecture Cross-Grading Support in Debian
Student: Kevin Wu
Deliverables of the project: Evaluate, test, and develop tools to evaluate cross-grade
checks for system and user configuration.
Project: Upstream/Downstream cooperation in Ruby
Student: utkarsh2102
Deliverables of the project: Create guide for rubygems.org on good practices for
upstream maintainers, develop a tool that can detect problems and, if possible
fix those errors automatically. Establish good documentation, design the tool to
be extensible for other languages.
Congratulations and welcome to all the interns!
The Google Summer of Code program is possible in Debian thanks to the efforts of
Debian Developers and Debian Contributors that dedicate part of their free time to
mentor interns and outreach tasks.
Join us and help extend Debian! You can follow the interns' weekly reports on the
debian-outreach mailing-list, chat with us on our
IRC channel or reach out to the individual projects' team
mailing lists.
Here s my (seventh) monthly update about the activities I ve done in the F/L/OSS world.
Debian
It s been 14 months since I ve started contributing to Debian.
And 4 months since I ve been a Debian Developer. And in this beautiful time,
I had this opprotunity to do and learn lots of new and interesting things. And most
importantly, meet and interact with lots of lovely people!
Debian is $home.
Sponsored a lot of uploads for William Desportes and Adam Cecile.
Mentoring for newcomers.
FTP Trainee reviewing.
Moderation of -project mailing list.
Applied for DUCI project for Google Summer of Code 2020.
Ruby2.7 Migration:
Ruby2.7 was recently released on 25th December, 2019. Santa s gift. Believe it or not.
We, the Debian Ruby team, have been trying hard to make it migrate to testing. And it finally happened.
The default version in testing is ruby2.7. Here s the news! \o/
Here s what I worked on this month for this transition.
Upstream:
Opened several issues and proposed patches (in the form of PRs):
Issue #35 against encryptor for Ruby2.7 test failures.
Issue #28 against image_science for removing relative paths.
Issue #106 against ffi-yajl for Ruby2.7 test failures.
Debian LTS
Debian Long Term Support (LTS) is a project to extend the lifetime of all Debian stable releases
to (at least) 5 years. Debian LTS is not handled by the Debian security team, but by a separate group
of volunteers and companies interested in making it a success.
This was my seventh month as a Debian LTS paid contributor. I was assigned 24.00 hours and worked on
the following things:
Other(s)
Sometimes it gets hard to categorize work/things into a particular category.
That s why I am writing all of those things inside this category.
This includes two sub-categories and they are as follows.
Personal:
This month I could get the following things done:
Most importantly, I finally migrated to a new website. Huge UI imporvement! \o/
From Jekyll to Hugo, it was not easy. But it was worth it! Many thanks to Luiz for writing hugo-coder, Clement, and Samyak!
If you find any flaws, issues and pull requests are welcomed at utkarsh2102/utkarsh2102.com
Wrote battery-alert, a mini-project of my own to show battery alerts at <10% and >90%.
Written in shell, it brings me all the satisfaction as it has saved my life on many occasions.
And guess what? It has more users than just myself!
Reviews and patches are welcomed \o/
Mentored in HackOn Hackathon. Thanks to Manvi for reaching out!
It was fun to see people developing some really nice projects.
Thanks to Ray and John, I became a GitLab Hero!
(I am yet to figure out my role and responibility though)
Atteneded Intro Sec Con and had the most fun!
Heard Ian s keynote and attended other talks and learned how to use WireShark!
Open Source:
Again, this contains all the things that I couldn t categorize earlier.
Opened several issues and pull requests:
Issue #297 against hugo-coder, asking to enable RSS feed for blogs.
PR #316 for hugo-coder for fixing the above issue myself.
Issue #173 against arbre for requesting a release.
Issue #104 against combustion, asking to relax dependency on rubocop. Fixed in this commit.
Issue #16 against ffi-compiler for requesting to fix homepage and license.
Issue #57 against gographviz for requesting a release.
Issue #14 against crb-blast, suggesting compatability with bio 2.0.x.
Issue #58 against uniform_notifier for asking to drop the use of ruby-growl.
PR #2072 for polybar, adding installation instructions on Debian systems.
Like each month, here comes a report about the work of paid contributors to Debian LTS.
Individual reports
In March, 252 work hours have been dispatched among 14 paid contributors. Their reports are available:
Abhijith PA did 16.0h (out of 14h assigned and 2h from February).
