The Fedora Project is making great strides with SElinux, but as you note, the browser (and e-mail client) are tough cases, because they can launch other apps (OOo, media players, plugins) with different security requirements from the browser. Handling these transitions in a flexible but secure way is challenging. But with the progress being made now, a solution will almost certainly be shipped in the Vista timeframe. The expectation is that Linux desktop releases that appear in late 2006 (FC6?) -- around the same time as Vista -- will use SElinux to sandbox desktop applications.
...the security model in Vista will be more sophisticated than anything shipping with Linux today.
Are you sure about that? Windows Service Hardening, one of the more advanced parts of the security model, has a feature set that sounds like a subset of SElinux -- I haven't seen WSH in action but from what I read it sounds like a mandatory access control (MAC) scheme, which would prevent a compromised service from doing something which it should not -- very much like SElinux. But SElinux controls apply to all software, not just system services.
Nedit is a notepad on steriods. Simple UI, very clean window layout, open source, but with all the toys under the hood: syntax highlighting, rectangular moves, autoindent, macros, the works. (Unfortunately based on Motif/Lesstif, but about the nicest Motif UI I've seen in a long time).
Groups can do lots of useful things -- but if you use groups with a User Private Group scheme (like RedHat's) and delegated group administration (groupmod -A on some systems) then they really take off.
Thanks for the pointer -- actually, the Help buton doesn't do anything on my FC5 test system, but you're right that the context-sensitive help (right-click) does include a description of the focus policies. Too bad it's not in the handbook.
I've been using Gnome (on FC and Ubuntu on my personal, business, and client systems) and KDE (on SuSE systems at the college where I teach) pretty much every day for years. I know the keybindings, the shortcuts, and the configuration options for both, and I'm including coverage of both in a book I'm writing. I personally prefer Gnome (gasp! - a longtime *nix user, a competent programmer, an experienced sysadmin that... prefers Gnome!) but that's by a small margin.
But as I've been writing the book, I've realized that both include some pretty hoary crud from a user perspective. (Before I get flamed: yes, of course FC uses a heavily themed version of both desktops, but don't skip the line above where I noted that I also use Ubuntu and SuSE).
Take KDE's configuration system, for example -- you can get to the configuration module for, say, the Window Manager in several different ways (through the Control Center, or a right-click on titlebar), but the user interface is very slightly different depending on how you get there (butons vs. tabs? different numbers of options on the buttons and tabs?) -- why?! What purpose does this serve other than confusing the user? People criticize Gnome's [various versions of] load/save dialogs, but KDE's use of a horizontally-scrolling display of variable-width columns brings new meaning to the phrase 'user hostile' (and copying it from a braindead Windows design is no defense). What about configuration options that have proliferated to the point of absurdity? - such as window focus options that include "focus follows mouse", "focus under mouse", and "focus strictly under mouse" (when the differences are not documented except in some obscure post on a developer's list)??!?
Gnome is no better. Why can I drag'n'drop a wallpaper or a desktop theme onto the appropriate configuration dialog, but not a GDM theme? When I successfully install a new personal font using the fonts:/// location in Nautilus, why doesn't the new font show up in that Fonts window??!?
Both desktops have significant shortcomings. The features and shortcomings of each will rub us in different ways. But without friendly competition between the two camps -- thankfully, augmented by cooperation through freedesktop.org -- I think the free desktop would not be anywhere close to where it is now.
So long live diversity, choice, and friendly competition!
Sure, prepaid cellphones can be counted as "disposable, one-use toys", but you have to have someone to call! If both parties are going through prepaids like candy - one or two calls then on to the next phone - managing the constantly-changing phone numbers becomes more than a small chore, and it becomes a nightmare to keep a half-dozen parties in touch with each other. It's not going to happen on both ends of the connection.
You don't need to tap the prepaids, you just need to tap the numbers that the prepaids are calling.
ImageMagick understands the image format used for most CT and MRI photographs, so most run-of-the-mill Linux distros can display images from medical imaging CDs. (The Windows applets usually provided on the disc do make navigation a bit easier, though).
