September 2008 Archives

eWeek: Financial Crisis Offers Opportunity for Linux, Open Source

By Darryl K. Taft

No Desktop Linux for You!

| 6 Comments

Those of us who use Linux on our desktops understand that it is a great desktop OS. In this capacity it is perfectly capable of meeting the needs of most people. There are however, two major factors which prevent it from becoming a viable alternative for average people in the US. Both also represent a certain corruption of the US political system. I'm referring to software patents and the 'Digital Millennium Copyright Act' (DMCA).

People use their computers to browse the web, send and receive email, word processing, catalog and re-touch pictures etc... Linux and the applications included with most distributions are capable of doing these things and doing them well. Today people have come to expect multimedia capabilities with their computers. This is the dilemma which Linux faces in the US. Particularly with commercial DVDs. Not because GNU/Linux apps aren't capable of playing these encrypted discs but because they are prevented from doing so by the DMCA. In particular DeCSS which was created through reverse engineering by Norwegian Jon Johansen. (otherwise known as "DVD Jon")

The DMCA is a bad law which was passed after heavy lobbying by big media and proprietary software companies. The DMCA prevents circumvention of copy-protection and this is why the use of DeCSS is technically illegal in the US. Common sense and a basic idea of right and wrong would dictate that people should be allowed to view legally purchased content. The MPAA doesn't see it this way. Which is why they sought to prosecute Jon Johansen in Norway. After two attempts the judge in the case asserted that since Johansen had legally purchased his DVDs he had a right to watch them even if that required circumvention of the CSS encryption. Johansen was aquitted of all charges.

While other nations are more concerned with consumer protections in some respects, the use of DeCSS in the US remains illegal. To deal with this, Linux distributors in the US do not include DeCSS and do not offer it in their repositories. Although DeCSS can be easily downloaded from repositories outside of the US. Novell goes one step further by purposely crippling xine libraries in openSUSE to prevent the playback of encrypted DVDs even with the DeCSS library installed. Canonical now sells proprietary DVD software for use with Ubuntu. This puts Linux at a disadvantage in that Windows includes this capability. DVD software for windows is also generally included with the purchase of a DVD-ROM.

We must also consider the case of the ubiquitous iPod. OSX and Windows users have the option of installing iTunes. This software doesn't exist for use on Linux. With Linux, iPod compatibility is a moving target. Because of the popularity of the iPod, developers of free music players/managers have worked for iPod compatibility only to see it broken by the next firmware update from the most closed software/hardware company on the planet.

Today, the average consumer expects multimedia capabilities 'out-of-the-box'. (or at least easily obtainable) Today GNU/Linux is artificially handicapped by the DMCA putting the operating system at a disadvantage when compared to other OSs with respect to multimedia capabilities. Of course the freedom of GNU/Linux vastly out weighs this disadvantage but most people are not aware of Free Software's existence nor it's ideals. They just want it to work.

This dilemma is not easily solved in the US. We could push for bad laws such as the DMCA to be changed or repealed, but with powerful, big-money lobbies pressuring Congress this would be an exercise in futility. Another option (and one already taken by some) is to use DeCSS to watch legally purchased content as a matter civil disobedience and fight it out in court if it comes to that. Until this problem is solved, GNU/Linux will not become mainstream. Which brings us to a point of contention for many in the free software community.

Many in the 'community' are not concerned with whether or not Linux becomes 'mainstream'. Some even have an aversion to the idea. Mainstream adoption of Linux is important. With wider adoption comes wider awareness and increased advocacy. This is vital when faced with proprietary vendors who seek to destroy the 'threat' of Free Software by any and all means necessary. (including corruption of our legislative process)

In part 2 we'll discuss software patents...

Noteworthy: GNOME 2.24.0 is out!

| 0 Comments

Vincent Untz: GNOME 2.24.0 is out!

After six months of work from the whole community, we can finally introduce GNOME 2.24.0 to the world! It's a good release, with cool new stuff and big improvements (as usual ;-)). Among other things, I'm happy that empathy got in, and also glad for the ekiga team to see that they managed to get ekiga 3.0 out in time! It's actually a bit unfair to just mention those two events, since many more people rocked; go check the release notes to learn about more changes.

GNOME 2.24



( More... )

SlashDot: China To Run Out of IPv4 Addresses In 830 Days

| 2 Comments
Posted by CmdrTaco on Wednesday September 24, @09:23AM
from the blame-canada dept.
JagsLive writes "China is running out of IP addresses unless it makes the switch to IPv6. According to the China Internet Network Information Center, under the current allocation speed, China's IPv4 address resources can only meet the demand of 830 more days and if no proper measures are taken by then, new Chinese netizens will not be able to gain normal access to the Internet. Li Kai, director in charge of the IP business for CNNIC's international department, says that if a netizen wants to get access to the Internet, an IP address will be necessary to analyze the domain name and view the pages. At present, most of the networks in China use IPv4 addresses. As a basic resource for the Internet, the IPv4 addresses are limited and 80% of the final allocation IP addresses have been used."

( More... )

Nokia N95/N96: Still the Best SmartPhone of All

| 0 Comments
175px-Nokian_logo.svg.pngAll of this 'hype' about the iPhone, G1, yada yada has just about reached a high crescendo.  It's just so silly.  They don't shine a candle to the Nokia N-series N95/N96.

120px-Nokia_N96_screen_landscape.jpgThere are still some N95s in the product channel but the newest is the N96.  You don't have a touch screen (horrors) or a keyboard (OMG), but it does do a lot.  Here's some of the things I do with it:


