Search Results: "will"

1 November 2007

Michal Čihař: Czech pages about phpMyAdmin

After two weeks of testing, I'd like to announce Czech pages about phpMyAdmin - http://phpmyadmin.cz/. You will find there various tips and howtos for using phpMyAdmin as well as project and development news. I'd like to build there a community where people could find help about this tool in their native language, but I have no idea whether it has a chance to succeed. Anyway the domain name was cheap so I had to try to realize idea, which was sitting in my head for quite a long time.

David Nusinow: Call For Testing

I've just uploaded a new version of the xorg package to unstable. This package builds (somewhat confusingly, but trust me, there's a good reason) the xserver-xorg package that many people use to create their xorg.conf's. For this upload, we've been ripping out the logic in the xserver-xorg scripts that create the xorg.conf. The reason for this is that the X server can actually handle most of this configuration automatically at runtime, and I'm working on making it do even more. So rather than rely on a custom hacked together script we're moving towards a shared codebase that all linux and bsd distros should end up using to dynamically configure X at startup. This will be a significant win and it's really my primary release goal for Lenny.

So while this work is still ongoing, I'd like to ask that you all, our wonderful users of unstable, test these changes in the 7.3+3 package out. You see, we don't force an update to your xorg.conf, so your previous config should continue to work just like it always did. However, what we need to know if these slimmer xorg.confs work also. So if you have an xorg.conf that isn't customized, please copy and rename the copy somewhere (don't call the copy xorg.conf or else the server might load it even if it's not in the canonical /etc/X11 location) and run dpkg-reconfigure xserver-xorg to generate a new file. You'll see a lot less questions than in the past, but your old responses should be used by default. When you're done, restart the server and make sure it loaded like it used to. If not, please file a bug using reportbug against the xserver-xorg package.

This is still a work in progress, and I've still got a number of things I want to carefully extract from the scripts before the release, most notably any reliance on external programs like discover and xresprobe. But as things are, the configs should be slimmer and there's less time spent answering questions that aren't useful to getting a working X server running. I'm sure I'll send out another call for testing as I remove more major parts of the config, but this is an important step. Thanks everyone for helping make Lenny awesome!

31 October 2007

Andrew McMillan: CRM114 Awesomeness

I hate spam! Which probably puts me in the same camp as 99.99999% of the world. The other 1 in 10 million are, of course, the spammers, who seem to take the space invaders approach to sending e-mail: we'll keep sending you more until you die. A few years ago I used to only receive perhaps 1 every 100 seconds, which was pretty annoying, but Spamassassin was quite able to filter out 99% of those and let through about 1-2 each day, which I could deal with. My spam levels increased to maybe 1 every 20 seconds, and late in 2005 I implemented a second layer of spam filtering on my laptop using DSpam. This worked quite effectively, but DSpam is really not the tool for the job - it's much more appropriate as a company-wide antispam solution, and potentially as a replacement for Spamassassin. It drove me nuts on my laptop because it's resource usage slowed down the interactive response. When I got my new laptop at the beginning of the year I decided against continuing with my rather baroque mail setup and to leave the spam filtering on the server. What I didn't realise is that my spam rate had increased again to around 1 every 8 seconds, and it has been slowly driving me to distraction ever since. It seems to have cranked up another notch recently, to perhaps 1 every 3 seconds now, so that 1% making its way through Spamassassin was getting to a very annoying several hundred each day. The longer I took to resolve it, the more time I would be wasting dealing with it every day. What I chose to apply on this occasion was CRM114, which I had some vague idea might be able to help. I was fairly impressed by the relatively simple install, but what completely blew me away was the speed with which it was able to learn to be useful. Starting from scratch, it seems to be correctly classifying over 90% of my incoming mail after about 12 hours of training, on a total of only 75 'Unsure' messages. Even after only an hour it was getting over 50% (I'll describe my actual CRM114 installation process in a comment below). So far there have been no false positives. Now that CRM114 is installed I will be able to look into some of it's other mail classifying features too, and I'm really looking forward to that too.

Michal Čihař: Gammu test version 1.13.96

Finally this testing series is stabilizing and there are no known regressions. The latest big regression with encoding PDU data has been just fixed. Full list of changes: You can download from usual place: http://cihar.com/gammu/ I hope this will be really the last one before 1.14.0.

30 October 2007

Daniel Burrows: Here we go again...


[10/30/2007]
Version 0.4.7 "Where did all these
balloons come from?
And why am I wearing
a fake nose?"

