Search Results: "ag"

24 September 2011

Biella Coleman: Hack Week On the Media

So much reporting on hacking is . so bad (no surprise to readers here). Worse is that term term was bandied out constantly during the News of the World Scandal. In contrast to this historical tradition, On the Media has curated a stellar Hack Week that provides depth, breath, and nuance; the producer of the show, Alex Goldman, poured an enormous amount of time, labor, and thought in compiling a rich set of materials to get at the term hackers, the many facets of hacking (from phreaking to hardware hacking) and best of all, interviewed the fantastic Marcia Hoffman from the EFF on one of the laws, the Computer and Fraud Abuse Act, whose massiveness (and vagueness) has the potential to do a lot of damage and which is often wielded against hackers (and many non-hackers as well). There is also an audio section on the term hacker, which I myself might have done slightly differently, emphasizing, that alongside the MIT hacker (covered so well by Steven Levy) phone phreaking (only called as such in 1973 but well and alive before then) fed into a transgressive tradition that was not simply about malicious hacking nor about the media portrayals that started to explode in the 1980s. The interview gets at the fact that there are differences and hackers can be quite sectarian but I might have pushed this fact a little further. All in all and after the ad nauseum use and abuse of the term hacking during the News of the World scandal (and its overabuse with Anonymous), this collection is the perfect antidote.

Biella Coleman: On Leaving NYU/NYC for Montreal/McGill

funny-pictures-cat-is-canadian Despite being on sabbatical last academic year, life was hectic and chaotic leaving me with next to no time to write entries here. Anonymous, which I had worked on for a few years, exploded. I was excommunicated from my house (due to a flood/something likely mold making be very sick) and had to commute to Princeton from the far reaches of Manhattan where I crashed at a friends house for 5 months, while fighting my landlords. I then decided to go on a job hunt primarily as I did not know what would happen with my housing situation in NYC but I was also pursuing some interesting opportunities. Though the housing issue was eventually resolved, in May a rare and enticing opportunity arose. Come January 2012 I will be joining the Art History and Communication Department at McGill University as the Wolfe Chair in Scientific and Technological Literacy. The decision to leave MCC NYU was torturous. The faculty is stellar. The graduate students are top notch and cream of the crop. And the digital media faculty is a force of nature, perhaps one of the deepest and most dynamic departments when it comes to the study of digital media. They also know how to treat their junior faculty right, which made it a place I respected and am deeply indebted to. But this type of opportunity is rare and it helped that NYC as wonderful as it is, is not my cup of tea. I wanted to eventually settle in one of the large Canadian cities, and Montreal was on the top of my list. I get to join one of the best universities in the world and a department whose work on digital media, STS, and politics converges with much of my own. The position provides resources, time, and room to cultivate scholarly work, help build a program of some sort in Science Technology Studies at McGill, and also engage with the public about the ethics and politics of science and technology. I will be teaching a class to joint BA/BS majors on scientific and technological controversies, a topic close to my heart. I also hope to create an open courseware website for my hacker course, which I will teach sometime in the 2012-2013 academic year. It is all that I can ask for, well, except for the weather. I would be lying if I did not admit that the winter scares the heck out of me I know some days I will feel just like this . lolcat4823558

Andreas Metzler: exim with support for TLS1.1 and TLS1.2

I have just uploaded exim4 4.76-4 to experimental. Compared to 4.76-3 the only addition are the changes from upstream's gnutls_fixes branch, making exim4 advertise and use TLS1.1 or TLS1.2 if available. We would appreciate some testing.

Martin-Éric Racine: Proposed updates for CUPS-PDF packages at Ubuntu

For those who use CUPS-PDF on Ubuntu, I have pushed some updated packages into Lucid-proposed, Maverick-proposed and Natty-proposed, mainly to make the package's post-install actions bulletproof, so that automated installs and PPD updates take place in a flawless way. Comments from anyone who tested these package updates are welcome on Launchpad bug #805947. Once these updates have been approved, I'll go through the daunting task of reducing the debdiff down to its utmost essential components and attempt to submit a stable-update to Debian as well.

