tag:blogger.com,1999:blog-23906117176773152202024-02-06T19:12:05.918-08:00mdeslaurRandom ramblings of a shell junkie.mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.comBlogger22125tag:blogger.com,1999:blog-2390611717677315220.post-42496029227204380142013-12-16T11:25:00.001-08:002013-12-16T12:04:50.484-08:00Ubuntu Touch and User Privacy<h2>
Application Confinement</h2>
When we started thinking about how to design the security infrastructure in Ubuntu Touch, one of the important criterias was user privacy. For Ubuntu Touch, and the converged desktop in the future, we are moving from a model where people install software provided in an archive maintained by packagers to a model where applications get uploaded by the authors themselves directly into a software store. While this allows users to quickly gain access to the latest and greatest applications, it also brings with it a new problem: how to prevent malicious applications from stealing the user’s private data.<br />
<br />
The traditional archive model in Ubuntu is based on trust, barrier to entry, and time. In order to get something uploaded or modified in the archive, a developer needs to demonstrate trustability by contributing a significant amount of work before upload rights are granted. Learning how to create and modify packaging, and successfully getting contributions sponsored is complex, time consuming, and is a barrier to entry. Once a package does get uploaded or modified, it is generally done in the development release. This allows a package to be in the archive for a certain amount of time before it becomes part of an official release. Hopefully, if something malicious does make it to the archive, it will be discovered in the development release before it gets published in an official release.<br />
<br />
This long and complex process results in a software archive that can be trusted, but prevents software developers from being able to quickly get new versions of their software into the hands of their users. One of the goals of the Ubuntu Software Store is to allow a software developer to perform a few simple steps and have their application available to be installed by users in minutes, not in months.<br />
<br />
How do we trust software that can be made available to users in minutes? Simple: we confine it, and prevent it from accessing the user’s private data.<br />
<br />
<h2>
The Permissions Problem</h2>
<br />
At some point, an application may need to access some of the user’s data for it to be useful. For example, an image editing application is quite useless if it can’t open any of the user’s pictures. There needs to be a way to give applications permission to access certain data.<br />
<br />
On another mobile platform, this is solved in two ways: having each application ship with a list of required permissions, and implement a shared storage location where applications can freely access the user’s files. When a user installs an application, a dialog box is displayed listing all the permissions that are required for the application to work correctly. The user then has two choices: they can either continue with the installation and grant the required permissions, or they can cancel the installation process.<br />
<br />
As a user, this is a difficult choice to make.<br />
<br />
In order for a user to make an informed decision about a security question, there needs to be some context. If a flashlight application I am attempting to install indicates that it requires access to my address book, I have no idea at this point in time <i>why</i> that access is required. Does the application feature a “Recommend this app to friends!” button which would require access to my contact list, or does it contain adware that wants to data mine me? At this stage, I am unable to make an informed decision on the trustworthiness of the application, and will most likely install it even if I’m not in complete agreement with the permissions that are being requested. This is an all-or-nothing proposition: there is no way for me to use an application if I don’t accept the complete list of permission it requests.<br />
<br />
This results in a software store loaded with no-cost applications that exist solely to data mine personal information for profit. Users are walking around with mobile devices completely unaware of the fact that the trivial applications they’ve installed are tracking every move they make.<br />
<br />
<h2>
Trusted Helpers</h2>
<br />
In the security model we’ve developed, users get to make decisions on sensitive actions at the moment they are needed, instead of at application installation time. This is performed by system components called “Trusted Helpers”.<br />
<br />
Ubuntu Software Store applications are confined by default. They can only access their own directories, and their own data. Instead of granting permissions to access user data, we grant access to <i>request</i> user data using Trusted Helpers. This allows applications to access specific data as approved by the user instead of granting permissions to access it all.<br />
<br />
For example, instead of granting permission to directly access all of the user’s contact list, an application can request access to a contact. The system address book will then display a list of contacts to the user and only the specific contact selected by the user will be sent to the application. The application <i>only</i> has access to the contact which was specifically authorized by the user.<br />
<br />
If a flashlight application needs access to a user contact in order for a “Recommend this app to friends!” button to work, the user will be making an informed choice, as the request will be the direct result of having pressed the button. The flashlight app can be used without fear of it accessing contact information during normal usage.<br />
<br />
The same idea exists to exchange data between applications. If the user wants to edit a picture using an image editing application, the application will ask a system service known as the Content Hub to obtain an image. The Content Hub will then request a picture from the application which owns the data, in this case the Gallery application. The Gallery application will display a picker dialog to the user allowing them to select a specific photo to which the image editor will be granted access.<br />
<br />
A similar approach exists for access to other system services that are security-sensitive, such as the device GPS. At the moment an application wants to access the user’s location, a dialog will be displayed asking for permission. If the user accepts the request, the decision is cached, and the application can now access the user’s location in the future. If the user declines, the application can continue functioning normally, but without the location information. A user will be able to revoke the granted permissions at any time.<br />
<br />
Trusted Helpers allow users to specify, in a fine-grained way, which private information can be accessed by applications. The decision to grant these permissions is done at the moment the access is needed, giving the user the appropriate context for making an informed decision. Applications can be installed and used without fear that private data is being collected in the background.<br />
<br />
<h2>
Policy Groups</h2>
<br />
Applications in the Ubuntu Software Store are confined with technology called AppArmor. In order to facilitate the creation of AppArmor profiles by application developers, Ubuntu comes with a predefined list of “Policy Groups”. These Policy Groups are specified by application developers when creating packages for submission to the Ubuntu Software Store.<br />
<br />
Some of the Policy Groups simply give access to the APIs necessary to communicate with Trusted Helpers. For example, the “location” Policy Group allows an application to communicate with the location service which uses the GPS, but does not give access to the GPS directly. The location service is a Trusted Helper which will prompt the user for authorization, so the mere presence of this Policy Group doesn’t directly affect user privacy.<br />
<br />
Some of the other Policy Groups, such as “networking”, grant access to common services that aren’t really suitable for user prompting. Since most applications need network access, it would be inconvenient and inefficient to prompt the user for each one.<br />
<br />
Although Policy Groups weren’t designed to be visible to end users, there is a utility in the Ubuntu Software Store called “Permy” that will display the ones being used by each installed application.<br />
<br />
Power users who would like to experiment with restricting Policy Groups for installed applications can currently do so by editing the security manifest files. Each package in the Ubuntu Software Store ships a security manifest file that enumerates the Policy Groups granted to the package. When the package is installed, its security manifest file is available in /var/lib/apparmor/clicks/ and it can be edited by the admin of the system. For example, if you wanted to remove the “networking” Policy Group from the hello-world application:<br />
<br />
$ adb shell vi /var/lib/apparmor/clicks/ar.com.beuno.hello-world_hello-world_0.1.json<br />
<br />
change:<br />
<br />
{<br />
"policy_groups": [<br />
"networking"<br />
],<br />
"policy_version": 1.0<br />
}<br />
<br />
to:<br />
<br />
{<br />
"policy_groups": [],<br />
"policy_version": 1.0<br />
}<br />
<br />
Then apply the changes to the AppArmor policy with:<br />
<br />
$ adb shell aa-clickhook -f<br />
<br />
At the moment, application upgrades will reset any modifications done to Policy Groups, but we will be introducing override files in this development cycle. The override files will allow power users to revoke application Policy Groups in a way that will survive application upgrades.<br />
<br />
In the future, we intend to develop the required system service to allow power users to easily revoke Policy Groups with a simple graphical interface.<br />
<br />
<h2>
The User is in Control</h2>
<br />
We believe the user should ultimately be in control of all access to their private data, and security should be more fine-grained than the all-or-nothing access inherent to a set of predetermined permissions associated with an application. Allowing the user to selectively share data with applications on a use by use basis as is done with Trusted Helpers makes Ubuntu Touch and the Ubuntu Software Store the ideal platform for privacy conscious users.mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.comtag:blogger.com,1999:blog-2390611717677315220.post-82556516548221173472013-02-03T11:24:00.002-08:002013-02-03T13:21:49.804-08:00My Mythbuntu setupI watch a lot of TV. Although I would
really like to get rid of my <a href="http://www.shawdirect.ca/">satellite provider</a> and switch to
streaming the shows I like off of the Internet, living in Canada
means a lot of the <a href="http://www.hulu.com/">streaming video services</a> aren't available, and
even if they were, the bandwidth required to watch them would bust my
download quota.