  • Sync your Evolution, Outlook, etc calendar, contacts, tasks with PC Suite (USB, Bluetooth)
  • Push IMAP email (Consilient)
  • Open more than one application at a time (no can do with iPhone)
  • Run Java applications (no can do with iPhone)
  • Use your N95 as a SIP-VoIP phone (e.g. with Skype, fring, TruPhone, SIPphone, Gizmo5, Asterisk)
  • USB 2.0 data connection
  • Bluetooth connectivity (OBEX, DUND, Keyboard, Headset, Multimedia)
  • 802.11 b/g Wi-Fi
  • InfraRed connectivity
  • 5 Megapixel Carl Zeiss Optics Camera
  • VGA Movie Camera (Play/Record)
  • Windows Remote Desktop (Using RDM+)
  • Virtual Network Connection (VNC)
  • Secure Shell (Putty)
  • Create your own 'hot spot' (Ad. Hoc with Joikuspot)
  • MicroSDHC hot swapable drive (8Gig)
  • Nokia Maps 2.0 (Entire US off-line map stored on MicroSD drive with Voice turn-by-turn Drive/Walk directions)
  • GPS Navigation with Nokia Maps, Google Maps
  • Great Browser (using Apple WebKit), but you can install Opera or Opera Mini (free)
  • Accelerometer (works great with RotateMe portrait/landscape and Step Counter--pedometer)
  • Tether your Laptop for Internet access via bluetooth (EDGE, 3G speeds with a data plan)
  • Rip TV/full length Movies to MPEG-4/DivX and watch (TI OMAP ARM11 supports 25 fps)
  • Voice activated commands
  • Sound Recorder (including phone calls)
  • FM Radio Reciever
  • Internet Radio (Visual Radio, Nokia Radio)
  • Podcasting (Create/Play)
  • MP3 Music Player
  • Stereo Speakers
  • TV Infrared remote control (Psiloc--very important for Men)
  • Stereo Mic/Headset connection
  • TV-out connect and view pics/play movies on your external display
  • DivX Movie Player
  • Adobe Flash Lite
  • Youtube Player
  • Apache Webserver (Nokia Web Server)
  • Replaceable/Rechargable battery (try that on the iPhone)
  • Barcode Reader
  • Adobe PDF Reader
  • Quick Office (Word Excel document support)
  • Bluetooth keyboard
  • Zip Archive support
  • Over the air install of Nokia SISX applications
  • Gmail and Google Apps Mail binary applications for Nokia
  • N-Gage Games
  • SMS/Multimedia/Email messaging

Ok, I think I hit oil so I'll stop drilling. :)

Nokia and Google's Android Threat

| 3 Comments
175px-Nokian_logo.svg.pngOk, the new T-Mobile HTC Android G1 arrived today.  Yawn.  Excuse me.  I'm just not impressed.  Why? Because I own a Nokia N95.  Nokia is 'king of the hill' and the N95 is the smartphone to beat.

Google's Android, the G1's operating system, has a LONG way to go to start to become a threat to Nokia's world-wide Cellphone market dominance.  The G1 certainly is nice and has some bells and whistles but it doesn't strike me as being 'better' than the Nokia N95

That the G1 is being compared by many media sources to the Apple iPhone amuses me.  The iPhone is a 'toy' when compared with Nokia's N95 and newest N-series product, the N96.

This article sheds light on Nokia's viewpoint toward Android and puts the size of their market share in perspective.  If you know anything about Nokia then you know about Symbian S60 and just how mature and great an operating system it is.  Developer support has and continues to be superb.  Nokia recently acquired Symbian and are beginning the process of open sourcing Symbian which will assuredly put pressure on Android and competiting open source vendors.

That will happen soon.

Noteworthy: DIRECTV Scores Points in the Linux Community

| 0 Comments
Written by Lisa Hoover - Sep. 22, 2008

Unlike NBC's coverage of the 2008 Olympic Games, DIRECTV customers who have the NFL Sunday Ticket SuperFan viewing package can now watch live football games on computers running Linux.
( More ... )

Apple Patch Process: A Mess

| 0 Comments
Apple's patch process a mess, say researchers

Constant updating shows Mac OS X isn't ready for the enterprise

September 22, 2008 (Computerworld) Apple Inc.'s patching process proves that the company isn't serious about moving Macs into the enterprise, security researchers said today.

One dissenting expert, however, said it was unfair to compare Apple's patching procedures with, say, Microsoft Corp.'s.

"You have to evaluate the patching performance of the company if you're looking at Macs," said Andrew Storms, director of security operations at vendor nCircle Network Security Inc. "And the last two weeks hasn't been a gold star for Apple." ( More... )



Friday, September 19, 2008 2:14 PM/EST

Nevada Deadline on E-Mail Encryption Looming

What happens in Vegas, may stay locked down in Vegas.

On Oct. 1, the state of Nevada will be requiring the encryption of all transmissions, such as e-mail, for all businesses that send personal, identifiable information over the Internet. The statute was signed into law in 2005 and is about to kick in as an enforceable law next month. Three years flies when you're raking in chips at casinos and enjoying the rising popularity of poker.

The Nevada law is stated as such:

NRS 597.970 Restrictions on transfer of personal information through electronic transmission. [Effective October 1, 2008.]

1. A business in this State shall not transfer any personal information of a customer through an electronic transmission other than a facsimile to a person outside of the secure system of the business unless the business uses encryption to ensure the security of electronic transmission.


As with any law about to go in effect, this one could be bound to catch many Nevada businesses off guard. In parallel, a few IT security vendors that sell encryption software and hardware are lining up to tell the technology media about it.

Think about all the hotels, resorts, golf courses, pawn shops, nightclubs, check cashing, ski lodges and small businesses this is going to effect. Not to mention all the businesses--the vice-ridden ones legal to Nevada only and otherwise--that incorporate in the tax-friendly state. Nevada is the West's version of Delaware (albeit a much sexier state, sorry Delaware).

Beyond the infrastructure impact, the statute itself looks like swiss cheese. Bryce K. Earl, a Las Vegas-based attorney with Santoro, Driggs, Walch, Kearney, Holley & Thompson, has been following the issue closely and believes there are some problems with the statute as it is on the books right now, namely the broad definition of encryption, the lack of coordination with industry standards and the unclear nature of penalties both criminal and civil.

"The statute's lack of specificity with regard to penalties will perhaps create the unintended consequence of opening up more liability," said Earl. That doesn't sound good, but again, nothing has happened just yet.

Earl explained why the broad definition of "encryption" by the state is potentially problematic. Here is the definition from the state's Web site:

NRS 205.4742 "Encryption" defined. "Encryption" means the use of any protective or disruptive measure, including, without limitation, cryptography, enciphering, encoding or a computer contaminant, to:

1. Prevent, impede, delay or disrupt access to any data, information, image, program, signal or sound;

2. Cause or make any data, information, image, program, signal or sound unintelligible or unusable; or

3. Prevent, impede, delay or disrupt the normal operation or use of any component, device, equipment, system or network.

Earl said an argument could be made that a password-protected document sent in an e-mail might be good enough to hold up with the state's broad definition of encryption here. Is that good enough?

