Scott McNulty gets his MacUser career off to a good start with an article about using passwords, which links to a New York Times article.

There have been several attempts to move past the username and password combination. In reality, there are only three things that can authenticate that you are who you say you are. Something you have, something you know, or something you are. The username/password combo is an example of something you know, but the combination of items makes the authentication mechanisim much stronger. For example, swiping an ATM card (as the NYT article also references) is a combination of something you have and something you know. Using a finger print reader is an example of something you are. The best security combines these three , although it’s cumbersome to do over the web.

For example, I use a dual screen set up with Xrandr, and it works well, especially with the new compositing ability in Gnome 2.22. Getting xrandr to work properly required me to edit a few lines in the xorg.conf file to allow for a large maximum desktop size. Compare this with how Windows deals with dual monitors. You plug it in, turn it on, enable it in the preferences, and there you go. Now compare that with how Macs handle dual monitors. You plug in another monitor and it works… bottom line.

I realize that there are a lot of valid reasons for this. Proprietary hardware, lack of documentation, legacy code, etc, etc, etc…

I also realize that 99% of people who use a computer do not care.

Computers should be like appliances… plug them in, turn them on, and start using them. I like the toaster analogy. I don’t care how my toaster works. I just want it to make my toast in the morning. I don’t care if I have the “freedom” to take the toaster apart and study the timing mechanisem and re-create it in yet another toaster. I just want toast. I use Linux at work because it is an amazing server. I’ve seen Linux servers keep on trucking through some environments that would kill another OS. I use Linux on my laptop at work becuase it integrates in with my workflow and scripting perfectly. I don’t use it for the freedom, I use it because it works well for my environment. My environment however, is very different from the average home user.

If Linux is ever going to take hold it needs to learn a few things from Apple. Here are a few points that will bring Linux onto Mom and Dad’s desk.

1. Own the hardware. Apple controls all aspects of its hardware/software relationship. I’m not saying that a particular Linux distro would only be able to be installed on whatever vendors hardware, but I’m saying that a hardware vendor should adopt Linux and fully develop the OS in house to support its hardware.

2. Maniacally control the distro. The open source nature of Linux makes this very difficult, but it also makes Linux feel… disjointed. This goes hand in hand with point 1, develop the hardware and software in tandem to support each other. Release the code as GPL, sure… give it back to the community, but control what goes into the distro and develop it in-house. Linux has a bad habit of adding features because it can. Compiz has hundreds of options for rediculous visual features that no one needs (and a few that everyone does need!), and which really distract from using the computer. Another example: Do you think KDE 4.0 would have made it past the desk of Steve Jobs? Can you imagine what that conversation would have been like?

Underling: “Yea, we know the visual features are incomplete, and there’s several things that don’t work, but we’d like to ship it anyway.”

SJ: Shoots underling.

Which leads me to my next point:

3. Appoint someone Grand High Poomba. Someone needs to be there to say “No”. Someone who will say, yea, that’s a great idea, but we are not going to do that in this distro. At times I think that Mark Shuttleworth is that guy… and then there are other times when he decides to ship every six months if Ubuntu is ready or not. Shuttleworth could be that guy.

4. Provide the end to end user experience. When I pop open the lid of my laptop, I expect to be able to start using it within seconds. When I close the lid, I expect the laptop to go to sleep and wait for me to need it again. When the hardware is fused with the software, and features are controlled and perfected, the result is a very fluid, intuitive experience that brings the users back.

The last item I’d love to see from Linux is to stop adding new features. Seriously, stop adding new, untested, beta quality code and spend some time perfecting what is already there. Fix what you have first. Then, and only then start adding new features.

Linux, we’ve come a long ways, but we’ve still got a long ways to go.

Going outside the box can have disastrous results with Linux. Back in early 2000 and 2001 when I was installing SuSE and Mandrake on my old IBM box, I wound up in dependency hell more than once. If you’ve never been there, it goes something like this:

OK, I want to upgrade my music player to the latest version, so I’ll download the latest RPM. Wait, that failed, because it depends on a newer version of some library file that I don’t have, so I’ll go search the Internet and try to find that. OK, found it, downloaded the rpm, and it failed to install because it depends on a newer version of some other library file that I don’t have. Looks like there’s no RPM for that library, so I’ll download the source code and compile it. OK, ./configure; make; make install; Nope, that failed because of a gigantic list of dependencies that are not available! At this point, you have to make a decision: Do you go ahead and find the dependencies, or do you give up and have a drink instead. If you choose to go ahead, you download the source to a dozen different packages and install them, then compile your library, then compile your other library, then go to install the rpm to find that it fails because one of the applications you upgraded along the way is, get this, too new to support your music player, and the install still fails. Oh, and by the way, half of your other apps that used to work, don’t work any more.

