etbe - Russell Coker

Gnash and use of Free Software

There is currently a discussion on a private mailing list about whether some money from a community organisation should be used to assist the development of Gnash (the free software Flash player) [1]. The main reason for this is that there are apparently some schools that depend on flash web sites to such a degree that they won’t consider using a free OS that lacks Flash support.

It has been shown that there are a number of issues related to contributing financially to free projects, the people who advocate financial contributions in this case assure us that such problems have been addressed but it will remain controversial to some extent. One thing that is not controversial is the fact that testing and debugging is universally a good thing. So I advocate doing such testing as a way to contribute to Flash development and therefore free software use in education.

The Debian-Edu project has a web page with a link to flash sites that can be used for testing [2]. So I plan to now install Gnash on all Linux desktop systems that I run and get bug reports to help development. I encourage others to do the same.

Also there is the Ming library for developing Flash files which could apparently do with some help in the development process [3].

While a non-free format such as Flash is not ideal, it’s certainly a lot better than Silverlight!

Note that I don’t have strong feelings about the issues of financial support for Gnash (which is why I didn’t contribute to the private discussion in question). But I am convinced that more people using and testing Gnash is a good thing.

Bad but Appealing Copyright Arguments

Some people seem to believe that the problem with copyright law is the inability of people on the free culture side of the debate to compete with the large amounts of money that are being spent but the RIAA et al.

I think that a significant part of the problem is that many intelligent and well-meaning people are simply unaware of or unconvinced by the arguments. For example the Reid Report post titled “Paul Porter speaks truth to Black radio” [1] includes the quote “Only the United States, North Korea and Iran don’t pay royalties for performers on free AM/FM radio“. This point actually sounds quite reasonable and will convince many intelligent and well-meaning people who have an interest in politics – such as Ms Reid.

Cory Doctorow has written an interesting article titled “Internet ©rapshoot: How Internet Gatekeepers Stifle Progress”[2]. He describes how the big “entertainment” companies are failing to properly represent their customers or the artists who produce the content, and in the process creating monopolies out of companies such as Apple and Google.

Cory starts by raising the issue of cultural discourse, monopolies in the distribution of popular art will lead to control over the political process. Ironically the article that Ms Reid cited [3] mentions the issue of “pay for play” which led to “a steady diet of misogyny, violence and drug culture” on the airwaves.

Brendan Scott has written about a similar issue in Australia where the music copyright holders are trying to get massive increases in license fees from restaurants and other small businesses [4]. The expected result of this is greater use of classical music (which is out of copyright) and more interest in purchasing licenses from small musicians who aren’t affiliated with the music cartels. One of his main points is that playing music in public places (including public radio frequencies) is the major form of advertising for musicians.

Michael Tiemann writes about a Brazilian band that has been quite profitable by skipping the recording industry, providing the fans what they want, and selling CDs direct to fans [5]. This is one of many examples to illustrate the fact that the current music factory system is not required for musicians to make a profit.

Amanda Palmer has written an interesting blog post about how the Warner music group wasn’t getting as much money from Youtube as they wanted so they demanded that HER music videos be removed [6] (among many others). So we have a music studio that doesn’t even pay the artist (below a certain number of sales the artist gets no payment, selling 30,000 albums is not enough to get a cent) demanding that the music videos be made unavailable to fans when the artist wants them published. This is a travesty and if similar licensing schemes are implemented for radio stations then we can expect that some radio stations will be financially discouraged from playing music even when the artist would be happy to have it played for free!

In Australia we have an organisation that secretly taxes all viewing of material that they think is under copyright with a suitable license (they give no detailed information on how they determine the copyright and license status – they probably violate my license by taxing universities for copying posts from my blog). Educational institutions and other organisations that sign up get to pay them some money based on what they are deemed to have used. The money is then distributed to the creators in proportion to the amount of use their material received. The distribution rules state that any amount less than $50 per year for an Australian resident or $200 per year for a non-resident will be instead redistributed to other people [7]. Usually analysis of The Long Tail [8] comprises the majority of the sales if users are given enough opportunities to search for a product that is a good match for their requirements. This is the entire basis of businesses such as Amazon.com. The Australian Copyright Agency (Copyright Agency Limited – CAL) seems to have a business model of taking all the revenue that might be “earned” by the creative people in the “long tail” and give it all to the top performers. If a similar system was implemented for the US music industry then it would be great for Michael Jackson’s estate, but bad for the vast majority of musicians.

