Home Blog Page 1347

Back to the Source: Why FOSS is More Important Than Ever

good-evening-mr-gatesIn the olden days the topic of software freedom was central to Linux and free/open source software. Software freedom needs to remain front and center. Remember Richard Stallman’s Four Freedoms?

“Nobody should be restricted by the software they use. There are four freedoms that every user should have:

  • the freedom to use the software for any purpose,
  • the freedom to change the software to suit your needs,
  • the freedom to share the software with your friends and neighbors, and
  • the freedom to share the changes you make.”

Another way to say this is we should always have the freedom to tinker.

We used to take these freedoms for granted with all of our personal property. We can mod our homes, we can buy random items, glue glitter and googly eyes on them and resell them as holiday crafts, we can do anything we want with our own stuff. Except for our digital property. There we run into vast mazy minefields of laws and Digital Rights Management and prohibitions and the idea that we don’t own it, but merely license it, so it’s not really ours and the vendor has the right to control it, and to control what we do with it.

Even Free Software does this; for example the GPL requires that if you mod and distribute GPL code, you must also distribute your source code. But there are significant differences. If you violate a typical proprietary software license you’ll feel the wrath of attack lawyers, which is assuaged by applications of large sums of money. If you violate the GPL you lose the right to use GPL code. When you repent and mend your ways you get to use it again. These GPL provisions only apply when you re-distribute code; whatever you do in the privacy of your own home or shop is nobody’s business but yours. Most proprietary licenses insert themselves into your normal use and private business.

Just for fun, go read the EULAs for Windows 8. There are 10, count ’em, ten of ’em. This is what Windows users must “agree” to.

Did Linux Really Win?

My fellow codgers are experts at treating insomnia with stories from the olden days; those heady days back in the last millennium when Linux was a radical adventure, and only riff raff and weirdos were into it. Microsoft was Sauron, Apple was Saruman, and we free software/open source rabble had epic flamewars about everything: Emacs vs. Vi, KDE vs. GNOME, graphical desktop vs. the text console, apt-get vs. Yum, and oh my gosh the license wars. GPL, BSD, artistic license, MIT license, copyleft, copyright, Apache, the Unlicense, Q, Nethack, Multics, Sleepycat, Fair, and dozens more, all sounding like characters at a comic con. Every week a new milestone and a new adventure, and fighting for legitimacy: Groklaw, Lindows, the hated SCO; Windows Refund Day; IBM’s first billion-dollar Linux pledge and their famous Linux commercials (“The servers! They stole all the servers!”); the United States vs. Microsoft; the Red Hat initial public offering; Ernie Ball publicly dumping Windows and adopting Linux after being raided by the Microsoft license police…I could ramble on and on, because the Linux and FOSS world was smaller then, more like a loud but cozy club, and events felt bigger.

The Linux and FOSS world is many times bigger now, so individual events and personalities don’t loom as large. We like to boast “Linux has won!” because of Android and the dominance of Linux and FOSS in all key computing arenas: supercomputing, embedded computing, cloud, networking, data centers, web sites and services…everywhere but the general-purpose PC desktop. But even as Linux has exploded in the enterprise, software freedom for the consumer masses has suffered. So — have we really won?

What Does Winning Look Like?

Linux and FOSS are mainstream, and the FOSS development model is widely-accepted. All kinds of businesses love to claim open source creds whether they have any or not. It’s rare to hear anyone calling Linux a cancer, as Microsoft’s Steve Ballmer did. Even the most hardcore proprietary software vendors have to interoperate with FOSS now, and many that were hostile once upon a time are now contributors. Credit for this goes to the growing popularity of Linux and FOSS, Linux distro logosand even more to the efforts of developers like Greg Kroah-Hartman and John Linville who extend helping hands to vendors, and assist them with learning how to become contributors.

But there is still no Tier 1 vendor selling desktop Linux. Dell has on occasion released a desktop Linux machine. And HP and Dell sell Linux servers, with many hoops to jump through to find them. If you want Linux pre-installed from a vendor who does it right you go to one of the excellent independent Linux vendors such as System76, ZaReason, Emperor Linux, Penguin Computing, or Pogo Linux. There are no Linux computers at Walmart, Best Buy, or Fry’s. Even Amazon, the largest store on Earth, has only few oddball Linux PCs.

