"A man's gotta know his limitations." - a famous Clint Eastwood character

Radio ads are now being heard in my area touting something called "Xfinity Home Security" from Comcast cable. The idea is that it would be really great to be able to control a home security system from your smart phone. I'm afraid this indicates that online convenience will soon prove more popular than security, even within the security products market - truly a new irony. If Comcast saw a potential market for such a thing, consider the possibilities...

Assume that the application security issues are solved (the code is secure). That leaves out any problems with the remote interface and the installed app at home. Let's also assume that the Internet Service Provider's servers are properly maintained and in secure configuration. And since this is an extension of ADT home security, we'll assume that there are no problems on their end (any and all physical and software interfaces). What does that leave? Well, at home, it leaves the thing that the (secure in this example) stuff is installed TO, namely the home computer. This is a computer not maintained by Comcast or by ADT or by the ISP (although their systems are possibly impeachable in other examples). This computer's Administrator Of Record is Joe Sixpack, probably with a few wife/kid computers on a $79 router. The last such computer that I looked at for somebody was as secure as a screen door on a submarine.

[Observe: To get into secure app XYZ on user's computer, obtain access to the base Operating System. Since this machine is running a series of security devices, assume 24/7 online stance. This gives you lots of time to run a... "password recovery program". Or to look for cached login info from OS to app. Bingo. You get into the secure app from the OS that the home user failed to configure correctly or patch regularly. This resembles the MANY examples of an outfit getting invaded through a telecommuter workstation left up and online.]

{Another aside: If you replaced the user machine in the above scheme with an appliance, that would eliminate my main objection. Not that appliances haven't had updating and hardening problems, though...}

The larger point? We from the Unix/open source side would not immediately have these problems since all the linking apps aren't available for Linux, Solaris or such. But the problem that remote access for home security poses is that it's not the systems that pose the biggest chance for failure. It's the judgment of the user. It's what the user has authorized to run locally. It's whether or not one should have remote access to things like history logs that record when a door was opened/closed over the last 60 days. Or streaming video in the garage or kitchen. Linux or OpenWhatever can solve lots of problems when replacing systems less secure, but it can't make the user smarter. This is our Limitation as open source advocates: open source can't fix everything. Not only must we evangelize about some system choice where possible; we must warn against giving out one's email address too much, or clicking on a strange web link, or opening that attachment. Those are problems in any system configuration, use or policy stance.

User Experience Report: OpenSUSE LINUX 11.3

Briefly, here's how I've spent some of the last two days: on a 2004-vintage 2.7ghz Celeron (HP) with 3/4 gig of ram, I've kicked the tires on openSuse.org's latest offering and there's good news and bad.

On the bad side, around a half dozen reboots were required for all the hardware detection to appear to have completed satisfactorily. Also, in spite of the networking section getting out to the internet after a boot or two, the app that looks for updates still hasn't seemed to have found any. I'll try the many command-line options soon out of impatience.

On the good side, the interface is slick and many included apps perform acceptably well. Audio CD played back with no reconfiguration, startup chimes and confirm tones were present and consistent, reboot time sped up after a few instances (it might be saving last-known-good-state info in many places), and OpenOffice was pretty quick and stable even during first use setup.

Too early to tell, really, but at the moment it looks like I'd rate 11.3 as similar to other recent offerings from the Novell/SUSE camp: a worthy contender but needs polish. I've not had quite this many bumps even from recent Fedoras, let alone Linux Mint or other Ubuntu variants. Another thing: I'm covering the simple desktop stuff for a reason. If one wants to impress the Windows people who are coming over out of curiosity, the simple stuff has to work. I realize that I could use rpm or yum command lines and that it might be better to do so. But if an Updater Applet is right there in the tray waiting to be used, it should work. And in 11.2, it DID.

Next project will probably be to get the newer laptop thrown together and install BackTrack 4 to the HD and frolic through that famous and extensive tool collection. Oh, and the Celeron 2.7? Back to CentOS!

This Is What I'm Talking About

Here's a quote from Chapter 5 of the Eric Raymond book (The Art Of Unix Programming) that I'm reading without actually being a programmer:

"In the following discussion, when we refer to “traditional Unix tools” we are intending the combination of grep(1), sed(1), awk(1), tr(1), and cut(1) for doing text searches and transformations. Perl and other scripting languages tend to have good native support for parsing the line-oriented formats that these tools encourage."

This is from the 'Data File Metaformats' heading in the chapter entitled "Textuality", touting the value of things being done as widely-understood text streams as opposed to the use of relatively more cryptic closed methods.

Simply referring to such a concept of "traditional Unix tools" helps reinforce what newcomers to Unix methodology are seeking to learn. This would also hold up in greater relief the point of contact between the Windows command line and Unix, as tools have been ported from one world to the other, and can be available for use in both.

