APT vulnerability discovered – upgrade packages!

As posted on the Debian Security Mailing list, a security vulnerability has been discovered in the APT package manager. In the announcement, you can read that

[it] does not properly handle errors when validating signatures on InRelease files. An attacker able to man-in-the-middle HTTP requests to an apt repository that uses InRelease files (clearsigned Release files), can take advantage of this flaw to circumvent the signature of the InRelease file, leading to arbitrary code execution.

The security vulnerability is said to be patched in version 1.0.9.8.4 in Debian Stable (jessie) and version 1.4~beta2 in Debian Unstable (sid).

Arch Linux and user friendliness

Arch and user friendliness… For those of you that are familiar with Linux, let that statement sink in for a moment. When I started to use Linux, I had heard of it and some distributions that were available. A friend of mine, my co-blogger Zevoryx, told me of Linux, more specifically about Ubuntu. At the time, around year 2008, I did not find Ubuntu as visually appealing as an operating system as it is today. Therefore, I chose to try out Fedora.

At the time, Fedora was quite user-friendly, even though there were some minor issues that I had with it. Back then, I used to listen to music and watch videos that was posted on Youtube. As Youtube used Adobe Flash (and still may use to a minor extent), it did not go so well. For those of you that don’t know of Fedora, it only uses free/open source software in all areas, excluding the firmware. That means that certain programs, such as Flash is not installed by default, neither can you download it from Fedora’s sources. Instead, you had to add Rpmfusion as a source from where you could download packages. Thereafter, you could install Flash. After this, everything worked like a charm.

Over the years, I have tried out some Linux distros. To name a few of them Debian, Linux Mint and Trisquel can be mentioned. At some point, I also tried out Arch. At that time, it was not as user friendly as I would say it is today. The operating system did come as a “bare metal” OS at the time, without any user-friendly documentation as I can remember.

Last year, about three or four months ago, I chose to try out Arch again. The operating system still comes as a “bare metal” OS, but now there are many guides to follow. For example, the Beginners’ guide is a nice guide to have. Even though I like to see myself as an intermediate user of Linux, making partitions of the HDD in a CLI is something that gives me the creeps. At least when I know that I can’t revert what I have done. Therefore, I find it nice to have the guide available.

I can say that I still use the Arch installation that I made back then. Yes, it took a bit of work to install and configure all packages to work as I want it to work. Arch is a good OS when you would like to mitigate bloatware in your OS (i.e. programs that you wouldn’t use). And yes, if you have the time to sit for a moment to learn Arch, I would say that it is quite user-friendly, much thanks to the beginners’ guide that is available.

Using & Choosing Linux

Linux (or GNU/Linux depending on whom you ask) is a free, open source operating system. It is divided into many distributions which have their advantages and disadvantages compared to each-other. But the distributions have one thing in common, and that is that they put you in control. Depending on which distribution, you can choose exactly which packages (the programs are called so) you would like to install to your system, when you would like to update it (unlike in Windows where you must update at boot/shutdown) and so on. Did I mention that you do not need to reboot the Linux system very often?

You can run a Linux system for a long time without the need of rebooting it. This is because you do not need to reboot the system except for eventual kernel updates. Those do not happen so often, but if it bothers you there has been a kernel add-on which eliminates the need for a system reboot. The add-on is called Ksplice, and the last stable release to the public was about roughly two years ago. The source code for that can be seen on this github page. Nowadays, Oracle, that acquired Ksplice in June, 2011, offers a proprietary counterpart based on that code to enterprise users that pay.

Which Linux Distribution Should I Use?

It depends on what you are seeking of. If you would like a Linux distribution which feels like Windows, Zorin OS would be a safe go. Their gallery should show the look of that distribution.

Another user-friendly distribution is Linux Mint. I am talking about the default edition, based on Ubuntu. There are some desktop environments to choose from, such as KDE, Cinnamon and MATE. Which one to choose depends on which one seems to suit you.

Intermediate users probably would like Debian, which is a stable distribution. If you know the command line, then Debian would be very easy to use. Actually, the more command line you know in Linux, the more you can configure your system. And thus you will also have more control over it.

Advanced “hard-core” users probably would like Arch Linux. Their goal is to have a simple, bloat-free operating system. If you know exactly which packages you need (i.e. dependencies) then Arch Linux would be for you.

Advanced “über-hard-core” users probably would like to build their own Linux system. Then LFS (Linux From Scratch) probably is a good challenge. The aim is to build your own Linux system from source. There is a handbook of how to do that in their homepage.

Open source business programs

Introduction

In the market today, there are a variety of programs that can be used. Programs that are presented in this post are thought of as alternatives to proprietary equivalents. Even though there may be plugins that are proprietary, the base of these programs are open source. This is not a “use this software to replace that software” guide, but rather a post that suggest some software that can be used instead of their proprietary counterparts. When I get more time in the future, I may make a guide about configuring some of the software that I mention in the post.

Starting to use open source

It probably never is good to dive in to new experiences. With that I mean that it is not good to try out a GNU/Linux distribution before trying out some software first. After all, it is kind of a style change. In some cases the open source software works differently than proprietary that you may be used to. That is why it is better to try out some open source applications instead of installing a complete GNU/Linux operating system to use as a primary system.