Let us pause to let the chorus of “But Linux is too HAAARD for the MAAASSES” erupt and subside. Poppycock. Linux is easy. Windows is hard. And stupid, and incurably insecure, and overpriced. Apple is a stylish prison with the most hardcore attack lawyers. (And not all that easy.) I can’t find a link, but remember when Apple sicced their lawyers on the little girl who sent them an iPod feature request? In the FOSS world she would have been invited to submit a patch herself, and perhaps in a rude way. But never attack lawyers.

Small independent Linux shops make it dead easy to buy a Linux computer. You go to their sites, and lo! There they are. You can customize them online and make your purchase without ever talking to a human. If you need help or a custom configuration they will take care of you. Oddly, the titans of tech are unable to do this without making it a great big hairy deal. (I learned to make custom Debian spins way back in the last millennium. Surely a bigtime tech company with battalions of staff and control of the hardware can do the same.) In a genuinely competitive marketplace we could go to any major retailer and order up whatever computers we want with whatever operating system we want. We could choose from Linux, Windows, FreeBSD, and maybe some others that have fallen by the wayside such as Amiga, OpenSolaris, and OS/2, and perhaps some others that would have been invented in a lively open marketplace. That we can’t means the market is still under the thumbs of the wrong people.

But What About Android?

Android is paraded proudly as evidence that Linux has won the mobile phone and tablet market, hurrah! Its market penetration is rather astonishing, owning over half of the US mobile market. I think much of Android’s success is due to the name and the cute logo, and Google successfully wooing manufacturers. Customers are not asking for Linux phones, and most Android users have no idea what Linux is. So it doesn’t feel like much of a Linux win to me, but rather a Google/Samsung/HTC/LG/etc. win.

Is Android really Linux, and is it really open? Android runs on a modified Linux kernel. It has its own separate software and development ecosystem, and it is special-purpose for touchscreen devices and mobile phones. The Android you find on most commercial devices is very Google-centric and loaded with Google apps, and you can’t remove them. You can’t even turn them off without a fight, and they turn themselves back on. The Google Play Store is cram-full of closed-source proprietary apps that seem to be more about spying on you rather than being useful to you; you have to watch the permissions that they require with an eagle eye, and even if you’re careful with what you install you have no way to stop them from changing their terms of service later. There is no easy way to find open source apps on the Play store. (Try F-Droid to find FOSS Android apps.)

You can download and play with the open source Android bits at the Android Open Source Project. There are a number of Android forks, and the most popular is CyanogenMod. Whether you can install it on your own phone or tablet is iffy, as most Android devices are very locked-down and you don’t get root access. Some devices are so locked-down you cannot install apps from anywhere but the Play Store.

cyanogenmod

However, you can still root most devices via known Android flaws. Once you succeed in rooting your device and installing CyanogenMod you have to install the Play Store and other Google Apps separately, if you want them, because CyanogenMod cannot distribute them. The Google Apps are closed-source, and while they’re free of cost to distribute Google allows them to be distributed only on certified devices, and suprise! Certification costs tens of thousands of dollars. Once you’re certified you have to install a set of apps that Google specifies. You don’t need them to use CyanogenMod. CyanogenMod behaves more like a traditional Linux because it gives you control of your device’s hardware. (Note that inexpert tinkering can brick your device.)

This highlights one of the core strengths of “real” Linux, and that is a large number of diverse software repositories, and the most advanced software management of any platform. Users have multiple excellent choices for their software sources.

Who Owns Our Stuff?

The unsettled battle is who owns our stuff? You know all those free cloud services that everyone in the world is trying to suck you into? They’re not doing it because they love you and want to give you cool free things. It’s just one more cog in the data-mining machinery that exploits the Internet and everyone who uses it. “If you’re not paying for the product, you are the product” is the prevailing business model. The real customers are marketers, and their appetite for every last morsel of our private information is bottomless. It’s a black box with no accountability or oversight.