Ben Hutchings did 12.25h (out of 20h assigned and 0.75h from February), thus carrying over 8.5h to April.
Evolution of the situation
March was a strange month for many people all over the globe. Here we ll just express our hopes that you are and will be well!
LTS gained a new contributor in March, Anton Gladky, however he then decided to become active later this year. Similarly Hugo Lefeuvre notified us that he ll be inactive in April.
In case you missed it (or missed to act), please read this
post
about keeping Debian 8 Jessie alive for longer than 5 years.
If you expect to have Debian 8 servers/devices running after June 30th 2020, and would
like to have security updates for them, please get in touch with
Freexian.
Hurry up: the end of Jessie LTS is coming in less than three months!
The security tracker currently lists 25 packages with a known CVE and the dla-needed.txt file has 23 packages needing an update.
Thanks to our sponsors
New sponsors are in bold.
Here s my (sixth) monthly update about the activities I ve done in Debian this March.
Debian LTS
This was my sixth month as a Debian LTS paid contributor.
I was assigned 24.00 hours and worked on the following things:
CVE Fixes and Announcements:
Issued DLA 2131-1, fixing CVE-2014-6262, for rrdtool.
For Debian 8 Jessie , this problem has been fixed in version 1.4.8-1.2+deb8u1.
Issued DLA 2131-2, fixing regression caused by DLA 2131-1, for rrdtool.
For Debian 8 Jessie , this problem has been fixed in version 1.4.8-1.2+deb8u2.
Issued DLA 2135-1, fixing CVE-2020-9546, CVE-2020-9547, and CVE-2020-9548, for jackson-databind.
For Debian 8 Jessie , these problems have been fixed in version 2.4.2-2+deb8u12.
Issued DLA 2137-1, fixing CVE-2020-10232, for sleuthkit.
For Debian 8 Jessie , this problem has been fixed in version 4.1.3-4+deb8u2.
Issued DLA 2139-1, fixing CVE-2020-5258 and CVE-2020-5259, for dojo.
For Debian 8 Jessie , these problems have been fixed in version 1.10.2+dfsg-1+deb8u3.
Issued DLA 2141-1, fixing CVE-2020-10184 and CVE-2020-10185, for yubikey-val.
For Debian 8 Jessie , these problems have been fixed in version 2.27-1+deb8u1.
Issued DLA 2146-1, fixing CVE-2019-15690, for libvncserver.
For Debian 8 Jessie , this problem has been fixed in version 0.9.9+dfsg2-6.1+deb8u7.
Issued DLA 2147-1, fixing CVE-2019-17546, for gdal.
For Debian 8 Jessie , this problem has been fixed in version 1.10.1+dfsg-8+deb8u2.
Issued DLA 2149-1, fixing CVE-2020-5267, for rails.
For Debian 8 Jessie , this problem has been fixed in version 2:4.1.8-1+deb8u6.
Issued DLA 2153-1, fixing CVE-2020-10672 and CVE-2020-10673, for jackson-databind.
For Debian 8 Jessie , these problems have been fixed in version 2.4.2-2+deb8u13.
Issued DLA 2154-1, fixing CVE-2020-10802 and CVE-2020-10803, for phpmyadmin.
For Debian 8 Jessie , these problems have been fixed in version 4:4.2.12-2+deb8u9.
In March 2020, I have worked on the Debian LTS project for 10.25 hours (of 10.25 hours planned).
LTS Work
Frontdesk: CVE Bug Triaging for Debian jessie LTS: libpam-krb5, symfony, edk2 (EOL), icu, twisted, yubikey-val, netkit-telnet(-ssl), libperlspeak-perl (new EOL). and glibc.
Upload to jessie-security: tinyproxy (DLA-2163-1 [1], 1 CVE, 1 severe bug [2]).
Revisit CVE-2015-9541 in jessie's qtbase-opensource-src and agree with Dmitry Shachnev from Debian's KDE/Qt Team about tagging this CVE '<ignored>' in Debian's security tracker. The proposed upstream patch uses an API not available in jessie's Qt5 version (QStringView API) and the serious of patched ot be applied would be quite invasive.
Prepare upload of libpam-krb5 4.6-3+deb8u1 (1 CVE) (will be uploaded during the day).
Look closer into CVE-2019-17177 for FreeRDP v1.1 (and decide to ignore it, as patchwork would have to be applied all over the code).