It seems likely to me that the current situation with the music industry is fairly optimal for making a few very popular musicians very rich. The proposed changes for the US will make things even better/worse (depending if you are among the rich few or the majority of the population). One thing we need to ask ourselves is whether we want laws that will make a few people rich or laws that will give many people an adequate income for work they enjoy and which also enriches our culture. This correct decision seems obvious to me.

Can anyone think of other good points that should be raised when discussing such issues with people who don’t consider copyright to be a big issue?

Free Books and T-Shirt Sales

Cory Doctorow has written an interesting column for the Locus Magazine about his experience in giving away free copies of his books [1]. Mainly he rants about some of the criticism he has received, initially it was people claiming that giving away books for free only worked because he was not a well known author, now people claim that it only works because he is well known.

I’d like to see authors publish free work (as Cory does) and then sell print-on-demand t-shirts.

Cafepress.com has their cheapest t-shirt at $US16.99, Zazzle.com has a shirt for $US15.95, and SpreadShirt.com has shirts for as little as $US6.40 but their web site is difficult to navigate and gives me a lack of confidence in their operation. In spite of the difficult web site SpreadShirt.com seems to be the best offer at $6.40 for a basic shirt, that means either lower prices for the customer (and more sales) or a higher profit margin.

The sale of a t-shirt could give the same revenue to the author as a sale of a book while also costing less than the price of one book in a store. It would be more useful after the book has been read (something you can wear rather than something that takes up space on a shelf), and it would advertise the book. The amount of effort required to create a decent shirt is a small fraction of the effort required to write a book, in many cases the cover artwork could be used with only minor alterations. Cory Doctorow’s novels page has images that could make seven different great shirts with a small amount of effort [2].

I’m sure that there are also many people who want to buy the book and the shirt, so it should give a general increase in revenue.

Ownership of Laptops for Work

Jetstar has announced some new changes to the way they manage their IT infrastructure [1]. Some parts of it are obvious things that people have been doing (or wanting to do) for a long time – such as using thin clients with no moving parts (not even cooling fans).

But the really interesting part is their plan for managing laptops. They are using a virtual machine image on a flash storage device that can run on any system. So deploying a new system will only require installing the virtual machine software and inserting a storage device. Moving a user’s environment to a different system (EG due to hardware failure) will merely require inserting the storage device in a new system.

That raises the issue of ownership of the device. It seems that Jetstar are considering using systems that are owned by employees, Stephen Tame said “In two years’ time a laptop should be a condition of employment, and this includes bringing your own laptop“. When introducing that I expect there would be some resistance by employees who don’t want to spend the money. However
I have previously estimated the costs of running a car [2] which works out to more than $1,650 per year for insurance, registration, basic maintenance, and the interest that would have been received if the car had not been purchased and the money had been invested. Laptops can be purchased for significantly less than $1000 (currently the EeePC 701 is on sale for $219) and can be expected to last for three years or more if you are careful to avoid damage and don’t run demanding software. So a job that demands ownership of a laptop is asking for a much smaller financial investment than one which demands ownership of a car. But I expect that many employees won’t see it that way.

The up-side for employees to bring their own laptops is that they can choose a model that suits their preference. Everyone has preferences regarding the size of keys on a keyboard, the distance that they travel and the pressure required to register a key-press. For desktop machines it’s easy to swap keyboards but for laptops there is no such option. Then there’s the issue of the trade-off between physical size and weight vs display resolution, personal preferences in this regard will depend to some extent on the body mass and strength of the employee.

Now there are a number of security issues related to personal laptop use. Obviously if the laptop has a Trojan-horse program installed then it could sniff any data that goes past on the network. The most trivial case of this could be addressed by running VPN software inside the emulated environment. This would force a Trojan to compromise the virtual environment (EG by modifying the address space) or to compromise the files on disk (insert a Trojan inside the filesystem for the virtual environment). The former would be tricky to get right while the latter would be trivial. Both attack methods have been used in the past and proven to work. This is why many companies prohibit their employees from connecting their own systems to the corporate network.