Moreover, how the heck will Nevada enforce this?

Earl said at this time it was unclear, but he thinks that the state--which holds legislative session every other year--could address the statute for more clarity next year when the Nevada state government reconvenes. A possible-pending lawsuit may also help to better define the law for clearer interpretation, but as Earl hinted, that doesn't necessarily mean it will help that potential lawsuit.

The challenge for Nevada is that its intentions were good in trying to stem the tide of identity theft and criminal behavior online. But once again, the legal system and the IT industry are faced with potentially bigger compliance and liability issues than they probably intended. The disconnection is real.

As of posting time, representatives of the state had not gotten back to me with comment.

What should businesses do about this issue?

UPDATE: A spokesman for the state has directed me to a state assemblyman (who I will follow up with), but more interestingly, has pointed out this provision in the law:

NRS 193.170 Prohibited act is misdemeanor when no penalty imposed. Whenever the performance of any act is prohibited by any statute, and no penalty for the violation of such statute is imposed, the committing of such act shall be a misdemeanor.

Summer 2008: It's a Wrap!

| 0 Comments
Sum04-115.jpg
It seems like just yesterday we were at the beginning of the Summer, doesn't it?  So, here we are, at its close, the Autumnal equinox

Where does the time go?  Why is it that time passes more quickly as you age?  Summer would last 'forever' when I was a kid.

Anyhow, enough of that.  I am getting over it. 

I thought I would put together some notable IT Tech Highlights of the Summer of 2008 for you.



Tell me, what have I forgotten?

--Dietrich

New Deal: Buy a Toaster Get Investment Bank for Free

| 0 Comments
toaster.jpgAll of the losses that Wall Street incurred as a result of the cascading Sub-prime lending problem through yesterday have been erased on the news that the Feds plan to create some form of Financial structure to buy out the 'bad debt' (illiquid Mortgages) of ailing Financial groups.

This effectively shifts from the balance sheet debt from Banks over to the U.S. Federal Government.  The question is how will the Feds manage that debt in terms of packaging and resale?  Will the US Taxpayer pay for it?

That's one expensive toaster!

Your thoughts?


Happy Birthday Linux!

| 0 Comments
                          ooMMMMMMMooo
                       oMMMMMMMMMMMMMMMoo
                      MMMMMMMMMMMMMMo"MMMo
                     "MMMMMMMMMMMMMMMMMMMMM
                     MMMMMMMMMMMMMMMMMMMMMMo
                     MMMM""MMMMMM"o" MMMMMMM
                     MMo o" MMM"  oo ""MMMMM
                     MM MMo MMM" MMoM "MMMMM
                     MMo"M"o" "" MMM" oMMMMM"
                     oMM M  o" " o "o MMMMMM"
                     oM"o " o "  o "o MMMMMMM
                     oMMoM o " M M "o MMMM"MMo
                      Mo " M "M "o" o  MMMoMMMo
                     MMo " "" M "       MMMMMMMo
                   oMM"   "o o "         MMMMMMMM
                  MMM"                    MMMMMMMMo
                oMMMo                     "MMMMMMMMo
               MMMMM o             "  " o" "MMMMMMMMMo
              MMMMM          "            " "MMMMMMMMMo
             oMMMM                          ""MMMMMMMMMo
            oMMMM         o         o         MMoMMMMMMM
            MMMM               o              "MMMMMMMMMM
           MMMM"     o    o             o     "MMMMMMMMMMo
         oMMMMM       Happy Birthday           MMMMMMMMMMo
         MMM"MM            Linux!             "MMM"MMMMMMM
         MMMMMM           "      o   "         MMMMMMMMMMM
         "o  "ooo    o                     o o"MMMMMMMMoM"
        " o "o "MMo       "                o"  MMMMMMMM"
    o "o" o o "  MMMo                     o o""""MMMM"o" "
 " o "o " o o" "  MMMMoo         "       o "o M"" M "o " "
 "o o"  " o o" " " "MMMM"   o              M o "o" o" o" " o
 M  o M "  o " " " " MM""           o    oMo"o " o o "o " "o "
 o"  o " "o " " M " " o                MMMMo"o " o o o o" o o" "
 o" "o " o " " o o" M "oo         ooMMMMMMM o "o o o " o o o "
 M "o o" o" "o o o " o"oMMMMMMMMMMMMMMMMMMMo" o o "o "o o"
  "" "o"o"o"o o"o "o"o"oMMMMMMMMMMMMMMMMMMo"o"o "o o"oo"
        "" M Mo"o"oo"oM"" "               MMoM M M M
               """ """                      " """ "

ACTA: Criminalizing Freedom

| 0 Comments

The deal

The "Anti-Counterfeiting Trade Agreement" (ACTA) is currently being negotiated behind closed doors. Involved parties include the US, EU, Japan, South Korea, Australia, New Zealand, Canada, Mexico, and Switzerland. Since this treaty is being negotiated in secret what we do know comes from a document which was leaked on WikiLeaks.

Clearly this treaty is supported by big media companies and big proprietary software companies to 'protect' 'intellectual property'. However, the implications of this treaty, based on what we know, could have devastating effects on the sharing of Free Software. In the US, treaties which are ratified by the Senate carry the force of law. Normally, in the course of legislating a given bill, the bill is public as well as the debate on the bill. In short, the process is transparent. In the case of ACTA there is no public disclosure of the proposals. No public input or debate. Once the text of the treaty is finalized it need only be approved by one house of Congress. When ratified it becomes 'the law of the land'. The lack of transparency is troubling.

There are a few US Representatives involved in the drafting and negotiation of this treaty. Chief among them is Rep. Howard Berman (D-CA). His top four campaign contributors in 2006 were Time Warner, News Corp, Sony Corporation of America, and Disney. Coincidence? I don't think so.

Ramifications

ACTA could potentially force ISPs to police all traffic moving across their networks. Those in the US who use GNU/Linux and who download codecs from foreign mirrors (due to disastrous software patents) in order to use legally purchased content may be prevented from doing so. Media companies would love to end not only file sharing but the client software which enables it. This treaty could have detrimental effects on legitimate uses of p2p software. Such as in downloading Linux distributions. Of course as with anything, there will be unintended consequences. In many cases the unintended consequences are the intended goal of those who lobby officials.

