In just over a month (1 month and 1 day, to be precise), it's FOSDEM again. The Debian Developers Room schedule is almost complete, and some interesting things are being published around it. Such as the pre-FOSDEM beer event. In previous years, this always happened at the "Le Roi d'Espagne", a bar at Grand Place in Brussels. This was a nice place for many years, because it's easily found, and they have this backroom where quite a lot of people would fit in. Unfortunately, "quite a lot" does not equal "a huge number", with the amount of people going to the pre-FOSDEM beer event more and more approaching the latter than the former as the years go by. Last year, it finally became too crowded, and it was decided that the pre-FOSDEM beer event would change bars this year. Which has now happened. This year, the pre-FOSDEM beer event will be at the Delirium Caf , which is not at the Grand Place anymore, but just 100m away from it; the FOSDEM website has more information. A nice feature of the Delirium Caf , besides the fact that they are much larger, is the huge amount of different beers they have. Over 2000 of them, which you can query online!. And that's not even considering the soft drinks or waters or whatever, which they also have on their menu. Another novelty this year is the streaming; the main tracks that will be held in Janson will be streamed out of the event, and the Debian video team is also planning to do some streaming. Meaning, even if you can't make it to FOSDEM, you'll still be able to follow some of it. You won't be able to follow everything, especially not the hallway track which at FOSDEM is a very important one; but at least you'll be able to sample some bits, which is nice. Other than that, not much will change. There'll be a key signing party, organized by yours truly. There'll be Lightning talks, there'll be the Main track, and there'll be a number of Developer rooms, including the Debian one—which, occasionally, is also organized by yours truly. This conference has always been my favourite (even though I haven't been to many conferences besides FOSDEM); I've never missed even one edition ever since the very first one back in 2001 (when it was still called OSDEM). And since a few years, I've also been offering crashing space at our office, for international geeks who don't mind roughing it a bit (it's an office, there no shower, there's only floor space). This year, perhaps I haven't been spamming enough for that, but for now I only have two people who're interested in sleeping over (and they're not even sure); if you're going to FOSDEM and still need a place to sleep, you're (probably ;-) welcome. Send me an email. On the Debian front, things are going well, for the most part. The list of speakers for the Devroom is nearing completion, leaving me with little more to do than to start assigning times. We've been assigned a booth as well, but there I still need to figure out how to organize it, and what to do with it. There will of course be the regular UK T-shirts, and probably some other merchandizing, but I also want something involving some computer device. We've had this d-i "babelbox" installation running a few times now, which was nice; but I do think we need some variation, too. The only problem with that approach is that I don't really know what that variation could be. Suggestions are welcome! And so time goes on, and FOSDEM draws nearer. At some point it'll eventually happen, and then it will be over before one can say "blueberry pie". Sometimes I wonder whether all these months of preparation are actually worth it. But when FOSDEM is actually here, I'm sure I'll find that it is, indeed, worth it...

As you might know from reading my blog, at my workplace, we have largely standardized on Linux on the desktop and laptop.

We use systemimager to maintain a standard desktop image and a separate standard laptop image. These images differ because there are different assumptions. The desktop machines mount /home over NFS, authenticate to LDAP, etc. This doesn't work on laptops. Moreover, desktops don't use network-manager or wifi, but laptops do.

Our desktop image uses Debian's hardware autodetection -- plus a little hacking in /etc/init.d/gdm -- to automatically adjust to a wide range of hardware. So far this has worked well.

Laptops are much more picky. Our standard laptop model had been the HP nc4400 -- a small and light 12" model that people here loved. HP discontinued that model. Their replacement was the 2510p. We ordered one in here for evaluation. Try as we might, we couldn't get it to suspend and resume properly in Linux.

So I went out scouring the field of Linux laptops. Companies such as Emperor Linux buy retail laptops from people like Lenovo, test them for Linux, and sell them -- at a premium. These were too expensive to justify at the quantities we need them.

Then I stumbled across Linux Certified. I'd never heard of them before. I called them up and asked a few questions. They don't buy retail laptops, but instead have OEMs in Taiwan build laptops to their spec. They happen to use the same OEM that Fujitsu does, I believe. (No big company builds laptops in the USA these days). I asked them about wifi chipsets, video chipsets, whether they use stock kernels. I got clueful answers to all of these.

