Politics. Mudslinging. Chocolate.

Whether Murray is right or not, I think his recent rant is rather tasteless and I agree some kind of retraction/apology is needed.

FWIW, Murray’s post certainly don’t reflect what I’ve experienced when I started participating in the GNOME project 2003-2004ish. That said, I acknowledge it may reflect what others have experienced. I don’t know. Also, I tend to stay out of politics… at least politics on that level. That said, I do appreciate others doing all this work; for a project of GNOME’s size we do need people in the foundation and some board, we need people spreading the word around GNOME, we do need to participate in standard organizations etc.

Either way, this kind of mudslinging is very unproductive for the project and everyone involved should know better. An old friend of mine once said “Can’t we just focus on the chocolate?”. This was in reaction to stupid in-company fighting and also a pun on a tv commercial from some chocolate company. The commercial involved three chocolate makers. They were making chocolate. Or rather, two of them were ranting about all sorts of non-sense and as a result they didn’t make much chocolate. At some point the third guy just had enough and he started whining. Much like me in this post.

Guys, can we please focus on the chocolate instead of all this non-sense?

Frustrated…

On Xguest, Access Control and Desktop

Dan, I think the ideas behind Xguest are nice. But your ideas about using SELinux to implement access control for users leaves much to be desired. If you think that a brutal approach of denying individual users to even access services like HAL, NetworkManager and Bluez is good, then please think again. Please realize that if you do this, the desktop experience will suddenly change. Things like networking and bluetooth applets will cease to work. The file manager will fall back to relying on /etc/mtab and /etc/fstab. I’m not sure PulseAudio will start.

The problem is that your approach is not fine grained; it’s all or nothing. And this is not really useful. For example, for NetworkManager what you want is to lock down the machine so the user can only connect to trusted networks. With e.g. trusted networks being defined as something that is defined in a file in /etc that only uid 0 can change.

I’m not sure if it’s a surprise to you, but over the past year or so I’ve been working on and off on an application-level access control mechanism (similar to various RBAC implementations but with a few innovations on top) called PolicyKit that does all this. It’s specifically designed and optimized for desktop applications but can also be useful for legacy UNIX command line apps. It puts the administrator and users back in control since it provides a way for them to gain authorizations by authenticating and also supports systems like Ubuntu that has no root password. It provides a nice user interface for human beings to manage authorizations. There’s GTK+ widgets to make it really simple to integrate into existing applications (and KDE support is underway). The list of applications that are PolicyKit enabled is growing rapidly. It’s in all the major distributions. It encourages least privilege, e.g splitting a program into privileged and non-privileged bits.

It’s not that I hate SELinux because I don’t. I think SELinux is already very useful, just look at how useful SELinux is in confining network-facing and privileged services. I also have SELinux support in PolicyKit already and I plan (with your help) to make gnome-user-share run in a dedicated SELinux context so it is authorized to punch holes in the firewall without any configuration whatsoever (today it’s totally broken since g-u-s picks a random high port number to listen on). But, Dan, frankly, I think your use of SELinux to lock down access on the desktop is misguided. It’s a bit like if all you have is a hammer, then everything looks like a nail. I feel that it’s a bit sad that that two developers, working for the same company, in the same office are trying to solve the same problems. We really ought to do better.

(Disclaimer: this post does not necessarily represent the views of my employer, Red Hat, Inc.)

Update: A few people pointed out that I sounded too confrontational in this post and maybe they’re right. As I tried (and probably failed at) to explain it’s not either/or. Surely, there’s a ton of value in using SELinux to lock down privileged mechanisms like HAL, NM, Bluez and so on. Having PolicyKit and SELinux work well together is in everyone’s best interest.

Native languages and poisonous people

I think, over the past 3.5 years I’ve been working on free software, I have sent more than 5,000 mails, all in English, to various mailing lists, most of them with more than a few hundred subscribers. It’s always a bit weird (even after living in Massachusetts for more than 2.5 years) to use your second language and I believe it will stay that way the rest of my life. Which is fine and all.

Sketchy Dane

In general, I’ve found that native English speakers are very nice to non-native English speakers. In stark contrast, for example, are natives of my own country Denmark; whenever a foreigner attempts to speak Danish everything becomes a bit weird. One common thing is that the native Danes try to switch to conversation to English because it makes them less uncomfortable. I guess there are many reasons for this difference of behavior; first, Danish is a small, insignificant (and dying) language, most people speak English anyway and not a lot of native English speakers have a second language at all. But it’s also a cultural thing. In particular, I find that it’s very easy to live among the Americans; they’re friendly (actually, I jokingly tend to say “it’s like living with the smurfs”; many, not all though, people here are just more optimistic about the future than in Denmark and the EU.). The fact that English is a second language have never been an issue for me at all.