This treaty is an end-run around the legitimate legislative process. It is done to further enrich content companies to the detriment of the people and their freedom. There are a few groups actively opposing this treaty such as the Electronic Frontier Foundation.

What do you think?

HP Linux OS?

| 1 Comment
Rumor has it that HP may have a small team working on a HP Linux OS.

As reported by Businessweek, HP is working on their own Linux-based operating system.

This doesn't come as a surprise. It's widely known that Windows Vista hasn't been exactly flying off the shelves. OEMs have counted on new releases of Windows to drive hardware sales. With the lackluster demand for Vista many OEMs are not realizing their projected sales figures. In the past, new versions of Windows were a blessing for OEMs that are tied to Microsoft. Now that blessing has become a curse.

Because Microsoft has maintained a monopoly they have been in the position to dictate terms in the PC market. Needless to say that this doesn't sit well with large OEMs.

We now know that Linux is a viable option on the desktop as witnessed by the myriad of netbooks which offer Linux with a compelling GUI as the default. We see Dell offering select systems with Ubuntu pre-installed. HP has partnered with Novell to offer the option of SLED on some systems. Acer's vice president of marketing, Gianpiero Morbello said in an interview with vnunet.com "We have shifted towards Linux because of Microsoft". As OEMs continue to explore the Linux alternatives there will inevitably be challenges.

Large OEMs exploring and shipping desktop Linux is a threat to Microsoft's profitable consumer PC monopoly. It's a safe bet that they won't stand idle and watch that monopoly slowly evaporate. After Microsoft stopped shipping XP to OEMs this past summer they were forced to backtrack a bit and continue to offer XP for 'netbooks' to compete with the various Linux offerings. Vista requires far too many resources to effectively run on this class of computer.

Steve Ballmer frequently points to Linux as infringing Microsoft's 'IP' (software patents) and implies that Linux distributors will eventually have to compensate Microsoft for it's use. As GNU/Linux starts to take a serious bite out of Microsoft's market share it is probable that they will turn to the courts. Unfortunately it is likely that many OEMs will try to enter into 'patent covenants' ala Novell under the guise of "interoperability". Will GPLv3 prevent this?

It's a very good thing that OEMs are waking-up to the potential of Linux on the desktop. As members of the community we must focus our efforts on making sure they do it right with respect to the community.

Security: SSHD Brute Force Attacks On The Rise

| 3 Comments
54policetux.gifYou've read the thread in various blogs where yet another smug Unix/Linux/Mac gearhead refuses to admit they have any security issues.  And then the obligatory blog comments flame war ensues.

If you've run any *ix box with sshd Secure Shell service running that takes full exposure to the Internet, say open with the default port 22, and have looked at your /var/log/messages (or wherever your distro stores sshd messages) file, you know that it has become a 'free-for-all'.

Every day, brute force dictionary-based attacks are run from points far and wide across the globe.  Some areas score a higher frequency than others.  China and South Korea are the leaders and the attacks often come overnight.  Here's what a typical brute-force sshd attack looks like as recorded in the log:


Jul 28 21:32:16 server sshd[10855]: Illegal user office from 213.191.74.219
Jul 28 21:32:16 server sshd[10855]: Failed password for illegal user office from 1.2.3.4 port 53033 ssh2
Jul 28 21:32:16 server sshd[10857]: Illegal user samba from 1.2.3.4
Jul 28 21:32:16 server sshd[10857]: Failed password for illegal user samba from 1.2.3.4 port 53712 ssh2
Jul 28 21:32:16 server sshd[10859]: Illegal user tomcat from 1.2.3.4
Jul 28 21:32:16 server sshd[10859]: Failed password for illegal user tomcat from 1.2.3.4 port 54393 ssh2
Jul 28 21:32:16 server sshd[10861]: Illegal user webadmin from 1.2.3.4
Jul 28 21:32:16 server sshd[10861]: Failed password for illegal user webadmin from 1.2.3.4 port 55099 ssh2


Things you can do to harden your system:

  • Edit your /etc/ssh/sshd_config and set "PermitRootLogin no" "Protocol 2"
  • Use passwordless Public Key Authentication, with "UsePAM no" in sshd_config.
  • Make system login ids and passwords as strong as possible
  • Install brute force detection software, such as DenyHosts or fail2ban
  • Move ssh from port 22 to a port above 1024
  • Set up a Firewall rule to 'rate limit' sshd

You should strongly consider using the passwordless Public Key method.  Setting "UsePAM no" will turn off PAM authentication so that remote connect attempts won't prompt for a login/password.  But, there may be times when remote access makes Public Key access impractical.  So, in that situation you'll want to use a "UsePAM yes" setting.

As I've said, port 22 takes a lot of hacking every day, so I've installed DenyHosts.

When the hack involves a fixed ip source, DenyHosts will add the offending ip to /etc/hosts.deny after the fifth failed login attempt.  Denyhosts works by scanning the /var/log/messages file.

When the hack involves a variable (forged) ip, and the scan is done in such a way that each successive login attempt comes from a 'bogus' source ip, these brute force attempts 'fly below the radar' so to speak of DenyHosts.

Moving the port 22 to another one above 1024 can reduce the brute force attempts but is not a guarantee they won't occur. 

You should be able to filter these sshd attacks and you can by adding two rules to your server's Firewall.  In openSUSE 11.0 you can add custom iptable rules to /etc/sysconfig/scripts/SuSEfirewall2-custom.  Putting the rules there will ensure that they will get applied any time you ifup/ifdown your eth0 interface or restart the Firewall or server.

These two lines have eliminated brute force attacks for the most part:

iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP


The two directives 'rate limit' ssh connection attempts to a maximum of 8 within a one minute time frame.

For those offenders who should be 'banned' from your system, add the file /etc/badips and this script to the SuSEfirewall-custom as well:

### BEGIN BAD IPS
if [ -f /etc/badips ]
then
  for BAD_IP in `cat /etc/badips`
    do
      iptables -I INPUT -s $BAD_IP -j DROP
      echo 'ip '$BAD_IP' banned'
      echo
    done
else
  echo "Can't read /var/badips"
fi
### END BAD IPS
Should you need to ban an ip, add each to /etc/badips on a separate line--restart the Firewall and they're history.