23 September 2011

Julien Danjou: OAuth 2.0 for Emacs

This week, I've finished my OAuth 2.0 client implementation for GNU Emacs. I have imported it into GNU ELPA so Emacs 24 users will be soon able to install it using the new Emacs packaging system. OAuth 2.0 can be used to access, among others, Google APIs or the Facebook Graph API.
Flattr me!

Matthew Garrett: Supporting UEFI secure boot on Linux: the details

An obvious question is why Linux doesn't support UEFI secure booting. Let's ignore the issues of key distribution and the GPL and all of those things, and instead just focus on what would be required. There's two components - the signed binary and the authenticated variables.

The UEFI 2.3.1 spec describes the modification to the binary format required to produce a signed binary. It's not especially difficult - you add an extra entry to the image directory, generate a hash of the entire binary other than the checksum, the certificate directory entry and the signatures themselves, encrypt that hash with your key and embed the encrypted hash in the binary. The problem has been that there was a disagreement between Microsoft and Intel over whether this signature was supposed to include the PKCS header or not, and until earlier this week the only widely available developer firmware (Intel's) was incompatible with the only widely available signed OS (Microsoft's). There's further hilarity in that the specification lists six supported hash algorithms, but the implementations will only accept two. So pretty normal, really. Developing towards a poorly defined target is a pain. Now that there's more clarity we'll probably have a signing tool before too long.

Authenticated variables are the other part of the puzzle. If a variable requires authentication, the operating system's attempt to write it will fail unless the new data is appropriately signed. The key databases (white and blacklists) are examples of authenticated variables. The signing actually takes place in userspace, and the handoff between the kernel and firmware is identical for both this case and the unauthenticated case. The only problem in Linux's support here is that our EFI variable support was written to a pre-1.0 version of the EFI specification which stated that variables had a maximum size of 1024 bytes, and this limitation ended up exposed to userspace. So all we really need to do there is add a new interface to let arbitrary sized variables be written.

Summary: We don't really support secure boot right now, but that's ok because you can't buy any hardware that supports it yet. Adding support is probably about a week's worth of effort at most.

comment count unavailable comments

Matthew Garrett: UEFI secure booting (part 2)

Microsoft have responded to suggestions that Windows 8 may make it difficult to boot alternative operating systems. What's interesting is that at no point do they contradict anything I've said. As things stand, Windows 8 certified systems will make it either more difficult or impossible to install alternative operating systems. But let's have some more background.

We became aware of this issue in early August. Since then, we at Red Hat have been discussing the problem with other Linux vendors, hardware vendors and BIOS vendors. We've been making sure that we understood the ramifications of the policy in order to avoid saying anything that wasn't backed up by facts. These are the facts:
Microsoft have a dominant position in the desktop operating system market. Despite Apple's huge comeback over the past decade, their worldwide share of the desktop market is below 5%. Linux is far below that. Microsoft own well over 90% of the market. Competition in that market is tough, and vendors will take every break they can get. That includes the Windows logo program, in which Microsoft give incentives to vendors to sell hardware that meets their certification requirements. Vendors who choose not to follow the certification requirements will be at a disadvantage in the marketplace. So while it's up to vendors to choose whether or not to follow the certification requirements, Microsoft's dominant position means that they'd be losing sales by doing so.

Why is this a problem? Because there's no central certification authority for UEFI signing keys. Microsoft can require that hardware vendors include their keys. Their competition can't. A system that ships with Microsoft's signing keys and no others will be unable to perform secure boot of any operating system other than Microsoft's. No other vendor has the same position of power over the hardware vendors. Red Hat is unable to ensure that every OEM carries their signing key. Nor is Canonical. Nor is Nvidia, or AMD or any other PC component manufacturer. Microsoft's influence here is greater than even Intel's.

