Archives

Categories

Links January 2009

Jennifer 8 Lee gave an interesting TED talk about the spread and evolution of what is called “Chinese food” [1]. In that talk she compares McDonalds to Microsoft and Chinese restaurants to Linux. Her points comparing the different local variations of Chinese food to the variations of Linux make sense.

The CentOS Plus repository has a kernel with support for the XFS filesystem, Postfix with MySQL support, and some other useful things [2].

Mary Gardiner comments about the recent loss of a blog server with all content [3]. One interesting point is that when you start using a service that maintains your data you should consider how to make personal backups in case the server goes away or you decide to stop being a customer.

Val Henson makes some interesting points about the reliability of Solid State Disks (SSD) [4]. Some people are planning to replace RAID arrays of disks with a single SSD with the idea that a SSD will be more reliable, this seems like a bad idea. Also with the risk of corruption it seems that we have a greater need for filesystems that store block checksums.

Lior Kaplan describes how to have multiple Linux bonding devices [5], the comment provides some interesting detail too.

programmableweb.com has a set of links to sites that have APIs which can be used to create mashups [6]. One of the many things I would do if I had a lot more spare time is to play with some of the web APIs that are out there.

Gunnar Wolf has written some insightful comments about the situation in Israel and Palestine [7]. He used to be a Zionist and spent some time living in Israel so he knows more about the topic than most commentators.

Charles Stross has written an informative post about Ubuntu on the EeePC [8]. What is noteworthy about this is not that he’s summarised the issues well, but that he is a well known science-fiction writer and he was responding to a SFWA member. One of his short stories is on my free short stories page [9]. He also wrote Accelerando which is one of the best sci-fi novels I’ve read (and it’s also free) [10].

Don Marti has written about Rent Seeking and proprietary software [11]. It’s an interesting article, nothing really new for anyone who has followed the news about the coal and nuclear industries.

Erik writes about “The Setting Sun” and points out that Scott McNealy had tried to capitalise on the SCO lawsuit but Red Hat has ended up beating them in the market [12].

SE-LAPP

On Tuesday afternoon I gave a talk on behalf of KaiGai Kohei about SE Linux and the LAPP (Linux Apache, PostgreSQL, PHP/Perl) stack. KaiGai has blogged about this [1], unfortunately Google Translation does a poor job of Japanese and has particular problems with KaiGai’s work (could anyone who knows Japanese and English well please submit some tips to Google). KaiGai’s post is useful for links to his notes which are good background reading.

My talks about SE-LAPP and SE-PostgreSQL have been getting some notice, Bob Edwards referenced SE-PostgreSQL in his talk about database security.

It’s good to see KaiGai’s great work getting the notice that it deserves. I hope that it becomes a standard feature of the PostgreSQL code base in the near future!

Also Casey Schaufler, James Morris, and I have bought KaiGai a present of some Tasmanian wine, in recognition of his great work.

Status of SE Linux in Debian LCA 2009

This morning I gave a talk at the Security mini-conf of LCA about the status of SE Linux in Debian. Here is a summary of the issues I covered:

General Status

In Lenny (the new release of Debian that will come out in a month or two) SE Linux is working well. Considerably better than in Debian/Etch. There is an installation document on my documents blog [1], it’s very easy, only two scripts need to be run with no parameters to do most of the work (5 commands in total). There is more detail on installing SE Linux in Lenny (and other issues) in the Debian Wiki [2].

The default configuration of SE Linux is “targeted”. Previously we had separate policy packages for “targeted” and “strict”, now they are configuration options for selinux-policy-default. It is also possible to have some users in the unconfined_t domain (like the “targeted” policy) and some in confined domains such as user_t. Changing to strict can be done one user at a time, this needs further documentation.

Backports

I maintain an APT repository of i386 and AMD64 packages for better SE Linux support. This includes libraries built to not need an executable stack (see my previous blog post for details [3]). It also includes i386 libraries that don’t need text relocations AKA execmod (see my blog post about why i386 must die for details [4]).

My Lenny repository includes policy packages before they appear in Testing as well as the packages that are modified to fix the execmod and executable stacks issues. I plan to maintain this repository for some time, at least as long as I am actively using Lenny, but the content will change.