So we ordered one of their LC2100s models. They didn't offer Debian preinstalled, but did offer Ubuntu, so I selected that. The laptop arrived a couple of days (!!) later, configured with the particular CPU, etc. that I selected.

I was surprised at the thrill I felt at taking a brand new laptop out of its box, turning it on, and watching Grub appear before my eyes. Ubuntu proceeded to boot. I then of course installed our regular Debian image on the thing to check it out.

It needed a kernel and xserver-xorg-video-intel from lenny, as well as the ipw3945 driver for wifi, but otherwise worked with the exact same software as our HP nc4400 image. (In fact, it wasn't hard to support both laptops with that image, since both use a lot of Intel hardware.) The one trick was making hibernate call /etc/init.d/ipw3945d stop so that the ipw3945 module could be unloaded before suspend. (Why this particular chipset needs a daemon is beyond me, but oh well.)

The hardware is great. As far as I know, the ipw3945 was the only component that wasn't directly and automatically supported by DFSG-free software in lenny main. The screen is sharp and high-contrast (it's glossy, which I personally don't like, but I bet our users will). The device itself feels sturdy. It's small and dense. I haven't opened it up, but it looks like all you need is a screwdriver to do so.

The only downside is that they don't sell docking stations for it. Their standard answer on that is to buy a USB docking station. That's a partial answer, but can't handle power or video like a standard docking station will.

Also, the LC2100s is much cheaper than the HP laptop, even when configured when nicer specs in every way. That is no doubt partially due to the lack of the Windows tax.

I'm sending off an order for 4 more today, I believe.

Julien Goodwin asks whether an insecure platform can perform secure computation [1]. My immediate reaction was to recall Charles Babbage’s quote On two occasions I have been asked, ”Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?” […] I am not able rightly to comprehend the kind of confusion of ideas that could provoke such a question [2]. However on careful reading of Julien’s post it seems that he is most interested in the integrity of the computations rather than the secrecy. He suggests the possibility of performing the computation twice and comparing the results. Of course the issue to consider is whether both computations could be subverted. It seems most likely that if you are using someone else’s computation cluster for the calculations then performing the same calculation on two nodes of that cluster will give the same result both times (whether it’s right or wrong). If there was a computation that would get a result that can be verified with little computation then it would be an easy problem to solve. For example if I wanted to brute-force a passphrase for a GPG key then I could try all combinations that were known to be possible, if one was flagged as correct then in a millisecond I could verify it. If none of the possibilities were listed as correct then I could assume that the process was broken in some way. The problem with this is that such a passphrase can have arbitrary length (I know someone who uses more than 50 characters). So if I used a brute-force attack on passwords of up to 9 characters that doesn’t exclude a 10 character password. Probably the best potential use for insecure systems is for analysing large data sets. There have been several projects to harness unused computation resources to perform various large calculations (protein folding and SETI are two examples). Most such projects use closed-source programs because the people who run the contests are afraid of cheats who modify their programs to merely say “no” repeatedly and quickly. Of course this wouldn’t be a problem if they didn’t have a high-score table, and disassembling the program to hack the protocol can’t be that difficult (consider the work invested in reverse engineering protocols such as SMB which are much more complex). It would probably be reasonably to randomly send batches of work to two machines in different regions for such large-scale public computation projects. Finally if you want to perform calculations on secret data on someone else’s hardware then you may have lost before you even start.