What does this mean for the end user? Microsoft claim that the customer is in control of their PC. That's true, if by "customer" they mean "hardware manufacturer". The end user is not guaranteed the ability to install extra signing keys in order to securely boot the operating system of their choice. The end user is not guaranteed the ability to disable this functionality. The end user is not guaranteed that their system will include the signing keys that would be required for them to swap their graphics card for one from another vendor, or replace their network card and still be able to netboot, or install a newer SATA controller and have it recognise their hard drive in the firmware. The end user is no longer in control of their PC.

If Microsoft were serious about giving the end user control, they'd be mandating that systems ship without any keys installed. The user would then have the ability to make an informed and conscious decision to limit the flexibility of their system and install the keys. The user would be told what they'd be gaining and what they'd be giving up.

The final irony? If the user has no control over the installed keys, the user has no way to indicate that they don't trust Microsoft products. They can prevent their system booting malware. They can prevent their system booting Red Hat, Ubuntu, FreeBSD, OS X or any other operating system. But they can't prevent their system from running Windows 8.

Microsoft's rebuttal is entirely factually accurate. But it's also misleading. The truth is that Microsoft's move removes control from the end user and places it in the hands of Microsoft and the hardware vendors. The truth is that it makes it more difficult to run anything other than Windows. The truth is that UEFI secure boot is a valuable and worthwhile feature that Microsoft are misusing to gain tighter control over the market. And the truth is that Microsoft haven't even attempted to argue otherwise.

comment count unavailable comments

22 September 2011

Biella Coleman: Congressional Quarterly on Hackers

When I was in graduate school, there were two publications that when I found out about them, they changed my life, for the better. One is the Annual Review of Anthropology (and there are many other Annual Reviews) and Congressional Quarterly Researcher. Both, albeit in very different ways, provide clear and crisp road maps and resources related to the topic under discussion. I had the pleasure of writing an ARA on digital media and I had always hoped that there was a Congressional Quarterly on hackers and hacking. Well now there is one and I have to say, they have done a fantastic job. I am not surprised. They tend to be pretty matter of factual and present many sides to an issue. The author, Marcia Clemmitt, did just that, covering open source, transgressive hacking, Anonymous, and cybersecurity among many other issues. Out of all the recent publicly oriented publications on hackers and hacking, this is the one that is the most in-depth but accessible. The only hitch is that the article is behind a pay wall but most universities subscribe to them and you can order an individual copy. update: I forgot to mention that there is an excellent segment in the 24 page report by Daniel Flower, which covers the history and significance of the protests. It is compact but the best account I have seen.

Lucas Nussbaum: Windows dynamic disks and debian installer ?

Windows has a feature called Dynamic Disks, which makes it ignore the DOS partition table and manage partitions its own ways. gparted is supposed to detect that, and warn the user that it can t deal with that. The solution is to reboot in Windows, switch the partition back to Basic disks , and then proceed with installing Debian (or Ubuntu). However, a student of mine had an interesting experience because gparted did not detect the dynamic disk stuff and did not warn about it, so the student went ahead with installing Debian squeeze. After reboot in Windows, Windows sees the partition as invalid . The same happens with Ubuntu 11.04 (not really surprising). I m surprised I did not find much information about that issue. Does someone has more info ? The student was using two disks in his laptop, and only the second one (not the one used to boot windows) was using dynamic disks .

Christian Perrier: 3rd update about Debian Installer localization

Yet another progress report about D-I l10n. Full stats are here Status for D-I level 1 (core D-I files): New complete languages since last update: Esperanto, Spanish, Tamil, Simplified Chinese. Status for D-I level 2 (packages that have localized material that may appear during default installs, such as iso-codes, tasksel, etc.): Status for D-I level 3 (packages that have localized material that may appear during non-default installs, such as win32-loader)

Christian Perrier: R.I.P. Troy Davis

Just like Saudi Arabia, China and a few other democratic countries, the state of Georgia which is part of United States of America still murders its citizens. Troy Davis has just been murdered by lethal injection 27 minutes ago. I'm not always proud to live in the country I'm living in, but today I am. Even if we were the last country in EU to abandon death penalty, on october 9th 1981, we can't legally murder our citizens for nearly 30 years now. I hope that M. Troy Davis now rests in peace. My only hope is that the noise made around this will help all those people who daily fight against deatch penalty in USA. Don't abandon hope. Full abolition will happen.