- New features:

* The options dialogs have been completely replaced by a new
interface, based on a top-level list view. This fixes many
deficiencies of the old interface: it handles long strings more
gracefully, avoids many of the focus-handling bugs that the old
dialogs had, and should generally be better-behaved.
(Closes: #197976, #331200, #424708)

* Prompts that ask you to enter text will now wrap to multiple lines
when the text gets long, rather than hiding parts of the string.

* The online help and other Help-menu itmes are now top-level views,
which should make them somewhat more usable. (Closes: #434349)

* Support for the "Breaks" field and for trigger states (thanks to
Michael Vogt and Ian Jackson for patches and prodding).
(Closes: #438543)

* Two new styles, "PkgDowngraded" and "PkgDowngradedHighlighted",
are provided to control how downgraded packages look. By default
these packages look like any other installed package.
(Closes: #434442)

* aptitude can now display homepage URLs stored in the Homepage
field of packages.


There are bug-fixes too, but those aren't as fun. So instead I think I'll include some diffstat output. Everyone likes diffstat!


daniel@alpaca:~/programming/aptitude/head$ hg diff -r 0.4.6.1:0.4.7 diffstat
.hgtags 1
NEWS 92 +
b/src/apt_config_treeitems.cc 477 ++++++
b/src/apt_config_treeitems.h 156 ++
b/src/generic/util/browser.h 42
configure.ac 20
doc/en/aptitude.xml 187 ++
help-fr.txt 10
po/ChangeLog 24
po/dz.po 188 +-
po/es.po 82 -
po/gl.po 19
po/ne.po 1277 +++++++++--------
po/pt.po 20
po/ru.po 97 -
po/sv.po 1854 ++++++++++++--------------
po/zh_CN.po 23
src/Makefile.am 2
src/apt_info_tree.cc 4
src/apt_options.cc 598 +++++---
src/apt_options.h 12
src/cmdline/cmdline_action.cc 6
src/cmdline/cmdline_check_resolver.cc 2
src/cmdline/cmdline_do_action.cc 134 +
src/cmdline/cmdline_prompt.cc 124 -
src/cmdline/cmdline_search.cc 4
src/cmdline/cmdline_show.cc 20
src/cmdline/cmdline_why.cc 64
src/defaults.cc 4
src/dep_item.cc 1
src/desc_parse.cc 2
src/generic/apt/apt.cc 32
src/generic/apt/apt.h 30
src/generic/apt/aptcache.cc 54
src/generic/apt/aptcache.h 21
src/generic/apt/aptitude_resolver_universe.cc 28
src/generic/apt/aptitude_resolver_universe.h 57
src/generic/apt/infer_reason.cc 22
src/generic/apt/log.cc 8
src/generic/apt/matchers.cc 531 +++++--
src/generic/apt/matchers.h 28
src/load_grouppolicy.cc 25
src/menu_tree.cc 12
src/pkg_columnizer.cc 19
src/pkg_grouppolicy.cc 27
src/pkg_grouppolicy.h 9
src/pkg_info_screen.cc 10
src/pkg_item.cc 31
src/pkg_item.h 7
src/pkg_subtree.cc 22
src/pkg_subtree.h 12
src/pkg_tree.cc 4
src/pkg_tree.h 1
src/pkg_ver_item.cc 31
src/pkg_ver_item.h 5
src/pkg_view.cc 24
src/reason_fragment.cc 10
src/solution_fragment.cc 5
src/solution_item.cc 76 -
src/solution_item.h 14
src/ui.cc 179 +-
src/vscreen/fragment.cc 140 +
src/vscreen/fragment.h 40
src/vscreen/ref_ptr.h 5
src/vscreen/testvscreen.cc 20
src/vscreen/vs_editline.cc 310 +++-
src/vscreen/vs_editline.h 33
src/vscreen/vs_tree.cc 113 +
src/vscreen/vs_tree.h 40
src/vscreen/vs_treeitem.cc 4
src/vscreen/vs_treeitem.h 21
src/vscreen/vs_util.cc 1
72 files changed, 4853 insertions(+), 2754 deletions(-)

MJ Ray: More cut-and-paste browser fun: message-id search engine

If you use a firefox-based browser, bookmark http://mid.gmane.org/%s then right-click it in your bookmarks menu, pick Properties and enter "message-id:" in the Keywords field. Then you can paste Message-Id lines from email headers (or some debian list posts) into your browser window and it will search gmane for it. Handy. (2007-10-31: 1 comment)

Marc 'HE' Brockschmidt: No DPL campaigning to see, please move along

Even though Adrian von Bidder suggests that I'm starting a bit early with the DPL campaigning, I thought I could add a few more thoughts to the blagosphere.

