Archives

Categories

Voting and Linux Australia

Dhanapalan writes about the small number of voters for Linux Australia elections [1]. I guess that blacklist-voting is partly to blame for my inactivity in this regard. Linux Australia is running pretty well so I don’t think there’s a great need for me to go out of my way to vote.

One thing that could be done given that LCA is an LA event is to give a voting session keynote status at LCA. Have it happen just after a keynote speech and have some prize given away to a random person who attends – the free laptops that were given away one year are not required, a free lunch voucher would be more than enough to increase the attendance.

A final factor that needs to be considered is the number of elections that we may vote in. I vote in Australian elections (state and federal), Debian votes (General Resolutions and DPL elections), and sometimes my local LUG. The amount of attention that I can focus on political issues is limited and divided with other elections that are more important.

It’s too Hot in Melbourne

The Bureau of Meteorology has forecast temperatures of 43, 43, and 35 for today and the next two days. Those temperatures are in celcius. Yesterday was also above 40C so my entire house is hot.

As my airconditioner is not overly large (a smaller unit is more efficient) the back part of my house will get really hot even without extra computers so I’m turning off my SE Linux Play Machine. Also a couple of years ago a SE Linux Play Machine died during summer in a similar situation, and I prefer not to lose hardware.

It will be on again in a few days.

Links January 2009

Jennifer 8 Lee gave an interesting TED talk about the spread and evolution of what is called “Chinese food” [1]. In that talk she compares McDonalds to Microsoft and Chinese restaurants to Linux. Her points comparing the different local variations of Chinese food to the variations of Linux make sense.

The CentOS Plus repository has a kernel with support for the XFS filesystem, Postfix with MySQL support, and some other useful things [2].

Mary Gardiner comments about the recent loss of a blog server with all content [3]. One interesting point is that when you start using a service that maintains your data you should consider how to make personal backups in case the server goes away or you decide to stop being a customer.

Val Henson makes some interesting points about the reliability of Solid State Disks (SSD) [4]. Some people are planning to replace RAID arrays of disks with a single SSD with the idea that a SSD will be more reliable, this seems like a bad idea. Also with the risk of corruption it seems that we have a greater need for filesystems that store block checksums.

Lior Kaplan describes how to have multiple Linux bonding devices [5], the comment provides some interesting detail too.

programmableweb.com has a set of links to sites that have APIs which can be used to create mashups [6]. One of the many things I would do if I had a lot more spare time is to play with some of the web APIs that are out there.

Gunnar Wolf has written some insightful comments about the situation in Israel and Palestine [7]. He used to be a Zionist and spent some time living in Israel so he knows more about the topic than most commentators.

Charles Stross has written an informative post about Ubuntu on the EeePC [8]. What is noteworthy about this is not that he’s summarised the issues well, but that he is a well known science-fiction writer and he was responding to a SFWA member. One of his short stories is on my free short stories page [9]. He also wrote Accelerando which is one of the best sci-fi novels I’ve read (and it’s also free) [10].

Don Marti has written about Rent Seeking and proprietary software [11]. It’s an interesting article, nothing really new for anyone who has followed the news about the coal and nuclear industries.

Erik writes about “The Setting Sun” and points out that Scott McNealy had tried to capitalise on the SCO lawsuit but Red Hat has ended up beating them in the market [12].

SE-LAPP

On Tuesday afternoon I gave a talk on behalf of KaiGai Kohei about SE Linux and the LAPP (Linux Apache, PostgreSQL, PHP/Perl) stack. KaiGai has blogged about this [1], unfortunately Google Translation does a poor job of Japanese and has particular problems with KaiGai’s work (could anyone who knows Japanese and English well please submit some tips to Google). KaiGai’s post is useful for links to his notes which are good background reading.

My talks about SE-LAPP and SE-PostgreSQL have been getting some notice, Bob Edwards referenced SE-PostgreSQL in his talk about database security.