I might back-port the newer upstream policy to Lenny at some later date. If I do this it will be near the time that Lenny+1 is released and I will put it in a different location to my current Lenny repository.

I am currently deciding what to do with packages from external repositories such as debian-multimedia (see my previous post for the background) [5]. I may have to create a separate repository for non-standard Debian packages which I then modify to better support SE Linux.

I also plan to build packages of Security Enhanced PostgreSQL [7] for Lenny and Lenny+1. After demonstrating it’s capabilities I will suggest that it be considered for Lenny+1.

Play Machine

I have been running a Play Machine (open root machine) [6] for most of the last seven years. In the near future (probably the week after LCA) I will upgrade it to Lenny. One thing that I didn’t mention is the fact that I plan to demonstrate other things such as SE-PostgreSQL in Play Machines.

Training

I have a Xen server that is used for my Play Machine, I will run it as a SE Linux training machine and grant temporary ownership of a DomU to anyone who wants to learn and have a document with a list of tasks to complete to learn about SE Linux. I might be able to get it online this week. If so then I’ll make it available first to LCA delegates.

I will also set up a Bittorrent server for a Xen image for anyone who wants to go through the same SE Linux training program on their own machine – this will allow them a greater time limit and also avoid contention for my server. Unfortunately I have some problems with BitTorrent, I would appreciate any advice about running a torrent tracker.

Post Lenny

SE PostgreSQL is an exciting new development that I want to get in Debian. Initially I will create my own APT repository for it and include it in my Lenny repository. Hopefully it will become a standard feature in Lenny+1.

Security Enhanced X (the X window access controls) is a significant security feature. I hope to have that in Lenny+1, but it might not be possible.

Security Lessons from a Ferry

On Saturday I traveled from Victoria to Tasmania via the ferry (to attend LCA), they grossly failed in their security measures and provide three lessons for others:

  1. Make it possible for people to read security relevant documents .
  2. Make obeying the rules not be a cost and make the fact known.
  3. Don’t be lazy.

Here is the detail:

  1. When driving towards the ferry in a queue that lasted about 30 minutes just around the last corner there was a sign notifying me of the security rules. As soon as it was visible I started reading it but the security guard started frantically waving at me, the time taken to read it was holding up the queue. Therefore I never discovered the full list of things that I’m not supposed to do.
  2. One rule was that cylinders of gas (such as propane) were apparently banned and should be surrendered – presumably to prevent a gas leak in the confined space of the ship’s hold from risking an explosion. Anyone who did have such a gas cylinder would probably not want to have it stolen by the security people and would be inclined to lie and hope that the security people wouldn’t find it. If they had made it well known that such gas cylinders would be stored in safe keeping for the duration of the voyage and then returned then they would have been more successful.
  3. They wanted to check the luggage compartments of all vehicles. To check the tail-gate of the Kia Carnival van I was driving first required that all the bags which had been put over the back seat be removed (they were resting against the tail-gate and would fall out if it was opened). When the guard realised that they would have to wait for me to empty a lot of luggage out they decided to just trust me that I didn’t have any bad things on board (even though due to point #1 I didn’t know what bad things were). This problem happened a second time when I reached Tasmania and the guards wanted to search for fruit.

Security Enhanced PostgreSQL

Today was the first day of Linux Conf Au 2009 [1]. KaiGai Kohei was unable to attend the conference and give a database mini-conf presentation about his work on Security Enhanced PostgreSQL [2], so I gave the presentation in his place. It was a fairly difficult presentation and required that I learn a lot about PostgreSQL in a small amount of time. But the result seemed OK, the audience seemed reasonably interested and the questions indicated that there was no extreme negative reaction to it.

After the main presentation I gave a live demo using a Fedora 10 machine image that KaiGai provided. That ended about four minutes after the specified time, which was pretty good considering that I started about seven minutes late to allow the audience time to return from the lunch break.

Tomorrow I will give another talk for KaiGai on the topic of the Security Enhanced LAPP (Linux, Apache, PostgreSQL, and PHP) stack. I will also give a talk about the status of SE Linux in Debian/Lenny.

For both talks I have a separate laptop for the demos, so after tomorrow I will only take one laptop to LCA – which will probably be an EeePC (on some days at least).

Old PDA vs New Mobile Phone for PDA use

Since about 2002 I have been using a iPaQ [1] for taking notes while on the move. I have a pair of H3950 iPaQs that were given to me for the purpose of some software development work.