A directive from the root prompt of "iptables -L | more" will confirm your firewall settings.
A directive of "/sbin/SuSEfirewall2 status | more" will show you in summary form the iptable activity.

There are other security measures you can put into place such as Tarpit, but the above recommendations should put the sshd hackers out of business.

Thanks and Be Safe!
--Dietrich

Catalyst: Perl's answer to Ruby on Rails and AJAX

| 0 Comments
catalyst_logo.pngI've been using Perl for over ten years now.  It has been around since the 1980s and has won a place in the trusted scripting languages category for thousands of Web Developers, Programmers, and System Administrators.  You'll find Perl comes pre-installed with most every Unix and GNU/Linux distribution.  Perl does do so many things that distinguish it from any other Dynamic Scripting Language written that it has earned the distinction of being 'the duct tape of the Internet'.  When you become more acquainted with the language and its capabilities, that description becomes quite appropriate.

To the credit of Larry Wall, the Author of Perl, Perl has become so popular that a culture has formed around its legendary 'open source' roots which resulted in creation of a repository known as the Comprehensive Perl Archive Network, or CPAN for short.

CPAN has existed since 1995, and has, to date, over 6848 authors and 14283 high-quality modules that are freely downloadable (and directly usable in Catalyst) and licensed under the terms of the GNU General Public License (GPL) .

Perl is a Functional Procedural modular scripting language, that also supports 'Object-Oriented Programming' design but gives you the choice to pick and choose if and when you want to apply OOP and supports the adage that 'there is more than one way to do it'.  Programming-republic-of-perl.pngIf you have used another language such as 'C' or Pascal, you can get up to speed on the basics  quickly.  There are many Perl learning resources, including on-line tutorials, downloadable eBooks, and books.  My recommendation, if you buy books, is to start with some of the outstanding O'Reilly Publishers book selections.  Here are a few  recommended titles:




Learning Perl is excellent for beginners and provides a good basic foundation of concepts.  The others give a more in-depth look at all of the rich and varied features of Perl. 

If you make the time investment (a few hours), you will be pleased to discover just how easy Perl is to learn.  Some of the syntax may seem terse or arcane at first, e.g., regular expressions, but the above-listed books are well-written and do a good job of explaining everything you need to know.

This is all to preface the topic of this article Catalyst: Perl's answer to Ruby on Rails and AJAX.  Anyone doing full-time web development understands that the process is often repetitive and can easily grow into hundreds of coordinating web html, cascading style sheets, xml, javascript, template files.  Potentially, maintenance of these files can progressively become difficult if not problematic as scale and design complexity grow.  Making a design change can require making a change across several or more files.  Missing a change in one file can result in bringing down the web application.

200px-ModelViewControllerDiagram.svg.pngModel-View-Controller (MVC), attempts to manage these complexities and partitions away in a modular fashion the data and business rules (Model) from the user graphical interface (View) and actions taken by the user (Controller). 

Web applications employing MVC, or Frameworks, are implemented using web template systems.  The list of Frameworks in use has grown over time and some have become more popular than others, one being Ruby on Rails

Rails.pngThere's been a lot of press recently focused on Ruby on Rails as it has been used to develop the popular website Twitter.  Rumors about its inability to scale well have taken on a life of their own spurred by frequent reports of Twitter outages.  I am inclined to believe that those rumors are not justified.  It is probably more likely that there is a 'learning curve' in setting up distributed web server clusters that is unique for any implementation.  It's just that Rails has been put to the test on a large scale deployment most recently and is a relatively new untested Framework.

So, does Ruby on Rails being so popular imply it is better than say PHP with Joomla or Java with Spring or Perl with Catalyst?  Not really.  The successful implementation of any MVC depends on multiple factors, including the skill set and experience level of each individual tasked to contribute to the development of the web application--the programmer, web designer, database administrator, system administrator, system engineer, network engineer, all provide their own areas of expertise. 

The following comparisons between Perl/Catalyst and Ruby/RoR are taken from WikiVS Catalyst vs Ruby on Rails:

====================================================================


Ruby Language Comparison


Some features which differ notably from languages such as C or Perl:

  • Names which begin with a capital letter are treated as constants, so local variables should begin with a lowercase letter.
  • The sigils $ and @ do not indicate variable data type as in Perl, but rather function as scope resolution operators.
  • To denote floating point numbers, one must follow with a zero digit (99.0) or an explicit conversion (99.to_f). It is insufficient to append a dot (99.), because numbers are susceptible to method syntax.
  • Boolean evaluation of non-boolean data is strict: 0, "" and [] are all evaluated to true. In C, the expression 0 ? 1 : 0 evaluates to 0 (i.e. false). In Ruby, however, it yields 1, as all numbers evaluate to true; only nil and false evaluate to false. A corollaryregular-expressionnil on failure (e.g., mismatch). This convention is also used in Smalltalk, where only the special objects true and false can be used in a boolean expression. to this rule is that Ruby methods by convention -- for example, searches -- return numbers, strings, lists, or other non-false values on success, but
  • Versions prior to 1.9 lack a character data type (compare to C, which provides type char for characters). This may cause surprises when slicing strings: "abc"[0]ASCII code of the first character in the string); to obtain "a" use "abc"[0,1] (a substring of length 1) or "abc"[0].chr. yields 97 (an integer, representing the
  • The notation statement until expression, unlike other languages' equivalent statements (e.g. do { statement } while (not(expression)); in C/C++/...), actually never runs the statement if the expression is already true. This is because statement until expression is actually syntactic sugar over until expression; statement; end, the equivalent of which in C/C++ is while (not(expression)) statement; just like statement if expression is an equivalent to if expression; statement; end. However, the notation begin statement end until expression in Ruby will in fact run the expression once even in if the expression is already true.
  • Because constants are references to objects, changing what a constant refers to generates a warning, but modifying the object itself does not. For example, Greeting << " world!" if Greeting == "Hello" does not generate an error or warning. This is similar to final variables in Java, but Ruby does also have the functionality to "freeze" an object, unlike Java.

Some features which differ notably from other languages:

  • The usual operators for conditional expressions, and and or, do not follow the normal rules of precedence: and does not bind tighter than or. Ruby also has expression operators || and && which work as expected.
Ruby (< 2.0) lacks full support for Unicode, though it has partial support for UTF-8.