One example of a system that is based around running virtual machines for all desktop operations is the NSA NetTop project [3]. NetTop involves a SE Linux system that runs multiple instances of VMWare for different desktop environments. Each VMWare instance runs at a particular sensitivity level and uses a VPN connection to a back-end network running at the same level. The aim of NetTop is to prevent applications in the different VMWare instances from communicating with each other. The significant difference between a typical NetTop installation and what JetStar might be doing is that NetTop runs on a secure base – it’s hardware that has been purchased and installed by a military organisation and is run in a secure facility. While personal laptops that are owned by employees can be expected to be infected with viruses and Trojan-horse programs.

In the past I have suggested that an employment package for any skilled employee should include some budget for buying things that facilitate the work [4]. It seems to me that a company like JetStar could best achieve their goals by assigning a budget to each new employee to buy a machine for their use. The employee then gets to choose a machine up to that budget – which would only be for work purposes. Then when the employee leaves or the machine becomes due for replacement it could be sold at auction. When considering all the costs involved in hiring a new person, spending something less than $1,000 to buy a laptop is nothing.

Finally if buying machines for work purposes, you really don’t want employees using them for surfing porn. Porn sites tend to be particularly bad for malware distribution. To reduce the incidence of such problems I think that work machines should have their sound hardware disabled and laptops should not be purchased with overly large displays. There is no need to make work machines totally unsuitable for porn surfing (which would also make them less effective for work), but making them less suitable than a $500 budget PC should dramatically reduce the scope of the problem.

Healthcare and Free Software

The Washington Monthly has an interesting article about healthcare and Free Software [1]. It seems that a free system named “VistA” from the US Veterans Affairs department (not to be confused with the unpopular OS “Vista” that Microsoft released a few years ago) is competing against a range of proprietary software for managing patient data.

VistA has apparently performed very well, it’s cheap and easy to install, the data can be shared with other programs, and it was largely written by doctors and nurses so it’s optimised to their needs. It has been proven that VistA has saved many lives through better management of medicines and through permitting statistical analysis of the results of various treatments. It has also allowed medical staff to work more quickly which reduces waiting times and medical expenses.

But as you would expect in the US, whenever there is a way of saving lives while also saving money there are companies lobbying for the opportunity to make money while allowing innocent people to die. Of course there are established medical companies who are doing this now and have been doing so for some time.

But the latest news is that Microsoft, Intel, Cisco, and Allscripts, are sponsoring the Electronic Health Record Stimulus Tour – an aggressive measure to railroad doctors into buying proprietary software now.

MS is known for totally ignoring the law when it gives them an opportunity to gain market share, but this is a new low. What will MS do next? Sell drugs to children?

[1] http://www.washingtonmonthly.com/features/2009/0907.longman.html

The Streisand Effect and Chinese Barratry

Bruce Everiss has received two threatening letters from a NSW law firm representing the Chinese game company Evony. Here is the latest where they whinge about his publication of their first letter [1] (NB if threaten to sue a blogger you have to expect your letter to be published, it’s not discourteous it’s just the way things work). Here is the first letter from the law firm [2] – Bruce has illustrated the post with one of the advertising pictures that Evony uses (apparently ripped from a lingerie catalog).

I’ve seen some of the Evony adverts on my blog, the ones with a provocatively dressed woman (lingerie advert?) and the title “Come Play, my Lord“.

Ken has an amusing and insightful post on the issue [3] – which also makes some amusing jokes about the Australian legal system.

Bruce’s blog has some good insights into the gaming industry and culture, I’ve added his blog to my feed.

It seems that Bruce will gain a lot of readers due to these legal threats, while Evony seems unlikely to gain anything other than bad PR.

Free K-12 Text Books

The CK12 project is developing free (CC by SA) textbooks for the K-12 market (with a current focus on the early years of high school) [1]. Their primary aim seems to be flex-books – text books that can be localised and modified to better suit the needs of the students. But of course there are many other benefits, according to my best estimates storing text books on an ebook reader or one of the lighter NetBooks is necessary to avoid childhooh back injuries [2].