Adrian suggested to make the discussion of our of "vision of Debian" a regular event on debconf - I think it's a nice idea, but that doesn't mean we should keep silent about that topic the rest of the year. I think one of the problems we see in Debian is that we are missing an aim to strive for. We are currently just moving from release to release, while more and more developers have actually lost interest in stable releases. The impression that a common ground like Debian 4.0 is irrelevant seems to prevail, because the people most vocal in our user base usually want to see the newest and shiniest software on their desktop. We have been spending more and more effort to cater to their wishes and have ignored the fact that a majority of Debian-based installations are not run by such people, but by system administrators who do mass roll-outs and neither want nor need the newest X.org with more *bling*.

Ubuntu, the biggest Debian-based distribution, has found its users by packing up new software behind a nice installer, adding some branding elements and then shipping it. Stability is an issue for Ubuntu, but they don't spend as much time as we do on eliminating the last seemingly important bug in some esoteric software package before actually releasing. That observation is the ground for one of my ideas: Our current metric to determine how far testing is away from a release is counting the number of rc bugs - it doesn't matter if the rc bug is X.org crashing for all people or if it is a policy violation in a package with 12 users. Perhaps we should start thinking about a new metric, keeping in mind that for a majority of users, some bugs matter a lot and some matter not at all. With the release of etch, the number of installations of popcon has risen a lot, so for the first time, we have actual usage data that could help us with such a metric. There are a few problems with that approach, though:

I don't have more time right now, so the rest of my ideas will follow in the next few days, so stay tuned or add me to your killfile.

Theodore Ts'o: Tip o the hat, wag o the finger Linux power savings for laptop users

It’s interesting to see how far, and yet how much more work we need to do on power management for Linux. I recently got a new laptop — a Lenovo Thinkpad X61s — and using the powertop tool, I was able to configure my system to the point where in what I can “airplane mail reading mode” (mailbox preloaded into memory, USB disabled, wireless and ethernet disabled, backlight down to 30% brightness, sloppily written power hogs like Firefox and Notes — every single application writer should be forced to run powertap and explain why their program feels it necessary to constantly wake up the CPU), I can get my usage down to about 9.8 watts. Using the 8 hours extended battery, that’s 8 hours of battery life, although granted doing very little. On the flip side, if I’m doing a major kernel compile, I can drive up utilization up to almost 30 watts, which means less than 3 hours of battery life. So that’s definitely the good news; Linux can sharply reduce its power consumption to the point where it is highly competitive with Windows. (And probably better than Vista, just because that OS is so heavy and bloated.) So thanks and and a tip of the hat to Intel and to Arjan van de Ven for making such a useful tool like Powertop available. So now for the bad news. Getting down to this level of power saving thriftness, where the laptop is carefully sipping only the minimal amounts of power from the battery, is definitely a work in progress. First of all, you can only get this level of power savings by unloading a specific USB driver, uhci_hcd. This will disable low speed devices (including unfortunately the fingerprint reader and the EVDO WWAN device if you were silly enough to buy one that was built into the laptop as opposed to a stand-alone card that you can swap between laptops and lend out to friends as necessary). But how many users are going to open up a terminal window, su to root and type the command “rmmod uhci_hcd”? And know how to reload the driver using “modprobe uhci_hcd” when they need to use the USB devices again? A similar problem exists for Network Manager; when the user disables the network by right-clicking on the applet, why doesn’t it automatically bring down the interface, instead of forcing the user to manually su to root and then type the command “ifconfig eth0 down; ifconfig wlan0 down”? A more serious problem is the Intel Wireless driver for the 4965. Even with the wlan0 interface configured down, and with the RF kill switch enabled, keeping the iwl4965 driver loaded will still cost you an extra full watt of power. When you’re down to 9.6 watts, that means that keeping the iwl4965 driver loaded when you don’t need it will cost you a 10% reduction in your battery life! That’s just sloppy, and hopefully it will be fixed in a future update to the iwl4965 driver, but as long as you don’t mind manually removing and reloading it, you can work around this power-saving oversight. A bigger issue, though, one for which no workaround exists, is that unlike the ipw3945 drivers, which at least had private, non-standard iwpriv commands to engage the 802.11’s power-saving features, the iwl4965 driver has neither the non-standard Intel iwpriv interfaces, nor the standard iwconfig interfaces for enabling any kind of powersaving features, including changing the transmit power of the card. So while powertop deserves plenty of kudos, iwl4965 deserves a wag of the finger from a power saving viewpoint. No doubt Intel just needs to allocate more money to its Open Source Technology Center so it get more of its crack developers to work improving Linux support for their processors and chipsets. Speaking of which, I’m still waiting for an Intel x.org 965GM driver that can support compiz/beryl and simultaneously show video clips at the same time… And being able turn off the 50 interrupts/second generated by the video card when they aren’t needed because 3-d graphics aren’t currently in use, without requiring a restart of the X server, would also be a nice touch. The bottom line is that Linux power savings and Linux support for laptops in general is much better than it was a year ago, and a lot of credit has to go to the efforts of Intel’s teams producing such good work as powertop, their wireless drivers, and their open X server drivers. We still have a lot of work left to be done, though!