It's not necessarily true that older=unreliable. Many older systems don't need fans (fewer moving parts to break), and are over-engineered to a remarkable degree - I have PSUs from the 80's that operated 24x7 for a decade and a half and are still servicable (though not presently in use). More recent boxes burn through their fans and PSUs in a couple of years.
For a long time I ran a 20 MHz 80386 with 8MB RAM as my firewall+SMTP+DNS server. Worked fine on a broadband connection, 24x7 for 5 years, in a dusty basement, and moved a *lot* of data; I only took it out of service when I moved. (Of course, it took over two days to compile the kernel for it in the first place, but that's another story). If I took a 'current' box I'll bet it would die in those conditions in 18 months.
Sure you can change resolution on the fly (and more elegantly than Ctrl-Alt-KP+).
The extension is called xrandr (rotate and resize) and is installed by default in most current distros. There are panel applets that let you pick your resolution (and rotation, if supported) and everything will resize appropriately (e.g., maximized windows won't be off the screen), or you can use the xrandr utility if you want to do it under script control.
There seems to be two very different image sets in use with very different resolutions. For example, look up "L4K 1X1" and then zoom in. The data on the left is much lower-res than the data on the right, and in fact doesn't zoom to the three highest zoom levels, whereas the data on the right lets you zoom in to the point of being able to count parked cars.
I've been using ufile.ca for the past couple of years -- web based, totally OS-agnostic.
$19.99 for my wife and I (Canadian funds!).
It's pretty well designed: pleasant user interface, the option to save and resume the session, automatic shuffling of expenses and receipts between us according to who gains the best advantage, and electronic filing at the end. What's not to like?
Is there not a similar service available to those south of the 49th parallel?
This included the complete inability to even set hard drive mount points under Fedora Core 3, which is what finally led me to dump Fedora altogether.
Nice post -- but that bit about setting mountpoints under FC3 is an odd piece of disinformation.
During the FC3 install, you can set the mountpoints for every partition (or logical volume, or RAID device), either by selecting from a list of common mountpoints or by typing in the mountpoint name of your choice; and of course the default mountpoints can be changed anytime through/etc/fstab -- so I can't understand this comment (?).
I've been doing RAID in various ways for about a decade. The hardware vs. software landscape is very different than it was a few years ago:
(1) Hardware RAID -- this used to be the obvious choice; why load up the main CPU doing XOR loops? However, we are now seeing a lot of 'raid' cards that are in effect little more than multi-interface cards with some code in a BIOS rom, forcing the CPU to do all the work anyways. Putting them aside -- and those will be most of the low-end cards -- the higher-end hardware RAID cards just don't provide the bang for the buck that they used to. This is because...
(2) Software RAID has improved dramatically, especially in Linux (and I presume but cannot confirm, in the BSD's). The processor instructions that were added to the CPUs to accelerate graphics (3Dnow, SSE,...) happen to work nicely for RAID calculations as well. This is why you'll see some kernels run through trials to see which of several different parity algorithms is faster on the current CPU. This combined with other tuning done in the RAID code has reduced CPU overhead to who-cares levels.
The current software RAID implementation on Linux does hot sparing and rebuilds quite nicely. I haven't had a drive fail on a software RAID box, but I've simulated it, and the recovery was exactly according to spec. The only standard gotcha is booting when the boot drive has failed -- software RAID is little help there.
The ultimate solution for many systems (imho!) is LVM on top of RAID -- providing flexible partitioning, the ability to migrate to new devices, and snapshot backups in addition to the peace-of-mind of RAID-- and all for less than 3% CPU utilization.
I've been doing RAID in various ways for about a decade. The hardware vs. software landscape is very different than it was a few years ago:
(1) Hardware RAID -- this used to be the obvious choice; why load up the main CPU doing XOR loops? However, we are now seeing a lot of 'raid' cards that are in effect little more than multi-interface cards with some code in a BIOS rom, forcing the CPU to do all the work anyways. Putting them aside -- and those will be most of the low-end cards -- the higher-end hardware RAID cards just don't provide the bang for the buck that they used to. This is because...