<br />
<br />
I'm also really picky about video
compression, and some of the streaming services compress so much that
watching their shows on <a href="http://store.sony.com/webapp/wcs/stores/servlet/ProductDisplay?catalogId=10551&storeId=10151&langId=-1&productId=8198552921666483151">the 55” TV</a> I have in my living room is
<a href="http://en.wikipedia.org/wiki/Compression_artifact">painful</a>. Also, for some reason, half the shows and movies on Netflix
have audio sync issues on my setup.
<br />
<br />
<a href="http://www.mythtv.org/">MythTV</a> plays a large part in my
household. All shows I watch are scheduled and recorded in HD off my
satellite provider. While I wait for <a href="http://www.ubuntu.com/devices/tv">Ubuntu TV</a> to take shape, I've
recently upgraded my MythTV setup to <a href="http://www.mythbuntu.org/">Mythbuntu</a> 12.04.
<br />
<h4 style="margin-bottom: 0cm;">
Backend</h4>
<br />
My MythTV backend is running on an <a href="http://h10025.www1.hp.com/ewfrf/wc/document?docname=c01949097&lc=en&dlc=en&cc=us&product=4107499">HP Pavilion a4310f</a>, with 4GB or ram, and a 1TB HDD. It's hooked up to a
<a href="http://www.hauppauge.com/site/products/data_hdpvr.html">Hauppauge HD-PVR</a> which records the video stream coming from my
<a href="http://www.shawdirect.ca/english/customercare/techcentral/hardware.asp?page=505">satellite provider's box</a>. I have set the satellite provider's box to
output 720p, as that gives me reasonable file sizes with an
acceptable picture quality. Video is recorded over component cables,
and sound is recorded in 5.1 over a TOSLINK cable. I use the IR
blaster included with the HD-PVR to switch stations on the satellite
box.
<br />
<br />
Instructions for setting up the HD-PVR
in MythTV can be <a href="http://www.mythtv.org/wiki/Hauppauge_HD-PVR">found in the wiki</a>. This pretty much works out of the
box with Mythbuntu. Although I originally had stability problems with
the HD-PVR where every couple of months it would switch to recording
audio at 25fps resulting in audio drift, a firmware upgrade to
version 1.6.29353 has made it rock solid. I haven't risked upgrading
to the most recent 1.7.x firmware as I don't currently have any
issues.
<br />
<br />
You can obtain the script I use to
change channels, my lircd configuration files, and the rc.local file
I use to set the audio input <a href="http://people.canonical.com/~mdeslaur/mythtv/">here</a>.
<br />
<br />
To set the picture control values to
reasonable settings, I change the defaults for all channels in the
MythTV database by running the following SQL command:
<br />
<br />
<span style="font-family: "Courier New",Courier,monospace;">update channel set
contrast=16384,brightness=32768,colour=16384,hue=3840;</span>
<br />
<br />
I schedule programs to record using the
<a href="http://www.mythtv.org/detail/mythweb">MythTV web interface</a>, and recorded shows are streamed in HD over the
<a href="http://www.mythtv.org/wiki/UPnP">built-in UPnP server</a> to any one of the three <a href="http://www.avsforum.com/t/931796/official-ps3-faq-master-thread">Playstation 3s</a> I have
around the house which also serve as Blu-ray players. I also have a dedicated MythTV frontend in the
living room, which allows me to view TV shows without commercial
interruption, and to delete shows once they've been watched. These
are all connected using the wired gigabit network I installed during
house construction, preventing the problems associated with streaming
HD video over a wireless network.
<br />
<h4 style="margin-bottom: 0cm;">
Frontend</h4>
<br />
In the living room, which is my main TV
viewing area, a dedicated MythTV frontend is used. I am using a
<a href="http://www.jetwaycomputer.com/ITX-JBC600C99352W.html">Jetway HBJC600C99-352W-BW</a> mini computer. I chose that model because
it came with a built-in remote control, which allows me to power it
on and control it from my <a href="http://www.remotecentral.com/reviews/sony_rmvl610/index.html">Sony RMVL610</a> universal learning remote. It
also features Nvidia Ion2 graphics, which enables me to use <a href="http://www.mythtv.org/wiki/VDPAU">VDPAU with MythTV</a> in order get the performance necessary to decode HD
video.
<br />
<br />
I added a 1GB SO-DIMM to it, along with
a cheap 32GB <a href="http://www.kingspec.com/">KingSpec SSD</a>. It is also running Mythbuntu 12.04, and is
hooked up to the gigabit wired network.
<br />
<br />
Getting the remote to work was a bit of
a challenge. The device has a <a href="https://lkml.org/lkml/2012/4/8/140">bogus HID report descriptor</a>, resulting
in a compatibility issue with the kernel HID drivers. Before a <a href="https://lkml.org/lkml/2012/4/8/140">kernel fix</a> was available, I discovered an application called “<a href="http://forum.xbmc.org/showthread.php?tid=88560">hid-mapper</a>”,
which allows converting any HID event into a keypress event. This is
what I use on my frontend. I have packaged hid-mapper, along with
some fixes, and all of the configuration scripts necessary to get it
working on my frontend in <a href="https://launchpad.net/~mdeslaur/+archive/ppa/+packages?field.name_filter=hid-mapper&field.status_filter=published&field.series_filter=">my PPA</a>.