29 October 2007

Russell Coker: SecureCon 2007

I am running a tutorial and giving a talk about SE Linux at SecureCon 2007 [1]. The tutorial will go for 3 hours on Wednesday the 7th of November and will cover using SE Linux in CentOS 5 and Debian Etch, it will be a hands-on tutorial where every delegate gets ssh access to their own Xen DomU. The lecture is on Thursday the 8th of November and will be a 45 minute talk with an overview of SE Linux. It will be similar to my speech at the AUUG conference [2] but probably cover more of the features. The AUUG talk was driven by questions from the audience to spend a lot of time justifying SE Linux design decisions which took time away from other materiel. This wasn’t inherently a problem (I provided the information the audience seemed to want and everyone seemed happy), but I would like to cover more of the features and new developments.

Ingo Juergensmann: New Passport

Like Meike Reichle I'm going to order a new passport without fingerprints before this stupid new law becomes reality/active.
What Meike forgot to mention: you maybe need a certificate of birth (Geburtsurkunde) when you order a new passport. When you're ordering the new passport at your birth place, it's likely that you don't need such a certificate, but I moved in the meanwhile to another town and wanted to get a new passport last Thursday and was told from the people at the town hall that I need to have a certificate of birth.

Another interesting point to know: you can order your new passport anywhere in Germany, but when doing so somewhere else than where your main living is (Hauptwohnsitz), the costs will be doubled: instead of 59.- you'll need to pay 2x 59.- = 118.-.

Meike Reichle: Only three days left ...

Citizens of Germany have only three days left if they want to apply for a new travel passport that does not include its owner's fingerprints. From the 1st of November on German citizens who apply for a new travel passport will have to provide their fingerprints so they can be included in the passport's biometric section. Up until now, fingerprinting was a treatement reserved for those user reasonable suspicion of a crime. A new travel passport can be applied for at any time, whether the old one is expired or not. Your new passport will be valid for 10 years if you are 26 or older, otherwise it will be valid for only five years. A new passport costs 59,00 Euro respectively 37,50 Euro for those under 26 years. I for one do not welcome this further erosion of privacy so I got myself a new passport just in time. Guess I'll have to do a lot of travelling in the next 10 years ...

Ian Wienand: Non-thread safe C

Recently it has come up on the LKML and other blogs about how C is not thread safe. The nice piece of example code given is
int trylock()
 
    int res;
    res = pthread_mutex_trylock(&mutex);
    if (res == 0)
            ++acquires_count;
    return res;
 
