Category: IT

There’s a new Gentoo derivative:

“Pentoo” is an acronym for “PENetration on genTOO”. It is based on kernel version 2.6.10, uses the Gnome desktop environment, and aims to provide a complete platform for intrusion detection, penetration-testing and security assessment. The content of the LiveCD can be updated, allowing for
up-to-date fingerprint and vulnerability databases, for tools that require regular updates like the Nessus plugins, or scanner fingerprint files, metasploit etc. Users can optionaly store data on USB sticks for non-volatile storage support. Pentoo’s author, Michael Zanetta, emphasizes that “it
has to be considered beta as I have not much time to test it carefully,” so feedback and comments are very welcome, at bugs@pentoo.ch. A roadmap for the project is available, too.

(Source: Gentoo Weekly Newsletter: April 25th, 2005)

did you know you can configure mod_dav to allow read-only access to your webdav share (apart from the usual read-write access)? all you need is set “Options Indexes”, point your browser to the webdav url and enter your credentials. basically, i have the following mod_dav configuration[1]:

BrowserMatch “^WebDAVFS/1.[012]” redirect-carefully
BrowserMatch “Microsoft Data Access Internet Publishing Provider” redirect-carefully
BrowserMatch “Microsoft-WebDAV-MiniRedir/5.1.2600” redirect-carefully
BrowserMatch “^WebDrive” redirect-carefully
BrowserMatch “^WebDAVFS” redirect-carefully

LoadModule dav_module modules/mod_dav.so
LoadModule dav_fs_module modules/mod_dav_fs.so
DavLockDB /var/lib/dav/lockdb

DavMinTimeout 600
<Directory /path/to/the/dav>
Options Indexes
Dav On
AuthType Basic
AuthName “Please enter your webshare credentials”
AuthUserFile /path/to/the/passwordfile
Require user johndoe
</Directory>

i had to remove <Limit> restrictions as basic auth didn’t work with it for some reason. configuring a share that can be both accessed (read-write) using samba/smb/cifs and webdav is a bit more tricky and depends on which linux distribution you use. in a nutshell, you need to fiddle with directory permissions (especially the “sgid – set group id” bit) and figure out which setting works best (and the most securely) for you.

note that for security reasons, you should only allow encrypted http access (https using tls/ssl) to your share (see the <Redirect> option for example).

[1] in gentoo, edit /etc/apache2/conf/modules.d/45_mod_dav.conf

(thanks to flo for the tip)

nload, a decent network bandwith monitor for the linux console (you can thus use it to quickly monitor the available bandwidth on your remote linux server):

www.roland-riegel.de – nload: monitor network traffic and bandwidth usage

# emerge nload (surprise, surprise ;)

usage (for example):

# nload -i 2000 -o 400

(where 2000 is the [i]ncoming/downstream and 400 the [o]utgoing/upstream bandwith of my server in kbit/s)

(note that it doesn’t brew coffee, though ;)

(kudos to Crypto from #gentoo for the hint)

As Linus Torvalds mentioned it as the most viable BitKeeper replacement, monotone: distributed version control is on my watchlist now (and it should be on yours too, eventually ;).

I’ve been using subversion/svn for a while now (BTW if you use it, choose FSFS for storage type and DAV for connectivity). It’s pretty okay (way better than CVS, at least) as long as you’re working online and the only one accessing the repository ;) For distributed development (such as with the Linux kernel) it’s less suitable though. Particularly merging conflicting revisions kind of “sucks”. Monotone promises to bring improvements in this field (monotone FAQ):

How do you merge versions?

The merging system is based on a pair of 3-way merges: one set-oriented one at the changeset level to resolve differences in tree layout, and one line-oriented one at the file level, to resolve differences in concurrent edits to the same file. If either of these fail, they are passed off to a user-provided hook function, which invokes emacs ediff mode by default (but can be overridden).

It is important to note that a 3-way merge is not the same as simply “applying patches” in one order or another: we locate the least common ancestor of the merged children in our ancestry graph, calculate the edits on the left and right edges, adjust the right edge’s edit coordinates based on the left edge’s edits, and only then do we concatenate the left and right edges (ignoring identical changes, and rejecting conflicting ones).