(2) Software RAID has improved dramatically, especially in Linux (and I presume but cannot confirm, in the BSD's). The processor instructions that were added to the CPUs to accelerate graphics (3Dnow, SSE,...) happen to work very nicely for RAID calculations as well. This is why you'll see some kernels run through trials to see which of several different parity algorithms is faster on the current CPU. This combined with other tuning done in the RAID code has reduced CPU overhead to who-cares levels.
The current software RAID implementation on Linux does hot sparing and rebuilds quite nicely. I haven't had a drive fail on a software RAID box, but I've simulated it, and the recovery was exactly according to spec. The only standard gotcha is booting when the boot drive has failed -- software RAID is little help there.
The ultimate IMHO is LVM on top of RAID -- flexible partitioning, the ability to migrate off devices, snapshot backups in addition to the peace-of-mind of RAID, and all for less than 3% CPU utilization.
The other thing that I've found disturbing (about Vonage in this case) is that they can (and do!) change their prices without warning.
I just happened to notice that their international call rates from Canada to Asia and Europe went up the other day -- still only a few cents per minute, but 5c/min --> 8c/min is a 60% increase! -- and they didn't mention this to customers (not as a note at the bottom of the bill, not as a note on their website, no notification at all).
Mostly true-- but remember that in order to get the benefits of an Open Source license you must comply with the terms of that license. You don't sign a contract, but you do have obligations. Very, very light obligations -- easy to keep -- but obligations nonetheless.
I was visiting Prince Edward County (Quite's Isle) recently and came across a brochure for a local, well-known photographer. Interestingly enough, she offered various wedding packages, with the option of including certain numbers of prints of various sizes, -OR- the high-res images on CD with no prints. I thought that was fairly progressive...
Sorry, I realized that in the previous post I used the abbreviation MHMU without defining it... MHMU is "Multi-Head/Multi-User" (as opposed to multi-head single-user with or without Xinerama; or multi-user using remote access).
I have a multi-user setup at home (I'm using it right now) which is described here... it has 3 heads (video/keyboard/sound/mouse for each). I've found it to be an economical approach that involves far less administrative work than any other multi-user configuration -- separate systems with NFS file shares, X terminals, you name it.
There are several significant challenges involved in setting up a multi-head, multi-user system:
The 'normal' kernel USB setup merges multiple keyboards and mice into a single queue. This makes sense when you're using an external keyboard and mouse with a laptop, but it a pain in MHMU. Patches to the USB system are required.
The 'normal' console/virtual terminal system is not MHMU-aware. This has to be patched with the Backstreet-Ruby patches to work properly.
The 'normal' X server can handle a multi-head configuration, but expects all the heads to be used by one user. The prefbusid patch or similar must be applied to fix this.
Apps that use sound are a nightmare-- it's painful trying to get apps to send their sound to the right speakers. With three of us on the system, I regularly get blasted by sound from Flash websites that my kids are visiting. There is no standard for defining *where* sound should go -- yes, there are soundservers such as esd and artsd, but they are not used by all apps (and try finding current documentations for esd!).
If we made a concerted effort, the MHMU patches could be merged into the main source trees for X.org and the Linux kernel, and the distros could be set up to offer MHMU configurations at installation time.
However, the number of people using MHMU configurations is currently too small to really make a push for the integration of these features into the main source trees and distros.
So if you're using this type of system, or would find it beneficial, then let's work together to make this a mainstream option!
(I think that MHMU would be useful for: tellers in banks; kiosks such as library catalogs; computer labs and learning commons in colleges and universities; and family computing setups).
Slashdot Mirror
...the absence of a levy on DVD+/-Rs explains why they are the same price or cheaper than CD-Rs here.
...buy cheap CD's from the US. This is perfectly legal, and a great way to save money.
Yes, but as an 'importer' I'm liable for the levy on imported CDs. Excuse me for a second, the doorbell's ringing...