At first glance it seems OK, and I wasn't exactly sure what the problem was until I pulled it apart. GCC is well within its rights to produce the following code (annotated for clarity).
push   %ebp                     ; setting up stack frame
mov    %esp,%ebp                ; save esp to ebp
sub    $0x8,%esp                ; make some room on stack
movl   <mutex>,(%esp)           ; copy mutex to stack
call   <pthread_mutex_trylock>  ; call pthread_mutex_trylock
mov    <acquires_count>,%edx    ; copy acquires_count to %edx
cmp    $0x1,%eax                ; set carry flag if result == 0
adc    $0x0,%edx                ; add with carry
mov    %edx,<acquires_count>    ; write back acquires_count
leave                           ; release stack frame
ret                             ; done!
This code uses a bit of a trick to avoid a branch around code. It uses the carry flag, which is simple enough to understand when adding. Consider if you are adding 0001 + 1111 you end up with 11111, where the top bit is the carry bit. You can then feed this carry bit into another part of the addition operation if you were, say, using two 32 bit numbers to represent a 64 bit number on a 32 bit system. The trick uses the dual nature of the carry flag as a "borrow" bit; if a < b when a - b then the bit is set. Consider the simplest case of 0 - 1 -- the carry bit is set to indicate to the next operation that a bit needs to be borrowed. Imagine for a moment we have a four bit machine and want to do the 8-bit unsigned operation
1111 0000 -   (240) -
0000 0001     (  1)
==== ====
First we do 0000 - 0001 which leaves us 1111 with the borrow bit set. Then we do 1111 - 0000 but take note that the borrow bit is set, so get rid of the borrowed bit, leaving us 1110. Putting the two together gives us 1110 1111 or 239. Therefore the cmp $0x1, instruction (which is really just result - 1 with no output but setting flags) can only set the carry flag (i.e. borrow a bit) if the value is 0; any other value in result means there will be no need to borrow and the carry flag is not set. Consequently the add with carry (adc) will add one to the result only if the carry bit was set. A neat trick which avoids a jump, but not so much thread safe: if you are interrupted after the cmp but before the mov store you can write back the wrong value. Most people (including me till 5 minutes ago) looking at the code would assume that it was safe on the theory that acquires_count is not touched if you don't have the lock because it is inside the if statement. Interestingly, the Intel compiler does the simpler jump method
push   <mutex>                     ; push argument
call   <pthread_mutex_trylock>
pop    %ecx                        ; get return addr on top
test   %eax,%eax                   ; AND %eax,%eax
jne    <trylock+0x16>  --------+   ; if that wasn't 0, jump out
addl   $0x1,<acquires_count>    
ret                    <-------+   ; done!
Frankly I have no idea which one is faster/better (I would guess the second one because you don't always dirty a cache line, but you'd have to measure that against the cost of the branch) but obviously GCC thinks one thing and Intel thinks another and I bet if you put them in a room together you would end up with 3 opinions! I think the major point is that once upon a time it was mostly people writing kernels doing things like accessing I/O ports or other memory mapped areas that needed to be very careful the compiler didn't optimise out (or in) something incorrectly. With multi-threaded C code that problem moves up to the application developer too. A different instruction set can help here. The Itanium version is possibly less prone to this sort of thing because predication makes it faster to implement conditional branches -- any instruction with a predicate that is not set is skipped. The load and add is safe because it will only be done with the lock held. However, if anyone is wondering why Itanium come with such big caches, the difference between the 6 line version and the Itanium version below should answer that.
 [MII]       alloc r32=ar.pfs,4,3,0               ; alloc stack frame
             mov r33=b0                           ; return pointer
             mov r34=r1
 [MMI]       addl r14=72,r1;;                     ; r11 = &mutex from GOT
             ld8 r11=[r14]                        ;
             nop.i 0x0;;
 [MIB]       mov r35=r11                          ; put into argument 1
             nop.i 0x0
             br.call.sptk.few b0=<pthread_mutex_trylock>
 [MII]       cmp4.eq.unc p0,p6=r8,r0              ; if result !0, set predicate p6
             mov.i ar.pfs=r32
             mov r1=r34;;                         ; load acquires_count from GOT
 [MIB]       addl r10=144,r1                      ;
             nop.i 0x0
       (p06) br.cond.dptk.few <trylock+0x80>;;    ; jump to [1] if p6 set
 [MII]       ld4 r9=[r10]
             mov b0=r33
             addl r3=144,r1;;
 [MMI]       adds r2=1,r9;;                       ; acquires_count++
             st4 [r3]=r2                          ; save updated value
             nop.i 0x0
 [MIB]       nop.m 0x0                            ; [1]
             nop.i 0x0
             br.few <trylock+0x90>;;              ; jump to [2]
 [MII]       nop.m 0x0
             mov b0=r33
             nop.i 0x0;;
 [MIB]       nop.m 0x0                            ; [2]
             nop.i 0x0
             br.ret.sptk.many b0;;
I guess the moral of the story is that multi-threading is hard, but we knew that anyway.

