Odds and ends

After some consideration and waiting until it was stocked at a local vendor, I bought an Eee PC. Although my MacBook is pretty compact, I wanted a machine that I can use for calendaring, checking mail, and browsing. Since my phone does not offer these options, and are not that cheap without a new subscription, the Eee seemed to be a good choice. I opted for the non-surf variant with 4GB of flash storage an 512 MB RAM.

The standard Xandros-based distribution seems to be user-friendly and snappy. I was surprised to see that even OpenOffice.org booted up fairly quickly. However, I do not agree with some of the policies of Xandros (yes, I know, by buying the Eee, I paid the Xandros tax), and I prefer a system that is easy to customize for my own needs. Since the Debian community has worked hard on making Debian work well on the Eee PC, and provides an excellent Wiki page. The installation was a straight forward Debian-testing netinstall (the Eee doesn't boot from my 8GB USB memory stick, but 512MB and 1GB works fine). One of the upsides is that a driver for the wireless NIC is included in the default install, as well as some useful ACPI scripts to get the special keys of the Eee PC working. Virtually the only thing that I needed to change was the X configuration for touchpad scrolling.

I was a bit worried that the small screen would not be comfortable to use a normal desktop environment. So, I initially used the IceWM window manager with the GNOME network manager applet to get flexible en easy wireless connectivity. I ended up installing GNOME as well, and it turns that it mostly works fine with the screen size/resolution, although some dialogs are too large, and take some guesswork to tab through properly. Another problem is that the battery/power applet does not work well, because the machine reports the battery state in percentage rather than mAh.

All in all, it seems to be a good purchase, but I haven't tried the battery time and some other things yet. But I did accidentally drop it on the floor, and it still works :).

We have posted a warning about the impact of the Debian OpenSSL vulnerability on the CentOS-announce list, but I think it is useful to repeat it here (for readers of CentOS Planet) as well:

A severe vulnerability was found in the random number generator (RNG)
of the Debian OpenSSL package, starting with version 0.9.8c-1 (and
similar packages in derived distributions such as Ubuntu). While this
bug is not present in the OpenSSL packages provided by CentOS, it may
still affect CentOS users.

The bug barred the OpenSSL random number generator from gaining enough
entropy required for generating unpredicatable keys. In fact it
appearss that the only source for entropy was the process ID of the
process generating a key, which is chosen from a very small range and
is predictable. As such, all keys generated using the Debian OpenSSL
library should be considered compromized. Programs that use OpenSSL
include OpenSSH and OpenVPN. Note that GnuPG and GNU TLS do not use
OpenSSL, so they are not affected.

This vulnerability can affect CentOS machines through the use of keys
that were generated with the OpenSSL package from Debian. For
instance, if a user uses OpenSSH public key authentication to log on
to a CentOS server, and this user generated the key pair with a
vulnerable OpenSSL library, the server is at heavy risk because the
key can be reproduced easily.

Additionally, all (good) DSA keys that were ever used on a vulnerable
Debian machine for signing or authentication should also be considered
compromized due to a known attack on DSA keys.

As a result of this bug, everyone should audit *every* key or
cerficicate that was generated with OpenSSL, to trace its origin and
make sure that it was not generated with a vulnerable Debian OpenSSL
package. Or in the case of DSA keys care should be taken that they
were not generated or used on a system with a vulnerable OpenSSL
package. Keys that are potentially compromised should be replaced with
strong keys.

The Debian Wiki[2] has a preliminary list of affected application. A
tool to detect potentially weak keys is also provided, but it contains
an incomplete list of affected keys and can give false positives.

The Metasploit project provides a full list of weak keys in various
configurations[3].