<br />
<br />
If you do use my configuration
files, please be aware that since I use a universal remote, I opted
to make use of all buttons on the original remote without any regard
to their placement or function. If you intend on using the original
remote, you may want to reconfigure the button mappings to your
liking.mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com0tag:blogger.com,1999:blog-2390611717677315220.post-76569692047035835712011-11-18T21:30:00.000-08:002011-11-18T21:30:33.059-08:00Where's Chuck 2<a href="http://farm7.staticflickr.com/6050/6361508901_7f126b18d7.jpg"><img src="http://farm7.staticflickr.com/6050/6361508901_7f126b18d7.jpg" width="400"></a>mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com0tag:blogger.com,1999:blog-2390611717677315220.post-7089501168847609182011-11-18T18:13:00.001-08:002011-11-18T18:22:52.329-08:00Where's Chuck?<a href="http://farm7.staticflickr.com/6038/6360846011_cbcb94a107_z.jpg"><img src="http://farm7.staticflickr.com/6038/6360846011_cbcb94a107_z.jpg" width="400" /></a>mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com0tag:blogger.com,1999:blog-2390611717677315220.post-65158752474822057282011-10-17T08:43:00.000-07:002011-10-17T08:43:25.882-07:00How to disable the guest account in OneiricUbuntu 11.10 now ships with the guest account available at the LightDM login screen.<br />
<br />
This new feature isn't really a security issue, since by default using it requires physical access, and it is confined with an AppArmor profile. If an attacker has physical access to your laptop, all bets are off.<br />
<br />
The guest account can be disabled by editing /etc/lightdm/lightdm.conf and adding "allow-guest=false" to the "SeatDefaults" section.mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com4tag:blogger.com,1999:blog-2390611717677315220.post-29272299849462088852011-09-17T05:30:00.000-07:002011-09-17T05:46:59.593-07:00Introducing the Pasaffe password managerFor the past few years, I had been storing my passwords in an application called <a href="http://projects.netlab.jp/gpass/">GPass</a>. What I liked about it when I started using it at that time was its simplicity, and the fact that each entry in the database has a notes field that can be used for any additional information that the predetermined fields don't handle.<br />
<br />
Unfortunately, it doesn't seem to be actively developed anymore, and has been dropped from the <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=617590">Debian</a> and Ubuntu archives. What's more, I've never looked closely at how secure the database format is, and there is no way to open the database it creates on other devices, such as my phone.<br />
<br />
I started looking for a replacement about six months ago, and I didn't like most of the ones I tried. Some of them used a <a href="http://www.fpx.de/fp/Software/Gorilla/">cross-platform GUI toolkit</a> which made the app cumbersome to use. Others were <a href="http://www.keepassx.org/">too complex</a>, didn't have a place to store notes, or were <a href="http://oss.codepoet.no/revelation/wiki/Home">no longer actively maintained</a>.<br />
<br />
Since I've been wanting to learn GTK programming for a long time, this presented itself as a great opportunity. I started by looking at the popular password database formats, and the one that stood out was the one used by <a href="http://www.blogger.com/blogger.g?blogID=2390611717677315220" ref="http://passwordsafe.sourceforge.net/">PasswordSafe</a>. It is <a href="http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt?revision=4348&view=markup">well documented</a>, well designed, and has implementations available on <a href="http://passwordsafe.sourceforge.net/relatedprojects.shtml">numerous platforms</a>. I implemented a Python library to read and write the database format, and then proceeded to use the excellent <a href="https://wiki.ubuntu.com/Quickly">Quickly tool</a> to create the initial GTK user interface. Since I want my app to run on the latest LTS release, Lucid, I decided to stick with <a href="http://www.pygtk.org/">PyGTK</a> for now instead of <a href="http://live.gnome.org/PyGObject">PyGObject</a>. I plan on converting it to PyGObject for the next LTS release. After having developed it for a while, I feel it's in a good enough state to be used.<br />
<br />
Introducing: <a href="https://launchpad.net/pasaffe">Pasaffe!</a><br />
<br />
You can find the upstream project page <a href="https://launchpad.net/pasaffe">here.</a><br />
You can install it from a PPA <a href="https://launchpad.net/%7Emdeslaur/+archive/pasaffe">here.</a><br />
<br />
If anyone wants to contribute to it, there's a list of currently unimplemented features and other things that need to be done in the <a href="http://bazaar.launchpad.net/%7Emdeslaur/pasaffe/trunk/view/head:/TODO">TODO file</a>.mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com5tag:blogger.com,1999:blog-2390611717677315220.post-7997602778269525472011-05-31T14:38:00.001-07:002011-05-31T14:50:22.316-07:00Check your cron jobs...Yesterday, a PAM security update was <a href="http://www.ubuntu.com/usn/usn-1140-1/">released</a>. Unfortunately, it introduced a regression which caused the cron daemon to stop working with a <a href="https://launchpad.net/bugs/790538">"Module is unknown" error</a>.<br /><br />The updates were quickly pulled from the archive, and a <a href="http://www.ubuntu.com/usn/usn-1140-2/">regression fix has been released</a>.<br /><br />If you have servers or desktops configured with unattended updates, they may have gotten updated with the broken release. If so, cron jobs will have stopped and updates will no longer be automatically installed.<br /><br />You may fix this problem by performing one of the following actions:<br /><ul><li>Rebooting your machine</li><li>Restarting your cron daemon ("sudo /etc/init.d/cron restart")</li><li>Updating to the latest PAM packages (with Update Manager, or apt-get)</li></ul>This is a rather unfortunate situation, and steps have been implemented to make sure a similar issue doesn't happen with PAM updates in the future.<br /><br />We apologize for the inconvenience.mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com2tag:blogger.com,1999:blog-2390611717677315220.post-7011413058944844552011-04-13T12:14:00.000-07:002011-04-13T14:44:44.432-07:00Self-Encrypting Hard DisksI travel a lot with my laptop, and it can contain private information that shouldn't get disclosed if it's ever lost or stolen. For this reason, I've been using various types of disk encryption over the years, such as <a href="https://help.ubuntu.com/community/EncryptedHome">Ubuntu's encrypted home directory</a> feature, to reasonably assure that my data remains private.<br /><br />A few things have always bothered me with software encryption though. The first thing is the fact that software encryption is non-transparent. Although slight, there is a performance penalty in encrypting every read and write to your hard disk. Some people choose to only encrypt certain things to try and reduce that penalty. Do I only encrypt my home directory? What about my swap file or the /tmp directory? If I encrypt my swap file, do I give up hibernation, or do I make it ask me for a passphrase when I boot? What happens in case of disaster? Will I be able to boot a recovery cd and gain access to my data? Will I have saved the passphrase/encryption key somewhere safe in case an emergency arises?<br /><br />Another issue is the fact that the decryption key necessary to access my encrypted volumes is located somewhere in RAM. There are a bunch of reasons why this is worrisome, from <a href="http://en.wikipedia.org/wiki/Cold_boot_attack">“Cold Boot”</a> attacks, to hibernation, to simply having it leaked in some other way.<br /><br />But the biggest gripe I have with software encryption is the <a href="http://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html">“Evil Maid”</a> scenario. Basically, every time I leave my laptop unattended, someone could boot off removable media, or physically plug my hard disk in another computer, and alter the software that is loaded before my encrypted volumes. The altered software could send them my encryption password as I type it, or could wait around for my volumes to be mounted before installing a back door. I need to stay physically present with my laptop at all times to make sure this scenario isn't possible, something I'm not always prepared to do. Although laptops are expensive, the loss or theft of an encrypted laptop is limited to the value of the hardware, not the incalculable value of its contents. Leaving my <a href="http://www.dell.com/us/dfh/p/inspiron-mini9/pd">netbook</a> in my hotel room is an easy choice to make if all I stand to lose is a couple of hundred dollars.