28 October 2007

Adam Rosi-Kessel: Growing Up on YouTube

My daughters are perhaps among the first who will grow up seeing much more YouTube than POTV (my newly coined acronym, “Plain Old TV.”) Esther, now 2 , has still never seen anything on a television (recorded, broadcast, or cable). (Havi, a week old today, may not have seen anything at all at this point.) In addition to frequently watching videos from her own blog, Esther loves YouTube. Her most requested videos are embedded below, thanks to the excellent recently-installed Viper’s Video Quicktags. Thus Esther may never know anything but on-demand and user-generated culture. At least those will be her basic assumptions about how it’s supposed to work. It’s possible that this next generation will spell the end of network-scheduled and traditional advertising-interrupted media. I can never understand why anyone would bother to arrange their schedule to watch a show on TV and sit through commercials when they can rent it from Netflix or buy it from Amazon or iTunes and watch it when and how they want — and I grew up, to some extent, with the old TV model. Esther can barely wait for whichever video she wants now. I can’t see her putting up with content on someone else’s schedule as she grows up. Now the videos, as promised (both strong indicators that Esther adheres to the Long Tail theory): Actually, it turns out I didn’t coin POTV. It’s already defined here. Technorati Tags: , , ,

Neil Williams: cross-building transition complete

The rewritten apt-cross using the code from NorthernCross in libcache-apt-perl has just migrated into testing. Hinted alongside the new dpkg-cross and libdebian-dpkgcross-perl and emdebian-tools, this completes the first part of the transition.
I've been waiting for the migration to upload new versions but there isn't a new transition to start - yet.
Next stage will be to complete the support for the new dpkg-cross in dpkg itself (439979) and migrate the cross-config.$arch files into dpkg-dev. That only then leaves the dpkg-cross script itself, starting the next transition. On course to remove dpkg-cross before Lenny.

Russell Coker: Xen and Security

I have previously posted about the difference between using a chroot and using SE Linux [1]. Theo de Raadt claims that virtualisation does not provide security benefits [2] based on the idea that the Xen hypervisor may have security related bugs. From my understanding of Xen a successful exploit of a Xen system with a Dom0 that is strictly used for running the DomU’s would usually start by gaining local root on one of the DomU instances. From there it is possible to launch an attack on the Xen Dom0. One example of this is the recent Xen exploit (CVE-2007-4993) [3] where hostile data in a grub.conf in a DomU could be used to execute privileged commands in the Dom0. Another possibility would be to gain root access to a DomU and then exploit a bug in the Xen API to take over the hypervisor (I am not aware of an example of this being implemented). A final possibility is available when using QEMU code to provide virtual hardware where an attacker could exploit QEMU bugs, an example of this is CVE-2007-0998 where a local user in a guest VM could read arbitrary files in the host [4] - it’s not clear from the advisory what level of access is required to exploit it (DomU-user, DomU-root, or remote VNC access). VNC is different from other virtual hardware in that the sys-admin of the virtual machine (who might be untrusted) needs to access it. Virtual block devices etc are only accessed by the DomU and Xen manages the back-end. The best reference in regard to these issues seems to be Tavis Ormandy’s paper about hostile virtualised environments [5]. Tavis found some vulnerabilities in the QEMU hardware emulation, and as QEMU code is used for a fully virtualised Xen installation it seems likely that Xen has some vulnerabilities in this regard. I think that it is generally recommended that for best security you don’t run fully virtualised systems. The remote-console type management tools are another potential avenue of attack for virtualised servers in the case where multiple users run virtual machines on the same host (hardware). I don’t think that this is an inherent weakness of virtualisation systems. When security is most important you have one sys-admin running all virtual machines - which incidentally seems to be the case for most implementations of Xen at the moment (although for management not security reasons). In ISP hosting type environments I doubt that a remote console system based on managing Xen DomU’s is going to be inherently any less secure than a typical remote console system for managing multiple discrete computers or blades. I have just scanned the Xen hypervisor source, the file include/asm-x86/hypercall.h has 18 entries for AMD64 and 17 for i386 while include/xen/hypercall.h has 18 entries. So it seems that there are 35 or 36 entry points to call the hypervisor, compared to 296 system calls on the i386 version of Linux (which includes the sys_socketcall system call which expands to many system calls). This seems to be one clear indication that the Linux kernel is inherently more complex (and therefore likely to have a higher incidence of security flaws) than the Xen hypervisor. Theo’s main claim seems to be that Xen is written by people who aren’t OpenBSD developers and who therefore aren’t able to write secure code. While I don’t agree with his strong position I have to note the fact that OpenBSD seems to have a better security history than any other multi-user kernel for which data is available. But consider a system running Xen with Linux in Dom0 and multiple para-virtualised OpenBSD DomU’s. If the Linux Dom0 has OpenSSH as the only service being run then the risk of compromise would be from OpenSSH, IP based bugs in the Linux kernel (either through the IP address used for SSH connections or for routing/bridging to the OpenBSD instances), and from someone who has cracked root on one of the OpenBSD instances and is attacking the hypervisor directly. Given that OpenSSH comes from the OpenBSD project it seems that the above scenario would only add the additional risk of an IP based Linux kernel attack. While a root compromise of an OpenBSD instance (consider that a typical OpenBSD system will run a lot of software that doesn’t come from the OpenBSD project - much of which won’t have a great security history) would only lose that instance unless the attacker can also exploit the hypervisor (which would be a much more difficult task than merely cracking some random daemon running as root that the sys-admin is forced to install). Is the benefit of having only one instance of OpenBSD cracked due to a bad daemon enough to outweigh the risk of a Linux IP stack? I’m sure that the OpenBSD people would consider that a better option would be OpenBSD in the Dom0 and in the DomU. In which case the risk of damage from a root compromise due to one badly written daemon that didn’t come from OpenBSD is limited to a single DomU unless the attacker also compromises the hypervisor. When working as a sys-admin I have been forced by management to install some daemons as root which were great risks to the security of the system, if I had the ability to install them in separate DomU’s I would have been able to significantly improve the security of the system. Another flaw in Theo’s position is that he seems to consider running a virtual machine as the replacement of multiple machines - which would be an obvious decrease in security. However in many cases the situation is that no more or less hardware is purchased, it is just used differently. If instead of a single server running several complex applications you have a Xen server running multiple DomU’s which each have a single application then things become much simpler and more secure. Upgrades can be performed on one DomU at a time which decreases the scope of failure (which often means that you only need one business unit to sign-off on the upgrade) and upgrades can be performed on an LVM snapshot (and rolled back with ease if they don’t succeed). A major problem with computer security is when managers fear problems caused by upgrades and prohibit their staff from applying security fixes. This combined with the fact that on a multiple DomU installation one application can be compromised without immediate loss of the others (which run in different DomU’s and require further effort by the attacker for a Xen compromise) provides a significant security benefit. It would be nice for security if every application could run on separate hardware, but even with blades this is not economically viable - not even for the biggest companies. I have converted several installations from a single overloaded and badly managed server to a Xen installation with multiple DomU’s. In all cases the DomU’s were easier to upgrade (and were upgraded more often) and the different applications and users were more isolated. Finally there is the possibility of using virtualisation to monitor the integrity of the system, Bill Broadley’s presentation from the 2007 IT Security Symposium [6] provides some interesting ideas about what can be done. It seems that having a single OpenBSD DomU running under a hypervisor (maybe Xen audited by the OpenBSD people) with an OpenBSD Dom0 would offer some significant benefits over a single OpenBSD instance.