Questions on how this may affect CentOS users should be directed to
the CentOS users list. List subscription information is available
from:

http://lists.centos.org/mailman/listinfo/centos

With kind regards,
The CentOS Team

[1] http://www.debian.org/security/2008/dsa-1571
[2] http://wiki.debian.org/SSLkeys
[3] http://metasploit.com/users/hdm/tools/debian-openssl/

After having completed an excellent C++ course, I have been on the lookout for good books to venture deeper into the language. The following books turned out to be must-haves that I always try to keep within reach:

• The C++ Standard Library - A Tutorial and Reference, Nicolai M. Josuttis
• Beyond the C++ Standard Library: An Introduction to Boost, Björn Karlsson
• C++ Templates - The Complete Guide, David Vandevoorde and Nicolai M. Josuttis
• C++ Template Metaprogramming: Concepts, Tools, and Techniques from Boost and Beyond, David Abrahams and Aleksey Gurtovoy

To people yet unfamiliar to C++, I have been recommending Accelerated C++, Practical Programming by Example by Andrew Koenig and Barbara E. Moo. I only had the opportunity to skim through this book, but it seems to be aimed at leveraging C++ features and the standard library right away, rather than building up to C++ from C.

Those who are not actively monitoring the Wiki or project lists may be interested to hear that CentOS now more fornally hosts several subprojects with their own Subversion trees and ticket tracking. A list of projects is available on the Wiki. Currently there are four projects, which all potentially add a lot of value to CentOS:

• The CentOS Live CD project will be creating live CDs of the CentOS system, starting with CentOS 5.1. The project is driven by Patrice Guay, who also created the CentOS 5.0 Live CD, and who has renewed the live CD infrastructure to use the Fedora livecd-tools.
• Project Cranberry is working on a sysadmin toolkit, which will contain a specific set of packages aimed at system maintenance and recovery.
• Dasha is a project that aims to bring more drivers to CentOS, which can either be drivers that were disabled in the upstream kernel, drivers backported from newer kernels, and third party drivers. Since CentOS aims at stability rather than being cutting edge, this project is a welcome addition for newer hardware.
• Pandora is a project that works on a comfortable package browser for the CentOS repositories, that also aims to provide RSS feeds and future integration with the CentOS bugtracker.

Of course, we are always on the look-out for new contributors to the CentOS project and community, and working on CentOS projects is one of the possible ways to contribute. You can help projects by:

• Testing code and packages produced by the projects, and submitting bug reports for problems that you encounter at the project's Trac site.
• Contributing code to particular projects that you are interested in.
• Proposing a new project and driving it, if it is accepted as a CentOS-hosted project.

For the reasons outlined in my previous blog post, I have completely removed OS X and replaced it with Ubuntu 7.10. For my day to day use, modern GNU/Linux distributions are far more suitable. Besides that, the hardware vendor lock in and the loss of the possibility to fix bugs, make it even less attractive.

A short update on my first experiences with OS X. I had some pretty urgent work this week, and the good news is that I had no real problems getting stuff done. First off was a presentation that I had to finish. I prefer the LaTeX beamer document class for presentations over anything else. It lets me work on the actual content of slides, rather than formatting, and the class defaults are very sane in that they create very nice-looking slides. The MacTeX distribution was easy to set up, and provides TeX-live, Ghostscript, and some related stuff you may need.

The first less surprise came up running Mercurial, my favorite distributed SCM:

$ hg
[...]
    raise ValueError, 'unknown locale: %s' % localename
ValueError: unknown locale: UTF-8

This can be worked around by setting the LANG variable to 'c'. Of course, this is a bad solution, I still have to look into this. Though this is a minor problem compared to disk images (dmgs), let's state it right away: disk images suck! For the non-OS X user: these are images that get mounted when you click on them. Most third party software vendors provide their software as these disk images. Installation is usually done by opening the disk image, copying the disk image to the Applications directory, and unmounting the disk image. Besides the fact that you have to download disk images manually, application upgrades seem to be manually (usually). E.g. a security update was released for the Camino browser. I had to download the new disk image, open it, copy the new Camino folder to Applications folder, close the disk image. This is many steps back from APT and yum, where you can not only install your applications from repositories, but upgrade them with a single command as well. With Synaptic wrapped around it, APT is even very usable for non-expert users.