This was a very real problem a few years ago, that’s why there is such a focus on package managers, and why I recommend staying in the box. That’s why when I’m asked to go outside the box, I always tend to meet such requests with scruteny. Do you really need that? How badly do you need that?

Java however, is not so bad. It’s one of the few apps that is self contained in it’s own directory. You download the executable bin file from Sun, run the installer, and put the extracted directory wherever you choose. I normally put it in /usr/local/ Then, I do a which java, and move the original java to java.bak. Next, I create a symbolic link to the new java in /usr/local. Run java -version, and verify that we are using the new and improved java.

I’ll be back :)

Using sustainable formats on OSX, or… The Best of Both Worlds!

Remember the early days of networking… before TCP/IP became the standard protocol? Well, neither do I, but I’ve read about it. That’s years ago now, but back then, each computer manufacturer developed their own method of networking their machines together, and each method, or protocol, was incompatible with the other. Apple had AppleTalk, Novell had IPX/SPX, Xerox had XNS, and on and on it went. TCP/IP was born out of the desire to create a vendor independent network, which became known as ARPAnet, and later, the Internet.

This little history lesson is meant to illustrate the tremendous advantages there are to open standards. Would the Internet exist if it belonged to a single corporation? Not as it is today, no. These same ideas can be applied to several other forms of data on the computer; images, documents, music, etc… We now have the capability to keep almost all of our data in a format that is guaranteed to provide greater flexibility, so why isn’t Apple taking advantage of it?

For example, Mail, the venerable email client that comes with the Mac, provides suitable email functionality for most Mac users. Now that I’ve got several years of email stored on my Mac, I’d like to be able to keep those files in a format that is not subject to any corporation’s whims. I’d also like to be able to drop my mail folder on another platform and be able to open it up in a different client… interoperability. Another example is iPhoto, one of my favorites. Would it really be that difficult for Apple to design iPhoto so it stores its database in a reliable, documented format that is readable (and writable) outside the application?

This goes back to a central belief I have about data, and applications. While the application may belong to its author, the data it processes belongs to me, and it should be available to me in a well documented, open format. Open formats make sharing files easier, as they are capable of being supported on more platforms

How about giving Quicktime the ability to natively export to Ogg-Theora? Or allowing iTunes to use Ogg-Vorbis as its default media format? (DRM not considered here…) Pages? Keynote? How about some Open Document Format support? I really don’t think the move to open formats would be that big of a leap. Apple already includes several open source applications inside its server offering, and has built its core data framework around XML and SQLite, so why not open the rest of it up?

The other note worth mentioning is the high profile “switch to linux” news that has been making the rounds lately. With several long time Mac supporters moving to Linux citing problems with formats and a lack of openness from Apple, it seems to me that this is a problem that could be easily fixed. I’m not calling on Apple to open source OS X, I’m not even implying that, although open sourcing a few of the bundled apps might be a good thing in the long term

The world is becoming more aware, and times they are a changin. The world is knocking, dear Apple, its time to open up.

One of the projects I’ve been working on in the past week has been a rapid deployment server for SLES 9.  I would have liked to deploy SLES 10, but we are constrained by our application requirements.  Novell has done a great job at making it easy to deploy SLES or SLED using their Autoinstall and Installation Server options available through YaST.  Using Autoinstall, YaST steps you through the options required to generate an xml file, this xml file is read by YaST during system install and automates the process.  To build a network installation source, the contents of the CDs or DVD need to be copied to the hard drive, preserving symbolic links.  YaSTs Installation Server makes this easy, and also makes “slipstreaming” (to borrow a Windows term) a service pack into the install source automatic.  I’ve built the network install source both ways, and I prefer using YaST to do it for me.

Even with all this being said, YaST (in SLES 9) is still missing some features that require me to edit the xml file directly.  The most important feature it’s missing, which they included in SLES 10, is the ability to create LVM volumes during partitioning.  Not to say that it’s not possible, it just requires editing the xml source file.  Using a little trail and error, I was able to partition the drive with a 200MB /boot (too big, I know), a 2GB swap, and then partition the rest of the drive as LVM, and then mount /, /var, /opt, /usr, /tmp, /home, and /work inside the lvm.  Works like a charm.  If you need a working autoinst.xml file, you can download mine here.