The Fedora Project is making great strides with SElinux, but as you note, the browser (and e-mail client) are tough cases, because they can launch other apps (OOo, media players, plugins) with different security requirements from the browser. Handling these transitions in a flexible but secure way is challenging. But with the progress being made now, a solution will almost certainly be shipped in the Vista timeframe. The expectation is that Linux desktop releases that appear in late 2006 (FC6?) -- around the same time as Vista -- will use SElinux to sandbox desktop applications.
...the security model in Vista will be more sophisticated than anything shipping with Linux today.
Are you sure about that? Windows Service Hardening, one of the more advanced parts of the security model, has a feature set that sounds like a subset of SElinux -- I haven't seen WSH in action but from what I read it sounds like a mandatory access control (MAC) scheme, which would prevent a compromised service from doing something which it should not -- very much like SElinux. But SElinux controls apply to all software, not just system services.
Nedit is a notepad on steriods. Simple UI, very clean window layout, open source, but with all the toys under the hood: syntax highlighting, rectangular moves, autoindent, macros, the works. (Unfortunately based on Motif/Lesstif, but about the nicest Motif UI I've seen in a long time).
Whoops, of course that should be |s/groupmod -A/gpasswd -A/
Groups can do lots of useful things -- but if you use groups with a User Private Group scheme (like RedHat's) and delegated group administration (groupmod -A on some systems) then they really take off.
Thanks for the pointer -- actually, the Help buton doesn't do anything on my FC5 test system, but you're right that the context-sensitive help (right-click) does include a description of the focus policies. Too bad it's not in the handbook.
I've been using Gnome (on FC and Ubuntu on my personal, business, and client systems) and KDE (on SuSE systems at the college where I teach) pretty much every day for years. I know the keybindings, the shortcuts, and the configuration options for both, and I'm including coverage of both in a book I'm writing. I personally prefer Gnome (gasp! - a longtime *nix user, a competent programmer, an experienced sysadmin that ... prefers Gnome!) but that's by a small margin.
But as I've been writing the book, I've realized that both include some pretty hoary crud from a user perspective. (Before I get flamed: yes, of course FC uses a heavily themed version of both desktops, but don't skip the line above where I noted that I also use Ubuntu and SuSE).
Take KDE's configuration system, for example -- you can get to the configuration module for, say, the Window Manager in several different ways (through the Control Center, or a right-click on titlebar), but the user interface is very slightly different depending on how you get there (butons vs. tabs? different numbers of options on the buttons and tabs?) -- why?! What purpose does this serve other than confusing the user? People criticize Gnome's [various versions of] load/save dialogs, but KDE's use of a horizontally-scrolling display of variable-width columns brings new meaning to the phrase 'user hostile' (and copying it from a braindead Windows design is no defense). What about configuration options that have proliferated to the point of absurdity? - such as window focus options that include "focus follows mouse", "focus under mouse", and "focus strictly under mouse" (when the differences are not documented except in some obscure post on a developer's list)??!?
Gnome is no better. Why can I drag'n'drop a wallpaper or a desktop theme onto the appropriate configuration dialog, but not a GDM theme? When I successfully install a new personal font using the fonts:/// location in Nautilus, why doesn't the new font show up in that Fonts window??!?
Both desktops have significant shortcomings. The features and shortcomings of each will rub us in different ways. But without friendly competition between the two camps -- thankfully, augmented by cooperation through freedesktop.org -- I think the free desktop would not be anywhere close to where it is now.
So long live diversity, choice, and friendly competition!
Right, good thing that pagers don't have fixed phone numbers, otherwise the law would be on to us! Oh, wait...
Sure, prepaid cellphones can be counted as "disposable, one-use toys", but you have to have someone to call! If both parties are going through prepaids like candy - one or two calls then on to the next phone - managing the constantly-changing phone numbers becomes more than a small chore, and it becomes a nightmare to keep a half-dozen parties in touch with each other. It's not going to happen on both ends of the connection.
You don't need to tap the prepaids, you just need to tap the numbers that the prepaids are calling.
