Last week I wrote about CVE-2007-5925, a vulnerability in MySQL 5.0.51 (current version of the MySQL Community Edition), which is fixed in 5.0.52 (current version of the MySQL Enterprise Edition, released on the same day as 5.0.51) and was known for more than three weeks when 5.0.51 got released. 5.0.51 is also affected by CVE-2007-6303 and CVE-2007-6304, both as well already fixed in 5.0.52. While preparing 5.0.51-1 (not yet uploaded to unstable) for …

That is the good news. The bad news is, it is still affected by CVE-2007-5925, which allows remote authenticated users to cause a denial of service (database crash). Jörg Brühe wrote on the packagers mailinglist that is because the sources for 5.0.51 were cloned before the fix got in. I do not know exactly how their release model works, but looks like it needs to be improved, especially because 5.0.52 is not affected.

To make it even worse, bug #32125 which has a patch for the problem, was set to private a few days ago. Because we already have the patch in our MySQL packages since exactly three weeks, it …

The next upload of the MySQL packages to Debian (both branches, 5.0 in unstable and 5.1 in experimental) will disable binary logging in the default configuration file. I think most users of the MySQL packages in Debian don't really need it, and otherwise (e.g. on a replication master, or for point-in-time recovery) they know how to enable it.

This change only affects you when you're doing a fresh installation of the mysql-server package, or if you're still running the default configuration file shipped with the package. If you modified the configuration file in the past already (which should be the case when using replication, because the server_id line is disabled by default), the change will not be applied during an upgrade without explicit confirmation.

This morning I prepared and uploaded a Debian package of mylvmbackup, which provides a quick way to create backups of MySQL server's data files using an LVM snapshot. While it's waiting in Debians NEW queue for approval by the FTP masters, you can get it from here. It was built on and uploaded to unstable, but the package works fine on stable (etch) as well.

Last night I prepared a Debian package of MySQL Proxy. It still lacks an init script and a manpage, but beside that it works fine. I plan to finish and upload the package to unstable within the next days.

For details about using MySQL Proxy read Getting Started with MySQL Proxy by Giuseppe Maxia.

I promise, MySQL really does care about Debian. Since I arrived ten months ago (and even before that it seems), there's been several hand-wringing discussions about Debian and how we should approach it. The Debian and Ubuntu Developers do a fantastic job packaging mysql server, and I have nothing but respect for their efforts.

With RPM-based distributions, it's easy to tell people to download and install a package file. They expect it. They don't expect automatic upgrades. Creating a RPM file is easy because there's no implicit agreement about how to update it.

Our problem with Debian is that it's just too fantastic. That is, our Debian-using customers know that for almost everything, it's hard to do better than Debian does. We at MySQL wants to be able to give people our own binaries for several reasons, some good and some bad: Timeliness of package arrival; a Not Compiled Here disorder; options and defaults set as …

Few days ago I’ve started migration of some of my non-critical servers to Debian Etch (from Sarge). Just after first apt-get update && apt-get dist-upgrade, when apt has been upgraded, I noticed really strange (as for me) error: when I’ve tried to do “apt-get update” it worked fine, but there was annoying message like following:

# apt-get update
......
Fetched 5562B in 13s (421B/s)
Reading package lists... Done
W: There are no public key available for the following key IDs:
A70DAF536070D3A1
W: You may want to run apt-get update to correct these problems
#

UPDATE: Thanks to Kurt Fitzner we know, that:

There is already a mechanism to do this automatically:

$ apt-key update

This will obtain the necesary keys and import them. No need to go through gpg directly.

After not so …

For those of you who want to hear me read this instead of having to do so yourself (no hyperlinks), click here for .ogg and here for .mp3.

I migrated the blogs’ database and code from moonunit to avenger, both of which run Debian Sarge. Y’all should now notice a vast improvement in throughput. The ISP that Moonunit sits on should also see a large decrease in traffic.

Today, I added a campaign to raise funds for hosting. If you have any extra funds, please help me with colocation costs. It’s expensive and y’all use up a bunch of bandwidth. If you find this site …

My sound card wasn't working, so I installed ubuntu. now it works. I wiped my old testing version of maxdb and am now using the debian version.

I am going to see about making a synch manager debian package if one does not already exist.

My sound card wasn't working, so I installed ubuntu. now it works. I wiped my old testing version of maxdb and am now using the debian version.

I am going to see about making a synch manager debian package if one does not already exist.