Axel Beckert: Emacs Macros: Repeat on Steroids

vi users have their . (dot) redo command for repeating the last command. The article Repeating Commands in Emacs in Mickey Petersen s blog Mastering Emacs explained Emacs equivalent for that, namely the command repeat, by default bound to C-x z. I though seldomly use it as I mostly have to repeat a chain of commands. What I use are so called Keyboard Macros. For example for the CVE-2011-3192 vulnerability in Apache I added a line like Include /etc/apache2/sites-common/CVE-2011-3192.conf to all VirtualHosts. So I started Emacs with all the relevant files: grep CVE-2011-3192 -l /etc/apache2/sites-available/*[^~] xargs emacs & To remove those Include lines again M-x flush-lines is probably the easiest way in Emacs. So for every file I had to call flush-lines with always the same parameter, save the buffer and then close the file or in Emacsish kill the buffer. So while working on the first file I recorded my doing as a keyboard macro:
C-x (
Start recording
M-x flush-lines<Enter>CVE-2011-3192<Enter>
flush all lines which contain the string CVE-2011-3192
C-x C-s
save the current buffer
C-x C-k<Enter>
kill the current buffer, i.e. close the file
C-x )
Stop recording
Then I just had to call the saved macro with C-x e. It flushed all lines, saved the changes and switched to the next remaining file by closing the current file with three key-strokes. And to make it even easier, from the second occasion on I only had to press e to call the macro directly again. So I just pressed e for a bunch of time and had all files edited. (In this case I used git diff afterwards to check that I didn t wreck anything by half-automating my editing. :-) Of course there are other ways to do this, too, e.g. use sed or so, but I still think it s a neat example for showing the power of keyboard macros in Emacs. More things you can do with Emacs Keyboard Macros are described in the EmacsWiki entry Keyboard Macros. And if you still miss vi s . command in Emacs, you can use the dot-mode, an Emacs mode currently maintained by Robert Wyrick which more or less automatically defines keyboard macros and lets you call them with C-..

21 September 2011

Dirk Eddelbuettel: digest 0.5.1

A new version of the digest package (which generates hash function summaries for arbitrary (and possibly nested) R objects using any of the standard md5, sha-1, sha-256 or crc32 algorithms) is now on CRAN. Bryan Lewis, who is doing very stuff with websockets and Html5 as he demoed last week the Chicago R User Group meeting, needed raw support and was kind enough to send a patch. After some more testing, this change set is now in the new version which went onto CRAN earlier today. CRANberries provides the usual summary of changes to version 0.5.0. As usual, our package is available via the R-Forge page leading to svn and tarball access, my digest page and the local directory here.

Ian Wienand: Exploring $ORIGIN

Anyone who works with building something with a few libraries will quickly become familiar with rpath's; that is the ability to store a path inside a binary for finding dependencies at runtime. Slightly less well known is that the dynamic linker provides some options for this path specification; one in particular is a path with the special variable $ORIGIN. ld.so man page has the following to say about the an $ORIGIN appearing in the rpath: 
  ld.so understands the string $ORIGIN (or equivalently $ ORIGIN )
  in  an  rpath specification to mean the directory containing the
  application  executable.  Thus,  an   application   located   in
  somedir/app   could   be  compiled  with  gcc  -Wl,-rpath,'$ORI 
  GIN/../lib' so that it finds an  associated  shared  library  in
  somedir/lib  no matter where somedir is located in the directory
  hierarchy.
As a way of a small example, consider the following: 
$ cat Makefile
main: main.c lib/libfoo.so
	gcc -g -Wall -o main -Wl,-rpath='$$ORIGIN/lib' -L ./lib -lfoo main.c
lib/libfoo.so: lib/foo.c
	gcc -g -Wall -fPIC -shared -o lib/libfoo.so lib/foo.c
$ cat main.c
void function(void);
int main(void)
 
   function();
   return 0;
 
