(IN)Secure Magazine - a free security magazine in PDF format

One thing which any operating system worth its name should take seriously is the concept of security. In this internet age when more and more people are getting access to always-on broadband, security is all the more important.

I read in one article in a mainstream media that credit card fraud is becoming rampant and is on the rise. The fraudsters hack into vulnerable machines and access confidential data. While some operating systems struggle to contain the security threats, many others fare better in this department. Linux is inherently considered to be more secure. But the most secure operating system is by far OpenBSD which has seen only two vulnerabilities in its code in 10 years.

(IN)Secure is a magazine which is dedicated to discussing security related aspects of Operating systems. It is a monthly magazine which is freely made available for download in a PDF format. Mirko Zorz is its Chief Editor. The magazine carries security articles related to all operating systems. In the latest (11th edition) of the magazine, you may read an article on iptables titled - "IPtables : An introduction to a robust firewall". I may add that the article was contributed by me and so if you do read the article and find any faults, you may let me know about it rather than troubling Mirko ;-). You can download the 11th issue of the (IN)Secure magazine here (PDF file).

Difference between Computer Science, Computer Engineering and Software Engineering degrees

There was once a time when a major percentage of people who had anything to do with computers were in more ways than one Electrical Engineers by training. In fact I have seen many popular books on Computer science and electronics which are authored by people who have a background in Electrical engineering.

Then with change in times and fast technological progress, the electronics and computer field evolved and they branched into seperate engineering fields. And now computers have come a long way that this branch of learning has in turn split into sub streams namely Computer Science, Computer Engineering, Software Engineering and so on. Ask a techie what is the difference between these similar streams of study and in most cases you are sure to get a blank stare.

I myself didn't know about the difference between these computing streams until I chanced upon this very informative article authored by Tony. In the article, he explains in what way these are different from each other. For example he notes that Computer Science is inherently mathematical in nature and is about writing code where as Software Engineering is thinking about writing the said code (what ever that means). And Computer Engineering discipline deals with design of specialized type of software, and incorporates more hardware material into studies.

Using netselect-apt - Tip to select the fastest Debian mirror

Each time I install Debian - and I have done it scores of times on multiple machines, I get frustrated in choosing the right Debian mirror for updating the package database on my machine using 'apt-get update', or installing a new package for that matter.

Some of the questions that I had to find a solution for were ... Do I choose the Debian mirror in my country (India) or do I use one of the US servers ? Is there any way to find which of the two are the fastest for my geographic location ?

It might sound ironical, but experience tells me that the truism of choosing a Debian apt mirror closest to ones location does not hold true for me. Because at all times, when I have used a mirror from India, it is dead slow. And believe it or not, the responsiveness of the mirror will do a great deal of difference to how fast you are able to update your Debian machine.

Enter netselect-apt, a package which helps one to find and use the fastest Debian mirror for his region. What this script does in conjunction with 'netselect' command is, it first downloads a list of all the Debian apt mirrors from the official Debian website using wget. The list is saved in a file named 'mirrors_full' in your current directory. It then checks the responsiveness of each of the servers in the list and then selects the fastest among them. Finally it writes the necessary code in the sources.list file and saves it in your current directory. Considering that on last count there are a total of 248 Debian mirrors to choose from, that is a pretty tedious job.

In order to use netselect-apt, the first thing you have to do in your newly installed Debian machine is download and install the netselect-apt package. This can be done as follows :

# apt-get install netselect-apt

The netselect-apt package depends on the netselect package and so it will also be automatically installed.

You can pass a couple of options while invoking the netselect-apt command. For instance, I have Debian Etch installed on my machine. And if I want to find the fastest Debian Etch repository mirror for my geographic region, I run the netselect-apt command as follows :

# netselect-apt etch

If I want it to include non-free software section as well while creating the sources.list file, then I use the -n option :

# netselect-apt -n etch

You can also ask netselect-apt to select only ftp servers instead of http ones by passing the -f option.

# netselect-apt -n -f etch

Apart from etch, you can pass the following options - stable, testing, unstable, experimental, woody, sarge and sid. If you choose not to pass any options, then by default netselect-apt uses 'stable' as the option.

Once it finishes its work, you will find a newly created sources.list file in your current directory which will have the necessary code pointing to the fastest Debian server for your location. Now all you have to do is to copy the sources.list file to /etc/apt/ directory and do an apt-get update.