Another major benefit of flexible text books is the possibility of teaching a wider range of subjects. A subject does not need the level of interest that is required to get a publishing contract (which generally means acceptance by the education department of a state) to have a text book. Independent schools and home-schoolers can select subjects that are not in the mainstream curriculum.

The information for potential authors of text books is here (they didn’t make it particularly easy to find) [3].

One thing I would like to see is a text book about computer security. I really don’t think that this would be an overly difficult subject for an 11yo who is interested in computers. When I was 11 I read a text book on nuclear physics in the form of a comic book, I don’t think that computer security is inherently more difficult or harder to teach than nuclear physics. Naturally full coverage would require several texts aimed at different ages. But that’s possible too. It would probably be easiest to start with an age of ~16. Also as computer security is a subject that is both difficult at one end of the scale and essential at the other it would be necessary to have A and B streams (as is done with maths in the Australian education system).

Please leave a comment if you are interested in participating in the development of computer security related text books. Incidentally it would be good to get a contributor who has had experience in teaching teenagers even if they don’t have any knowledge of computer security – I don’t expect to find someone with good technical skills and teaching experience.

Increasing Productivity through Clean Air

Kamal Meattle gave an interesting TED talk about using plants to produce enough oxygen to support people in sealed buildings [1]. The combination he advocates is Areca Palm for the living-room (four shoulder-high plants per person), Mother-in-law’s Tongue for the bedroom to produce oxygen at night (six to eight waist-high plants per person), and Money Plant to remove formaldehyde and other volatile chemicals.

A study by the Indian government has found the health benefits from using such plants in an office environment to give a 20% increase in productivity. It seems reasonable to assume that the benefits would be smaller in a city such as Melbourne which doesn’t have serious pollution problems. But even a 5% improvement in productivity would pay for the cost of installing plants! The Indian research also indicated a 15% energy saving through having less “fresh air”.

It seems that now is not a great time to ask for a pay rise, but asking for more plants to be installed in the office is probably viable.

[1] http://www.ted.com/talks/lang/eng/kamal_meattle_on_how_to_grow_your_own_fresh_air.html

NBD and PXE Booting on Debian

I have a Xen server that I use for testing which is fairly lightly loaded. I considered making it diskless to save some electricity use (which also means heat dissipation in summer) and also some noise.

The first step is to setup a PXE server. This is reasonably well documented in the Debian Administration article on setting up PXE [1]. Basically the DHCP configuration needs to include the line “filename “pxelinux.0”;” to tell the workstation the name of the file to download. This file is downloaded from a TFTP server, so you need to install one (I chose the tftpd-hpa package). The pxelinux.0 is provided by the syslinux-common package, I believe that the Debian Administration article errs in not mentioning this fact, they recommend using wget to download it which means that there is no verification of the file contents.

It appears that the way PXE works is that you are expected to have a directory named pxelinux.cfg under the root of the TFTP tree which then contains PXE configuration files. The Debian Administration article gives an example of using a file named default but you can also name a file for the MAC address of the workstation, a number which appears to be a GUUID for the workstation, and the IP address in hexadecimal (if that doesn’t exist then it will be truncated one nibble at a time, so 10.10.10.100 will result in searches for 0A0A0A64, 0A0A0A6, … 0). That’s what my HP test machine does.

The Debian Administration article shows how to configure PXE for installing Debian. But I wasn’t interested in that, I wanted to convert a system that is running as a regular workstation to be diskless. The first step in doing this is to install the nbd-client package which results in rebuilding the initrd to have support for diskless operation. Then you have to install the nbd-server package on the file server. The documentation for this package suggests that it is designed to serve regular files as block devices, but it appears to work OK with LVM devices. Adding an export section such as the following to /etc/nbd-server/config causes an LV to be exported via NBD:

[export]
exportname = /dev/vg0/workstation0
port = 12345
authfile = /etc/nbd-server/allow
listenaddr = 192.168.0.1

Then it’s just a matter of copying the filesystem from the hard drive to the LV that is used for NBD. I piped tar through ssh to copy the root filesystem of a running system. But I could have copied the block device or used debootstrap to create a new image from scratch.