Marc 'HE' Brockschmidt: Why THEY don't want me to collect all left socks

Yoe seems to believe I see a cabal in Debian. Let me assure you: I don't - and if there would be a cabal, I would be part of it. I've seen most of Debian, played around with NM, the release team, have seen how our buildd network works (or, in the specific case of today: mostly works) and have close contact to people in all other core teams of the project. I still haven't seen a sign of a Cabal.

I believe that there are "clusters" of people who work better with each other, simply because they have known each other for years and developed trust, but that's nothing I would actually mark as problem. I do the same. Many of our core people have too much work to do, mostly because getting a job well done is usually reason to give you more tasks until your performance becomes abysmal. That doesn't mean that they are bad people or do bad things intentionally, but often, they don't allow people to help them - the usual reasoning is "new people need training, training needs time, time is what I don't have => no new people". Obviously, that argumentation is flawed in the long run.

Anyway, on to the more technical details:


And, FWIW: I do hate conspiracy theories too. They come to life because people usually want to see the "bigger picture" - even if there is none and all of the weirdness in their environment can be explained by chance, human error and unknown social problems. And as I said - I don't believe there is a group of people making decisions that seem bad for Debian. I just believe a lot of people try to do their best for Debian - but they fail on a regular basis.

Wouter Verhelst: No, there is no cabal

I have a theory. There are two kinds of people in the world: those who see conspiracies everywhere, and those who don't. Personally, I'm part of the latter group; and it annoys me endlessly when people in the former group use conspiracy theories to explain what they don't understand—much in the same way that I don't really understand people who use religion to explain what they don't understand. An example of what I mean: Marc 'HE' Brockschmidt wrote about the stuff he'd like to change in Debian, since he feels many things go wrong. Now even though he doesn't mention the word 'Cabal' anywhere in there, it still reads as someone who sees conspiracy theories in Debian. No hard feelings, Marc, but... I could go on, but I guess you got the point. Like I said, conspiracy theories annoy the hell out of me. Marc, it isn't personal, you're just the last in a long list. Oh, and BTW: comments to this post will be moderated away.