Popularity

Ruby on Rails sites directory Sites powered by Catalyst

Documentation

The Catalyst documentation is currently undergoing reorganization at http://catalystframework.org/, which is going to be powered by the Catalst-based wiki solution mojomojo. However, the most up-to-date Catalyst's documentation still resides on CPAN. At the moment, there is one book on Catalyst, which received mixed reviews [1].

RoR's documentation is organized in one place (http://www.rubyonrails.org/docs) and there are numerous books on Rails[2].

Performance

All of us working on Twitter are big Ruby fans, but I think it's worth being frank that this isn't one of those relativistic language issues. Ruby is slow.

General capability

Perl is said to make easy things easy and difficult things possible.

RoR makes easy things very easy and complex things very difficult:

Rails has a very strange learning curve. To get up a very simple website with a simple DB store, the language is great; you can get things up and running in no time, even if you're a newbie (...)

However, once you get past all the stuff Rails was designed to help you do, making it do interesting new things requires a TON of learning. All the "magic" it does, while great if you're doing things it was designed for, becomes a TOTAL headache when you're doing stuff it wasn't designed for, because all of a sudden you have to "understand the magic" in order to figure out why things aren't doing what you'd expect, and the reference documentation sucks -- several times, I've had to simply go dive into the library source code to try to figure out just what's going on, and even then, the "magic" makes it nearly impossible to easily figure out.


Application development speed

Rails is famous for its very rapid development of simple applications (Creating a weblog in 15 minutes).

Catalyst currently lacks a good set of screencast demonstrating its features. Two such resources are http://dev.catalyst.perl.org/wiki/Movies and Catalyst with FormBuilder screencast.

Features

Database

Catalyst supports a huge number of physical and virtual database backends, and different ORMs. RoR's favored ORM is ActiveRecord.

Perl/Catalyst has DBI, DBIx::Class, and Tangram which supports a large number of database backends (100+). Catalyst allows each model to be from different databases (even database sources). Some useful virtual databases exist (Amazon, Google, Excel documents, CSV files, etc.). DBIx::Class is the most popular ORM and supports features such as multi-column primary keys and character-based primary keys.

Rails supports the primary 6 database backends, although MySQL seems to be the best supported. Test and development "environments" can easily and automatically use different databases, however. Developers are not forced to use Rails' database layer, and some choose to use other Ruby based solutions. ActiveRecord is the most popular ORM for Rails. It has some design limitations in that it does not natively support multi-column primary keys.

The lack of support for multi-column primary keys is important, because many-to-many relationships require a junction table, whose primary key is made up of 2 columns referencing the two tables it links. Junction tables are required in most aspects of web application design: tagging items (an item may have many tags, and a given tag may belong to many items), representing user access roles etc.

Unicode / Internationalization

Since Ruby doesn't have any specific facilities for managing Unicode strings[5], Rails' support for Unicode is not yet mature.

Perl supports Unicode natively and so does Catalyst. [6]

Debugging

Catalyst can be debugged remotely with ActiveState Komodo IDE, or locally with the built-in perl debugger[7]. Every Catalyst application is generated along with a test script. Catalyst has built-in logging and can be integrated with Log4Perl[8].

Testing

Catalyst allows for easy decoupling of the model from the web application, which permits separate testing of the database backend without going through the web application. RoR fills the controllers up with logic.


====================================================================

catalyst_book.pngVisit the Catalyst project homepage to learn more about this exciting Framework for Perl.

Also, if you have a serious interest in Catalyst development, please consider purchasing Jonathan Rockway's new Catalyst book, published by Packt Publishing, now available for purchase.  Get it now!

 

Novell v. Microsoft: Anti-Trust Woes Continue

| 2 Comments
gavel_judge_justice_266806_l.jpgIf you've been following along over a Groklaw, now that the SCO v. IBM lawsuit has effectively come to an end with IBM prevailing, Pamela Jones now turns her laser-precise attention to the ongoing Anti-Trust case between Novell and Microsoft regarding Novell's once thriving WordPerfect and QuattroPro product line. 

Yes, you read that right.  It's about WordPerfect and QuattroPro.  Anybody remember?  Bueler?...OK, I do! 

The legal process can be long and drawn out and it's taken this long for Novell to finally have their day in court on a case that was originally filed by Novell in 2004. 

What's At Issue

A subsequent appeal filed by Microsoft against Novell's several claims has been overturned with a remaining two (2) claims that will go forward in the Novell v. Microsoft Antitrust case. They are summarized by Groklaw:


CLAIMS FOR RELIEF

A. Count I: Monopolization Of The Intel-Compatible Operating Systems Market

151. Novell incorporates the allegations in paragraph 1 through 150 above.

152. Microsoft possessed monopoly power in the market for Intel-compatible PC operating systems software.

153. Microsoft willfully and wrongfully obtained and maintained its monopoly power in the Intel-compatible operating systems market by engaging in anticompetitive conduct to thwart the development of products that threatened to weaken the applications barrier to entry, including Novell's WordPerfect word processing application and its other office productivity applications, in violation of Section 2 of the Sherman Act, 15 U.S.C.§ 2.

154. Through this misconduct, Microsoft has harmed consumers and competition by, without limitation, depriving consumers of the lower prices and more rapid pace of innovation that competition would have brought.

155. As a direct, foreseeable, and proximate result of Microsoft's misconduct, Novell was damaged by, without limitation, lost sales of office productivity applications and a diminution in the value of Novell's assets, reputation, and goodwill in amounts to be proven at trial. Novell's injury is of the type the antitrust laws are intended to prohibit and thus constitutes antitrust injury. ...

F. Count VI: Exclusionary Agreements In Unreasonable Restraint Of Trade

174. Novell incorporates the allegations in paragraphs 1 through 173 above.

175. Microsoft's agreements with OEMs and others not to license or distribute Novell's office productivity applications or to do so only on terms that materially disadvantaged these products unreasonably restrained trade by restricting the access of Novell's office productivity applications to significant channels of distribution in violation of Section 1 of the Sherman Act, 15 U.S.C. §1.

176. Through this misconduct, Microsoft has harmed consumers and competition by depriving consumers of the lower prices and more rapid pace of innovation that competition would have brought.