This is an alarming trend, especially considering that software controls everything. Medical devices, home appliances, tools, vehicles, power grids, factories, you name it and odds are it’s cram-full of microcontrollers that only the manufacturer knows how to program and debug. Auto manufacturers don’t want us to know how to read the trouble codes in our own vehicles. Killed by Code discusses the problem of malfunctioning buggy medical devices. Every time I go to the doctor I get creeped out by seeing Windows screens everywhere. Sure, I totally want my sensitive personal data stored on the most porous computing platform. Welcome to the World Wide Botnet.

Phil Hughes, the founder and original publisher of Linux Journal, famously asked “Would you buy a car with the hood welded shut?” We should have unfettered access to all source code on every device we own, and every device that touches us in any way. We’re a long way from this as “intellectual property” (a lazy term that encompasses patents, trademarks, industrial design rights, and copyrights) laws are insanely-stacked in favor of rights holders, at the expense of everyone else.

No Magic Moment

Progress is messy, and persistence wins. Linux has come a long way in 23 short years. There will never be a definitive “Aha! We won!” moment. I will call it a win when open code is the norm and closed-source is the exception, and all the crazy laws that try to control and restrict what we do with our own stuff die nasty painful deaths. Or even peaceful ones; I don’t care as long as they’re good and dead. I will call it a win when vendors quit treating us like criminals. The Oatmeal has the best take on this in I Tried To Watch the Game of Thrones and This is What Happened. (Crude language warning.)

Footnote

In anticipation of someone snarking “Well if you’re so pure then don’t use all that evil stuff lol!” I know, the people who say that think they’re scoring a killer shot, zing! But they’re not. We all make our best choices, and we continue advocating for improvements. Progress comes from being engaged and building bridges, rather than stomping away in a passive-aggressive huff.

India Market Puts Linux Smartphones to the Test

IDC-India-smartphones-Q2

India has suddenly become the hot ticket in the race to expand smartphones beyond saturated markets in the North America, Europe, and Asia Pacific. Following the late August introduction of Firefox OS phones from Intex and Spice selling for an unprecedented $35, Google announced the launch of its Nexus-like Android One smartphone program in India. This week, Jolla began selling its Sailfish OS based phone in India, and Samsung revealed plans for a November release of a Tizen phone in the country.

For the last few years, smartphone execs have been uniformly promoting the importance of China. Their wish has come true, as Chinese smartphone sales have surged, although for the most part the Chinese have been buying Android phones from homegrown companies like ZTE and Huawei. China is not yet saturated, but it’s increasingly difficult to compete there.

spice dreamuno

Smartphone vendors are now spreading out to the far corners of the Earth searching for potential new touchscreen addicts. India, with its huge population and rising middle class, is the prime target. The problem with India is the relative lack of 3G and 4G infrastructure for downloading apps or updates. A good part of the appeal of smartphones is the appeal of apps, but without the means to easily download them, many consumers are staying with cheaper Nokia feature phones.

To address this, vendors are preloading phones with numerous localized apps. In addition, Google is providing direct OTA (Over the Air) updates and app downloads for Android One customers at free or discounted rates.

Price is still the biggest differentiator in India. While there are tens of millions of potential consumers of phablets and other high-end Android phones, there are many hundreds of millions of less affluent consumers who still might be able to afford a more modest device, such as a Firefox OS phone. Google went for a mid-range approach for the first Android One phones, which sell for about $105. There are certainly cheaper Android phones in India, but also many that cost a lot more.

Some 71 percent of Indian phone sales are for feature phones, according to an August report from IDC. Samsung leads an Indian smartphone market that grew by 84 percent year-over-year in the second quarter, says the report. However, several Indian vendors are growing at a faster rate. Micromax, with 18 percent share, recently edged out Nokia (Microsoft) from the number two spot, says IDC.

Spice Fire One smartphoneSmartphone sales should double between now and 2018, projects IDC. The sub-$200 category, which represented 81 percent of sales in Q2 2014, will grow at a faster rate than the overall market, due in part to new competition from Firefox OS and Android One, says the research firm.

Most of Samsung’s volume has come from sub-$150 Android phones like the Galaxy Star Pro and Galaxy S Duo, according to the report. So far, Samsung has not signed up as an Android One partner.