27 October 2007

Russell Coker: Senator Online

I’ve been asked for my opinion of senatoronline.org.au which claims to be Australia’s only internet-based political party. The claim may be correct depending on what you consider to be “Internet based“. Here is a copy of their platform from their web site:
Senator On-Line is not aligned to any other political party it is neither Liberal nor Labor. Senator On-Line ( SOL ) is a truly democratic party which will allow everyone on the Australian Electoral roll who has access to the internet to vote on every Bill put to Parliament and have its Senators vote in accordance with a clear majority view. We will be running candidates for the upcoming federal Upper House (Senate) elections. When a SOL senator is elected a web site will be developed which will provide: Each person on the Australian Electoral roll will be entitled to one vote and only be allowed to vote once on each bill or issue. SOL senators will have committed in writing to voting in line with the clear majority view of the SOL on-line voters. Senator On-Line will enable broader community involvement in the political process and the shaping of our country. If you like the concept, please register your details and tell others about SOL.
Now at first glance it sounds like a good idea, the Liberal party (which is similar in all the bad ways to the US Republican party) has demonstrated what happens when a party gets away with entirely ignoring the wishes of the voters. But there are three significant problems with the Senator Online idea. The first is the issue of providing “Accurate information and balanced argument on each Bill“. We have seen many media outlets claiming that there is a debate about global warming (the debate ended years ago, the vast majority of scientists have agreed that global warming existed for a long time) and now the same media outlets are claiming that there is a debate about whether it will cause any harm to us in the near future (ignoring all the dams that are running low). One of the aims of the democratic process is that representatives who spend all their time working on politics can fully analyse the issues and also gain access to resources that are not available to the average citizen, thus being able to make better informed decisions. The next problem is that it can degenerate into mob-rule. The idea of having a tabloid TV show being able to directly control votes in the senate is not an exciting one. The final problem is how to ensure that each citizen gets the opportunity to have exactly one vote, solving this requires good security and identity checks involving viewing photo-id. The checks used for voting (merely asserting your name and residential address) might be considered adequate for an election, but are grossly inadequate for online voting where one false registration allows many false votes. I think it would be more interesting to have a populist party started that campaigns for the issues that have the most impact on the majority of citizens. Issues such as the fact that a couple on the median income can’t afford the median house price [1], the lack of job security that is caused by recent industrial relations legislation, the price of health-care, and the fact that any car which is affordable on a single median income (after money is spent on rent and other basic living expenses) will lack basic safety features such as air-bags. While the Green party has decent policies on these issues they have many other policies to consider. A party that solely concentrated on allowing more people to have decent health care, not risk losing their job, own their own home, and drive a safe car would get a lot of interest from people who don’t normally take much notice of politics.

Martin Zobel-Helas: Will Marc become DPL?

Marc wrote:
It’s this time of the year again: The one where I look back at my involvement in the project and decide that I’ve been a member long enough, so I should probably get out. For Debian, there are two ways to do it: Either become MIA or become DPL. […] So, what do you think? Marc, do you care what i think? If yes, here is my opinion: You really should run for DPL. I have the hope that you will be a very good DPL. Side note: Did the campaigning period start already?
No Tags

Christian Perrier: See you in BLR

The talks I proposed for FOSS.in, the major FLOSS conference in India, have been accepted for the Project Days, in the Debian-Ubuntu sessions. Thanks to the event organizers who will sponsor my travel to Bangalore, I'll probably leave as of Sunday Dec. 2nd and attend the entire conference from Dec. 4th to Dec. 8th. During earlier weeks, Sam Hocevar, the Debian Project Leader, also agreed to come to the conference and give two talks there. And, this morning, I had the nice surprise to discover that Lucas Nussbaum, one of our most tireless QA animators in Debian, will also come and give a talk about QA in Debian. So, that should make three French DD attending and, therefore, bring a strong Debian representation in this conference, which is something I definitely find interesting as I invested quite a lot of time and energy last years to increase the Debian presence in South Asia. This will certainly be a great occasion for us to give credit to the few people who contribute to Debian (and related projects) in India, and of course meet them in person. Please check the list of talks to get an idea of talks. Now for the challenge: the organizers expect our slides....by 7 days as of now. I don't know for Sam and Lucas but I have just begun working on one of my two talks (the i18n one, of course...you know: the one with the cute maps....). Would someone have a ready "How to contribute to Debian" talk somewhere? :-)

Next.

Previous.