• [1] http://laptop006.livejournal.com/39799.html


• [2] http://en.wikipedia.org/wiki/Garbage_In,_Garbage_Out

Share This

Things have been rather hectic lately, so I haven't found much time to blog. Here's why: DBE62 The Gigabit Ethernet version of our thin client took more time to produce than I expected, for a number of reasons mostly related to a few improvements we decided to squeeze into the design at the last minute. However, today, we finally reached a point where LinuxBIOS runs as well as it did on our previous DBE61 model and where we no longer need any DOS tool to flash the MAC address into the VIA velocity Gigabit chip we selected. Hurray! Production will only commence in one month, but I'm already excited by the new model's potential, both as a thin client and as an embedded platform. Another good thing is that, thanks to Ubuntu developer Scott Balneaves, we managed to get all the necessary tools to support thin clients based on LinuxBIOS into LTSP, so our Etherboot model works out of the box on Ubuntu, since Gutsy. Hurray! There is one remaining issue related to recent changes in X.org core functionalities that make the AMD driver we need unstable but, again, various AMD, Debian and Ubuntu developers are looking into fixing this, so we should soon have spotless Geode support into Debian and Ubuntu again. T rkiye I visited Turkey twice over the last few months, because I'm putting together a pilot project to better promote the Estonian high-tech sector abroad, in collaboration with the Estonian government. I have to say that the more I visit Turkey, the more I like the place and the more understand why these people see themselves as Europeans because, you know what? They are: practically every significant civilization and religion that is at the core of European culture had major events taking place in in Anatolia or Thrace and, also, a devastatingly huge percentage of the consumer goods sold in Europe are designed and manufactured in Turkey. Learning the rudiments of Turkish has also proven to be a lot of fun. While I'm nowhere near as fluent in Turkish as in Finnish or even in Estonian, the learning curve isn't as steep as I initially expected: Altaic and Ugric languages share a surprising amount of grammatical concepts, while Turkish itself borrowed a lot of vocabulary from French, because the founder of modern Turkey, Atat rk, was very fond of the language. I'll venture that proximity with nearby Middle-Eastern countries that were formerly under French influence has something to do with it too. Identity crisis To me, the most challenging part of these business missions abroad is to represent a whole economic sector from a country of which I'm not a citizen or even a resident. Case in point: Being invited to dinner by a Turkish investor, I noticed the waiter asking my host where his foreign guest might be from. A few minutes later, as the waiter put down a gigantic pita bread with the word "Estonia" spelled in roasted sesame seeds, my host asked, reading my business card:

• Actually, your name doesn't sound Estonian. France?
• Qu bec.
• And your mobile number ... 358 ... is that Finland?
• Yup. I've been living there for the past 10 years.
• Ah! So you don't live in Tallinn?
• Nope. Helsinki.

Looking at the waiter and pointing at the gigantic pita, he continues:

• Actually, make that Canada ... no, Finland ... Ah, sorry, never mind. Just keep it as Estonia.

Honestly, trying to keep a straight face while saying "We" about a country of which I'm not a citizen and where I don't even reside becomes unbearable. At some point, some European bureaucrats will have to admit that I need a new citizenship, to reduce the confusion and to let me find myself a proper national identity again; the sooner, the better. Besides, the absurdity of the situation keeps on jumping at everyone's face: during the second mission to Turkey, I kept on bumping into Finnish diplomats who took personal offense at me for living in their country and yet representing the interests of a competing, neighboring country. If you ask me, I cannot entirely blame them for it. However, as far as I'm concerned, I've done my homeworks: I've been here 10 years, I speak the language and I don't have a criminal record. Given this, you'd think that acquiring citizenship would be a mere formality, but the Ulkomaalaisvirasto doesn't see it that way. If you ask me, this country's very first Minister of Immigration, Mrs.Astrid Thors, ought to unilaterally grant citizenship to anyone who's lived here for at least 5 years, just for the asking, regardless of what circumstances brought them here or of what absurd decisions the Ulkomaalaisvirasto might have previously made on their residence permit status. Doing this would go a long way towards undoing the mess of her predecessors at the Ministry of Interior and it would speak volumes about how much Finnish society has evolved from the days when any foreigner was a commie they had to push over the Eastern border.

I was recently on a wireless network I trust even less than I usually trust wireless networks, so was looking for a way to ensure a little more security. I've previously setup a PPTP tunnel, but that server is on a boat heading to San Francisco so that was not an option. I have a linode with a generous bandwidth limit, so my first thought was to set that up and route through it with OpenVPN. It started getting a bit complicated and didn't work out-of-the-box with NetworkManager so I gave up. Then I found that ssh has a really nifty -D option to implement a SOCKS5 proxy. Therefore all I needed to do was ssh -D localhost:8080 remote.box and then setup Firefox to use localhost:8080 as a SOCKS proxy server. But it gets better; I did wonder if my DNS requests were leaking onto the local network, which a quick packet sniff confirmed. It turns out with SOCKS5 all you need to is go to the Firefox about:config page and turn on network.proxy.socks_remote_dns and DNS is tunnelled too. Since my mail already comes and goes via encrypted channels, this zero maintenance approach pretty much wraps up everything I need from a VPN solution!