177. As a direct, foreseeable, and proximate result of Microsoft's misconduct, Novell was damaged by, without limitation, lost sales of its applications and a diminution in the value of Novell's assets, reputation, and goodwill in amounts to be proven at trial. Novell's injury is of the type the antitrust laws are intended to prevent and thus constitutes antitrust injury.


This does not bode well for Microsoft, given their prior Antitrust conduct (United States v. Microsoft)

300px-Billgates.JPG

and given their most recent European Union Competition Case.

Recall the halcyon years when software vendors were able to innovate and be on a competitive footing in the market place.  Those were the 1980s and early 1990s before Microsoft Windows began to emerge.  It was a very good time offering many good, creative software solutions.

It is only beginning to feel that way again now with the emergence of disruptive forces such as Linux and open source.


How Did WordPerfect Go Wrong?

There are various 'theories' about why WordPerfect failed--I've extracted some of them from an article 'How Did WordPerfect Go Wrong', written by Ed Foster:

"[...The basic historic facts of the WordPerfect saga aren't in dispute. Early in the IBM PC era, Satellite Software's WordPerfect 4.X series supplanted WordStar as the most popular word processor, based largely on its macro capabilities, "reveal codes" feature, and the company's reputation for high-quality free support. But WordPerfect was late with its first Windows version, and then the bundling of Word with Microsoft Office on many PCs resulted in WordPerfect's sale - first to Novell, then Corel in 1996 - aimed at producing a competitive office suite. While retaining popularity in some markets, particularly legal circles, WordPerfect now generally gets little attention as a Word competitor compared to free software alternatives.

But there seems to be plenty of dispute about whether WordPerfect simply failed to compete or was a victim of Microsoft monopolistic practices. Some feel that deathblow the Office bundling dealt other productivity applications was just a real smart move on Microsoft's part. "I think Microsoft gets a lot of criticism that they DON'T deserve," wrote one reader. "I remember the days of Lotus 1-2-3 and Harvard Graphics and WordStar and GoldenGate, and life with MS Office is soooooooooo much better and more productive. All those open-source geeks wouldn't be nearly so effective if Microsoft hadn't thoroughly and clearly defined the target -- i.e., the user needs -- for them."

But others think Office allowed inferior Microsoft applications to win out over better products. "In reality, Office was a bit late to the party," wrote another reader. "While Word 2.x was failing to wow customers, Lotus 1-2-3, WordPerfect, and others were providing superior products. IMO, WordPerfect is still the superior product because it allows a savvy user to determine exactly where the formatting in a document is being adversely 'helped' by the application and allows deleting those control codes. Those were the leaders of the pack, Microsoft brought up the rear, then used FUD to crush them."

But another reader countered with a chronology of WordPerfect's self-inflicted wounds. "Frankly, WinWord 2.x was a great program, well ahead of its time, especially if you ran it on Windows 3.0/3.0a as opposed to 3.1x. WordPerfect 5.1 for Windows (Q4-1991) was a dismal failure -- totally unstable, not feature-laden, and it even used a DOS-based installation program! WordPerfect 5.2 (Q1-1992) was a massive bug-fix, albeit small & fast. WordPerfect 6.0 (Q4-1993) was another buggy piece of crap, but it showed potential. Only when WordPerfect 6.0a (April, 1994) came out was there something worthwhile on the Windows front. By mid-1994, 2 1/2 years after the first version of WordPerfect for Windows came out, was there something reasonably stable. But by then, the damage was done and MS-Office 4.2/4.3 was available."

Of course, others pointed out Microsoft didn't exactly make it easy for anyone to compete with its Windows applications. "MS Office crushed its competition for one reason and one reason ONLY -- undocumented application programming interfaces," wrote another reader. "WordPerfect ran into problems because they invested big-time in a new graphical product for the operating system Microsoft touted as the future -- OS/2 -- while Microsoft was busily writing a competing product using secret programming interfaces for their real operating system of the future - Windows. Microsoft created and exploited intentionally undocumented Windows capability to ensure that its competitors' products would run like a dog, thus ensuring MS Office was the only viable choice on Windows -- and of course locked users into Windows with monopolistic practices well-documented in the various lawsuits they lost. You are giving the wolf credit for the excellent taste of lamb chops."

There are other explanations, however. "WordPerfect indeed ran into trouble when it did not move quickly into the Windows environment," wrote an anonymous observer from WordPerfect's former neighborhood. "They had plenty of time to respond to it but chose not to for whatever reason they may have had. Their top two owners (49.5% ownership each) had cultural differences from each other that distracted them from paying attention to the future of the product at that time. They parted ways by selling the WordPerfect organization to Novell for about $700 million. WordPerfect's legendary support had begun to decline prior to that sale. By that time, many of their programmers and support people had been fired (some my close friends) and most offices were empty with the lights off. That was well over ten years ago."]..."

So, now some of those theories will be put to test.  I, for one, will be following this case along at PJs Groklaw daily to its outcome--that may take years.  But it may truly determine the fate of Microsoft and possibly result in their break-up into smaller competing companies (e.g., separating operating systems from applications lines of business much as what ultimately happened in the  AT&T Antitrust case).

With that closing thought, I pose this question to you:

Assuming Microsoft is judged to have violated Antitrust laws, should Microsoft be broken up into smaller competing companies?

As always please feel free to talkback in the comments section.

NBC Live Streaming NFL: Opts for Adobe over Silverlight

| 0 Comments
09000d5d805e3ee0_gallery_600.jpgIt's time for Sunday Night Football and I am doing something that I have never done before.  I am not grabbing the TV remote to check on football scores during commercials of my wife's TV show.

No, rather, I am using my HP AMD Turion64 X2 Pavilion running openSUSE 11.0 x86_64 with a VirtualBox 64-bit host running Windows XP Pro 32-bit and have fired up the Google Chrome browser to watch NBC NFL Football Live streaming over the internet--for FREE.  Thank you NBC!

The big deal is that NBC has chosen to go with Adobe AIR/Flash over Microsoft's Silverlight for the season.

Let me tell you I am on a RoadRunner 10u/1d Mb connection and the Chrome browser is holding its own--there are no crackles, stutters, jitters, clicks, pops--just a smooth clear feed with good audio.