# cp ./sources.list /etc/apt/sources.list
# apt-get update

Please note that the speed of the servers change over a period of time and is dependent on a variety of external factors. So the server that netselect-apt chooses today need not be the fastest one for you say, a couple of weeks hence. So if you are in the habit of installing and updating software all the time, it will be prudent to run netselect-apt once every week or so and update your sources.list file to point to the fastest mirror.

Metric equivalent of Microsoft fonts for Linux

Visit any random website and chances are the website expects your machine to have a set of fonts which have become the de-facto standard on the Internet. The fonts being Arial, Times New Roman, Courier New and so on. While it may not be illegal to install these fonts on a Linux machine, they are propritery and are owned by Microsoft. And Microsoft does not licence third parties to redistribute these fonts - a reason why you don't find these commonly used popular fonts installed in Linux by default.

This is going to change once and for all. Red Hat in association with Ascender Corp has developed a set of fonts which are the metric equivalent of the most popular Microsoft fonts, and they have released it under the GPL+exception license. Three sets of fonts have been released, them being:

1. Sans - a substitute for Arial, Albany, Helvetica, Nimbus Sans L, and Bitstream Vera Sans
2. Serif - a substitute for Times New Roman, Thorndale, Nimbus Roman, and Bitstream Vera Serif and
3. Mono - a substitute for Courier New, Cumberland, Courier, Nimbus Mono L, and Bitstream Vera Sans Mono.
   

The advantage for Linux users is that now you don't have to explicitly install Microsoft fonts anymore as the web sites or documents which use Microsoft fonts will display flawlessly using the metric equivalent fonts which can be included in all Linux distributions by default.

The work on the fonts is yet to be completed and so will be released in two stages. In the first stage, all the fonts are released as fully usable but will lack the full hinting capability provided by True Type/Free Type technology. In the second phase of the release which will happen some time in later half of 2007, the fonts will have full hinting capability and will be at par with or excel the Microsoft fonts in quality. For now Red Hat has made available all the fonts for download so that you can test it on your machine.

Creating good quality fonts - ie. fonts which retain its quality even in smaller sizes is a very tedious and time consuming process. And buying good quality fonts is a very costly affair with each set of fonts costing anything upwards of $100 . By taking the initiative to develop good quality fonts which are the metric equivalent of Microsoft fonts, and releasing them under a Free licence, Red Hat has done a very good deed for the Free Software and Open Source cause.

A new way to look at networking

Van Jacobson is a research fellow at PARC. Prior to that, he was the Chief Scientist and co-founder of Packet Design, Chief Scientist at Cisco and has also headed the Network Research group at Lawrence Berkeley National Laboratory.

Van talks at Google Tech Talks about the concept of a network and how it enables the efficient transfer of data from one remote location to another. In the talk Van laments how the network research in the US has stuck in a dead end for the past decade or so and it should be a wonderful time for networking as every thing is connected to everything else, there are cell phones, computers, laptops, PDAs and so on and each can be connected with each other. But unfortunately as Van puts it every thing we do with networking is getting harder. Wireless barely works and information or data is not at sync with all the diverse devices we use. In his talk he puts forward his idea of how networking can be made simpler.

A very informative talk worth watching by anyone who is interested in knowing how computer networks work. Duration: 1 Hr 21 Min

EnGarde Secure Linux 3.0.14

EnGarde Secure Linux is a Linux distribution developed by Guardian Digital - an open source Internet security company, and is designed with security in mind. Built from grounds-up, this product has been in development since 1999. EnGarde Secure Linux highlights its "Secure by default" tag as the one reason that it should be favored to be used as a Linux server. The developers have considerably reduced its size to include server-only applications and the whole administration of the server from the rebooting to its shutting down as well as configuring and maintaining web servers, database servers and so on can be done remotely from the confines of a web interface.

Guardian Digital has split EnGarde Secure Linux into three branches. Them being

1. The Unstable branch which contain bleeding edge packages and is open only to developers.
2. The community branch which is provided for free and is supported by the open source community. And lastly...
3. The professional branch which is officially supported by Guardian Digital. And which needs to be bought.
   

The main difference between the community branch and the professional branch apart from the fact that one is free and the other is paid version is that Professional branch is much better tested and documented and can avail of the official support of Guardian Digital. Compared to that, the community branch will have to rely on the mailing list for support.