Web browser

Probably one of the easiest application changes is to switch browsers. While there are many browsers to choose from, a well known is Firefox.

Email client

Mozilla Thunderbird is an email client, that can be used instead of Microsoft Outlook.

Email and groupware server

Citadel groupware server is an open source email and collaboration solution. It offers traditional terminal-BBS-layout as well as browser based.

Office software

Previously OpenOffice.org has been more or less the only “big” MS Office alternative. However, when Oracle acquired Sun Microsystems, many developers were afraid that the project would be shut down. Therefore, many old OpenOffice.org developers started the The Document Foundation and made a fork called LibreOffice with code from the LGPLed OpenOffice source code. In my opinion, LibreOffice feels much more fresh and more modern compared to OpenOffice.

So, what is included? Installing a full installation of LibreOffice you would get you a equivalent of MS Word, Excel and PowerPoint, a math formula program, database and a drawing program.

Server operating systems

There are two server operating systems which I recommend. Both are based on GNU/Linux but functions differently. (Probably I should write more about how to setup a server using one or the other distribution in the near future?)

CentOS is an operating system that is based on RHEL and is aimed to be binary compatible with that OS. The main difference is that the branding is taken away. And that users get support trough the CentOS documentation or forums.

Debian is an operating system that started its days back in 1993. It is one of the oldest GNU/Linux distributions, and is lead by developers that develop it in their spare time.

City using open source

If you have read news about Munich, you probably have heard about their switch from Microsoft Windows to a free GNU/Linux distribution called LiMux. They completed that task last year, and the project has been ongoing for about ten years. Before, Munich used Windows NT technology and around year 2002 they felt being too tied to the Windows ecosystem. When Microsoft heard about Munich’s decision to “ditch” the Windows ecosystem, Steve Ballmer rushed there. Unfortunately for Microsoft, the proposition was rejected and in July 2004 the switch started to take place. About one year ago, the estimated savings was about 11 000 000 €, which would in today’s value (at the time of writing this post) be close to 15 000 000 USD.

There have been other cities that have tried to change their infrastructure from being locked to more open environments. However, they were not as successful as Munich. There can be many reasons why, e.g. badly planned upgrades or too much combustibility (making an own distribution is not a simple task). More about that here and here.

Conclusion

What you need is up to your organization. Small steps is better to take instead of switching the whole environment over night. If you consider to change environment, you may look at how Munich has done. But my suggestion would not to make an own distribution, but rather use an existing distribution that fits your needs. If that is not found in the countless GNU/Linux distributions, then probably an own distribution would be a good idea.

A little history of free software, GNU/Linux and FSF

In my previous posts, I have written a lot about free software, open source software and about FSF. In this post I will try to write why the GNU project and the Free Software Foundation exists.

Richard Stallman, the founder of the GNU project, was once a student at MIT’s Artificial Intelligence Lab. There he was in a group of hackers where they used “free software” (the term was not invented at the time). He was there trough the 70’s and early 80’s. The first contact with proprietary software was an incident with a printer at MIT. The printer had been a gift from Xerox, and papers occasionally got jammed. The printer was in a room of its own, and it could take hours before someone checked out the printer. But Richard wrote a program that would inform if the printer got jammed for those logged in waiting for printing jobs.

In the end the hacker group wanted to fix the printer, and Stallman went to Carnegie Mellon University, after he had heard that someone there had the source code¹. He asked the person that had the source code, and he answered “I promise not to give you a copy”. This was, accordingly to Richard Stallman, his first contact with proprietary software. This is one of the incidents that made Stallman later start the GNU project².

Later, in the early 80’s, the hacker group was split and all modern operating systems that was available was proprietary software. The easy way would have been to accept the terms of the proprietary system licenses, but Stallman chose not to. He started working on a completely free Unix-like operating system that is called “GNU”. It stands for “GNU’s Not Unix”, and is accordingly to Stallman a hack (because of its name).

In the early 90’s, the GNU system was almost complete but lacked one key programme; the kernel. At this time, Linus Torvalds had written a kernel of his own, called Linux. He had previously used Minix (another Unix-like operating system), but did not like the licensing at the time which only restricted the use only to educational use. So he wrote a kernel of his own³.

As the GNU system was almost complete, lacking the kernel, developers started to put together GNU tools with the Linux kernel and GNU/Linux was born. One of the first operating systems using GNU/Linux, that still is in active development is Debian GNU/Linux. It is, in my opinion, a good and stable GNU/Linux operating system that is more towards the intermediate computer users (the installation could be a bit tricky). However, Ubuntu, that is a derivate of Debian, is in my opinion for both beginners and intermediate GNU/Linux users as this is easy to use and does not require that much knowledge in GNU/Linux.

¹ http://www.youtube.com/watch?v=E6LsfnBmdnk (He starts talking about the printer at 5:00, and continues in the second link)
http://www.youtube.com/watch?v=YA4vnDaeGO4&feature=relmfu Retrieved at 2012/06/26 14:00 CET.

² http://www.gnu.org/gnu/thegnuproject.html Retrieved at 2012/06/26 14:00 CET

³ http://www.cs.cmu.edu/~awb/linux.history.html
http://en.wikipedia.org/wiki/Linux Retrieved at 2012/06/26 14:00 CET