It’s good to see KaiGai’s great work getting the notice that it deserves. I hope that it becomes a standard feature of the PostgreSQL code base in the near future!

Also Casey Schaufler, James Morris, and I have bought KaiGai a present of some Tasmanian wine, in recognition of his great work.

Status of SE Linux in Debian LCA 2009

This morning I gave a talk at the Security mini-conf of LCA about the status of SE Linux in Debian. Here is a summary of the issues I covered:

General Status

In Lenny (the new release of Debian that will come out in a month or two) SE Linux is working well. Considerably better than in Debian/Etch. There is an installation document on my documents blog [1], it’s very easy, only two scripts need to be run with no parameters to do most of the work (5 commands in total). There is more detail on installing SE Linux in Lenny (and other issues) in the Debian Wiki [2].

The default configuration of SE Linux is “targeted”. Previously we had separate policy packages for “targeted” and “strict”, now they are configuration options for selinux-policy-default. It is also possible to have some users in the unconfined_t domain (like the “targeted” policy) and some in confined domains such as user_t. Changing to strict can be done one user at a time, this needs further documentation.

Backports

I maintain an APT repository of i386 and AMD64 packages for better SE Linux support. This includes libraries built to not need an executable stack (see my previous blog post for details [3]). It also includes i386 libraries that don’t need text relocations AKA execmod (see my blog post about why i386 must die for details [4]).

My Lenny repository includes policy packages before they appear in Testing as well as the packages that are modified to fix the execmod and executable stacks issues. I plan to maintain this repository for some time, at least as long as I am actively using Lenny, but the content will change.

I might back-port the newer upstream policy to Lenny at some later date. If I do this it will be near the time that Lenny+1 is released and I will put it in a different location to my current Lenny repository.

I am currently deciding what to do with packages from external repositories such as debian-multimedia (see my previous post for the background) [5]. I may have to create a separate repository for non-standard Debian packages which I then modify to better support SE Linux.

I also plan to build packages of Security Enhanced PostgreSQL [7] for Lenny and Lenny+1. After demonstrating it’s capabilities I will suggest that it be considered for Lenny+1.

Play Machine

I have been running a Play Machine (open root machine) [6] for most of the last seven years. In the near future (probably the week after LCA) I will upgrade it to Lenny. One thing that I didn’t mention is the fact that I plan to demonstrate other things such as SE-PostgreSQL in Play Machines.

Training

I have a Xen server that is used for my Play Machine, I will run it as a SE Linux training machine and grant temporary ownership of a DomU to anyone who wants to learn and have a document with a list of tasks to complete to learn about SE Linux. I might be able to get it online this week. If so then I’ll make it available first to LCA delegates.

I will also set up a Bittorrent server for a Xen image for anyone who wants to go through the same SE Linux training program on their own machine – this will allow them a greater time limit and also avoid contention for my server. Unfortunately I have some problems with BitTorrent, I would appreciate any advice about running a torrent tracker.

Post Lenny

SE PostgreSQL is an exciting new development that I want to get in Debian. Initially I will create my own APT repository for it and include it in my Lenny repository. Hopefully it will become a standard feature in Lenny+1.

Security Enhanced X (the X window access controls) is a significant security feature. I hope to have that in Lenny+1, but it might not be possible.

Security Lessons from a Ferry

On Saturday I traveled from Victoria to Tasmania via the ferry (to attend LCA), they grossly failed in their security measures and provide three lessons for others:

  1. Make it possible for people to read security relevant documents .
  2. Make obeying the rules not be a cost and make the fact known.
  3. Don’t be lazy.