I have decided to run a contest for security related blog posts that appear on Planet Linux Conf Au [1]. That Planet is for people who are attending Linux Conf Au [2], and the prize (or prizes) will be given out at the conference. The aim will be posts on the topic of computer security from people who are not experts. Anyone who has been employed as a security consultant or developer of security software or who has spoken at a conference such as LCA on a topic related to security can enter but will only be eligible for an honourable mention. Any such expert who enters for an honourable mention MUST note on their entry that they are not eligible for a prize to avoid any possible confusion. Only blog posts of a positive nature will be well regarded by the judges. Negative reviews are only acceptable if they have positive suggestions for improvement and/or bug reports linked from them. You may submit a series of posts on a theme, and multiple posts on different security issues will help an entry - we will judge the contributions of the person not a single post. The prize pool is currently $50, which I hope to expand - but such expansion depends in part on the quality and quantity of early entries, so if some good entries are submitted soon then there will be more and bigger prizes. Currently the prize pool comes from the pockets of me and Casey, commercial sponsorship will be accepted and may increase the prize pool significantly. The duration of the contest is from this moment until at least lunch-time on Friday the 1st of February. We may extend the contest until Friday night and announce the winner(s) on Saturday - but at this time you should not count on such an extension and plan to have your entry or entries in by mid-day on Friday the 1st of Feb (Australian eastern daylight savings time). So far of the people I have invited to join the judging panel only Casey Schaufler has accepted. Casey and I will consider offers to assist in judging from people who have a combination of security and blogging experience that is significant, but note that as of this time all prize money comes from the judges… When you write a post that you wish to submit for the contest please comment on this post with the URL to make sure that the judges don’t miss it. Entries submitted on the last day may need some other form of notification, I will write a future post which clarifies this issue. Some issues related to selecting the winners have yet to be determined, I will write future posts with more information. But please don’t hesitate to enter now, well written posts that have a positive tone are what you need. Also entering quickly will help increase the prize pool, more prizes means a greater chance that you will win one! One thing I am considering is how to manage commercial sponsorship if it is offered. One possibility I am considering is allowing a sponsor to declare that half of the money they pay will be used as prizes for entries that relate to their product. That would give an extra incentive for people to blog about topics related to the sponsor but still give extra prize money for other topics. In that situation the relation between the sponsor’s product and the prize winning entry or entries would be liberal, so a post about standard Unix security features would be eligible for prize money from any commercial Linux distribution. Finally you must have your own individual blog to enter the contest. Guest-posts on other people’s blogs or group efforts are not eligible for anything other than an honourable mention.

• [1] http://planet.linux.org.au/lca2008.html


• [2] http://linux.conf.au/

Share This

Working!
I've decided to replace the previous post rather than leave it in place when there is a solution available.
Fixing the problem
I've been considering a new laptop for weeks - mainly to get more RAM, more space but without adding to the actual size of the machine (or weight). I know, I should have taken more time over the selection, I should have found out more about the hardware, etc.etc.
I've ended up with an HP Pavilion dv6000 (dv6615ea) for the 2Gb RAM, 15inch screen, 250Gb hard drive to replace my ageing iBook 12inch with 128Mb RAM and 30Gb hard drive - all for barely an inch extra depth and very similar weight (and it was cheaper than the original price of the iBook). I thought I'd made a good choice. Yes, it was "NVidia Graphics" according to the sticker and yes, I could have spent more time (and money) finding a pre-installed lappy but I was hasty. (Much the same way as you should never go food shopping whilst hungry). I've managed with NVidia graphics before without using the horrid proprietary rubbish and I was prepared to put up with less-than-perfect graphics (I never use 3D anyway) because the free driver is at least stable with the graphics that I actually need.
Updated
The ethernet card is not recognised by the Debian Etch installer - after a comment placed on this blog after my original post, I tried the Lenny installer for amd64 with signficant success. Selecting the vesa driver for the graphics provided a usable X setup (1024x768). I've still spent a lot more time on this than it should really have required but I do now have a genuine amd64 Debian installation with GNOME. The only thing not working is wireless (oh and sound). The wireless appears to be a bcm43xx issue - the driver appears to let the card work (the orange light turns blue) and the device is created but scanning fails.
I'm probably still going to have to leave this new lappy behind and take my existing iBook to Fosdem in a few weeks, but I'm now happier with HP in general.
I'll try to post a longer review somewhere soon.
So, thanks for the tip, Julian!