<br /><br />Since the hard disk that came with my Lenovo Thinkpad was a little small for my taste, I decided to replace it with a bigger one. In doing so, I specifically paid $20 more to get a model with <a href="http://www.hitachigst.com/internal-drives/self-encrypting-drives/">FIPS 197 certified hardware encryption</a>. These hard disks will encrypt everything that is stored on the physical platters with <a href="http://www.hitachigst.com/support/index-files/bulk-data-encryption-faq-index">AES 128bit encryption</a>, and a random key. When the disk is powered on, a standard ATA password is required to access it, and the password cannot be reset; if it is lost, the disk is no longer usable. A master password can be set that can be used to reinitialize the random key, so the disk is usable, but the data contained is lost.<br /><br />Fortunately, most <a href="http://www-307.ibm.com/pc/support/site.wss/MIGR-69621.html">ThinkPad models come with the required BIOS support</a> for disk encryption, so simply swapping the hard disk and setting a password in the BIOS screen was enough to get it working. Not all computer manufacturers have implemented the ATA security set, so you need to check carefully. Apparently <a href="http://www.hitachigst.com/support/index-files/bulk-data-encryption-faq-index">MacBooks</a> <a href="http://seagate.custkb.com/seagate/crm/selfservice/search.jsp?DocId=206011#4">don't have it</a>, for instance.<br /><br />For under $100, I now have an encrypted 500GB hard disk in my laptop that asks for a passphrase when I boot. Is this solution perfect? No. But, it's better than what I had before, and is perfectly adequate for my piece of mind.mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com10tag:blogger.com,1999:blog-2390611717677315220.post-71882284240871265192010-11-07T11:08:00.000-08:002010-11-07T11:28:21.762-08:00Netbook screen resolutionI love my <a href="http://en.wikipedia.org/wiki/Dell_Mini_9#9_Series">Dell Mini 9</a>.<br /><br />I'm back from UDS in Orlando, and have once again spent a whole week on my Mini 9. It's got a webcam so I can call home, and has bluetooth so I can use an external mouse without plugging in a dongle when the need arises. Although I've tried netbooks with 92% keyboards, I'm not ready to sacrifice portability by adding the extra 2 inches required to fit them. The keyboard on the Mini 9 has the perfect feel for such a small keyboard, and I've gotten quite used to it.<br /><br />The only thing I can't quite get used to is the native screen resolution: <a href="http://en.wikipedia.org/wiki/WSVGA#WSVGA_.28576p.29">1024x600</a> is not a lot of screen real estate to work with.<br /><br />The other day I was looking at the <a href="http://manpages.ubuntu.com/manpages/maverick/en/man1/xrandr.1.html">xrandr documentation</a>, and I noticed it supports screen scaling. I now regularly use the following command:<br /><br />xrandr --output LVDS1 --scale 1.25x1.25<br /><br />This scales my 1024x600 netbook screen to 1280x750, which is really cool when trying to view <a href="http://summit.ubuntu.com/">large web pages</a>, or <a href="http://projects.gnome.org/evolution/">any other application</a> that uses a lot of screen space. The downside of this is a slight blurriness that is, in my opinion, an acceptable trade-off.<br /><br />Unfortunately it doesn't look like there's a way to set scaling in the <a href="http://library.gnome.org/users/user-guide/stable/goscustdesk-70.html.en">GNOME Monitor Preferences</a> tool.mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com4tag:blogger.com,1999:blog-2390611717677315220.post-50594821034129072932010-10-07T06:43:00.000-07:002010-10-22T05:44:05.992-07:00Stuck on dial-up (Updated)My mother has been a happy Ubuntu user ever since I installed Dapper to solve the <a href="http://support.microsoft.com/default.aspx?scid=gp;en-us;windowsmegeneralprotection">countless</a> <a href="http://www.pchell.com/support/tildefile.shtml">problems</a> she was having with <a href="http://www.pcworld.com/article/125772-2/the_25_worst_tech_products_of_all_time.html">Windows Me</a>. Since her computer is starting to age, and she's a 5-hour drive away, I bought her a brand new computer for her birthday, which I've been installing with Lucid this week.<br /><br />Problem is, she is still <a href="http://www.pcworld.com/article/136441/rural_us_doomed_to_dialup.html">stuck on Dial-Up internet access</a> no matter how hard she's tried to get broadband from the local phone and cable companies.<br /><br />Unfortunately, <a href="http://projects.gnome.org/NetworkManager/">NetworkManager</a> still doesn't have 56K modem support, so a few steps are necessary to setup Ubuntu for dial-up.<br /><br />Since her phone line is noisy, I purchased a <a href="http://www.usr.com/products/modem/modem-product.asp?sku=USR5686G">reliable modem</a> that doesn't need special drivers to work in Linux, along with an appropriate USB-to-serial adaptor.<br /><br />Once I made sure the modem was visible by searching through dmesg for the right serial port, and testing it with minicom, I performed the following steps:<br /><br /><ol><li>Installed the gnome-ppp package</li><li>Added her user to the "dip" group so gnome-ppp could spawn the pppd daemon</li><li>Configured gnome-ppp with the phone number, username and password provided by her ISP</li></ol><br />Once that was done, connecting to the Internet worked great, except for a single problem: Firefox would always start up in "Work Offline" mode. It turns out Firefox uses NetworkManager to figure out if an Internet connection is available when it starts. To fix this:<br /><br /><ol><li>Type "about:config" in the Firefox URL bar</li><li>Search for the "toolkit.networkmanager.disable" key</li><li>Switch it to "true"</li></ol><br />I'm looking forward to seeing her go from Hardy to Lucid this weekend!<br /><br />Updated 2010-10-22:<br /><br />So, I ran into a couple of extra difficulties when I actually installed her new computer. It seems her ISP uses CHAP or PAP to authenticate which wasn't the case when I tried connecting with my ISP at home. Gnome-PPP uses WvDial to perform the actual dialing, and WvDial tries to add the necessary authentication information itself to the /etc/ppp/pap-secrets and /etc/ppp/chap-secrets files. Problem is, those files are owned by root and are 600 by default. The pppd man page states "this file should be owned by root and not readable or writable by any other user. Pppd will log a warning if this is not the case.", so this isn't an easy problem to solve. Since I didn't want her running gnome-ppp as root, I changed both files' ownership to root:dip and permissions to 660. This allowed gnome-ppp to authenticate to her ISP, even though pppd is logging a warning.<br /><br />The second problem I encountered was that Evolution would always come up as offline. Like Firefox, it integrates with NetworkManager to check if the computer is online. Unfortunately, unlike Firefox, Evolution doesn't seem to have a way to disable NetworkManager integration. Since time was limited, and I knew she wouldn't be using the Ethernet port on her computer, I simply disabled NetworkManager entirely by editing the /etc/init/network-manager.conf file.<br /><br />My stepfather owns a Dell Vostro laptop with Lucid on it, and uses it to connect to the high-speed wireless network at work. He asked me if I could get a modem for his laptop so he could use Dial-Up when at home. I'm not sure how I will be able to handle this for now, as disabling NetworkManager won't be an option in his case...mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com3tag:blogger.com,1999:blog-2390611717677315220.post-63253812734655949202010-09-30T07:54:00.000-07:002010-09-30T08:01:59.776-07:00New GPG key!In accordance to the Ubuntu Security team's <a href="https://wiki.ubuntu.com/SecurityTeam/GPGMigration">GPG key transition plans</a>, I now have a new GPG key capable of generating SHA-2 signatures.