What's more, it's not just one cam feed--its FIVE cam feeds that you can watch on inset windows or bring up full-screen on-demand--main, star, cable, sideline, and end zone cams--all running concurrent feeds to the screen.  Pretty remarkable stuff.

Here's a picture of the current action:View image

This is giving Microsoft's Silverlight a bit of a 'black eye' as the de facto Adobe Flash player and Adobe AIR are present on a majority of Windows PCs as compared to Silverlight, so there is some wisdom in NBC's having chosen Adobe.

Anyhow, it's back to the game and may the best team win (Chicago Bears vs Indianapolis Colts).

So, get your home PC 'tuned up' for next week!!  It's going to get a work-out!

--Dietrich

SUN xVM VirtualBox 2.0: Too Much Fun

| 2 Comments
virtualbox-logo.png
Not having enough fun yet?

As if using Linux wasn't fun enough, it just keeps getting better.

Just yesterday, SUN released a major version 2.0 of xVM VirtualBox, a virtual machine memory manager.  If you have been intimidated by or reluctant to try out one of the virtual machine memory managers, I'd suggest you give this one a try, because it is, bar none, the easiest, slickest, vmm of them all.  Don't bother with VMware Server unless you enjoy tying up a lot of disk space and don't care if your USB 2.0 is demoded to 1.0.  Better yet, VirtualBox makes good use of supported Intel-VT and AMD-V, which for all intents and purposes, makes, speed-wise, your VMs virtually indistinquishable from the local hardware.  

There isn't a Linux compile of Chrome just yet, and some users are resorting to using a WINE emulator hack to get it running, but I say why bother?  You can be up and running with a Windows VM in a matter of less than an hour and have any of your Windows kit at your fingertips right from Linux--on demand.  Particularly, one of the nice features one can pull off is starting your VM and then shutting it down (Ctrl-Q) with option 'Save the machine state', essentially suspending and writing an image to disk of the current state of your VM.  The benefit is that you can then launch your VM from suspended state and it boots up in less than 3 seconds on some of the newer dual-core processors.  Also a nice feature, pressing Ctrl-L will put your open Windows App in 'seamless mode', so that for all intents and purposes it appears as another window on the Linux Desktop--doing this with Google Chrome, for example.  Vista users will be pleased to learn that VirtualBox 2.0 now supports Vista 64-bit hosts.  Here's more of the skinny taken from SUN's press release:

"...Sun xVM VirtualBox is the powerful open source virtualization tool that makes software development easier. It also eases migration issues by enabling a single computer to run multiple OSes and applications simultaneously, with virtually no performance degradation. Sun xVM VirtualBox supports Windows, Mac OS, Solaris OS, and Linux hosts. The latest version of xVM VirtualBox adds support for 64-bit versions of Vista and RedHat Enterprise Linux. In addition xVM VirtualBox includes a new interface for managing a virtual Mac desktop, improved networking for Mac OS X and the Solaris OS, and improved performance on AMD chips. Customers who purchase an Enterprise Subscription receive a Right-to-Use License, allowing them to deploy xVM VirtualBox using their own software deployment tools. Enterprise Subscriptions start at $30 (USD) per user per year, which includes 24/7 technical support. Volume discounts are also available. What Can xVM VirtualBox Do? Sun xVM VirtualBox gives developers the flexibility to develop cross-platform applications without the need to maintain multiple hardware systems, thus lowering capital costs and increasing productivity. Sun xVM VirtualBox can also be extremely helpful during a desktop migration because users can continue to work with their familiar applications on the new platform. That saves training time and other IT resources..."

View image of Google Chrome running in 'seamless mode' on Linux Desktop

I can't say enough nice things about VirtualBox.  It has taken top spot with me over VMware and unless by some 'miracle' something new appears, it will stay that way for a long time.

So, hurry up!  Time's a wasting.  Go get your VirtualBox Now!  Trust me, you won't regret it.

Chrome Build for Linux: Missing pieces

| 2 Comments
Reflective_Google_Chrome_Icon_by_dert07.pngNot satisfied with having installed Chrome into Windows XP, I decided to follow the directions for svn checkout and compile found here.  The checkout ran without error.  The make returned errors (running on openSUSE 11.0).  Since this am, a small change to the build instructions page, which I hadn't refreshed was added at the top in a very nice red window.  Had I seen that, I would not have bothered going further:

Build Instructions (Linux)

This page describes how to build the Chromium browser in Linux. Read this if you're interested in testing the build or porting code.

Note: There is no working Chromium-based browser on Linux. Although many Chromium submodules build under Linux and a few unit tests pass, all that runs is a command-line "all tests pass" executable.
So, a Linux compile of Chrome will have to wait.

I'll keep an eye on the page to check for updated information.

If by chance any readers come across new information on how to build Chrome for Linux before I do, please give us a shout!

--Dietrich

Google Chrome: A Browser?

| 7 Comments
Google has announced the release of their new beta browser Chrome. This begs the question, why? After all we already have a truly awesome open source browser in Firefox. Do we need another browser in the market? With Firefox taking a huge bite out of MS Internet Explorer's market share do we really want to see Firefox face new competition from Google? Maybe these aren't even the right questions.

Let's start by looking at the whole picture. We should say that Google's Chrome is also a browser. It's primary function is far more than just browsing the web. It is a platform for Google apps which purportedly allows for offline usage. This is clearly part of Google's vision of 'cloud computing'.

With Chrome, Google now has a platform which they control which will allow for tight integration with their applications. And here people have been anticipating an eventual release of a full-blown Google Linux distribution. However with this development, the OS on any given client machine has just become less relevant. This sets the stage for an application ecosystem which is tied to no particular OS.

The people at Microsoft are undoubtedly alarmed. This constitutes a huge threat to one of their two biggest monopolies. All that will be needed to run Google apps will be a free, lightweight Linux distribution with Chrome. Of course people who must do some work from home may still be tied to Windows and Office in the short-term but casual computer users can now have a majority of their needs met through Chrome and Google apps. Google's strategy should be clear to everyone by now.

I'm not sure how many will subscribe to the idea of 'cloud computing'. I prefer to do my computing locally. Especially with critical or sensitive data. The idea of involving the 'cloud' in many things makes me a bit aprehensive.

The question I ponder now is, what does this portend for Mozilla and Firefox?