Anyone managed to do that?

I tried the sid amd64 packages, the i386 packages, the lenny amd64 packages, backported etch packages (they worked for me on a i386 system at work). None of these lets me use networking.

Is wine networking working for other people using the amd64 arch?

---

Update: apparently I am one of the few for which wine networking on amd64 doesn't work. Th ebad thing is that I don't know why or how to fix it.

As there are some threads on the lists of enhancing Debian from time to time in various aspects and the upcoming DPL election period in some weeks, I found some memorable quotes in the book I'm reading at the moment:

Note: SA = System Administrator

The number-one attitude problem among SAs is a blatant disrespect for the people whom they are hired to serve. It is surprising how often we remind SAs that their users are not "lusers" or "pests with requests." They are the reasons why SAs have jobs. SAs are there to serve but, more important, to advocate for these people. [...]
We advocate that SAs stop using the termin users and replace it with the term customers. This becomes a reminder that SAs are in a service industry, supporting the needs of these people instead of "pests" who make request all day.

(From: The Practice of Network and System Administration, Limoncelli, Hogan, Chalup, Second Edition, page 756)

Communication:

• I will communicate with management, users, and colleagues about computer matters of mutual interest.


• I will strive to listen to and understand the needs of all parties.

(From: The System Administrator's Code of Ethics in The Practice of Network and System Administration, Limoncelli, Hogan, Chalup, Second Edition, page 325)

SAs do many tasks, but often, customers see only the parts that involve responding to their requests, not all the back-office work, and shouldn't have to see it. Therefore, how well you respond to customer requests is critical to maintaining an organizations reputation.

(From: The Practice of Network and System Administration, Limoncelli, Hogan, Chalup, Second Edition, page 364)

I don't know whether someone read this book as well lately or received another a proper christmas gift, but apparently someone found the time, finally, to fix the access to incoming.d.o for m68k buildds.

Thanks for giving access back! Yay! :-)

In an old post I dealt with the nice mod_chroot module to secure your multisite server. I also adopted recently vlogger in order to manage better apache logs for virtual hosts, when you have dozens or hundreds of them. Unfortunately the suggested way to use it (a simple piped command) does not work nicely with mod_chroot, because the piped command has to run in the chroot jail.

Of course, it is not a good idea installing the whole perl intepreter and all required modules in a minimized jail, so I adopted an oldish classic trick (the old things are always the best) to solve the issue: using a named pipe. You basically need to do something like the following:

mkfifo -m 600 /var/run/apache2/logger && chown www-logs /var/run/apache2/logger

cat /var/run/apache2/logger /usr/sbin/vlogger -u www-logs -g nogroup -s access.log /var/log/vlogger >/dev/null 2>&1 &

/etc/init.d/apache2 start

Of course your log directives will be something like:

LogFormat "%v %h %l %u %t \"%r\" %>s %b \"% Referer i\" \"% User-Agent i\"" vcombined
CustomLog "/var/run/apache2/logger" vcombined

You absolutely need to run the reader before the writer, else the init script would hang for ever. It is easy adding a simple init script to run vlogger before apache and it has also the big advantage of not requiring re-fork a perl intepreter at every damn log action. Piping rocks.

Debian Enhancement Proposals (DEPs): wanna comment? Ok, ok, you're right, I was late, but a good old rule of SPAM is: the more, the better. So, if you care about decision management (or, better, tracking) in Debian and you've always wondered why don't we have something like PEPs? please take part in this discussion: a nice "by product" of the Extremadura Debian QA meeting by Dato, Lars, and myself.

I’ve climbed up above the tagclouds and appear to be back in the “blogosphere” whatever that is. I hate that “blog” word. I also hate the word “prosumer.” Spent last weekend in Raleigh at FUDCon which was a lot of fun. I doff my fedora to the organizers. It was great to finally have the opportunity to meet a lot of my coworkers who I haven’t yet had a chance to run into at conferences. Poked a bit at btrfs in my idle cycles… managed to make it fall-over-go-boom on parisc64. Fixing that up should keep me busy in my spare time for the next little while… Oh. And if anyone would like to make me a new disembodied head^W^Whackergotchi, I’d very much appreciate it.