ImageMagick understands the image format used for most CT and MRI photographs, so most run-of-the-mill Linux distros can display images from medical imaging CDs. (The Windows applets usually provided on the disc do make navigation a bit easier, though).
It's not necessarily true that older=unreliable. Many older systems don't need fans (fewer moving parts to break), and are over-engineered to a remarkable degree - I have PSUs from the 80's that operated 24x7 for a decade and a half and are still servicable (though not presently in use). More recent boxes burn through their fans and PSUs in a couple of years.
For a long time I ran a 20 MHz 80386 with 8MB RAM as my firewall+SMTP+DNS server. Worked fine on a broadband connection, 24x7 for 5 years, in a dusty basement, and moved a *lot* of data; I only took it out of service when I moved. (Of course, it took over two days to compile the kernel for it in the first place, but that's another story). If I took a 'current' box I'll bet it would die in those conditions in 18 months.
I see a lot of misinformation here about the levy and private copying in Canada.
Let's set the record straight: private copying of music in Canada is legal, and the levy still applies to CD-Rs and cassette tapes.
For more info and links, see this previous blog post: It's Not Illegal if the Law Says You Can Do It
Sure you can change resolution on the fly (and more elegantly than Ctrl-Alt-KP+).
The extension is called xrandr (rotate and resize) and is installed by default in most current distros. There are panel applets that let you pick your resolution (and rotation, if supported) and everything will resize appropriately (e.g., maximized windows won't be off the screen), or you can use the xrandr utility if you want to do it under script control.
There seems to be two very different image sets in use with very different resolutions. For example, look up "L4K 1X1" and then zoom in. The data on the left is much lower-res than the data on the right, and in fact doesn't zoom to the three highest zoom levels, whereas the data on the right lets you zoom in to the point of being able to count parked cars.
I've been using ufile.ca for the past couple of years -- web based, totally OS-agnostic.
$19.99 for my wife and I (Canadian funds!).
It's pretty well designed: pleasant user interface, the option to save and resume the session, automatic shuffling of expenses and receipts between us according to who gains the best advantage, and electronic filing at the end. What's not to like?
Is there not a similar service available to those south of the 49th parallel?
This included the complete inability to even set hard drive mount points under Fedora Core 3, which is what finally led me to dump Fedora altogether.
/etc/fstab -- so I can't understand this comment (?).
Nice post -- but that bit about setting mountpoints under FC3 is an odd piece of disinformation.
During the FC3 install, you can set the mountpoints for every partition (or logical volume, or RAID device), either by selecting from a list of common mountpoints or by typing in the mountpoint name of your choice; and of course the default mountpoints can be changed anytime through
I've been doing RAID in various ways for about a decade. The hardware vs. software landscape is very different than it was a few years ago:
...) happen to work nicely for RAID calculations as well. This is why you'll see some kernels run through trials to see which of several different parity algorithms is faster on the current CPU. This combined with other tuning done in the RAID code has reduced CPU overhead to who-cares levels.
(1) Hardware RAID -- this used to be the obvious choice; why load up the main CPU doing XOR loops? However, we are now seeing a lot of 'raid' cards that are in effect little more than multi-interface cards with some code in a BIOS rom, forcing the CPU to do all the work anyways. Putting them aside -- and those will be most of the low-end cards -- the higher-end hardware RAID cards just don't provide the bang for the buck that they used to. This is because...
(2) Software RAID has improved dramatically, especially in Linux (and I presume but cannot confirm, in the BSD's). The processor instructions that were added to the CPUs to accelerate graphics (3Dnow, SSE,
The current software RAID implementation on Linux does hot sparing and rebuilds quite nicely. I haven't had a drive fail on a software RAID box, but I've simulated it, and the recovery was exactly according to spec. The only standard gotcha is booting when the boot drive has failed -- software RAID is little help there.
The ultimate solution for many systems (imho!) is LVM on top of RAID -- providing flexible partitioning, the ability to migrate to new devices, and snapshot backups in addition to the peace-of-mind of RAID-- and all for less than 3% CPU utilization.