Some Resource Links For Yez

Dell Vostro V13 laptop (Ubuntu option available):
Click!

System76 desktop, laptop and server models w/Ubuntu:
Click!

Are you a business and want SUSE with support included (BYO hardware)?
Click!

Note: I hold no stock or other financial interest in any of these concerns BUT I WISH I DID.

Kinda Linux But More Of An Open Source Posting (as usual lately)

...But linux IS involved! My past as a users' group president in Linux Land is not at all being denied here; I just digress lots. See what you think:

Our pals at LINUX JOURNAL put out this word about the OpenSolaris issue not long ago. It's not an alarmist article; it raises legit questions about whether Oracle values Unix dreadnought Sun's legacy or not. Well, aside from the decision whether or not to continue making certain code chunks widely available through OpenSolaris, Oracle seems to be trumpeting the virtues of the main event clearly enough.

Now there's this. The Illumos initiative may save the day.

My take on all this is that within the OpenSolaris orbit, projects like Nexenta were valuable to Solaris for general Unix PR, as well as for its own products. Nexenta in particular could get Linux people interested in toying with things like ZFS if only due to the Debian tools included, not the least of which is apt-get (and it works!! at least on SOME of my loads). This appeals to my if-it's-Unix-it's-cool ethic. The problem with continuation of the OpenSolaris project would be that Oracle might not be so forthcoming with the big section of proprietary code that's in OpenSolaris and that Oracle now owns. Illumos would solve that quandary if successful. I usually worry about distro forks, but this might be a good one - if one can even call it a fork.

ON A RARE PERSONAL NOTE: Some of you know that I work for an outfit that has a "boonies" location and a "Central" location and that I've been in the boonies for awhile. I AM NOW at Central! Thank you for your discretion.

I GIVE UP (not)

I've been, in piecemeal fashion, giving a review of Eric Raymond's book "The Art Of Unix Programming" and I must confess that it's tough going for someone who codes as little as I do. I at this point only know some basic shell and basic HTML, and to get the most out of Raymond's work, one must code in something more heavyweight such as one of the C's or Perl or even OO things. Raymond, now, will be critical of object-orientation in places but even that would help since most points the book makes are universal (among programmers).

Here's the two places I've been using to read the book online:

faqs.org
catb.org

See? See? I can at least code that.

As Raymond says in one of the intro sections, the book can benefit people that can at least understand that the Unix tradition might have something to teach them. It's not much help if you want to know about kernel application programming interfaces or C programming specifics. Even if you skim the hard parts and only absorb the culture, it can help one understand the Unix/open source ethos, and would be particularly helpful if you're coming from the object-oriented world to a Unix-based project.

I'll keep reading it but for purposes of this blog will move on to other topics - no doubt returning to this one from time to time, if only to rip off another Ken Thompson quote from Raymond.

Two Reviews (short)

In the middle of the other stuff I've promised here, lemme get two things off my chest: my experiences with the Mike Meyers "Passport" series study guide to the CompTIA Security+ certification exam, and a late experience with Fedora 12.

The Meyers series Security+ guide that I picked up used for about 3$ was worth a little more than that, considering that it came with a CD that had two practice exams (Windows-only reader, though). But although it knocked out the cobwebs regarding a few familiarity issues with me, my impression was that the questions (and perhaps the direction of the exam itself, which I've not yet taken) were so obvious that (on a test based solely on the book) one could get 75% without reading the book at all. I've switched to the Greg White book from McGraw-Hill for the current test (201); I'll give an impression of that one when possible.

The other issue I need to note: when downloading Fedora 13, I realized that I'd been doing it on a box with no burner. So I USB2'd an outboard Iomega and chose Brasero and then... stopped in my tracks about 5 minutes later. What's the matter with this picture? No reboot. No requests to install stuff. No error messages. Brasero didn't balk. NOTHING WENT WRONG. I burned the F13 install DVD while doing two other things and not paying attention. PLUS I used the full-install version of the DVD (not the live DVD or CD) to upgrade without disk wipe and there were no problems there, either. Not like a few years back when I trashed at least two installs that way.

People, Fedora is starting to work like a Mac. I'm sure many of you already experienced this or simply wonder what I'm behind about, but my job forces me to use... other stuff from You-Know-Who. So I've never had a lot of time to do testing. Way back when, many OS maintainers on the Linux side were criticized for having an attitude toward users that slammed those who wanted things to work and set up easier. Well, they seem to be getting the point at the Fedora Project, or were never in need of the point in the first place. My compliments to all concerned.

Back to the Eric Raymond book as soon as I get time.