<br /><br />If you've signed my old key (40B8CCDA) in the past, I would appreciate it if you could take a look at my <a href="http://people.canonical.com/%7Emdeslaur/key-transition-2010-09-30-mdeslaur.txt">transition statement</a>, and sign my new key (A744BE93).<br /><br />Thanks!mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com0tag:blogger.com,1999:blog-2390611717677315220.post-73980792443005055712010-04-23T05:29:00.000-07:002010-04-23T09:20:13.400-07:00Trying to switch to EmpathyI try to dogfood as much as possible. I try to use the actual applications Ubuntu ships by default for everyday things like web browsing, email and IM. I believe this is the best way for applications to get tested properly, fixed, and improved. If developers don't use the default applications because they are buggy, or don't contain necessary features, how can we expect them to be appropriate for regular users?<br /><br />I've been a <a href="http://www.pidgin.im/">Pidgin</a> user for years. It's a great, but now there's a new kid in town: <a href="http://live.gnome.org/Empathy">Empathy</a>, which is now the default IM client installed in Ubuntu and other distros. This week, I am attempting to switch from Pidgin to Empathy. So far so good. It's working pretty great, except for one thing: I keep missing the notifications when people send me messages.<br /><br />If I already have a chat window open with someone in Empathy, and the person sends me a new message, I get notified in three ways: I get a temporary notify-osd message, the Indicator Applet envelope turns green, and the window in my window list flashes for a few seconds and stays highlighted and bold.<br /><br />Most of the time, I miss the notify-osd popup, as I'm typing something, and tend to always finish before looking up at the alert. Once I do, I rarely have time to read the whole thing before it disappears. My Indicator Applet envelope is green most of the day as I almost always have unread messages in my Inbox. But as soon as I finish the task I'm doing and go to switch windows with the window list, I notice the highlighted and bold window demanding attention.<br /><br />The problem I have with Empathy is there is no way to tell it to open a new chat window automatically when a new message arrives and there isn't already a chat window open. When that happens, I don't have the highlighted window in the window list demanding attention, and often discover that I missed an IM an hour later when clicking on the green envelope to read my email.<br /><br />What am I doing wrong?mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com16tag:blogger.com,1999:blog-2390611717677315220.post-2582691984783086182010-02-26T05:51:00.000-08:002010-02-26T06:37:13.468-08:00Canadian tax software and LinuxWell, it's tax time again!<br /><br />This used to be the part of the year I would dread. Not because I feared how much income tax I would need to pay, but because I knew I would have to get Windows running in a VM or on a spare computer in order to use <a href="http://quicktax.intuit.ca/tax-software/quicktax-download-cd.jsp">tax preparation software</a>.<br /><br />I would get <a href="http://en.wikipedia.org/wiki/Heartburn">heartburn</a> from wondering if the new <a href="http://www.extremetech.com/article2/0,2845,815697,00.asp">flavour-of-the-day copy-protection </a>mechanism the software used would actually work in a VM, and if it would let me open up my files again after <a href="http://www.extremetech.com/article2/0,2845,834905,00.asp">reinstalling it</a> if something went wrong. Top that off with the fact that trusting your important data to Windows is like locking your safe with duct tape, and I'd be popping <a href="http://wesclark.com/am/rolaids.html">Rolaids</a> like candy.<br /><br /><span style="font-style: italic;">Are all the security updates installed?<br /></span>Every time I open "Windows update", it manages to <a href="http://support.microsoft.com/kb/296861">find some more</a>.<br /><br /><span style="font-style: italic;">Is my antivirus software properly installed and working?</span><br />What if I got <a href="http://www.infopackets.com/news/security/2008/20081231_400000_pcs_infected_with_fake_antivirus_2009_software_says_microsoft.htm">malware</a> while purchasing the antivirus software online, <a href="http://esupport.trendmicro.com/Pages/The-error-%E2%80%9CInstallation-Interrupted-A-security-threat-prevented-the-in.aspx">before I installed it</a>?<span style="font-style: italic;"> </span><a href="http://shop.symantecstore.com/">Which one do I choose?<br /></a><br /><span style="font-style: italic;">Oh great, the new version of the tax software uses Internet Explorer to update itself.</span><br /><br />Luckily, a couple of years ago I discovered <a href="http://www.ufile.ca/default.asp">UFile.ca</a>, a web-based tax preparation application. They even <a href="http://ufile.ca/Help/FAQ_tech.asp#11">officially support Linux</a>! It's quite refreshing to see a Tux logo right next to the Windows and Mac logos. It's even easier to use than the software I was previously purchasing!<br /><br />Of course, it's web-based, so it's up to you to decide if you're willing to accept handing over your tax information to a third party. In my case, the decision was easy: I get to decide <a href="http://www.ufile.ca/WhyUFile/OurHeritage.asp"><span style="font-style: italic;">who</span></a> can see my tax information, which is a lot better than <a href="http://www.smh.com.au/news/technology/identity-theft-virus-infects-10000-computers/2006/08/02/1154198204613.html"><span style="font-style: italic;">hoping</span></a> no one could see it.<br /><br />Goodbye heartburn!mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com6tag:blogger.com,1999:blog-2390611717677315220.post-36234858059316123292009-12-21T09:50:00.000-08:002009-12-21T10:05:42.731-08:00Ubuntu movie sightingI was watching the <a href="http://www.imdb.com/title/tt1132620/">Millenium movie</a> last night, and spotted an Ubuntu desktop being used by the "Plague" character:<br /><br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWEUwt3wAhpxtv8ToB2vBzu-JzrrQlkl6BSojyzR3H-Rc7SQ9sYjX8SQGdo3wLCpJLj8q3B81wSOBmsQj0WAYv18HzcvVNG47WsF7a57Mq6KyeJQwjJvyG-LmS6YfFkrQLH6lueUJMuSHq/s1600-h/millenium2.jpg"><img style="margin: 0px auto 10px; display: block; text-align: center; cursor: pointer; width: 320px; height: 186px;" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWEUwt3wAhpxtv8ToB2vBzu-JzrrQlkl6BSojyzR3H-Rc7SQ9sYjX8SQGdo3wLCpJLj8q3B81wSOBmsQj0WAYv18HzcvVNG47WsF7a57Mq6KyeJQwjJvyG-LmS6YfFkrQLH6lueUJMuSHq/s320/millenium2.jpg" alt="" id="BLOGGER_PHOTO_ID_5417752017113624466" border="0" /></a><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrIokU0gL6_PyJEtXuXaHbsIO1zjVhVCBq9xkEcp_wd4nfazDuUyfswGeTltLhKe0uDRAijDdTdrsLfdQHO-Dh8CvgbsNwi7g3Kgt9lNvZfp3XBqC49Qd26CJGD3XxKKK_7yI1Qp_3ViZI/s1600-h/millenium1.jpg"><img style="margin: 0px auto 10px; display: block; text-align: center; cursor: pointer; width: 320px; height: 186px;" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrIokU0gL6_PyJEtXuXaHbsIO1zjVhVCBq9xkEcp_wd4nfazDuUyfswGeTltLhKe0uDRAijDdTdrsLfdQHO-Dh8CvgbsNwi7g3Kgt9lNvZfp3XBqC49Qd26CJGD3XxKKK_7yI1Qp_3ViZI/s320/millenium1.jpg" alt="" id="BLOGGER_PHOTO_ID_5417749586604264018" border="0" /></a><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7L5aYFYfyVJBzsL8kOMUxD58rbF-Gfl7DrYRPJTWBcr_7p-Ooq8e76aWl5Wnb9sdCDLQtNyyCDNw9yrINrSKluN090PQakJhzrN8yrH0Qc4eb1JOU9iuYEZiMl6608j1S2R130tQq7tH-/s1600-h/millenium3.jpg"><img style="margin: 0px auto 10px; display: block; text-align: center; cursor: pointer; width: 320px; height: 186px;" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh7L5aYFYfyVJBzsL8kOMUxD58rbF-Gfl7DrYRPJTWBcr_7p-Ooq8e76aWl5Wnb9sdCDLQtNyyCDNw9yrINrSKluN090PQakJhzrN8yrH0Qc4eb1JOU9iuYEZiMl6608j1S2R130tQq7tH-/s320/millenium3.jpg" alt="" id="BLOGGER_PHOTO_ID_5417751219293882114" border="0" /></a>mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com4tag:blogger.com,1999:blog-2390611717677315220.post-38190832418619871022009-11-04T05:09:00.000-08:002009-11-04T05:56:49.222-08:00GNOME KeyringFor the past week or so, people have been <a href="http://ubuntuforums.org/showthread.php?t=1302342">talking</a> about a “security issue” in Seahorse. This sums up my opinion on the matter:<br /><br /><span style="font-style: italic; font-weight: bold;">This isn't a security issue, and there is no good way to fix it.