Yes, I know of the existance of Fink. Once they offer binary Leopard packages, I'll try it, because I'd be very happy to have a decent package manager. At least for the opensource applications that are usually provided with Linux distributions.

IcedTea packages are now available for CentOS 5/i386. IcedTea builds upon OpenJDK, and replaces the few binary plugs with stubs or classpath code. OpenJDK is the open source Java JDK that Sun Microsystems generously donated to the free software community.

Currently, not all Java software included in CentOS runs with IcedTea (most notably, Eclipse, but the latest version from the Eclipse Foundation works well after setting the language level to 5.0/1.5.0). But for many applications it seems to work well and fast.

I am a happy buyer/user of a HP laptop (HP NX6110), and previously of a HP/Compaq Workstation. Often, I also recommend HP computers to others. Unfortunately, a recent post on a Linux Dutch forum makes me want to reconsider such recommendations and my future purchases. There have been recent cases where buyers went to court, and the courts ruled that they should be awared a fee upon rejecting the Windows EULA. So, at the very least, I am surprised, maybe even entertained by their reaction. Here are some snippets translated from Dutch:

''It is correct that we, as a manufacturer, can not return the money for the license, or give a price reduction for a product of HP or Compaq. Your salesman could have the possibility to handle this for you. I have to state clearly that not every salesman can offer this possibility for all products that they sell.

To clarify this a bit more, every HP or Compaq product is delivered with a License, and we do not have the possibility to remove this license or deliver the product without a license, so without an operating system and extra hardware. HP only guarantees that their products work properly with the original software that was preinstalled.

It could be the case that you, together with your salesman, have to look at the possibilities of a completely different product from another brand. This can be a bare system, or a system from another manufacturer that provides more opportunities for returning the license costs.''

Thank you HP for listening to your customers, your advise couldn't have been clearer :)!

Disclaimer: I am not a lawyer, so I do not know whether HP or someone else is required to return a free upon declining the Windows EULA. But their own recommendation is pretty entertaining.

Update: Let's be fair: some resellers do offer HP laptops with FreeDOS.

The other day I bought one of those power consumption monitors (only 12 Euro at an electronics outlet). Some results:

• My Dell OptiPlex GX240 with an 1.5 GHz server with ondemand cpufreq (with p4-clockmod) and a tickless kernel: 38W (Idle) to ~80W (compilation). This suprised me, it uses a Netburst-based P4 CPU, so I was kinda wary to keep this machine running most of the day. But at 38W most of the day it is doing quite well, and it is still a pretty powerful machine (for e-mail, file, and shell serving).
• My main work machine with a Core2 Duo CPU clocking at 1.8GHz, 1GB RAM, onboard video chipset (nVidia), and a 240GB harddisk uses ~120W with a 17" TFT monitor.
• An eBox, with a VIA C3 800MHz CPU, and 256MB RAM, on-board video chipset (VIA) with an external USB consumes about 24W. This was intended to be my lightweight low-wattage mail server. Unfortunately, it overheats with an internal disk, and doesn't boot from some external USB disks.
• Lamp in my living room: 0W to more than 200 Watt, depending on the slider setting. While it strong enough to light my living room, this one definitely needs to go.

I still haven't tested the NSLU2. Conclusion: I'll replace the lamp by one or two low-power lamps. The (low) power use of Optiplex was really suprising, and will be my permanent server replacing the NSLU2 (to slow) and the eBox (to many hassles/unreliable).

If you live in or near The Netherlands, don't miss out on The Dutch Open Source Event (T-DOSE) that will be held on 13 and 14 October in Eindhoven. There's an interesting schedule, various projects have booths, and of course, there will be a social event.

Thanks to the tireless effort of Dag and other volunteers almost no West-European event goes by without CentOS presence. T-DOSE is no exception: there will be a booth and talks about dstat (Dag) and CentOS Virtualization (me). We could use additional help at the booth, so if you are interested, please visit the CentOS page for this event and let us know through the CentOS-promo list.

See you this weekend!