As modern mobile phones have telephony as a small part of their feature set I think it’s worth comparing a 2002 iPaQ with a 2009 mobile phone in terms of the note taking functionality.

I have just got myself an LG U990 “Viewty” mobile phone [2]. It has a screen resolution of 240*320 which is the highest resolution that is remotely common for a mobile phone – and the same resolution as my 2002 model iPaQ. The LG KC910 “Renoir” has a resolution of 240*400 and seems to be the only phone that my carrier provides which has a higher resolution. The iPhone [3] has a resolution of 480*320. So it seems that the most expensive modern mobile phone that is available in Australia has a screen resolution that is only twice that of a 2002 PDA. I believe that in Japan you could buy a PDA with a higher resolution than 240*320 in 2002.

My iPaQ is running Linux, so I can do whatever I want with it. I have a bar at the bottom of the screen with icons to launch, I configure it with the programs that I need most often and they are always one click away. While with my mobile phone I always have two large icons for paid services from my telco and I can’t add icons for the things that I want.

front view of iPaQ h3950 without sleeve front view of iPaQ h3950 with sleeve

My iPaQ has a virtual keyboard that can be displayed in portrait or landscape mode. The above pictures show it in the portrait mode which allows the greatest area of screen space for text. The landscape mode is good for entering long lines of text even though the total number of words that can be displayed on screen is smaller.

The size of my iPaQ is 134mm in height, between 77 and 84mm in width (it tapers) and 15.9mm thick without it’s protective sleeve. The protective sleeve (shown in the second picture) adds about another 5mm to the width and thickness.

My iPaQ is 1.76* the volume of my Viewty phone and at 184g vs 112g is 1.64* the mass. With it’s sleeve on it is about 2.4* the volume. It’s larger but with the sleeve it’s a lot more solid, a touch-screen is very fragile so putting a touch-screen device in your back pocket without a sleeve is not a viable option.

So I now own a mobile phone that has more storage, RAM, and CPU power than my iPaQ, but is less useful for the basic task of writing small documents and seems to have no facility for drawing diagrams. Most recent mobile phones have the ability to record voice (my Viewty can store 34 hours on it’s internal storage and supports mini-SD cards for extra storage). But my Viewty lacks the ability to pause voice recording so if I wanted a series of notes during a meeting I would get a series of short voice recordings rather than a single file with many items. The todo list is also fairly poor in the Viewty, so even disregarding the poor keyboard on the touch-screen it would compare badly to the iPaQ.

So it seems that an iPaQ that is almost seven years old when running Linux and the GPE Palmtop Environment [4] with with default configuration handily beats one of the latest and greatest mobile phones for all areas of common functionality.

If the Viewty had it’s source code available I would be tempted to contribute some patches (even if it was not free software).

Finally, before someone suggests an Android [5], Greenphone [6] or other phone that’s relatively open and programmable, I wanted a phone that had a good camera (by phone standards) and came essentially for free on an affordable contract. Maybe in two years time (when my current contract ends) there will be such a phone on offer. Mobile phones aren’t THAT important to me, so while I would like to encourage the development of open telephony platforms it’s a much lower priority than about a dozen free software projects.

I expect that in the future something like an Android will become a great mobile phone with great PDA functionality. But for the moment I’ll use an iPaQ and a Viewty.

Planet Flooding

One annoying thing that happens regularly is “Planet Flooding”. This is when one of the many blogs that is syndicated by a public Planet installation changes it’s time stamps and has 10 or more old posts appear as new. It’s doubly annoying when the blogger in question knows about the problem.

Planet Flooding is easy to solve. If you are changing your blogging software or doing something else that may result in old posts appearing to be new then all you have to do is configure your blog to include a small number of posts (maybe two or three) in the RSS feed. Seeing two old posts re-appearing plus a new post explaining it is not going to annoy anyone.

If you run a Planet (or Venus) installation then configure it to have a maximum number of posts per feed. For a Planet that syndicates feeds from a number of individuals and only includes a few days of traffic (which is probably a category that covers most Planets) there is no need for more than four items per feed.