One year ago, I took over Gammu maintenance. I think it time to summarize a bit what happened during that year. There were definitely good and bad releases in that time (especially strictness introduced to SMS parser in 1.13.0 took quite a lot of releases to fix various bugs), but generally I things Gammu is moving in a good way. What I would definitely call positive:

• Added build time testing. This helps a lot to catch regressions. However more tests could be done.
• I cleaned up lot of code parts so that Gammu is now more resistant to bad data and should not crash in these cases.
• Added lot of API documentation, most API functions are now fully documented.
• More often testing releases - I try to release every week. Sometimes changes are huge, sometimes just few bugfixes. This makes Gammu occur among most vital projects on freshmeat.net.
• Quite complete IrMC implementation together with AT/OBEX switching gives support for quite a big range of phones today.
• SMSD got PostgreSQL support.
• AT+CMGL support for reading messages gives us support for many phones which were not supported in the past.
• I started to use OpenSuse Build Service and Ubuntu PPA to provide up to date binaries for many distributions.

There are also some bad things:

• Nobody cares about build under MSVC. It is broken sometimes and I try to fix issues, but no constant testing of this causes problems.
• Almost no new features for Nokia phones. I simply lack time to do anything more than bug fixing here.
• Still bad support for Symbian phones. Some developer interested in this area is definitely needed. But probably OpenSync with SyncML is enough for most people.
• The changes I made to the SMS parser broke too much things, I should have payed more attention to this change. But now things seem to be worked out.

Some statistics of last year (based on Ohloh):

Value	Dec 2006	Dec 2007	Difference
Code Lines	90,540	101,687	+12%
Comment Lines	9,204	15,336	+67%
Comment Ratio	9.2%	13.0%	+30%

All these changes were made in approximate 1200 commits. I hope next year will not be worse :-).

Actually I never went away, yes 22 months is a long time between blog entries, I just got distracted by travelling and working at AwayPhone. I'm still there and we are looking for one or two developers, principally in the US (Washington state) — but as a global company, not necessarily — so let us know (ASCII only, spell-checked, coherent English, etc.) if you are interested. I've been on (technically) holidays for the past few weeks, but I find myself awake, reviewing code at 02:45 (now 03:30) and trying to catch up on emails. I'm reminded of a friend of mine who always used to shout “RELAX!” whenever we went bar-hopping. I've been trying to apply that to a broader area of life than just bars but it appears that it just isn't how I'm wired to operate; for better or worse. That means, that whilst in Australia, I'm also rebuilding my mothers' IT infrastructure at her publishing company. I want it all to survive without any intervention for at least 2 years. So, I've been evaluating various pieces of kit. My conclusions:

NetGear

Switches, Modems (ADSL) and Wireless access points

Western Digital

Linux NAS boxes (they have Samba, rsync and SSH on pre-installed. I'd expect a firmware update from the makers to incorporate iSCSI and allow you to join a domain shortly).

HP

Desktops and Servers. Although I wish Bdale has some influence within HP and I did not have to taint the kernel of my servers. Seriously, it is because of that I re-do a price/functionality check everything time I go to purchase a machine. HP only just get it right.

Linksys / Cisco - snom

VoIP handsets. To be honest, this category is still being evaluated; but I'm leaning towards snom.

I realise everyone has probably been burnt but some of the vendors mentioned above but this is my experience of them. You'll notice nothing about laptops. I'm looking around for a decent vendor, I'll let you know if I find one. If you have been following along, you will notice that the Netgear ADSL modems (DM111P) runs Linux. The WD MyBook World Editions II's, run Linux (and I'd expect that they could be coaxed very easily into running generic Debian). The HP stuff (mostly) runs Linux. As does the Linksys and snom handsets. We won. Now, I've got to figure out how to setup Clonezilla so that the desktop Windows machines can be replaced when they fail. And I have less than 144 hours to do so. There is nothing like a deadline to concentrate your mind. P.S. I do have some half-finished entries for the intervening 22 months, I will clean them up and post them under their original dates in the next few weeks