$ cat lib/foo.c
#include <stdio.h>
void function(void)
 
   printf("called!\n");
 
$ make
gcc -g -Wall -fPIC -shared -o lib/libfoo.so lib/foo.c
gcc -g -Wall -o main -Wl,-rpath='$ORIGIN/lib' -L ./lib -lfoo main.c
$ ./main
called!
Now, wherever you should choose to locate main, as long as the library is in the right relative location it will be found correctly. If you are wondering how this works, examining the back-trace from the linker function that expands it is helpful: 
$ gdb ./main
(gdb) break _dl_get_origin
Function "_dl_get_origin" not defined.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 1 (_dl_get_origin) pending.
(gdb) r
Starting program: /tmp/test-origin/main 
Breakpoint 1, _dl_get_origin () at ../sysdeps/unix/sysv/linux/dl-origin.c:37
37	../sysdeps/unix/sysv/linux/dl-origin.c: No such file or directory.
	in ../sysdeps/unix/sysv/linux/dl-origin.c
(gdb) bt
#0  _dl_get_origin () at ../sysdeps/unix/sysv/linux/dl-origin.c:37
#1  0x00007ffff7de61f4 in expand_dynamic_string_token (l=0x7ffff7ffe128, 
    s=<value optimized out>) at dl-load.c:331
#2  0x00007ffff7de62ea in decompose_rpath (sps=0x7ffff7ffe440, 
    rpath=0xffffffc0 <Address 0xffffffc0 out of bounds>, l=0x0, 
    what=0x7ffff7df780a "RPATH") at dl-load.c:554
#3  0x00007ffff7de7051 in _dl_init_paths (llp=0x0) at dl-load.c:722
#4  0x00007ffff7de2124 in dl_main (phdr=0x7ffff7ffe6b8, 
    phnum=<value optimized out>, user_entry=0x7ffff7ffeb28) at rtld.c:1391
#5  0x00007ffff7df3647 in _dl_sysdep_start (
    start_argptr=<value optimized out>, dl_main=0x7ffff7de14e0 <dl_main>)
    at ../elf/dl-sysdep.c:243
#6  0x00007ffff7de0423 in _dl_start_final (arg=0x7fffffffe7c0) at rtld.c:338
#7  _dl_start (arg=0x7fffffffe7c0) at rtld.c:564
#8  0x00007ffff7ddfaf8 in _start () from /lib64/ld-linux-x86-64.so.2
Just from a first look we can divine that this has found the RPATH header in the dynamic section and has decided to expand the string $ORIGIN. 
$ readelf --dynamic ./main
Dynamic section at offset 0x7d8 contains 23 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libfoo.so]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x000000000000000f (RPATH)              Library rpath: [$ORIGIN/lib]
 0x000000000000000c (INIT)               0x4004d8
 0x000000000000000d (FINI)               0x4006f8
At this point it proceeds to do a readlink on /proc/self/exe to get the path to the currently running binary, effectively does a basename on it and replaces the value of $ORIGIN. Interestingly, if this should fail, it will fall back on the environment variable LD_ORIGIN_PATH for unknown reasons. This might be useful if you were in a bad situation where /proc was not mounted and you still had to run your binary, although you could probably achieve the same thing via the use of LD_LIBRARY_PATH just as well. This feature should be used with some caution to avoid turning your application in a mess that can't be packaged in any standard manner. One common example of use is probably your java virtual machine to find its implementation libraries. 
$ readelf --dynamic /usr/lib/jvm/java-6-sun/bin/java
Dynamic section at offset 0x9a28 contains 25 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libpthread.so.0]
 0x0000000000000001 (NEEDED)             Shared library: [libjli.so]
 0x0000000000000001 (NEEDED)             Shared library: [libdl.so.2]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x000000000000000e (SONAME)             Library soname: [lib.so]
 0x000000000000000f (RPATH)              Library rpath: [$ORIGIN/../lib/amd64/jli:$ORIGIN/../jre/lib/amd64/jli]
 ...
There is a small but interesting security issue. If an attacker can hardlink to your binary that is using $ORIGIN then any path expansion is now relative to the attackers directory. Hence it is possible to make the linker read in arbitrary libraries and hence run arbitrary code. Clearly if your program is running setuid as someone else, such as root, you've just given up the keys to the house! Luckily, the dynamic linker will not let you shoot yourself in the foot like this, and prevents expansion of the $ORIGIN field if the program is running setuid. 
$ sudo chown root ./main
$ sudo chmod +s ./main
$ ./main
./main: error while loading shared libraries: libfoo.so: cannot open shared object file: No such file or directory
However, this is a good example of why you might want to keep users home and temp directories on separate file systems away from where binaries live. There is also a similar variable $PLATFORM, which describes the current running system. This is gained via the auxiliary vector, which I have written about here and here. Setting LD_SHOW_AUXV=1 will allow you to examine this value. 
$ LD_SHOW_AUXV=1 ls
...
AT_PLATFORM:     x86_64
...