For a severe case of Planet flooding (EG posts which always appear as being the newest and are therefore at the top of the list) the thing to do is to immediately remove the feed until the problem is fixed. Allowing a broken blog configuration to annoy other people is not doing any favors for the blogger in question, it simply drives people to filter the Planet to exclude the articles by that blogger. Yes it does take some work to adjust the configuration of the Planet, but that is surely no more work than replying to email rejecting requests for the configuration to be adjusted.

The first aim of running a blog or a Planet should be to make it readable, Planet flooding breaks this for the Planet and for the blogger who caused it. It is a technical problem and needs a technical solution (which can be temporarily removing the blog from the Planet syndication list).

Debian Multimedia and SE Linux

I have just had a need to install packages from Debian-Multimedia.org to correctly play .3gp files from my mobile phone (the stock Mplayer in Debian would not play the sound).

As part of getting this to work in a way that I like I rebuilt some packages so that shared objects would not demand an executable stack and added them to My SE Linux Etch repository [1]. The liblzo2-2 package is in Debian so I filed bug report #511479 against it. Not that I expect it to be fixed for Etch now that Lenny is about to be released. But it’s good to have the data in the bug tracking system for the benefit of all interested people.

The lame and xvidcore packages are only in the Debian Multimedia archive. I’ve sent email to the maintainer with patches. Not sure if he will accept them (again it’s not a good time for filing bug reports about Etch), but there’s no harm in sending them in.

The lame package also required execmod access, but I don’t have enough time to devote to this to fix it. For background information about execmod see my previous post [2].

See my previous post about executable stacks for more background information [3].

The next thing to do is to test this out in Lenny, hopefully I’ll get time to work on this tomorrow.

Video Camera for Shared Movies

I have never felt inclined to create content for Youtube due to the low resolution of the display and the fact that only one format is supported (Flash which is totally non-free).

The existence of blip.tv has inspired my interest in creating videos for distribution on the net. blip.tv has higher resolution than Youtube and supports multiple formats. Currently the multiple format support is limited to allowing users to upload whatever they want and then Flash (FLV) will be provided for download in addition to the original file(s). So for example I could upload MPEG4 and Quicktime movie files for the same content which would result in three download options (MPG, MOV, and FLV). It would be nice if they could support more formats as the default (maybe support transcoding to OGG), but it’s certainly a lot better than Youtube.

So the question then is how to create content. One option that I plan to use is Istanbul – the GNOME desktop session recorder [1]. It will record everything that happens on the desktop (or a section of the desktop) to an OGG file while also optionally recording audio input. This allows the creation of tutorials for performing various tasks on the computer.

Another option is to do animation, either completely computer generated or by combining a set of JPEG files into an animation file. This doesn’t interest me to the degree necessary to make me invest the necessary time.

But the most common way of producing video content is via a camera. So the question becomes what camera to get.

My current camera is a Sony Cyber-shot DSC-T5 [2]. It is a 5.1 mega-pixel camera with 3* optical zoom and supports 640*480 resolution movies at up to 30 fps. The quality of photos and video that it produces seems to be quite good, I don’t have any particular problem with the camera that I want to address by purchasing a new one, so a major aim of buying a new camera was the fact that it’s a few years old and something better must be available at a low price!

I asked for advice about this on my local LUG mailing list. One piece of advice that was offered by several people was to use a Digital Video camera with Firewire output to record quality video. They spoke about common digital cameras as “point and shoot” with the acronym “P&S” – which seems to be used as a term of abuse by people who are really into cameras. If using a DV camera with Firewire support (which is apparently a really important feature) then apparently Kino [4] is the program to use to capture the raw video data.

While the advice in regard to a digital video camera sounds good I’m not going to take it. Such DV cameras start at about $300 and appear to be physically larger. While a larger camera (with a larger lens) will give better quality pictures and higher frame rates with lower levels of ambient light I am planning to do my serious video recording in a controlled environment with reasonable lighting. Really I’m not THAT serious about video recording, so I don’t plan to spend $300 or more – I’ll accept the lower quality as a trade-off for lower price and greater convenience.

