Lite Linux Distros for a Digital Picture Frame?

bwy asks: "I'm building a digital picture frame, inspired by a story here at Slashdot. Currently, I'm using Red Hat 9 with GDM autologin, icewm, and a slideshow program autostarting. I've installed code to hide the mouse pointer and the 'powerswitch' kernel module to allow the frame to run a proper shutdown (instead of a suspend) when the ATX power switch is pressed. The hardware is an EPIA 5000 with a laptop drive. I think this is overkill, however, and I am a purist. Is there a lightweight distribution that is EPIA friendly? Such a distro shouldn't install GCC, so I'll need all the software as binaries. How would I go about booting from a ramdisk? This would make the 'powerwitch' kernel mod not so important since there is no worry of corrupting the file system." Does anyone have distribution suggestions, or pointers to other information that might be helpful for such a project?

Comments

Re:You don't need binaries.

[the_raptor]

Tad paranoid? I assume you audit every single line of code that runs on your system? Maybe check the BIOS to? Hell better make your own chips to, who knows what evil features could be built into them. ITS A PICTURE FRAME, NOT A BLOODY SERVER FULL OF CLASSIFIED MATERIAL.

Re:You don't need binaries.

[Anonymous Coward]

The parent poster seems to assume that the digital picture frame in question will be connected to the owner's home network. Another seemingly safe assumption is that said home network is connected to a much larger public network such as the global Internet. Using the addage that "a network is only as secure as its weakest link" then one can see why securing the digital picture frame would be considered necessary.

embedded linux

[cloudless.net]

Shouldn't you begin with embedded linux instead of redhat?

Re:embedded linux

[RevAaron]

That statement is close to being semantically null. RedHat can be used as "embedded Linux," and as far as a RT kernel, he certainly does not need one in this situation. As a rule, "embedded" doesn't mean much more than stripped libraries and an somewhat RT kernel- at least for Linux. Running a full distro rather than some "embedded" version probably means doing *a lot* less work. The thing has a harddrive, and he can install a pretty spartan system- so who cares? What difference would so-called "embedded" Linux make?

Different approach

[richie2000]

I used Gentoo on an old HP laptop with broken screen hinges. I also used the framebuffer stuff instead of a full windowing environment, partly because the laptop just had 64MB RAM and partly because I didn't feel like compiling X on a PII 266. :-)

The main reason for using Gentoo was that it let me decide exactly what to install. No servers in the background, no rxtra nothing. I was thinking of just deleting gcc and the source after I was done but I never got around to it, thinking I might need it later.

A distro? for this?!!

[zcat_NZ]

Take any one of the single floppy rescue bootdisks.

Add a copy of "zgv" (statically compiled, or you'll need to include vgalib and jpeglib)

Write a script that launches zgv with the appropriate parameters. Once you know it works, reinstall lilo so that your script gets run as init.

Total footprint will be perhaps two meg. Make an 'installer' for Linux or windows that dumps this at the start of a bootable CD and then lets the user fill the rest with pictures?

If you really have to have the fancy screen-merges and stuff, you can make up a system with JUST the linux kernel, XFree86, xscreensaver, and the very few libs that these depend on, basically the same way.

Re:You don't need binaries.

[Anonymous Coward]

Somebody's gonna root your picture frame. Beware of untrusted binaries!

Re:You don't need binaries.

[the_raptor]

I meant unless you can read C looking at the *source* is pretty pointless (my bad).
And by buffer overflows being *easier* I meant more likely to escape detection. A shell being bound to a listening port is something that should *obviously* not be happening in most programs.
As you said it is not as good or as fool proof as a backdoor. But backdoors are much more obvious then buffer overflows. And considering script-kiddies seem to have plenty of tools already for attack buffers, I don't think you have to worry about whether they would attack such a vulnerability.
And no I don't think code auditing efforts are a waste of time, I never said that. I said it is a waste of time for someone to prefer source over binaries (and check some of the source) and somehow think this makes them invulnerable to malware. I doubt one individual could check even the kernel for such things in a reasonable time frame (assuming said individual is not a code god)
If you *need* secure systems you use old code that has been heavily audited, and I would actually recommend OpenBSD.
And the irrsi backdoor was in the source and *not* the binary ;)
Since I personally don't have the time to audit the code in my system, I listen out for security and bug reports and patch my system.
*DIRECTED AT GRAMMER NAZI'S* Oh and you grammer nazi's can go fuck yourselves. Not even man enough to insult my spelling without hiding behind AC status? You truly are a waste of energy.