I've been doing RAID in various ways for about a decade. The hardware vs. software landscape is very different than it was a few years ago:
...) happen to work very nicely for RAID calculations as well. This is why you'll see some kernels run through trials to see which of several different parity algorithms is faster on the current CPU. This combined with other tuning done in the RAID code has reduced CPU overhead to who-cares levels.
(1) Hardware RAID -- this used to be the obvious choice; why load up the main CPU doing XOR loops? However, we are now seeing a lot of 'raid' cards that are in effect little more than multi-interface cards with some code in a BIOS rom, forcing the CPU to do all the work anyways. Putting them aside -- and those will be most of the low-end cards -- the higher-end hardware RAID cards just don't provide the bang for the buck that they used to. This is because...
(2) Software RAID has improved dramatically, especially in Linux (and I presume but cannot confirm, in the BSD's). The processor instructions that were added to the CPUs to accelerate graphics (3Dnow, SSE,
The current software RAID implementation on Linux does hot sparing and rebuilds quite nicely. I haven't had a drive fail on a software RAID box, but I've simulated it, and the recovery was exactly according to spec. The only standard gotcha is booting when the boot drive has failed -- software RAID is little help there.
The ultimate IMHO is LVM on top of RAID -- flexible partitioning, the ability to migrate off devices, snapshot backups in addition to the peace-of-mind of RAID, and all for less than 3% CPU utilization.
The other thing that I've found disturbing (about Vonage in this case) is that they can (and do!) change their prices without warning.
I just happened to notice that their international call rates from Canada to Asia and Europe went up the other day -- still only a few cents per minute, but 5c/min --> 8c/min is a 60% increase! -- and they didn't mention this to customers (not as a note at the bottom of the bill, not as a note on their website, no notification at all).
No contracts or legal agreements!
Mostly true-- but remember that in order to get the benefits of an Open Source license you must comply with the terms of that license. You don't sign a contract, but you do have obligations. Very, very light obligations -- easy to keep -- but obligations nonetheless.
I was visiting Prince Edward County (Quite's Isle) recently and came across a brochure for a local, well-known photographer. Interestingly enough, she offered various wedding packages, with the option of including certain numbers of prints of various sizes, -OR- the high-res images on CD with no prints. I thought that was fairly progressive...
Sorry, I realized that in the previous post I used the abbreviation MHMU without defining it ... MHMU is "Multi-Head/Multi-User" (as opposed to multi-head single-user with or without Xinerama; or multi-user using remote access).
I have a multi-user setup at home (I'm using it right now) which is described here... it has 3 heads (video/keyboard/sound/mouse for each). I've found it to be an economical approach that involves far less administrative work than any other multi-user configuration -- separate systems with NFS file shares, X terminals, you name it.
There are several significant challenges involved in setting up a multi-head, multi-user system:
The 'normal' kernel USB setup merges multiple keyboards and mice into a single queue. This makes sense when you're using an external keyboard and mouse with a laptop, but it a pain in MHMU. Patches to the USB system are required.
The 'normal' console/virtual terminal system is not MHMU-aware. This has to be patched with the Backstreet-Ruby patches to work properly.
The 'normal' X server can handle a multi-head configuration, but expects all the heads to be used by one user. The prefbusid patch or similar must be applied to fix this.
Apps that use sound are a nightmare-- it's painful trying to get apps to send their sound to the right speakers. With three of us on the system, I regularly get blasted by sound from Flash websites that my kids are visiting. There is no standard for defining *where* sound should go -- yes, there are soundservers such as esd and artsd, but they are not used by all apps (and try finding current documentations for esd!).
If we made a concerted effort, the MHMU patches could be merged into the main source trees for X.org and the Linux kernel, and the distros could be set up to offer MHMU configurations at installation time.
However, the number of people using MHMU configurations is currently too small to really make a push for the integration of these features into the main source trees and distros.
So if you're using this type of system, or would find it beneficial, then let's work together to make this a mainstream option!
(I think that MHMU would be useful for: tellers in banks; kiosks such as library catalogs; computer labs and learning commons in colleges and universities; and family computing setups).