Other security related work for Debian
Upload to stretch: libvncserver 0.9.11+dfsg-1.3~deb9u4 (1 CVE)
Upload to buster: libvncserver 0.9.11+dfsg-1.3+deb10u3 (1 CVE)
Upload to stretch: tinyproxy 1.8.4-3~deb9u2 (1 CVE, 1 severe bug [2])
Upload to buster: tinyproxy 1.10.0-2+deb10u1 (1 severe bug)
Study the code of x11vnc (regarding Debian bug #672435 [3], which currently has a temp-CVE), apply upstream's fix (which did not work) and ping upstream about possible other required patches in x11vnc and/or libVNC.
Credits
A very big thanks goes to Utkarsh Gupta, a colleague from the Debian LTS team, who sponsored all my uploads and who sent the DLA mails on my behalf, while I was (and still am) in self-induced GPG lockdown (I forgot to update my GPG public key in Debian's GPG keyring). Thanks, Utkarsh!
References
Like each month, here comes a report about the work of paid contributors to Debian LTS.
Individual reports
In February, 226 work hours have been dispatched among 14 paid contributors. Their reports are available:
Abhijith PA gave back 12 out of his assigned 14h, thus he is carrying over 2h for March.
Ben Hutchings did 19.25h (out of 20h assigned), thus carrying over 0.75h to March.
Evolution of the situation
February began as rather calm month and the fact that more contributors have given back
unused hours is an indicator of this calmness and also an indicator that contributing
to LTS has become more of a routine now, which is good.
In the second half of February Holger Levsen (from LTS)
and Salvatore Bonaccorso (from the Debian Security Team)
met at SnowCamp in Italy and discussed
tensions and possible improvements from and for Debian LTS.
The security tracker currently lists 25 packages with a known CVE and the dla-needed.txt file has 21 packages needing an update.
Thanks to our sponsors
New sponsors are in bold.
Here s my (fifth) monthly update about the activities I ve done in Debian this February.
Debian LTS
This was my fifth month as a Debian LTS paid contributor.
I was assigned 20.00 hours and worked on the following things:
CVE Fixes and Announcements:
Issued DLA 2095-1, fixing CVE-2020-7040, for storebackup.
Details here:
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation.
For Debian 8 Jessie , this problem has been fixed in version 3.2.1-1+deb8u1.
Furthermore, sent the patch for the security update for Stretch and Buster to the maintainer.
Issued DLA 2113-1, fixing CVE-2020-8631 and CVE-2020-8632 for cloud-init.
Details here:
For CVE-2020-8631, in cloud-init, relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
For CVE-2020-8632, in cloud-init, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.
For Debian 8 Jessie , this problem has been fixed in version 0.7.6~bzr976-2+deb8u1.
Issued DLA 2116-1, fixing CVE-2015-9542, for libpam-radius-auth.
Details here:
A vulnerability was found in pam_radius: the password length check was done incorrectly in the add_password() function in pam_radius_auth.c, resulting in a stack based buffer overflow.
This could be used to crash (DoS) an application using the PAM stack for authentication.
For Debian 8 Jessie , this problem has been fixed in version 1.3.16-4.4+deb8u1.
Issued DLA 2127-1, fixing CVE-2019-10785, for dojo.
Details here:
dojox was vulnerable to Cross-site Scripting. This was due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.
For Debian 8 Jessie , this problem has been fixed in version 1.10.2+dfsg-1+deb8u2.
Whilst Dylan issued DLA 2120-1, fixing CVE-2020-8130, for rake, I, with the Ruby team hat on, fixed the same issue for Stretch and Buster via proposed-updates.
This CVE was fixed via 10.5.0-2+deb9u1 and 12.3.1-3+deb10u1 respectively.
Triaged CVE-2020-1711 and CVE-2020-8608 with more precision and discussed the details with Ola.
Started working on rrdtool for CVE-2014-6262.
Debian Work
This was a great month! MiniDebCamp -> FOSDEM -> Ruby Sprints. Blog post soon :D
In the month of February, I did a lot of Debian work.
// given limited time in March, this section is yet to be updated.
One exciting blog post coming very soon.
Until next time. :wq for today.