It is not uncommon to run a Linux system with a kernel that was compiled for another distribution. One reason for doing this is the difficulty in compiling and testing a kernel to make sure it will do what you require. It’s not THAT difficult for someone who knows what they are doing, but if someone else has already done the work then it seems like a waste to re-invent the wheel. Sometimes it’s an issue of a driver that one distribution supports but not another, copying the entire kernel package from another distribution may be easier than compiling a new kernel with the extra driver. Sometimes it’s a kernel bug, if distribution A has fixed the bug and distribution B hasn’t, then it’s often easier to install a kernel package from distribution A when running distribution B. Another reason for running different distributions with the same kernel is Xen. If you have a Dom0 which hosts instances for different distributions as DomU’s then running the same kernel on all of them can make it easier to manage. Unfortunately it’s not uncommon for different distributions to have different kernel feature sets. One example I’m currently dealing with is the fact that the Debian/Etch kernel is compiled with CONFIG_AUDITSYSCALL disabled while RHEL and CentOS require it. So if you run a RHEL or CentOS system with a Debian kernel (EG running a Debian Xen server with a RHEL or CentOS DomU) then you see messages such as the following in your logs. crond[7824]: pam_loginuid(crond:session): set_loginuid failed opening loginuid The loginuid feature allows login and equivalent programs (which includes xdm and other graphical login programs, cron and every other program that runs a program on behalf of another user) to set the loginuid. This loginuid will be stored by the kernel, inherited across fork() and exec, and not be changed by running setuid or setgid programs. Therefore if you see some strange entries in your audit log indicating an attempted attack you can determine the original login UID of the person responsible. In terms of security features it’s not a really high priority. But it is really annoying when programs that work on RHEL don’t work properly with a Debian kernel and put many unwanted messages in the log files. For people who have less background knowledge about these things it may be more than annoying, and may even force them to change their deployment plans to make the message go away (not everyone knows which messages can be ignored or where to ask about such things). The fact that Etch has no user-space support for the auditing features in question (auditing system calls or setting the loginuid) was never a good reason for not enabling this feature (IMHO). Using the auditing system calls was simply a matter of copying the auditctl program from a RHEL, Fedora, or CentOS system (for those who didn’t feel inclined to compile the source). The loginuid required changes to PAM to enable it, but is actually a small part of the auditing layer. As a general rule minimising the differences between distribution kernels is going to benefit most people. Some people complain about kernel bloat, but there are worse candidates for that accusation and given that it seems impossible to buy a machine with less than 512M of RAM and a 900MHz CPU (the specs of the ASUS EeePC) adding a few extra kernel features seems unlikely to hurt anyone. It is of course always possible to compile your own kernel for the smallest machines. Finally I am in the process of back-porting SE Linux code and related security features to Etch, and having this already enabled in the kernel would make my work easier. I won’t do a 7 year support cycle for it unless someone pays, but supporting Etch past the release of Lenny with the latest SE Linux features (and the current features working properly) is my aim.