Below is a quick look at the latest Indian campaigns involving Linux-based mobile platforms: Google (Android One), Mozilla (Firefox OS), Samsung (Tizen), and Jolla (Sailfish OS). The odd-man out here is Canonical’s Ubuntu Touch, which is set to debut later this year in a special version of the Meizu MX4 phone. But who knows? Maybe Meizu is aiming for India as well.

Android One

Last week, Google announced the launch of the first Android One phones in India, from Micromax, Karbonn, and Spice. Like Google’s Nexus program, Android One is a mobile reference platform with an up-to-date Android stack free of bloatware, but it’s aimed primarily at developing nations.

The Micromax Canvas A1, Karbonn Sparkle V, and Spice Dream Uno sell for an average price of about $105. They all run Android 4.4 on a 1.3GHz, quad-core Cortex-A7 processor from Mediatek called the MT6582. Specs are almost identical, with all the devices offering 1GB of RAM, 4GB of flash, and a 4.5-inch, IPS capacitive touchscreen with 854 x 480-pixel resolution. The phones feature 5- and 2-megapixel cameras, and provide dual-SIM 3G GSM, WCDMA and 2G GPRS support. Bluetooth 4.0, WiFi, GPS, and FM radio are also available.

Other Android One phones will launch in Indonesia, the Philippines, Bangladesh, Nepal, Pakistan, and Sri Lanka by the end of the year, says Google. Vendors will include Acer, Alcatel Onetouch, Asus, HTC, Intex, Lava, Lenovo, Panasonic, and Xolo.

Google’s offer of direct OTA updates, with free update downloads during the first six months, is an attempt to reverse the problem of fragmentation in the Indian Android market. This is caused in large part by the time and expense of downloading updates, as well as the many Android phones that use third-party app stores. Google has also negotiated with Airtel to let users download up to 200MB per month of apps from Google Play, free of charge. As a bonus, Android One users will be among the first to download the upcoming Android L release.

Samsung’s Tizen Phone

Earlier this summer, Samsung’s flagship Tizen phone was finally unveiled as a relatively high-end, quad-core Samsung Z phone set to ship in Russia. Yet, in July, Samsung said the Russian launch was postponed indefinitely. Earlier this week, however, the Economic Timesquoted a Samsung exec as saying a Tizen phone would reach India following the Diwali festival in late November.

It is unclear whether the India-bound Tizen phone is the Samsung Z or something more modest. Last year, Samsung tipped plans to introduce a low-end reference design for Tizen phones, but the company has not mentioned it recently.

Firefox OS

The $25 Firefox OS smartphone” promised last February by Mozilla and chipset partner Spreadtrum turned out to be about $35, but no one seems to be complaining. The Intex Cloud FX costs 1,999 Indian Rupees ($33), and the Spice Fire One Mi-FX 1 goes for $2,299 Rs ($38), which is still about half the price of the cheapest Android phones, and a third of the Android One phones.

Granted, the phones have even lower-end specs than the first wave of Firefox OS phones, running on an ARM Cortex-A5 based SC6821 chipset from Spreadtrum that also integrates a 2G baseband. Both phones have 3.5-inch, 320 x 480-pixel capacitive touchscreens, as well as WiFi, Bluetooth, FM, and dual-SIM 2G GSM radios. You get 128MB RAM, 256MB flash, and a 2-megapixel camera. Firefox OS is now available on 10 smartphones in 18 countries, says Mozilla.

Jolla’s Sailfish OS

This week, Jolla shipped its Sailfish OS-based Jolla phone in India with online retailer Snapdeal. The phone, which has been limited to Europe, and now sellsfor 349 euros (about $446), down from the original 399 euros, is going for just 16,499 Rs in India, or about $270.

Jolla also announced that it was in negotiations with several Indian phone manufacturers to license the open source Sailfish OS. The Meego Linux based Sailfish will be free to vendors, while Jolla hopes to make money on services, according to an Economic Times report. Android app compatibility could give Jolla a boost.

India Tests the OS

Winning the Indian market does not guarantee success in other emerging markets in the Middle East, Southeast Asia, Africa, and South America. India is a unique country, with special challenges — for example, the Firefox OS phones in India offer support for three or four languages. However, the lack of broadband wireless infrastructure — and consumer buying power — will likely remain realities in a number of other markets for decades. The platforms that can successfully address these issues in India should have a leg up elsewhere.