</span><br /><br />There, I've said it. Now, here's some background:<br /><br />Although people are talking about Seahorse, the actual application that manages passwords is called <a href="http://live.gnome.org/GnomeKeyring">GNOME Keyring</a>. GNOME Keyring is an application that manages a user's authentication information, such as user names and passwords. It stores the authentication information in one or more encrypted databases, called <span style="font-style: italic;">keyrings</span>. A password, supplied by the user, is required to unlock a keyring, at which point all the information contained within is decrypted and is made available to applications via the libgnome-keyring library. It is similar to the <a href="http://en.wikipedia.org/wiki/Keychain_%28Mac_OS%29">Keychain</a> in Mac OS X, and Protected Storage in Microsoft Windows.<br /><br />Traditionally, a desktop application that needed to remember a user's password, such as an email or an instant messaging program, would store the password in a hidden <a href="https://bugs.launchpad.net/ubuntu/+source/pidgin/+bug/226974">config</a> <a href="https://bugs.launchpad.net/ubuntu/+source/tsclient/+bug/296682">file</a> in the user's home directory. Appropriate permissions would be set on the file to make sure other local users can't read it.<br /><br />Sometimes, passwords stored in this manner would be obfuscated using a <a href="http://www.oxid.it/ca_um/topics/vnc_password_decoder.htm">reversible scheme</a>, as the password needs to be converted back to plain text in order to be used. This would provide a false sense of security. Users inspecting the file would think the passwords were encrypted, but a myriad of <a href="http://www.oxid.it/creddump.html">little</a> <a href="http://www.nirsoft.net/utils/pspv.html">recovery</a> <a href="http://www.forensicideas.com/tools.html">scripts</a> and on-line converters were available to anyone who knows how to perform a <a href="http://www.google.ca/search?q=password+recovery">Google search</a>.<br /><br />A password managing daemon, such as GNOME Keyring, increases the security of stored passwords for the following reasons:<br /><br /><ul><li>Passwords are stored in a database that uses <span style="font-style: italic;">real encryption</span>, not just an obfuscation scheme</li><li>A single code base needs to be audited to make sure no vulnerabilities exist in the encryption algorithms that are being used</li><li>The database is protected by a password that is known only to the user who unlocks it</li><li>Since the database is encrypted, no other user or bootable CD can recover the stored passwords if the unlock password is not known</li></ul><br />So, if GNOME Keyring increases the security of user credentials, why can you see your passwords exposed in plain text when you open Seahorse? <span style="font-style: italic;">Because you've unlocked the keyring using your login password.</span><br /><br />Although GNOME Keyring supports multiple keyrings, there is only one by default, called “login”. This keyring is automatically unlocked by a PAM module when logging into a GNOME desktop. When the desktop session is closed, the keyring is locked. When the keyring is in an “unlocked” state, the database files are decrypted using the decryption password and all the contents are in memory for gnome-keyring-daemon to access.<br /><br />Now, the attack scenario that has been talked about this past week has been leaving your computer unattended, and an attacker using Seahorse to access your clear text passwords. This has been criticized as being a security issue, and a few “solutions” have been suggested to “fix” the issue. Here are some of the scenarios proposed:<br /><br /><span style="font-weight: bold;font-size:130%;" >Scenario 1: Ask for the user's password before displaying the clear text keyring contents.</span><br /><br />This scenario doesn't work in practice. Once the keyring is unlocked, the contents are available under the user's security context. Since the GNOME Keyring daemon is under the user's security context, the intruder has every privilege necessary to simply bypass the authentication step and directly read the unencrypted keyring from memory. Even if Seahorse asked for a user password, nothing could prevent the intruder from simply downloading a “reveal passwords” application from the Internet or a USB key. There is no difference in time or skill required to open Seahorse and display passwords, or to type “gnome password revealer” in Google and execute the first application available for download. The GNOME Keyring project has a <a href="http://live.gnome.org/GnomeKeyring/SecurityPhilosophy">web page to explain this</a>.<br /><br />Even worse, the fact that a password would be required in Seahorse would make the user <span style="font-style: italic;">think</span> that a password is required to see the clear text information. This would give the user a <span style="font-style: italic;">false sense of security</span>. If Seahorse asks for a password, but a five line python script can bypass the password, bug reports would change from “Seahorse displays clear text passwords” to “Seahorse authentication can be easily bypassed”. This scenario doesn't solve the problem.<br /><br /><span style="font-weight: bold;font-size:130%;" >Scenario 2: Make keyring session expire automatically after a certain time.</span><br /><br />If the keyring session expires automatically, such as every 15 minutes, it becomes useless. The purpose of the keyring is to store passwords that are needed by applications. With keyring session expiration, Evolution can't automatically check for new mail, Empathy can't auto-reconnect to instant messaging networks, the wireless connection can't re-authenticate to access points.<br /><br />If you expire the keyring session every 15 minutes, you will probably need to type in your password every 15 minutes. Besides, if you leave your computer unattended, 15 minutes is long enough for an intruder to steal your passwords. This scenario doesn't solve the problem.<br /><br /><span style="font-weight: bold;font-size:130%;" >Scenario 3: Make the keyring daemon run as root or as a dedicated user.</span><br /><br />The idea behind this is to have a central daemon that would authenticate users and applications before giving out passwords. Since the daemon doesn't run under the user's security context, no amount of hacking by an intruder in an unlocked desktop session would result in gaining access to the unlocked password database.<br /><br />Although this scenario may seem appealing, it would probably be <span style="font-style: italic;">less secure</span> than the current approach. If we have a central daemon that serves all users, a programming vulnerability could result in other users gaining access to your confidential information. Besides, if your desktop applications, under your security context, can gain access to the passwords they need, so can an intruder in your security context. The intruder's script can simply spoof the desktop applications themselves to get the passwords, or get them out of the application's memory. This scenario doesn't solve the problem.<br /><br /><span style="font-weight: bold;font-size:130%;" >Scenario 4: Stop using GNOME Keyring.</span><br /><br />Well, GNOME Keyring was created to solve the problem of people writing down their passwords everywhere, including text files or their computer, and the problem of applications storing passwords in text files. Removing GNOME Keyring would decrease security to the state it was before. This scenario doesn't solve the problem.<br /><br /><span style="font-weight: bold;font-size:130%;" >Scenario 5: Locking the desktop session when stepping away from the keyboard.</span><br /><br /><span style="font-style: italic;">Now we're getting somewhere!</span><br /><br />Since the attack vector that's being discussed is an intruder gaining physical access to an unlocked desktop, the simplest way to prevent this from happening is to <span style="font-weight: bold;">lock the desktop when you leave it unattended</span>.