Sketchy German

Until today. I guess there’s a first time for everything, the topic of my native language came up on the Fedora live cd mailing list just recently. Response here. Time to watch How Open Source Projects Survive Poisonous People (And You Can Too) again I suppose.

The whole thing just makes me a little sad inside.

Gah!

Just received this in the mail today from Europcar Australia:

As the registered owner of the vehicle stated below we have received a Speeding Infringement Notice and, upon searching our records, we can confirm that the infringement was incurred during your rental period.

Guess I should have looked out for speed cameras.

Random photo plug: Darling Harbour in January

I’m slowly losing my patience with the gods regarding distribution of luck and fortune.

Software Freedom and Dealing with Resume Failures

• Go read davej’s thoughts on Why Fedora isn’t Ubuntu. Required reading for people who believe in free software and thinks shipping insecure drivers is a bad idea. Choice quote: Maybe we can get a spaceman with lots of money to pay for the subsequent legal costs too.
  


• Someone here at Red Hat was unhappy about a review of early RHEL5 code where Suspend to RAM didn’t work for the reviewer. Though I’m of the firm opinion that the root problem should just be fixed, reality is that it won’t get fixed anytime soon. So I ended up hacking up something so if suspend/hibernate fails… the user is presented with this on his next login:
  

  
  
  Problem resuming, buddy!
  

  
  


• This (somewhat useless) dialog is just the beginning; the long term upstream plan is to hook this up to Bug Buddy. Determining when to show this dialog is actually really difficult because the most common problem is that the system resumes just fine but the video isn’t turned on. And there is no chance of detecting such a failure programmatically, hence we need to be smart about it; find patches and more information here. I expect this to land in Rawhide pretty soon.
  


• Am still in RHEL5 bug fixing mode; at least there’s light at the end of the tunnel so I can return to doing upstream work.
  

Random Stuff and Random Flames

Looking at myself or looking at you?

• Just booked tickets for LCA 2007 in Sydney, Australia in January 2007. Am also taking some vacation to bum around .au the week following the conference. Am also planning to submit a proposal for the GNOME miniconf.
  


• Sad to see yet another defector. Here’s a very insightful comment from davej about some of the damage done to the free software community.
  


• Less-than-insightful rant about “crappy HAL” that frankly pisses me off.
  


• Spent around 3-4 days optimizing HAL for CPU and memory consumption, here are the difference it makes on the 770, courtesy of Rob Taylor
  


• Am almost done with a huge freakin patch for activation on the system message bus. Will need to write down how this relates to some of the init replacement projects out there; here are some thoughts about that for now, but it really deserves a full blog entry.
  


• With the D-Bus bits (system bus activation) in place, I can move forward and do some PolicyKit stuff that requires the D-Bus bits in order to be useful.
  


• Trying to spend lots of time on work-stuff since personal life is a bit busted at the moment.
  

System Configuration

So once again the topic of system configuration and Elektra (aka LinuxRegistry) has come up on fedora-devel-list and since I know most people even on the list don’t keep up because of the sheer volume, I’m going to use my blog to link to my response.

Denmark vs. Japan at WCC 2006 - EOS 20D and 70-200mm f/2.8 lens @ ISO 400

It shouldn’t be a surprise to people knowing me that I consider myself a UNIX hater. In fact, this whole thread on f-d-l made me realize that the with regards to system configuration you really only want two things: session-wide and site-wide configuration. Maybe it’s time to open a CafePress store and pimp shirts and stickers with the mottos a’la # rm -rf /etc. Seriously.

Received my MacBook Pro last week and I’m psyched. Now to get Fedora installed .

System-wide Lockdown and Usability

I wrote some time ago about how most modern Linux distributions deals with with granting unprivileged users additional privileges when they are logged in at the console. Stuff like allowing them to access removable disks, power down the system and so forth - Project Utopia stuff, that whole story.

While this is great for the home user, stuff Just Works, it’s not always ideal in more controlled environments such as call centers, university settings, Internet Cafes or print kiosks. Also, working for a distributor I’m also sometimes personally on the receiving end of rude people who wants this too. I don’t disagree much really. Yes, it makes sense to easily lock down what the operating system allows a user in front of it to do. Even to the point where it is totally unusable. Notably this is required for EAL style certifications of systems. Yes, Sarbanes-Oxley requires it too, and yes, some companies (search for the word ‘epoxy’ in that link) disable the USB ports of their employees computers.