I have seen an advert for a camera described as a DC-777 at a good price from DirectBuy.com.au [3]. The camera in question is one that has no reviews anywhere on the net and seems to be a re-badged version of someone else’s camera. It initially sounded quite good with 11mega-pixel resolution, but the fine print shows that it has a 7MP CCD and uses interpolation to get a higher resolution. Also the movie capability is 640*480 at 30fps (the same as my Sony). So the benefit of using the DC-777 would be the rotating display which can face the same direction as the lens thus allowing someone who is making a video of themself to see what they are creating. This doesn’t seem to be $200 worth of benefit, but the camera might be a reasonable deal for someone who doesn’t already have a decent “P&S” digital camera.

Another interesting piece of advice I received from my local LUG was that the amount of time taken to get a good image (which determines the shutter speed on a good camera or the maximum frame rate for video) is determined in part by the size of the elements in the CCD. So with all other things being equal a camera that supports higher resolution will require longer exposure. For my use the benefit of higher resolution photos is often for the purpose of cropping pictures of objects that were too far away to allow completely zooming in. 3* optical zoom (as implemented in my current camera) is a limit when photographing objects that are far away in good light conditions (in poor light it’s often a factor of the lens size).

In the past when looking at digital cameras I would make the resolution of the picture the prime criteria – with the idea that bigger is better. But now it seems that the smart thing to do is to make optical zoom the prime criteria for general purpose camera use. Also having a larger lens is a significant benefit, but as the overall volume of the camera is going to be roughly proportional to the radius of the lens cubed it can’t get that big without some serious compromises on portability.

Obviously an SLR [5] offers significant quality benefits. But if you are unwilling to spend so much money a good result can be obtained by what are sometimes called “Big Zoom Digital” cameras. These are cameras with a body shape that resembles a SLR, they vary in size between the P&S cameras and SLRs, and have fixed lenses that are significantly larger than those of P&S cameras. I gave such a camera to a relative for Christmas and I was very impressed by the quality of pictures and movies that it produced. I chose a Kodak camera with 12* optical zoom which was quite impressive (unfortunately the 15* model had sold out). One of the benefits of a Big Zoom Digital camera over a DSLR is that as there is no option to replace the lens there is also no possibility to get dust inside the camera (which is apparently a problem with SLR cameras).

For my own use I plan to stick with my Sony Cybershot. I can’t get anything significantly better for an amount of money that I am prepared to spend, and I also don’t really want a larger camera. So I think I’ll buy a tripod (or maybe two tripods of different sizes), that should deliver a real benefit for my photography without costing much.

Update: One thing I forgot to mention is the film speed rating (AKA the “ISO” number) [6]. A higher ISO number means that the camera can take faster pictures in less light. The Wikipedia page reports that camera manufacturers are permitted to interpret the ISO scheme in several different ways, so they can essentially just make stuff up. Probably the best that can be said for the ISO number is that any camera which advertises it is aimed at more serious users and is therefore likely to be of higher quality. I’m sure that if I was to spend $700 or more then I would get a camera with an advertised ISO number that actually means something, but I don’t have any plans to ever do that.

Matt made a good comment that the quality of the glass matters. For an SLR you can consider the lens quality independently of the quality of the rest of the camera. But for cheap cameras it’s just a matter of the entire package.

Tidal River

Tim (a member of my local LUG) writes about some observations he has made of a nearby river and speculates on a tidal bore-like phenomenon [1].

One thing that surprised me was how short the list was on the Tidal Bore Wikipedia page [2], and the fact that is it missing an entry for Tidal River at Wilson’s Promontory [3] (where my family often spent the Christmas holidays when I was young).

Some of the tidal bores are described as having a wave as high as two meters, Tidal River is not so impressive, my observation was that during the 80’s it was about 40cm near the mouth of the river. The area near the river mouth had many bends when I last saw it which absorbed some of the energy of the wave (but I expect that the river changes course constantly so it might be straight from time to time).

On one occasion I River Surfed [4] about 500 meters upstream at Tidal River on a surf-mat (an inflatable surf-board).

I have searched for research into this issue, the Tidal Bore Research Society [5] seems to just maintain a list of tidal bores and not do any real research. Pierre Lubin, Stephane Glockner, and Hubert Chanson published a paper titled “Numerical simulation of turbulence generated by a tidal bore” [6]. Hubert Chanson at the University of Queensland has written an interesting paper titled “Physical Modelling of the Flow Field in an Undular Tidal Bore” [7]. Hubert seems to have published more papers related to tidal bores than anyone else (or at least more papers that are publicly accessible).