<br /><br />If someone gains access to your desktop, your passwords are not the only thing they can access. Who needs your email password, when they have access to your whole mail file?<br /><br />Even if we assume GNOME Keyring could be made attacker proof, we would need to do the same for every desktop application. An intruder could, in a few seconds, install a <a href="http://en.wikipedia.org/wiki/Trojan_horse_%28computing%29">Trojan horse</a> downloaded off the Internet that runs in the background and emails him your passwords as soon as your desktop applications use them. The same application could intercept your sudo password, and become root to access the GNOME Keyring data. <span style="font-style: italic;">Absolutely no technical skill is required to do this.</span><br /><br /><span style="font-weight: bold;">Leaving your desktop unattended exposes all your confidential data to an attacker, not just your passwords.</span><br /><br /><span style="font-style: italic;">Game Over.</span><br /><br /><span style="font-size:130%;"><span style="font-weight: bold;">Recommendations:</span></span><br /><br /><ul><li>Always lock your screen when you leave your computer unattended. This is akin to locking your front door when leaving the house. Hit Ctrl-Alt-L, select “Lock Screen” from the user switch applet, or put the “Lock Screen” applet somewhere in your panel for easy access.</li><li>Set a low screen-saver idle timeout, for example, 5 minutes. If you forget to lock your session, it will do so automatically after a couple of minutes, reducing the time your confidential data is exposed.</li></ul><br />And remember: <span style="font-style: italic;">This isn't a security issue, and there is no good way to fix it.</span>mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com30tag:blogger.com,1999:blog-2390611717677315220.post-84008034290273015412009-08-30T11:25:00.000-07:002009-08-30T11:48:07.225-07:00The ideal portable media playerAfter the overwhelming response to my <a href="http://mdeslaur.blogspot.com/2009/07/goodbye-apple.html">Goodbye Apple blog post</a>, I have compiled a list of criteria I would like to see in a portable music player:<br /><span style="font-weight: bold;"><br /><span style="font-size:130%;">Linux compatibility</span></span><br /><br />This is a deal-breaker for me, as I only use <a href="http://www.ubuntu.com/">Ubuntu</a>. The next mp3 player should be manageable from a Ubuntu desktop. In order of preference:<br /><br /><ul><li>Manufacturer lists Linux support or compatibility on the box</li><li>Manufacturer lists Linux support or compatibility on their website</li><li>Device is known to work with Linux</li></ul><br />Of course, I would also need to be able to update the device's firmware, but this isn't a must. I can probably find someone with a Windows box to do a one-time firmware update.<br /><br /><span style="font-weight: bold;font-size:130%;" >Video support</span><br /><br />I spend a lot of time in airports and planes. This is where I use my player the most. I like watching videos and movies while on the move. I want at least a 2.5 inch screen, but it still needs to be light and small enough to fit in my shirt pocket. It's what I had on my 5G iPod Video, and it's the minimum I would tolerate.<br /><br />Video conversion should be easy, and should not require Windows-only software. I should be able to encode video from DVDs I own, and from video podcasts I download from the Internet.<br /><br />Bonus points if the manufacturer gives some example <a href="http://ffmpeg.org/">ffmpeg</a> or <a href="http://www.mplayerhq.hu">mencoder</a> command-lines in a wiki somewhere, or submits presets for their device to encoding software such as <a href="http://handbrake.fr/">Handbrake</a>.<br /><br /><span style="font-size:130%;"><span style="font-weight: bold;">Podcast support</span></span><br /><br />I listen to a lot of <a href="http://www.twit.tv/FLOSS">podcasts</a>. Since a lot of podcasts are available encoded in mp3 format, most people think they work on any mp3 player. Fact is, I want the player to be able to recognize podcasts and apply special logic to them the way iPods do. They need to:<br /><br /><ul><li>Have a “completed” flag to be able to easily spot the ones I've listened to already</li><li>Automatically resume from where they were left off (without having to manually set a “bookmark”)</li><li>Be in a separate list from regular music files</li></ul><br />The most important criteria for me is the automatic resume one, and is the one most media players are lacking. I don't enjoy losing my place in a podcast when I get interrupted, or want to listen to some music. Trying to locate where you were in an hour-long podcast with a fast-forward button is painful.<br /><br /><span style="font-size:130%;"><span style="font-weight: bold;">Standard USB port</span></span><br /><br />I want a media player with a standard <a href="http://en.wikipedia.org/wiki/Mini_usb#Mini_and_Micro">mini or micro USB port</a> for syncing and charging. I hate having to spend extra on spare proprietary cables. I hate having to lug ten different proprietary cables in my laptop bag when I travel. And most of all: I hate forgetting the proprietary cable at home when I leave on a trip. Even though the iPod has a proprietary connector, at least you can purchase a spare cable pretty much anywhere.<br /><br />Of course, most devices come with proprietary ports because a standard USB port can't offer all the extra features that a portable media device needs, such as TV Out, Audio Out, Line in, etc. How about this for an idea, folks: USB for syncing/charging, and proprietary port for all the rest.<br /><br /><span style="font-size:130%;"><span style="font-weight: bold;">User-friendly interface</span></span><br /><br />My dad came over the other day with a <a href="http://www.youtube.com/watch?v=d5BajfRaz9Y">cheap no-name 3rd generation iPod Nano knockoff</a> he bought at an electronics store. He was raving about how inexpensive it was.<br /><br />The user interface was the most horrible thing I have ever encountered. It was so complicated to simply get a song to play that I would have paid double the price difference to never see it again.<br /><br /><span style="font-size:130%;"><span style="font-weight: bold;">On-demand playlist support</span></span><br /><br />Although this isn't something that's absolutely necessary, I really enjoy listening to music while <a href="http://ipod.about.com/od/introductiontotheipod/ht/otg_playlist_ip.htm">creating a playlist on the device itself</a>.<br /><span style="font-size:130%;"><br /><br /><span style="font-weight: bold;">Adequate volume</span></span><br /><br />The volume needs to be loud enough to listen to music and movies while on a plane. My Sony PSP isn't loud enough for me to listen to movies on a plane.<br /><br /><span style="font-size:130%;"><span style="font-weight: bold;">Open multimedia format support</span></span><br /><br />It would be great if the device supported open multimedia formats and codecs, such as <a href="http://en.wikipedia.org/wiki/Ogg">Ogg</a>, <a href="http://en.wikipedia.org/wiki/Flac">FLAC</a> and <a href="http://en.wikipedia.org/wiki/Theora">Theora</a>.<br /><br /><br />Well, that's all I can think of for now. Based on recommendations in my blog comments, I have purchased a <a href="http://www.cowonamerica.com/products/cowon/s9/">Cowon S9</a>. Also, I have received a <a href="http://us.creative.com/products/product.asp?category=213&subcategory=214&product=18615">Creative Zen MX</a>, and will be receiving a <a href="http://www.sansa.com/players/sansa_fuze">Sansa Fuse</a> shortly. In the coming weeks, I'll be reviewing each of these (and maybe others) to try and find the ideal portable media player for Linux users.mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com10tag:blogger.com,1999:blog-2390611717677315220.post-33054881229974901442009-08-18T14:30:00.000-07:002009-08-18T14:44:45.457-07:00My God! It's full of stars!Ever try hooking up a server or firewall with multiple network cards? You stand in back of it wondering which RJ45 port is eth0, which one is eth1...