This setup is great, but it required me to boot off of the CD, and then enter a long install=nfs://bla bla bla/bla bla autoyast=nfs://blalbalba line at boot time.  To really make the system work, I needed network booting for full automation.  I found a great walk through in this pdf, which surprisingly enough, worked for me the first time.  I had to install tftp, syslinux, and dhcp-server rpms, then edit a couple of files, move a couple of things, really no big deal.

Now, I’m ready.  When we get 100+ servers in, which I’m told I’ll have 7 days to install, I’ll be able to say “what would you like me to do with the rest of the time?”

You can download the utility here: WSU

Yes, we are well aware of the built in runas utility, but we just think this is easier.

Matt’s also got a beta with some interesting features. wsu now accepts -p argument for changing cpu priority.

ex. wsu regedit -p 4

1 Below Normal
2 Normal
3 Above Normal
4 High
5 Realtime

You can download the beta here: wsu2 Beta

Screenshots: Because you know you love them.

If you are interested, wsu is written in Visual Basic. The executable is very small, here’s the source code:

Imports System.Security
Imports System.IO
Imports System.Diagnostics
Public Class frmWinSu
    Function ConvertToSecureString(ByVal str As String)
        'converts string to secure string
        Dim password As New SecureString
        For Each c As Char In str.ToCharArray
            password.AppendChar(c)
        Next
        'Returns new secure string
        Return password
    End Function
    Public args() As String
    Public adminAcct As String

    Private Sub frmWinSu_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        'if no arg is passed, exit winsu
        args = Environment.GetCommandLineArgs
        If args Is Nothing Or args.Length <> 2 Then End
        Try
            'Gets admin acct from configuration file
            Dim file As New FileStream("C:\winsu.conf", FileMode.Open, FileAccess.Read)
            Dim fileReader As New StreamReader(file)
            adminAcct = fileReader.ReadLine
            'If the file is blank, do nothing
            If adminAcct = "" Then End
            'Closes filestream and streamreader
            fileReader.Close()
            file.Close()
            lblAcct.Text = "Enter the password for " & adminAcct & " to perform administrative tasks"
        Catch
            End
        End Try
    End Sub

    Sub StartProc()
        Try
            'instantiates new process from the path read from config file
            'Process is started as user adminAcct with password from txtPasswd
            Dim proc As New Process
            proc.StartInfo.FileName = args(1)
            proc.StartInfo.UseShellExecute = False
            proc.StartInfo.UserName = adminAcct
            proc.StartInfo.Password = ConvertToSecureString(txtPasswd.Text)
            proc.Start()
        Catch ex As Exception
            ' displays message if an error occurs
            MsgBox(ex.Message)
            'if error is from incorrect logon info, then start over
            If Err.Number = 5 Then txtPasswd.Text = "" : Exit Sub
        End Try
        End
    End Sub

    Private Sub cmdOK_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles cmdOK.Click
        'Executes StartProc() routine
        StartProc()
    End Sub

    Private Sub txtPasswd_KeyPress(ByVal sender As Object, ByVal e As System.Windows.Forms.KeyPressEventArgs) Handles txtPasswd.KeyPress
        'Executes StartProc() routine if enter key (chr(13)) is pressed
        If e.KeyChar = Chr(13) Then
            'e.Handled stops the proram from making the really annoying _
            'error alert noise when you press the enter key on a single _
            'line textbox
            e.Handled = True
            StartProc()
        End If
    End Sub

    Private Sub cmdCancel_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles cmdCancel.Click
        End
    End Sub
End Class

We hope you like it, if there are any questions or suggestions, drop them here in the comments.

NOTE:  We just discovered that WinSU is already taken as a name, so Matt asked to have it changed to wsu.

The Master Craftsman has an intimate relationship with his tools. He knows not only what they do, but much more importantly, how they do it. His choice of tools for a certain task is based on years of experience, research, and hands on use. He can debate intelligently on the merits and problems with his tools, as compared with other tools that he has tried and discarded over time. His choice of tools explains something about him.

The Master Craftsman enjoys his work, and is comfortable with his place in the world. He is an expert, and he knows it.