20 September 2011

Axel Beckert: Creative Toilet Paper Usage in Webcomics

Funnily two of my daily web comics recently featured interesting things you could do with toilet paper: Zits on 19th of September 2011 involving a fan and Calvin and Hobbes on 13th of September 2011 involving flushing the toilet. Although both experiments are obviously resource wasting, they look like quite some fun and I m tempted to actually try them both at least once. (I though don t plan to try this, too. :-)

John Goerzen: Mexico Part 6: Conclusion

The sixth in a series; see also parts 1, 2, 3, 4, and 5. It s been about two weeks now since we got back home. Every few days, our boys still talk about Mexico. Jacob talks about what he will want to do when we go back and how he d like to see Jonathan over there again. Jacob, Oliver, and I look at photos from our trip a few times a week. This is all a sure sign that our boys loved the trip. And I keep trying to find Mexican food that tastes as good as the real thing (and, so far, failing). Another sign of a good trip! I think it is possible to have fun, relax, and enjoy new experiences all at the same time. We did that in Mexico. We had a lazy afternoon or two with the boys taking naps or playing with other children at the house we stayed at. And we stayed in a beautiful hotel without air conditioning, explored old downtown areas and ancient ruins, and bought things from crowded markets and people selling things from a table along a road. To anyone thinking about visiting: Go. Enjoy it, bring back memories, and live a little more serendipitously than usual. That s what I hope to do when we visit Greece before too long. Finally, here s a photo of the painting I bought from a roadside vendor for $17. Make sure to view it full screen. I think it says more about Mexico than 6 blog posts do.

Kai Wasserb ch: TNEF or how to lock-up your e-mails

As the administrator for several MTAs I've received my fair share of support requests for "unreadable" e-mails. They generally have an attachment called winmail.dat. This is what all (for exceptions see the rest of this blog post) non-Outlook MUAs can display, when they receive an e-mail with the application/ms-tnef (or application/vnd.ms-tnef) MIME type. TNEF is a propietary format cooked up in Redmond. When chosen, the e-mail in question isn't sent as text/plain or at least text/html, but the entire e-mail is put into an TNEF-encoded attachment, most often called winmail.dat, in which you (most commonly) find the content of the e-mail in RTF, possible attachments are also put into the winmail.dat. The easieast solution for all involved parties is to convince the sender, that her Outlook and/or Exchange setup needs fixing (disabling TNEF in Outlook and Exchange 2003). Sadly this won't work all the time. The other solutions are to either filter the e-mails on your e-mail server and run them through something like ytnef_smtpd.py (please note, that this might be legally problematic for you as a service provider, opening an e-mail, even automatically, is a violation of communication privacy rights in many jurisdictions). Or, if the legal problem is too big or can't be solved through an local server installation (e.g. because there is no server running 24/7), you're left with either using Outlook (probably what Microsoft intended) or you can use a plug-in/add-on for your client. I've tested the LookOut add-on for icedove and it seems to work well. There are of course plug-ins for many other clients, but I can't honestly tell whether they work or not. [UPDATE 2011-09-20]: Fellow Debian Developer Josselin Mouette wrote me, that Evolution is capable of reading TNEF-encoded e-mails out of the box, but he also said that [TNEF e-mails should] be banned by all means.[/UPDATE 2011-09-20] Now, before I close, please always try to convince the sender/postmaster to fix their setup. It has only advantages: text/plain e-mails are smaller, they're less likely to contain malicious code (i.e. no parts hidden away from the virus scanner on the mail server (amavis can read TNEF e-mails, if libconvert-tnef-perl is installed)) and all recipients can open the e-mails with the client of their choice.