Features of EnGarde Secure Linux are many and are as follows (as quoted from their website) :

• Linux 2.6 kernel for the latest hardware compatibility
• SELinux Mandatory Access Control provides high security by strictly enforcing service separation at the kernel level
• Guardian Digital Secure Network features free access to all system and security updates and allows for quick and easy updating of the entire server
• Broad support for server hardware, including 64-bit AMD architecture and hardware RAID
• Web-based management of all functions, including the ability to build a complete web presence with FTP, DNS, HTTP, SMTP and more
• Secure up-to-date LAMP stack serves virtual websites with Apache v2.0, MySQL 5.0, and PHP 4.4 (PHP 5.0 available as an optional package)
• Latest BIND 9.3 provides secure DNS services
• Completely new WebTool, featuring easier navigation and greater ability to manage the complete system via a secure web browser connection
• RSS feed provides ability to display current news and immediate access to system and security updates
• Integrated firewall with ability to manage individual firewall rules, control port forwarding, and creation of IP blacklists
• Commercial grade Network Intrusion Detection System displays and graphs incoming attacks in real time
• Built-in Host IDS monitors system files for unauthorized changes to ensure system integrity
• Built-in UPS configuration provides ability to manage an entire network of battery-backup devices
• Real-time access to system and service log information
  

Ryan Berens who is an open source advocate at Guardian Digital tells me that EnGarde Secure Linux is a fully functional platform distribution that focuses on integrated security and ease of management. EnGarde Secure Linux has also been released by Guardian Digital as a Live CD so that it can be taken for a test drive without installing on ones machine.

Is brand name Ubuntu over hyped ?

Ubuntu is a Linux distribution which is famed for its ease of use and has built up an image of being a newbie friendly Linux distribution. Ubuntu has arguably the largest community following compared to all other Linux distributions. And it has enhanced its cause many times by following the policy of shipping free CDs of Ubuntu to anyone willing to try this Linux distribution.

Nowadays if you visit any tech blog or site, you seldom fail to notice at least one article espousing the cause of Ubuntu Linux. In fact, even the media pundits have jumped on to the bandwagon and have started tomtoming the virtues of this very popular Linux distribution (see here, here and many other places).

But recently when I reverentially downloaded the latest version of Ubuntu 7.04 (Feisty Fawn), burned it to a CD and booted into it, guess what? it failed to load.

Fig: Error encountered while booting Feisty Fawn LiveCD

The picture of my monitor above gives an idea of what I was faced with while booting Ubuntu 7.04 from the CD. It was showing an error on the lines that the ata2 port on my machine failed to respond. And I was put into an initramfs built-in shell.

The machine I tried to boot Ubuntu is a moderately recent Pentium 4 machine with 631 MB memory - more than twice the recommended minimum memory needed to load Ubuntu. The machine doesn't have any extra features like bluetooth, WiFi or out of the ordinary peripheral devices. And Debian Etch has been running quite flawlessly on this machine.

I am not an Ubuntu critic. Not even by a long short. In fact, if you search this blog, you will find numerous articles related to Ubuntu where I have talked favorably about it. I was really impressed with Ubuntu 6.06 (Dapper Drake) and its 6 step install method.

But a regular reader of this blog will find that I have been unusually quiet about the next release version which is Ubuntu Edgy Eft (6.10). It is not because I hadn't downloaded and installed it. But I did not find anything worth talking about that particular version. In all fairness to Edgy Eft, it at least booted to a complete desktop on my machine. But the latest version of Ubuntu 7.04 - Feasty Fawn, refuses to even boot and gives me the message as seen in the picture above. In all certainty it is a problem related to the Linux kernel bundled with Fiesty Fawn. Then the question arises as to why the Ubuntu team decided to use that particular version of the kernel. Perhaps that is a price you pay when you adopt experimental features without proper testing. I would really like the Ubuntu team to bring out succeeding versions at par with ver 6.06 in terms of quality.

Considering my experience with Ubuntu Fiesty Fawn against the eulogies in the media, I am forced to ask if the brand name Ubuntu is over hyped - most probably the residual effect of an over-zealous community behind it. No Linux distribution is perfect. Each has its pros and cons. I for one would like to see a balanced discussion about the pros and cons of a distribution without delving into unnecessary fanboy-ism.

Update (22 May 2007): It seems this problem is the result of a bug in Ubuntu Fiesty Fawn. Two days back, I received the CD I ordered through shipit. And even this CD refused to boot properly on my machine. A bug report has been filed at launchpad.net which you can read here. And Bheesh has provided a work around to this problem on his site, which I concede I haven't tried out yet as I do not have the patience to go through the whole ruckus just to boot into a Desktop. So as long as Ubuntu team sleeps over this undecided bug, it is sayonara from me to Ubuntu.