Concern Over Bash Vulnerability Grows as Exploit Reported “In the Wild”

Dubbed “Shellshock.” the vulnerability is already being exploited by what looks to be a web server botnet.

The vulnerability reported in the GNU Bourne Again Shell (Bash) yesterday, dubbed “Shellshock,” may already have been exploited in the wild to take over Web servers as part of a botnet. More security experts are now weighing in on the severity of the bug, expressing fears that it could be used for an Internet “worm” to exploit large numbers of public Web servers.

In a blog post yesterday, Robert Graham of Errata Security noted that someone is already using a massive Internet scan to locate vulnerable servers for attack. In a brief scan, he found over 3,000 servers that were vulnerable “just on port 80″—the Internet Protocol port used for normal Web Hypertext Transfer Protocol (HTTP) requests. And his scan broke after a short period, meaning that there could be vast numbers of other servers vulnerable. A Google search by Ars using advanced search parameters yielded over two billion webpages that at least partially fit the profile for the Shellshock exploit.

“It‘s things like CGI scripts that are vulnerable, deep within a website (like CPanel’s /cgi-sys/defaultwebpage.cgi),” Graham wrote. CPanel is a Web server control panel system, used by many Web hosting providers. “Getting just the root page is the thing least likely to be vulnerable. Spidering the site and testing well-known CGI scripts (like the CPanel one) would give a lot more results—at least 10x.”

Read 5 remaining paragraphs | Comments

Read more at Ars Technica

Oracle OpenStack for Linux Arrives, As Competition Heats Up

In case you thought the OpenStack cloud computing race wasn’t crowded enough, Oracle has just made its Oracle OpenStack for Oracle Linux distribution generally available. Based on the OpenStack Icehouse release, it allows users to control Oracle Linux and Oracle VM through OpenStack in production environments. It  an support any guest operating system (OS) that is supported with Oracle VM, including Oracle Linux, Oracle Solaris, Microsoft Windows,and other Linux distributions.

Meanwhile, Oracle is also deepening its partnership with Canonical surrounding OpenStack. Users who install Oracle Linux as a guest OS on Canonical’s Ubuntu OpenStack distribution will qualify for OS support from Oracle. Likewise, Canonical will support Ubuntu as a guest OS on Oracle OpenStack.

 

Read more at Ostatic

AWS’ Reboot Highlights How Cloud Needs Patching Best Practices

It’s likely that large cloud computing players will have to adopt a security patching cadence similar to the one used by the software industry. In the future, the cloud will have its version of Patch Tuesday.

XWayland Linux Gaming Performance With GNOME Wayland On Fedora 21

With this week’s Fedora 21 Alpha release delivering the very latest open-source Linux graphics driver code, the newest Wayland code, and the updated GNOME 3.14 desktop with its day-to-day support for Wayland, I’ve been busy benchmarking.

Read more at Phoronix

There’s Wayland Changes Needed Before GNOME Will Be 100% Ported

With yesterday’s GNOME 3.14 release the Wayland support is considered sufficient for day-to-day use running the GNOME stack on Wayland rather than an X11 Server on Linux. However, the GNOME developers don’t consider this to be “100% complete” yet and there’s still some more work needed to be cleared up on the Wayland side…

Read more at Phoronix

Samsung Moves 500 Software Engineers to Other Tizen Software Divisions

  Samsung Electronics have decided to move 500 Software Engineers out of their mobile phone development unit into other consumer electronics parts such as TVs, network, printer and its corporate software R&D divisions, according to various reports on the net. Looking at the reaction on the Internet, the vast majority of tech sites see this as Samsung not having faith in their Smartphone business, and in Particular Tizen Smartphones. I disagree with this.

There are lots of unknowns in this equation and without knowing their current Android development strategy, its not clear if these software engineers were even surplus to requirements. “To further strengthen the company’s overall software prowess,†the company said in a statement. The focus will be “to enhance our competitive edge in the Internet of Things (IoT) industry and increase synergies for the Tizen platform,†it said [Samsung].