Here is the detail:

  1. When driving towards the ferry in a queue that lasted about 30 minutes just around the last corner there was a sign notifying me of the security rules. As soon as it was visible I started reading it but the security guard started frantically waving at me, the time taken to read it was holding up the queue. Therefore I never discovered the full list of things that I’m not supposed to do.
  2. One rule was that cylinders of gas (such as propane) were apparently banned and should be surrendered – presumably to prevent a gas leak in the confined space of the ship’s hold from risking an explosion. Anyone who did have such a gas cylinder would probably not want to have it stolen by the security people and would be inclined to lie and hope that the security people wouldn’t find it. If they had made it well known that such gas cylinders would be stored in safe keeping for the duration of the voyage and then returned then they would have been more successful.
  3. They wanted to check the luggage compartments of all vehicles. To check the tail-gate of the Kia Carnival van I was driving first required that all the bags which had been put over the back seat be removed (they were resting against the tail-gate and would fall out if it was opened). When the guard realised that they would have to wait for me to empty a lot of luggage out they decided to just trust me that I didn’t have any bad things on board (even though due to point #1 I didn’t know what bad things were). This problem happened a second time when I reached Tasmania and the guards wanted to search for fruit.

Security Enhanced PostgreSQL

Today was the first day of Linux Conf Au 2009 [1]. KaiGai Kohei was unable to attend the conference and give a database mini-conf presentation about his work on Security Enhanced PostgreSQL [2], so I gave the presentation in his place. It was a fairly difficult presentation and required that I learn a lot about PostgreSQL in a small amount of time. But the result seemed OK, the audience seemed reasonably interested and the questions indicated that there was no extreme negative reaction to it.

After the main presentation I gave a live demo using a Fedora 10 machine image that KaiGai provided. That ended about four minutes after the specified time, which was pretty good considering that I started about seven minutes late to allow the audience time to return from the lunch break.

Tomorrow I will give another talk for KaiGai on the topic of the Security Enhanced LAPP (Linux, Apache, PostgreSQL, and PHP) stack. I will also give a talk about the status of SE Linux in Debian/Lenny.

For both talks I have a separate laptop for the demos, so after tomorrow I will only take one laptop to LCA – which will probably be an EeePC (on some days at least).

Old PDA vs New Mobile Phone for PDA use

Since about 2002 I have been using a iPaQ [1] for taking notes while on the move. I have a pair of H3950 iPaQs that were given to me for the purpose of some software development work.

As modern mobile phones have telephony as a small part of their feature set I think it’s worth comparing a 2002 iPaQ with a 2009 mobile phone in terms of the note taking functionality.

I have just got myself an LG U990 “Viewty” mobile phone [2]. It has a screen resolution of 240*320 which is the highest resolution that is remotely common for a mobile phone – and the same resolution as my 2002 model iPaQ. The LG KC910 “Renoir” has a resolution of 240*400 and seems to be the only phone that my carrier provides which has a higher resolution. The iPhone [3] has a resolution of 480*320. So it seems that the most expensive modern mobile phone that is available in Australia has a screen resolution that is only twice that of a 2002 PDA. I believe that in Japan you could buy a PDA with a higher resolution than 240*320 in 2002.

My iPaQ is running Linux, so I can do whatever I want with it. I have a bar at the bottom of the screen with icons to launch, I configure it with the programs that I need most often and they are always one click away. While with my mobile phone I always have two large icons for paid services from my telco and I can’t add icons for the things that I want.

front view of iPaQ h3950 without sleeve front view of iPaQ h3950 with sleeve

My iPaQ has a virtual keyboard that can be displayed in portrait or landscape mode. The above pictures show it in the portrait mode which allows the greatest area of screen space for text. The landscape mode is good for entering long lines of text even though the total number of words that can be displayed on screen is smaller.

The size of my iPaQ is 134mm in height, between 77 and 84mm in width (it tapers) and 15.9mm thick without it’s protective sleeve. The protective sleeve (shown in the second picture) adds about another 5mm to the width and thickness.

My iPaQ is 1.76* the volume of my Viewty phone and at 184g vs 112g is 1.64* the mass. With it’s sleeve on it is about 2.4* the volume. It’s larger but with the sleeve it’s a lot more solid, a touch-screen is very fragile so putting a touch-screen device in your back pocket without a sleeve is not a viable option.

