“This week, advisories were released for zlib, php, mtr, squid, analog, and imlib. The vendors include Conectiva, Debian, FreeBSD, and Red Hat.”
Category:
- Security
Category:
Category:
I’ve been playing with my new Linux-powered Sharp Zaurus SL-5500 PDA since last Thursday and I wanted to pass along my impressions so far. First off, I have to say this is the coolest little gadget since sliced bread. I have lived with a Palm IIIx for almost three years as my steadfast companion, but this device just blows my mind with its potential.
Secondly, I have to say that the Zaurus is far from perfect. There are
“gotchas” a-plenty that I will elaborate on later.
Hardware
The best description of this PDA is that it’s a Linux laptop that
fits in one hand. With its hardware, it’s pretty well set:
Software
This thing covers all the software basics. Navigation is very easy,
and everything is clear and uncluttered. There are five major groups:
apps, games, jeode (java apps), settings, and documents, for all files that
aren’t applications. You can navigate to each easily with the
buttons on the front of the Zaurus, or using the touch screen. The menu
bar at the bottom of the screen gives you easy access to time, volume
control, battery status, external card status, network status,
application switching, and a start button. Again, it’s all laid out to
make it pretty easy to get around and do stuff; there’s no confusion.
The sync software, the good
The Zaurus comes with two kinds of sync software: Qtopia Desktop and
Intellisync. The Intellisync is for syncing with MS Outlook, and because
I don’t run Outlook, I can’t tell you anything about that. The
Qtopia Desktop I do run; it’s basically the same thing as Palm’s Desktop
software. I had no trouble setting it up with Windows 2k. I followed
the directions, and it hooked up no problem. Setting up the Linux
version was a little more difficult. The Windows version comes with the
Zaurus on CD, the Linux version I had to download from Trolltech. They
screwed up and put the Win32 install instructions in the .tgz file
instead of the Linux instructions, so I had to go download an older
version to get the correct install instructions.
Mandrake 8.2 almost
recognized the Zaurus from scratch. When you plug in the Zaurus, it is recognized
as a USB device, and Mandrake tries to load the driver for it.
Unfortunately, it loads the wrong driver. Messing around with
modules.usbmap I changed a couple of values for the usbdnet driver and
now Mandrake loads up the correct driver. I added an ifcfg-usb0 file in
the network-scripts directory, and now I have a hot-plugable
interface. The Qtopia Desktop hooked up, no problem, and I was able to
sync from the Zaurus to my Linux desktop without any trouble.
The sync software, the bad
The Qtopia Desktop software is flaky. I would not recommend this setup
to a novice PDA user. It is possible that my impression is influenced by my coming out of a Palm-based world, but the software doesn’t seem to work the way I would
expect it too when syncing. I have twice lost significant amounts of
address entries or calendar entries do to syncing issues. I have found
that the only way I can reliably enter stuff is to leave the sync
software on “PDA overrides desktop.” When entering lots of data in
the desktop side, I then manually switch it to “desktop overrides PDA,” do
a sync, then back to “PDA overrides desktop.”
The issues mostly come up
when you enter stuff on the desktop or change things on the
desktop while there are already similar entries on the PDA. It
doesn’t handle this well. For this reason, I would say this setup is not
for the general consumer. Only people who know how to be careful should
use it. The Intellisync software may be better, but again, I haven’t
tested it. The Linux version I have was just
released this weekend (it’s listed as a beta version).
Miscellaneous issues
There is one major security issue: The version of Linux the
Zaurus runs does not come with support for IPtables or IPchains. This
wouldn’t be horrible (it actually disables a lot of the normal daemons
that are problems) except for one screw-up. Someone decided to use FTP
as the syncing software’s conduit, and even better, it logs in as root
with no password! So the qpe daemon (which is the Zaurus GUI interface)
also has an ftp daemon running on port 4242 with root login and no
password, and it is bound to all ports, all IP addresses! The Zaurus
comes with tcpwrappers, but qpe doesn’t run through that, so if you
hook the Zaurus up to a network, root file read/write access is
available to all. You can set a root password, which at least puts a
password into the mix, but reports are that it kills the sync ability (I
haven’t investigated this yet).
At the moment, this isn’t a terrible
issue for me, because I’m using my Zaurus as a PDA without an Internet/external
network connection for now. But because I plan on purchasing a network
card for it, I also plan on figuring out some way to firewall this thing
off from the outside world.
Summary
The Zaurus is a great hardware device with some minor and major software
issues. I would recommend this device to Linux and computer-savvy
people who want a very flexible PDA, with warnings about the
potential issues. Most of these issues can be avoided with some care.
This is a new product, and like many new products it has bugs. I hope
these bugs will be fixed quickly, and given the Open Source nature of
the device, this should be possible. It would be a shame for a couple of
stupid mistakes to ruin the Zaurus potential. I’m happy with my
purchase, and look forward to putting this little beast to some hardcore
sysadmin/programming work!
NOTE on Broadcast: tonight we wil be bringing you some of the stories we would have covered last week. The rumor that we were forced off the air because of our announcement of the formation of GeekPac is 100% not true, but happened because of loosing one of our major network connections, and so we were unable to broadcast.
In Segment One – Hot News: We will be covering the hot Linux news of the last few weeks. In particular we will talk about the best of this years April 1st Internet Hoax’s. There were lots this year.
In Segment Two- Introducing The Open Technology Consortium (GeekPAC) or A more aggressive step at securing our future.
Tonight we ask the listeners indulge us a bit as we introduce our New Political Action Committee The Open Technology Consortium. We will have a URL available for users to review our initial Position Statement by ShowTime. The need for such a PAC should be obvious.
It has become apparent. Regardless of the efforts the founding members of the PAC have attempted to use to influence the outcome of political events that impact the mixed communities of; the Open Source development community, the Internet and ISP communities, the Linux community and the “non-Microsoft centric” portion of the general IT community; that those efforts have failed.
It is now time to take a more aggressive, attack direct to the seat of power in Washington DC. The creation of this PAC is to effect a sense of UNITY between several technology communities, and allow a common reference to carry a diverse message.
Please join us on the show, and check our IRC Chat(irc.thelinuxshow.com
#linuxshow).
Remember tune in at 6pm pt, 7pm mt, 8pm ct, and 9pm et.
Catch the Linux show at
www.thelinuxshow.com
Category:
Attorneys for Elcomsoft asked U.S. District Court Judge Ronald Whyte to dismiss U.S. v. Elcomsoft, the case that began last July with the arrest of the Russian programmer Dmitri Sklyarov. The attorneys claim the company’s software enables “fair use” rights of copyrighted materials — rights that the Constitution protects.”