MJ Ray: Six of the Best Podcasts?

I m listening to quite a few podcasts recently. Here are my current favourites: And now for number six, what are you listening to? Anything you d recommend?

19 September 2011

Sylvain Beucler: Building Android NDK samples

I searched forever for a way to just build the examples in the Android NDK, preferably from the command line. Here's how. First step: build the C++ code: 
cd /usr/src/android-ndk-r6/samples/san-angeles/
/usr/src/android-ndk-r6/ndk-build
Simple enough. Second step:
You will then need to generate your final .apk through the usual means. -- Android NDK Dev Guide
Thanks a ****ing lot! In addition the documentation is very much Eclipse-centered - and I can't be bothered to install and configure all the Eclipse stack for a mere Java wrapper for the above-generated .so file XD We first need to use the 'android' wrapper and download the "SDK Platform Android 2.2, API 8, revision 3" - aka "android-8", the first environment to support OpenGL ES 2. 
/usr/src/android-sdk-linux_x86/tools/android
It appears we first need to "manage the project", more precisely import from an existing project: http://developer.android.com/guide/developing/projects/projects-cmdline.html So we create a project by importing the sources from the current directory: 
/usr/src/android-sdk-linux_x86/tools/android update project \
  --name san-angeles --path . --target "android-8"
Then we use ant to build the thing: http://developer.android.com/guide/developing/building/building-cmdline.html 
apt-get install ant openjdk-6-jdk
ant debug  # avoid messing with signing
We now have a bin/san-angeles-debug.apk and we can run it in the emulator. Create a new "Virtual device" using the "android-8" platform we downloaded above, and launch it. Given the time needed to boot the OS, I suggest enabling snapshots. Scaling to display resulted in a very tiny, dark and slow display, in a first step I suggest using a non-scaled one. 
/usr/src/android-sdk-linux_x86/tools/android
At last we can run it! Install it in the emulator: 
/usr/src/android-sdk-linux_x86/platform-tools/adb install -r bin/san-angeles-debug.apk
You'll find a DemoActivity in your apps directory :)
Note: I tried to compile the "hello-gl2", showcasing OpenGL ES 2.0, but sadly it crashes:
Sorry! The application GL2JNI (process com.android.gl2jni) has stopped unexpectedly. Please try again.
The emulator apparently doesn't advertise EGL_OPENGL_ES2_BIT (checked in in GL2JNIView.java). If you try to by-pass it, you'll get loads of:
E/libEGL ( 333): called unimplemented OpenGL ES API
It's worth noting the OpenGLES20 sample from the "API Demos" application uses a fall-back OpenGL ES 1 renderer if v2 is not available - it made me mistakenly believe that OpenGL ES 2 was supported only from Java >( OpenGL ES 2 is not supported in the emulator as of 2011-09-17 - period.

Sylvain Beucler: Advanced 2D OpenGL plotting

gnuplot? Here's a third tutorial from Guus focused on GPU-assisted plotting. It also provides excellent exercices on manipulating the OpenGL windows using the Viewport and the Scissors :)
http://en.wikibooks.org/wiki/OpenGL_Programming/Scientific_OpenGL_Tutorial_03
The OpenGL wikibook is free documentation, and you are welcome to redistribute it under certain conditions; see the CC-BY-SA or GFDL licenses for details ;)

Next.

Previous.