So I now own a mobile phone that has more storage, RAM, and CPU power than my iPaQ, but is less useful for the basic task of writing small documents and seems to have no facility for drawing diagrams. Most recent mobile phones have the ability to record voice (my Viewty can store 34 hours on it’s internal storage and supports mini-SD cards for extra storage). But my Viewty lacks the ability to pause voice recording so if I wanted a series of notes during a meeting I would get a series of short voice recordings rather than a single file with many items. The todo list is also fairly poor in the Viewty, so even disregarding the poor keyboard on the touch-screen it would compare badly to the iPaQ.

So it seems that an iPaQ that is almost seven years old when running Linux and the GPE Palmtop Environment [4] with with default configuration handily beats one of the latest and greatest mobile phones for all areas of common functionality.

If the Viewty had it’s source code available I would be tempted to contribute some patches (even if it was not free software).

Finally, before someone suggests an Android [5], Greenphone [6] or other phone that’s relatively open and programmable, I wanted a phone that had a good camera (by phone standards) and came essentially for free on an affordable contract. Maybe in two years time (when my current contract ends) there will be such a phone on offer. Mobile phones aren’t THAT important to me, so while I would like to encourage the development of open telephony platforms it’s a much lower priority than about a dozen free software projects.

I expect that in the future something like an Android will become a great mobile phone with great PDA functionality. But for the moment I’ll use an iPaQ and a Viewty.

Planet Flooding

One annoying thing that happens regularly is “Planet Flooding”. This is when one of the many blogs that is syndicated by a public Planet installation changes it’s time stamps and has 10 or more old posts appear as new. It’s doubly annoying when the blogger in question knows about the problem.

Planet Flooding is easy to solve. If you are changing your blogging software or doing something else that may result in old posts appearing to be new then all you have to do is configure your blog to include a small number of posts (maybe two or three) in the RSS feed. Seeing two old posts re-appearing plus a new post explaining it is not going to annoy anyone.

If you run a Planet (or Venus) installation then configure it to have a maximum number of posts per feed. For a Planet that syndicates feeds from a number of individuals and only includes a few days of traffic (which is probably a category that covers most Planets) there is no need for more than four items per feed.

For a severe case of Planet flooding (EG posts which always appear as being the newest and are therefore at the top of the list) the thing to do is to immediately remove the feed until the problem is fixed. Allowing a broken blog configuration to annoy other people is not doing any favors for the blogger in question, it simply drives people to filter the Planet to exclude the articles by that blogger. Yes it does take some work to adjust the configuration of the Planet, but that is surely no more work than replying to email rejecting requests for the configuration to be adjusted.

The first aim of running a blog or a Planet should be to make it readable, Planet flooding breaks this for the Planet and for the blogger who caused it. It is a technical problem and needs a technical solution (which can be temporarily removing the blog from the Planet syndication list).

Debian Multimedia and SE Linux

I have just had a need to install packages from Debian-Multimedia.org to correctly play .3gp files from my mobile phone (the stock Mplayer in Debian would not play the sound).

As part of getting this to work in a way that I like I rebuilt some packages so that shared objects would not demand an executable stack and added them to My SE Linux Etch repository [1]. The liblzo2-2 package is in Debian so I filed bug report #511479 against it. Not that I expect it to be fixed for Etch now that Lenny is about to be released. But it’s good to have the data in the bug tracking system for the benefit of all interested people.

The lame and xvidcore packages are only in the Debian Multimedia archive. I’ve sent email to the maintainer with patches. Not sure if he will accept them (again it’s not a good time for filing bug reports about Etch), but there’s no harm in sending them in.

The lame package also required execmod access, but I don’t have enough time to devote to this to fix it. For background information about execmod see my previous post [2].

See my previous post about executable stacks for more background information [3].

The next thing to do is to test this out in Lenny, hopefully I’ll get time to work on this tomorrow.