<br /><br />Here's a little tip: you can make network card lights blink with the ethtool command:<br /><br /><blockquote><br />ethtool -p eth0<br /></blockquote><br /><br />You can make each card blink for 30 seconds in order with something like:<br /><br /><blockquote><br />for net in eth0 eth1 eth2; do ethtool -p $net 30; done<br /></blockquote>mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com0tag:blogger.com,1999:blog-2390611717677315220.post-60792212516689647592009-08-15T10:21:00.000-07:002009-08-15T12:39:27.874-07:00Aide (Advanced Intrusion Detection Environment) improvementsAt the Karmic Ubuntu developer summit, we had a session on filesystem integrity checkers. The main purpose of the session was to see what the current state of them was, and if we needed to replace <a href="http://sourceforge.net/projects/aide/">Aide</a> in main with a newer alternative.<br /><br />I don't traditionally like filesystem checkers. While they are very useful to detect files that get modified during an intrusion, an administrator needs to invest an incredible amount of time in analyzing the log files that they produce every day. This is compounded by the fact that servers don't remain static: they get security and stability software updates installed. The more that servers get updated, the more they divert from the original database that was generated by the integrity checker, and the more false positives get reported in the log.<br /><br />Wouldn't it be great if the integrity checker was smart enough not to report on files that were changed by operating system updates?<br /><br />I introduced this very feature in the Aide package in Karmic Koala. It is disabled by default. To activate it, simply modify the /etc/default/aide configuration file and set “FILTERUPDATES” to “yes”. I also recommend changing “COPYNEWDB” to “yes” in order to get changes reported only once.<br /><br />This new configuration option will filter out files that were modified by operating system updates from the daily email sent to the administrator. It will not filter them out from the main log file.<br /><br />Of course, overwriting the pristine database every day and filtering out the files changed by system updates may slightly reduce Aide's effectiveness, but I think it's a compromise worth having if the alternative is to not use Aide at all because of administrative overhead.<br /><br />If you've never used Aide before on your Ubuntu server, and would like to give it a try on Karmic, here are the steps necessary to get started:<br /><br />1- Install aide:<br /><br /><blockquote>apt-get install aide</blockquote><br /><br />2- Create the initial database (this may take a while):<br /><br /><blockquote>aideinit</blockquote><br /><br />3- Customize the MAILTO, COPYNEWDB and FILTERUPDATES parameters in /etc/default/aide<br /><br />4- You should now get a daily email report on filesystem changes!mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com1tag:blogger.com,1999:blog-2390611717677315220.post-20830661152124726942009-07-23T05:20:00.000-07:002009-07-23T14:49:56.753-07:00Goodbye AppleI've owned a lot of iPods. My wife has owned a lot of iPods.<br /><br />Not anymore.<br /><br />For the longest time, I could use <a href="http://www.gtkpod.org/">gtkpod</a> to seamlessly access my iPods from my Ubuntu desktop. It initially took some reverse-engineering effort to understand the iPod's data format to be able to access it from non-iTunes software, but it was possible. All of a sudden, Apple is trying everything they can to prohibit interopability.<br /><br />First, they <a href="http://home.gna.org/linux4nano/">encrypted the firmware</a>, blocking the use of third-party firmware like <a href="http://www.rockbox.org/">Rockbox</a> and <a href="http://www.ipodlinux.org/">iPod Linux</a>. This doesn't bother me much, as I always prefered the original Apple firmware anyway.<br /><br />Then, in August 2007, they added a new <a href="http://gorkworld.wordpress.com/2007/09/17/ipod-hash-defeated/">hash</a> to the database to block non-iTunes software. This was quicky reverse-engineered and support was added to gtkpod once again.<br /><br />In November 2008, they changed the hash again. This time, Apple used code-obfuscation software on iTunes in an effort to complicate reverse-engineering a second time. When a <a href="http://bluwiki.com/go/Ipodhash">wiki</a> was put up to start documenting the new hash, Apple <a href="http://bluwiki.com/go/Ipodhash/Takedown">sent a takedown notice.</a> Fortunately, some people found an ugly <a href="http://marcansoft.com/blog/2009/01/using-amarok-and-other-itunesdb-compatible-software-with-the-iphone-2x/">workaround</a> to get gtkpod working again.<br /><br />In 2009, Palm released the Palm Pre. It supported <a href="http://gizmodo.com/5271917/palm-pre-to-sync-directly-with-itunes">syncing with iTunes.</a> Apple retaliated by updating iTunes specifically to block <a href="http://www.informationweek.com/news/personal_tech/smartphones/showArticle.jhtml?articleID=218500862">Palm Pre interopability.</a> Unfortunately, this changed the iPod database structure, and the workaround for gtkpod <a href="http://marcansoft.com/blog/2009/06/iphone-os-30-music-totally-incompatible/">no longer works.</a><br /><br />While I can understand Apple not wanting the Palm Pre to be able to sync with iTunes, as iTunes integration is one of the main selling points for the iPod, I can't understand why they would actively block third party software from accessing the iPod.<br /><br />Everyone is now selling <a href="http://en.wikipedia.org/wiki/Amazon_mp3">DRM-free mp3 music</a>, so it's not a question of protecting DRM. You'd think they would <span style="font-weight:bold;">want</span> to sell more iPods, not block a certain percentage of their market out.<br /><br />My 5G iPod broke today. Dear Apple, the replacement I purchase won't be from you.mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com91tag:blogger.com,1999:blog-2390611717677315220.post-29142597326347496362008-11-02T06:03:00.000-08:002009-07-23T14:50:19.578-07:00Launchpad search plugins for FirefoxIf you work a lot with <a href="http://www.launchpad.net/">Launchpad</a>, there is a package in the Ubuntu repos that adds Launchpad integration into the Firefox search box. The package is called "firefox-launchpad-plugin":<br /><br /><blockquote><span style="font-weight: bold;">Launchpad firefox integration</span><br />Mozilla Firefox Launchpad integration add quick search for:<br />- Ubuntu bugs on Launchpad<br />- Ubuntu specifications on Launchpad<br />- Ubuntu packages on Launchpad<br />- Ubuntu support tickets on Launchpad<br />- People and team on Launchpad</blockquote>mdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com0tag:blogger.com,1999:blog-2390611717677315220.post-23819206001946215722008-10-26T17:52:00.000-07:002009-07-23T14:50:34.864-07:00Adobe Reader fontsHere's another PDF tip while I'm at it: how to fix broken fonts in Adobe Reader in Ubuntu Hardy and Intrepid.<br /><br />It seems Adobe Reader doesn't use font-config by default. If you open a pdf file that uses Arial or some other font that is installed in font-config, Reader will still replace it with a generic Adobe Sans font. To turn on font-config support, modify the /usr/bin/acroread launcher script and uncomment the following two lines:<br /><br />ACRO_ENABLE_FONT_CONFIG=1<br />export ACRO_ENABLE_FONT_CONFIGmdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com0tag:blogger.com,1999:blog-2390611717677315220.post-71980765360139863312008-10-26T15:39:00.001-07:002009-07-23T14:50:47.974-07:00Discovering QPDFA friend of mine asked for help removing the restrictions on a PDF file he made a while ago. It seems he misplaced his original source file because of disk bloat and all that was left was a PDF file he created for the print shop. Of course, he couldn't remember the password he had used when he created the file.<br /><br />A quick look through google came up with a simple solution: qpdf, available in universe:<br /><br />QPDF is a program that can be used to linearize (web-optimize),<br />encrypt (password-protect), decrypt, and inspect PDF files from<br />the command-line.<br /><br />Here's the command line that removed the PDF restrictions:<br /><br />qpdf --decrypt infile.pdf outfile.pdfmdeslaurhttp://www.blogger.com/profile/05506714028603312467noreply@blogger.com0