Share This

I've been quietly coveting the Zonbu for a number of months now. I finally caved in and ordered one when we got back from Australia, with the intention of using it to replace minotaur, the computer that exports my RAID10 via ATA over Ethernet to my MythTV box. minotaur is the old daedalus, which I bought back around 2000. It's a VA Linux Pentium III. It's old, noisy, and has no idea what power management is. The Zonbu has more grunt than it (in terms of BogoMIPS), and it's a fraction of the size. Our linen cupboard is now significantly quieter (and hopefully cooler). Heck, hopefully the power bill will be lower as well. Anyway, I put the order in when we returned from Australia, with the expectation that it'd turn up some time while Sarah was in hospital, or shortly afterwards, and I could use the rest of the month that I was off work to play with it. Well, I got an email on the 31st of December, telling me they were out of stock, and unless I wanted to pay $29 more for one with built-in WiFi, I'd have to wait until mid-January. As I just couldn't see the point of having WiFi (or spending more money) and not needing the thing in a hurry anyway, because I had more important things to worry about in the meantime, I opted to wait. This morning, I emailed them to enquire about whether or not more stock had arrived, and they emailed back to say that they were still waiting, but they'd found one they could sell to me anyway. The company happens to be close by in Menlo Park, so I picked it up today in our travels. Let me just say that it is a very cool little computer, just if you use it for its intended purpose. It's running a customised Gentoo Linux, with a 2.6.22 kernel. I'm a bit surprised about their choice of Gentoo. I think they'd be better off partnering with Canonical, given that Mark Shuttleworth is trying to make a Linux distribution easy enough for his grandmother to use. That'd take the work of engineering the operating system out of the equation, then they could just focus on the hardware and a bit of integration with Amazon's S3. The thing I have to give them mad props for is documenting how to hack the tripe out of the box. They tell you how to enable root. They tell you how to enable PXE booting. So once I figured out that the front USB port seems to get treated slightly differently for a USB keyboard than the back ones, it was very easy to PXE boot it and install Debian. I initially started with trying to install Etch, but I kept getting missed interrupts on the CompactFlash device, which resulted in the filesystems panicking. So I gave up and went with Lenny, and presumably because it also uses 2.6.22, everything seemed to go fine. The box comes with a 4Gb CompactFlash card, which is ample for my needs. It's running the 686-optimised kernel, which is probably not ideal, but works. We'll see how things go. Interestingly, I blew another hard drive power supply, exactly like last time. I've no idea if it's the act of plugging everything back in again that's causing the problem, or they're generally flaky, and they don't fail until they're powered off and back on again. Maybe that IEC Y-cable wasn't such a good idea after all. I've now run out of spare power supplies, so I'm going to have to get some more for when these two inevitably fry themselves. Overall, I'm very pleased with this purchase, but it's a bit early to see how it's going to perform. I can't imagine it's going to perform worse than the computer it's replacing, but it was probably never intended for what I'm using it for either... Oh, and I discovered vblade-persist, which seems to be a very nice framework for managing ATA over Ethernet exports. Now I just need to get my hands on a big tub of Lego to build a nice chassis for the whole thing.

Well, this is being written on my broken HP laptop and from within GNOME at that. The problems that I anticipated last time are truly ugly : trying to manage a system that uses repositories from Mepis, Ubuntu and Debian are as horrendous as most Debianites would expect. Debian-based is not an easy balance and this is something that I will revisit within Emdebian. It would be easier if I didn't insist on Debian being added to the mix.
There are problems with cyclic upgrades where apt gets confused and repeatedly upgrades the same packages at the same version.
There are problems doing any building on the box - none of the -dev packages will install without massive work on apt-cache policy $foo and apt-get install $foo=$debian_version, due to dependency problems from having mixed distros. The end result of these was that all of KDE had to be removed - presumably due to upgrading libc6 but didn't worry about trying to put it back.
The wireless connection is still down - but it didn't work with plain Mepis either. The graphics are really weird - the proprietary NVidia kernel driver only copes with 1024x768 and I had expected more, plus scrolling behaviour is distracting.
So yes, even the this horrible setup can work in a basic and quite limited way but I'll need a full Debian install quite soon. It's stable, it's usable for limited tasks and at least I've been able to get GNOME onto it.
I'm going to leave it for now and revisit it later with a fresh Debian amd64 install - I've got to get back to some Emdebian stuff.
(Oh and yes, I did replace firefox with iceweasel).

As we all know, the Express are a load of xenophobic racist ignorant misleading cocks. Thanks to Iain who pointed me at this glorious post entitled something I won't repeat for fear of offending the children, I discovered what is probably the best example of selective quoting in the Express. They said:

The Government's equality chief Trevor Phillips recently said the fear that migrants are jumping council queues for homes is fuelling tensions.

Well if the government are scared that migrants magically jump up the council house queue, then it must be true. Or is it. The Guardian has the full quote:

Mr Phillips [chairman of the Commission for Equality and Human Rights] said tensions were driven by a widespread perception that newcomers often received unfair advantages. "Specifically, that white families are cheated out of their right to social housing by newly-arrived migrants," he told the [Local Government Association]. "I have never seen any reliable evidence to back up this claim. And there can be no doubt that much of the public feeling is driven by the careless media and racist parties."

If you ever wonder how low the Express and co. will go to get a quote or statistic, this is a good example. In a quote where the essence of the message is that the scum-class tabloids and racist parties are fueling anti-immigration views, they managed to get a quote to support a story against immigration. Well done, Tom Whitehead, you really do deserve a special place in hell. NP: Skreamizm Volume 4, Skream