I’ve had an abstract idea for this post for a couple of months now. The Master Craftsman is the embodiment of my professional goals. I’m not one to speak of gurus or wizards, since I come from very down to Earth country in Montana, but a craftsman, or a woodworker is an image that I can grab on to. I’m not a Master yet, but I’m working towards it. My tools are not jigsaws and planers, but vi and zsh, but the basic principles still apply. I think the idea of a craftsman is less about impressing others and more about perfecting his skill.

The heron has landed: a review of Ubuntu 8.04: Page 1: “”

Evidently the new built in search app Tracker is slow and returns lots of files that are irrelevant to the search. Ars says that Beagle is better, and is supported by more apps, but I’m thinking that Linux needs a more drastic change when it comes to built in search. Something along the lines of the Mac OS X fsevents. fsevents is kernel based, and tracks the changes to every file in the operating system. This makes spotlight very efficient, and very current… there’s never a need to re-index your system.

A built in search function like this would be great in Linux on the desktop, but I think it would be even more impressive on the server. Without doubt there would be a public api, one that could be used to collect the index from all servers on the network and offer one place to search through all files on all servers. This would be amazing for corporate file servers, although permissions would have to be worked out. I think its doable.

Not a great answer, so I decided to start tracking the email alerts with a centralized database. Now, at this point, I could have whipped up my own home-brew frankenstein creation, but since everything I wanted was already built into Wordpress, I really didn’t need to. Wordpress has the option of posting blogs via email. So, all I needed to do was set up a special email account on our mail server and make sure the pop3 server was running. Then, add the server and login information into Wordpress, setup a cron job to trigger the mail check every five minutes, and (whala) boom! Instant logging of all pages that are sent out in a searchable, easy to read, web format. Now, when management gets it in their mind to start asking questions, we can easily say “Let me reference my report.” They really like hearing things like that.

Building on the success of the alert log, I thought it might be good to also log all of our changes to the system. This idea is completely different from traditional “Change Management” systems which require you to log ahead of time what you want to accomplish in some ridiculous form or application. Instead, I find it much more useful and relevant to build in the change logging where we spend most of our time, the command line.

I’ve added an alias for “exit” in the shell like so:

alias exit="exec /scripts/ch_log"

Here is the ch_log script:

#!/bin/sh
# ch_log - Prompt the user to log system changes on
# exit from the root shell.
#
# jonbuys@os-zen.com - Wed Apr  2 15:32:43 CDT 2008
#
############################################################ 

HOST=`hostname`
DATE=`date +%m-%d-%y`
echo $DATE
echo "Did you make any changes to the system? (y/n)"
read answer

if [ $answer == n ] ; then
   echo "OK, Thanks!"
   exit 0
else
   echo "Cool, please enter your name, and then describe the changes in the form."
   echo "Name:"
   read NAME

    cat /scripts/log_template | sed s/NNN/$NAME/g | sed s/DDD/$DATE/g | sed s/SSS/$HOST/g >  /tmp/$$.answer
    vi /tmp/$$.answer
    mail change_log@mail.mydomain.com -s "Change Notification for $HOST"< /tmp/$$.answer
    echo "OK, thanks!"
fi
exit 0

############################################################
# EOF: ch_log

Basically, when we exit our shell we now have to make a choice… do we log what we did with this quick and easy script, or do we ignore it and risk the consequences. I’ve found that for the most part, I choose to log my work. The email that is sent off to the change_log@mail.mydomain.com address is picked up by a second Wordpress install, and posted to the blog. Now we have a historical record of what we’ve done incase something breaks, or (more importantly) when annual review time comes around and we are asked “what have you been up to?”

There is one other change that I had to make to get this to work right. By default, Wordpress holds all posts it recieves via email for approval before posting it to the main page. This is good security, but not really needed on an internal LAN, and it breaks the system I’ve laid out above. So, to fix it, I’ve made a slight change to the wp-mail.php file:

     // Set $post_status based on $author_found and on author's publish_posts capability
     if ($author_found) {
             $user = new WP_User($post_author);
             if ($user->has_cap('publish_posts'))
                     $post_status = 'publish';
             else
                     $post_status = 'publish';
     } else {
             // Author not found in DB, set status to pending.  Author already set to admin.
             $post_status = 'publish';
     }

Above, I’ve changed the “pending” post_status to “publish” for unidentified users, which is everything that it receives via email. This is a very bad idea to do outside of the LAN, but I don’t see any harm in it internally. Undoubtedly there are those who would disagree, but this works well for us.

This is how we are using Wordpress internally on our corporate LAN right now, I’d be interested to hear how some others are using Wordpress or other blogging software.