IIT Bombay, like most likely most Indian educational instituates, has some rules and regulations about the interaction between boys and girls that, at least to the uninitiated eye of a foreigner who was brought up in a liberal society, seem arbitrary and archaic. At IIT Bombay, for example, there may be no visits in hostels by students of the other gender (yes, there are separate boys and girls hostels) between 10pm and 7am, and during the day any such visit has to be registered at the reception security guard. And when there was need for more room for girls and they reassigned one wing of a boys hostel to the adjacent girls hostel, they closed the connection by bricking it and split the lawn by a fence. With barbed wire on top.
I took this as a theme for a satirical inspection of these policies which comes to the conclusion that IIT Bombay is a very progressive institute that puts these rules in place as affirmative action towards same-gender relationships. After some discussion with the editors the text got actually published in the institutes bi-monthly newspaper Raintree , unfortunately only now, two weeks after I left India. You can read the text on the bottom of page 8 in the 6MB PDF file.
I cannot predict how it will be received, but at least Utkarsh Raut, who illustrated the text, clearly got the message right. Thanks for the nice and very fitting drawing!
* No, we don t have moksha packaged yet.
Sometime ago, Nirav forwarded me query regarding Utkarsh (my project where our goal was to provide complete Gujarati interface in OS) who got CD long time back but facing some issue. Last week, I decided to help and finish this pending task and went to place we decided. It was small laptop (ie EEE PC) for guru of group called, OM Parivar. I installed Ubuntu and customized it for Gujarati interface and required software.
Second time, I went to Guruji s place for small training and I was wondering how fast man of 82 years can learn! He was very happy to see me helping and so I m converting more person to Linux. I also explained why I m using Linux and we even discussed about some Free Software philosophy.
Next time: Keep Debian Installer with USB boot handy
* Long time, no see! Well, I am busy with ‘real’ life Kavin is fine and growing like increasing number of Linux users
* Firefox (ah, IceWeasel!) team is coming to Mumbai (See ILUG-BOM website/mailing list for more details), as a contributor to Gujarati Localization, I got this cool Tshirt.
* Installed Debian ‘Etch’ on my office machine! Earlier, I was responsible for installing Ubuntu here
It took around 20 minutes for fresh install (1st CD). I would love if we can fit OO.o in first CD! Everything went fine. Smooth migration from Thunderbird mail box to IceDove. And, I love this cool sw seahorse.
* Finally, we did it!
List of people who attended meet:
1. Hardik Dalwadi (DeepRoot Linux)
2. Kartik Mistry (Magnet, Utkarsh)
3. Isaac Praveen (DeepRoot Linux)
We met at CCD near LD College of Engineering around 7 PM yesterday. It was surprise that only 3 people actually turned up at meet (I though of atleast 6/7 people). But, since this was Meeting Zero, Never mind!
We discussed lots of things from Debian Etch release to DeepRootLinux. Hardik showed fancy Beryl and Deepofix working. I handed over Debian Etch Multiarch CD, We tried to install it over VMware but couldn’t get it working
We also talked about attending some next cool events and involving student in LUGA. For any LUG, it is vital to have student base. Well, we had nice coffee too (Thanks to Hardik/Abhas Abhinav for sponsoring it!)
And yes, we had nice BSOD when Hardik tried to show me Windows XP Embedded! I took chance to get its video too!!
Pictures at: http://www.flickr.com/photos/kartik_m/tags/lugameet0/
So, if you are at/near Ahmedabad or Gandhinagar and care and dare to travel on Sundays, you are most welcome!
Last month, I got selected as a Google Summer of Code student for Debian again! \o/
Like 
We are very excited to announce that Debian has selected nine interns to work
under mentorship on a variety of
In March 2020, I have worked on the Debian LTS project for 10.25 hours (of 10.25 hours planned).
LTS Work
IIT Bombay, like most likely most Indian educational instituates, has some rules and regulations about the interaction between boys and girls that, at least to the uninitiated eye of a foreigner who was brought up in a liberal society, seem arbitrary and archaic. At IIT Bombay, for example, there may be no visits in hostels by students of the other gender (yes, there are separate boys and girls hostels) between 10pm and 7am, and during the day any such visit has to be registered at the 
* No, we don t have 
Kavin is fine and growing like increasing number of Linux users 
We also talked about attending some next cool events and involving student in LUGA. For any LUG, it is vital to have student base. Well, we had nice coffee too (Thanks to Hardik/Abhas Abhinav for sponsoring it!)
And yes, we had nice