NBD has an interesting design in that it exports block devices (which can be backed by files or real block devices) to a particular set of IP addresses and uses a particular TCP port for the export. So if you have two NFS exports from one server you might have 192.168.0.1:/home and 192.168.0.1:/data as exports but if you have two NBD devices you might have 192.168.0.1,12345 and 192.168.0.1,12346. This could be considered to be very sensible or utterly wrong.

The final thing to do is to setup a PXE configuration file. I put the following in a file named pxelinux.cfg/default, if I was going to deploy this seriously I would replace default with the IP address of the system.

DEFAULT lenny_i386

LABEL lenny_i386
kernel lenny/vmlinuz-2.6.26-2-686
append selinux=1 nbdroot=192.168.0.1,12345 initrd=lenny/initrd.img-2.6.26-2-686 root=/dev/nbd0 ip=dhcp --

The only things I needed to change in the image that I’m booting after transferring it from the hard drive is /etc/fstab and the network configuration /etc/network/interfaces – obviously if the network start scripts change the IP address of the workstation and thus make the root filesystem unavailable then things will break.

Wouter has some more background information on this [2]. He recommends using partitioned NBDs, that’s a matter of opinion, if I was going to use this in production I would use two NBDs, one for the root filesystem and another for LVM which would be used for everything else. I really like to be able to create snapshots and to change the size of LVs at run-time.
The down-side of LVM is that it can be really inconvenient to access LVM volumes when not running the machine that owns them – there is no support for using an LV as a PV (IE nested LVM) or for having two VGs with the same name running on the same machine.

Wouter also seems to be planning to write Debian Installer support for using NBD as a target. This would be a nice feature.

Now the next thing is to use Xen. Xen makes it a little more exciting because instead of having two essential files to be loaded (the kernel and the initrd/initramfs) you have three (the Xen kernel plus the other two). So we need to chain to a different boot loader. The Gentoo Wiki has good information on installing this [3].

The summary is that you need to chain the mboot.c32 loader from PXE which is then used to load the Xen kernel, the Linux kernel, and the initrd. Below is an example that I attempted. This loaded the correct files, booted Xen, and then hung. I didn’t investigate the cause.

DEFAULT mboot.c32 xen-3.2-1-i386.gz dom0_mem=258048 --- lenny/vmlinuz-2.6.26-2-xen-686 ro xencons=tty console=tty0 selinux=1 root=/dev/nbd0 ip=dhcp nbdroot=192.168.0.1,12345 --- lenny/initrd.img-2.6.26-2-xen-686

The configuration for mboot.c32 is particularly ugly. I think it would be better to have a replacement PXE loader which includes the mboot support.

I ended up deciding not to use NBD for the machine in question, the process of upgrading kernels (which is not uncommon on a test machine) would be made more difficult by the process of copying them to the tftp server, I guess I could write a script to rsync them. I had a problem with the system shutdown scripts killing the nbd-client process and hanging the system, I guess I could patch the shutdown scripts to ignore certain processes (this would be a good feature) or I could use SE Linux policy to prevent nbd-client from being killed by any domain other than sysadm_t. But generally it seemed to be more effort than saving 7W of power is worth.

Mail Server Security

I predict that over the course of the next 10 years there will be more security problems discovered in Sendmail than in Postfix and Qmail combined. I predict that the Sendmail problems will be greater in number and severity.

I also predict that today’s versions of Postfix and Qmail will still be usable in 10 years time, there will be no remote security problems discovered other than DoS attacks.

I’ve been having arguments about MTA security with Sendmail fans for over 10 years. I would appreciate it if the Sendmail fans would publish their own predictions, then we can wait 10 years and see who is more accurate.

I don’t recommend using Qmail (Postfix is what I use). But I think he wrote code that is unlikely to be exploited.

etbe – Russell Coker

Archives

Categories

Gnash and use of Free Software

Bad but Appealing Copyright Arguments

Free Books and T-Shirt Sales

Ownership of Laptops for Work

Healthcare and Free Software

The Streisand Effect and Chinese Barratry

Free K-12 Text Books

Increasing Productivity through Clean Air

NBD and PXE Booting on Debian

Mail Server Security

Archives

Email and RSS

Archives

Categories

Tags

Archives

Email and RSS