Copenhagen, Denmark - December 2005

I wrote some notes about how to fix this in what I consider a sane way. Sane here includes allowing a system administrator or home user to override this in a way that just works, e.g. pop up a dialog asking for auth to gain privileges to carry out the operation. Mocking around with configuration files in /etc does not qualify - do not pass start, do not collect $200 - put up a GUI dialog instead; it’s 2006 for crying out loud

Anyho, so I did this policy library and started to integrate it with gnome-mount. Sure, this example is kinda lame and the UI is still totally wrong. But it illustrates the point well. The sysadmin didn’t allow the user to override file system permissions on an advanced file system and we give the user the ability to correct it - there are lots of more interesting use-cases than this. And we need do need lockdown, otherwise all the Michal Jaegermann and Alan Cox’s of the world won’t let us put it in a general purpose operating system. Which is fair enough. Oh, before someone cries the root password is evil; whether we ask for the super user password, users own password or something different for auth should just be up to the OS vendor. It’s a boring implementation detail. It’s also fine by me to have a gconf key to hide these dialogs; that might be sometime a sysadmin in an enterprise setting would do. I think Clark even suggested once to put a button “Send request to sysadmin to enable feature” too. Whatever

Paris, France - January 2006

Whilst implementing this I researched various graphical su helpers including consolehelper / usermode that we ship in Fedora. They all suffer from the same set of problems most notably that they allow to run X applications as root. So, I guess for HAL I’ll be rolling my own just like everyone else . Read on please.

No, seriously, I strongly believe the idea of even allowing X applications to run as root is a dead end from day one. With the su helper I plan for PolicyKit (which is a project I’ve spun off HAL containing said policy bits), your application will at most be elevated to an unprivileged “system user”. The trick here is that HAL allows this unprivileged user to invoke D-BUS methods normal unprivileged console users wouldn’t be allowed to invoke. To get to this “system user”, the desktop user will have to auth (root password, own password, whatever) and will thus be presented with a dialog even (optionally) offering the one-time-pain option by granting this privilege to the desktop and/or other users forever (or until the sysadmin changes it).

Boston, MA - December 2005

The reason I’m spinning it off HAL is that it makes sense for the rest of the desktop bits (not only GNOME) to adopt the same architectural pattern; for example gnome-system-monitor could use this to renice processes.. g-s-m will simply provide a service on the system bus that runs as root and exports a method called Renice(). A PolicyKit policy file provides a list of uid and gid for who is allowed for this. Now, g-s-m will try to invoke Renice() but might get the PermissionDeniedByPolicy exception back. If this is the case, simply bring up said dialog, enter password, optionally grant this privilege to one or more users and, bingo, you’re done.

I plan to provide a PolicyKit-gnome library for these dialogs, e.g. password prompting and policy editing. Mostly because this is what I need for the HAL (and Fedora I guess), but I think it makes sense for GNOME too to consider this architectural pattern.

Yea yea, long boring blog post about admin stuff and it’s not even about cool bling stuff!. I hope at least that the admins love me

Sod it

So, this morning, I come down to the parking deck of my building to see this

Sunroof?

there were another convertible in the same shape and all the cars on the rear deck had their windows broken. Since I watched Mystic River (which is shot in my neck of the woods, e.g. Somerville) the other day, my first thought was to contract the Savage Brothers to make things right with the pricks who did this. Now I’m a bit more calm, so I think I’ll resort to calling the police and my insurance company. America, Fuck Yeah.

Hacking; Power outage

Life

I’ve been told that I had a fun time at IBC

Hacking

I’ve made good progress on the HAL project, lots of discussion and feedback on both xdg-list and linux-hotplug. It’s my first involvement in open source development and the ideas of extensive peer-review and general openness seem very good.

Reading

I’ve started reading Beyond Software Architecture : Creating and Sustaining Winning Solutions and it’s very good. Right up my alley with the role I have right now at work.

Robocurl

Finally some progress; we tested the kit sunday at the curling rink and it seems to work wrt. framerate updates etc. More on that later..

Power outage

Today, at approx 1240 local time all power disappeared in Copenhagen and parts of Sweden and Denmark. Four million people was without power for three to four hours. CNN is carrying the store here and the BBC coverage is here.

We all left work at about 1330 local time. On my way home people looked disoriented and there were signs of traffic congestion.. Power was restored at 1645 local time in my apartment and fortutantly my server came up again.. I did had to tweak around with my OpenVPN scripts and manually start the MySQL database, but that was really my own bad.

I’m quite amazed that something like this can happen in a country like Denmark where we pay more than 50% in taxes. I don’t mind doing that (that much), but then I want some freakin service and not this…

There are no reports on any fatalities (yet), which is good. On the bright side, I managed to do the dishes while the power was out

So MS wants to update software on my linux machine?

Heh, was just rebooting my laptop (Red Hat Linux 9 sometimes hangs when removing the power) and when logging into gnome, gaim gave me this (message text is in danish)

I wonder how some sysadmin guy at MS reacts when he sees it.. On the topic of laptops, I think I’m going buy an apple 12″ powerbook soon - my current laptop, a 15.4″ dell inspiron 7500, is more than 3.5 years old.. It’s still the computer I use the most though