The post Samsung moves 500 Software Engineers to other Tizen software divisions appeared first on Tizen Experts.

Read more at Tizen Experts

Linux Foundation Certified Engineer Will Sheldon on What It’s Like to Pass the Exam

Will Sheldon certified engineerJust a few days after the Linux Foundation announced its new certification program in August, Will Sheldon took the certified engineer exam and passed.

Sheldon, an IT manager for open source consulting company Appnovation Technologies, already held certifications from Microsoft and Cisco, but hadn’t yet gotten a Linux certification.

“I’ve been considering getting RHCE certified for some time,” Sheldon said, “but being more focused on Debian-based distros I’ve never really felt confident enough to take on the Red Hat environment.”

The Linux Foundation’s distribution-neutral exam – available on CentOS, Ubuntu, or OpenSUSE – was just what he’d been waiting for. He’s now one of the first IT pros to earn the title Linux Foundation Certified Engineer – a designation he believes will become increasingly important to recruiters.

“I’m confident that as LFCE becomes more established it’ll become one of the de facto HR search terms and greatly assist in getting the right sort of attention to my (LinkedIn) profile,” he said.

In this Q&A, Sheldon discusses why he took the exam, how he prepared, what the test was like, and gives some helpful advice for anyone who plans to take it.

How long have you used Linux and how did you get started doing system administration?

About 10-15 years now. I was drawn to the stability of the platform and the vast array of GNU FOSS software available coupled with the fantastic community surrounding so many software projects.

How did you get to where you are today?

I started my professional life as a computer bench technician building machines at a local computer store during summer holidays, from there I progressed to systems administrator for a small business where I studied for and achieved my CCNP, to eventually move to a role as a systems engineer and then project manager for a group of schools in London, UK where I obtained my MCSE and PMP certs. I then made the hop across the pond to Canada where I now live, and after two years working as IT manager for a group of schools across Canada, I found my way to Appnovation.

What, if anything, did you do to prepare for the exam?

I read the syllabus and thought that it seemed within my skill set, so I figured I’d have a go.

logo lftcert engineerWhat did you think of the exam?

I much prefer the live environment scenario to the more conventional multiple choice questions of other certifications. There is often more than one way to do it in Linux and by focusing on the outcomes, not the methods, the LFCE exam requirements more closely mirror real-world situations.

What surprised you, or stood out about the exam? (Did it meet your expectations?)

It surprised me how quickly the time passed. I’d certainly keep closer watch on how long I spent on the various tasks if i had to take it again.

Do you have any advice for anyone considering taking the exam to get certified?

Go for it, it’s a challenge in places but it’s truly not that hard if you have been through the syllabus and had a play in a VM.

What are you hoping to do with the certification, now that you have it?

Put it up on LinkedIn? Haha. Seriously though I already have Microsoft and Cisco certs, and now that Linux skills are becoming increasingly in demand I’m confident that as LFCE becomes more established it’ll become one of the de facto HR search terms and greatly assist in getting the right sort of attention to my profile.

Bug in Bash Shell Creates Big Security Hole on Anything With *Nix In It

Whoops. Mac OS X’s Bash shell is vulnerable to remote execution attacks.
Sean Gallagher

A security vulnerability in the GNU Bourne Again Shell (Bash), the command-line shell used in many Linux and Unix operating systems, could leave systems running those operating systems open to exploitation by specially crafted attacks. “This issue is especially dangerous as there are many possible ways Bash can be called by an application,” a Red Hat security advisory warned.

The bug, discovered by Stephane Schazelas, is related to how Bash processes environmental variables passed by the operating system or by a program calling a Bash-based script. If Bash has been configured as the default system shell, it can be used by network–based attackers against servers and other Unix and Linux devices via Web requests, secure shell, telnet sessions, or other programs that use Bash to execute scripts.

Because of its wide distribution, the vulnerability could be as wide-ranging as the Heartbleed bug, though it may not be nearly as dangerous. The vulnerability affects versions 1.14 through 4.3 of GNU Bash. Patches have been issued by many of the major Linux distribution vendors for affected versions, including:

Read 6 remaining paragraphs | Comments

Read more at Ars Technica