Why not use more “sophisticated” merge algorithms, as
in Codeville, Darcs, or
Arch?

A few reasons:

• We don’t see how Codeville’s algorithm achieves anything beyond
  what we currently do, though we’ll happily listen to explanations.
• Darcs algorithm is based on patch commuting, which requires a
  fundamentally different representation of versions than ours.
• Arch’s merges are based on applying patches in various orders.
  While better suited to cherry-picking, only one of them (star-merge)
  seems to provide a 3-way merge; the other two are strictly weaker.
• In general, we’re afraid of hitting patents. We don’t know exactly what’s
  patented in this field, but so far the 3-way merge has served well.

If you find a better, free merge operator, please let us know!

Hopefully, there will be more choice regarding monotone’s frontends and IDE integration soon.

BitKeeper would be the VCS of choice for me. Unfortunately, it will be closed source software exclusively soon. Due to BK’s high price tag, a commercial license (or leasing) of BK is not an option at the moment.

BTW. Surprisingly, there’s a whole bunch of other interesting VCS projects (most of which I didn’t know).

UPDATES:
1. monotone is available in Gentoo’s Portage tree, ready to be installed (IOW stable) :)
2. svk looks interesting too (particularly if you use svn already). Gentoo ebuilds for svk are masked currently.

as ingo restarted to publish plain exec-shield patches, i decided to apply his patch again. exec-shield-nx-2.6.11-A8 works nicely with kernel 2.6.11.6. there’s just a minor reject for the makefile:

– EXTRAVERSION =
+ EXTRAVERSION = -exec-shield

either patch the patch or change EXTRAVERSION from “.6” to “.6-exec-shield” manually.

nice document about exec-shield (among others): New Security Enhancements in Red Hat Enterprise Linux v.3, update 3 (PDF). another nice document: Security Enhancements in Red Hat Enterprise Linux (beside SELinux) (PDF). it also features a cool shell script – which is protected by copyright laws (and strict pdf drm settings) unfortunately.

NOTE TO SELF: check for compatibility with vms (jvm, mono). might break a couple of things.

Need to take a look at Migshm – A MAASK group DSM patch for openMosix (Gentoo patches). Might be useful for transparently distributing Mono/Java apps to leverage the computing power of many nodes in a LAN. Note that only Java apps running on JVMs using green threads are distributable with default OpenMosix. Mono apps aren’t distributable at all as the VM only uses native threads so far (I was told; not verified so far).

I should also re-enable distcc in order to better leverage available computing power.

An old “acquaintance”: The Joel Test: 12 Steps to Better Code

Just stumbled on it again. I don’t agree with all of the points[1], but it can’t hurt to check them in everyday life from time to time.

[1] 9 wrongly neglects budget restrictions, 11 wrongly discriminates people with a deep understanding of CS/IT but little practice in language XY, 12 a) not everybody has a bunch of people at hand for usability testing b) people tend to treat things as “well usable” if it feels or looks familiar even if they’re actually accustomed to very bad habits in regard to usability.

Tablet PC Post :: Tablet PC Software Trading Post – Download Utilities, Business Productivity, and Games

ShareKMC is a pair of programs that enable you to control your Tablet PC from your Notebook or Desktop over the local network (LAN). You can also copy and paste text and small images between the two machines.

neat little tool :)

Interview with Hurd developer Marcus Brinkmann | Wikinerds Portal:

Marcus Brinkmann: The Hurd is a multi-server system, running on top of a microkernel. This means that separate features of the kernel, like the network stack, authentication, or the filesystem, are implemented in different user-space processes, and not in the kernel. There are only few real multi-server systems out there, most other microkernel based systems you have heard about actually only run a single server on top of the kernel and thus are very similar to a monolithical kernel like the Unix kernel and its imitations.

The Hurd design goes one step further ahead of other multi-server systems and puts an emphasis on the user’s freedom to extend and enhance the operating system with new features. There is no mutual trust required for the individual components to cooperate. So, for example, the user can start their own filesystem services and attach (“mount”) them to the system’s file system hierarchy. Or a user can ignore the process servers services and start their own process management facilities, that is dissimilar to POSIX.

[Updated] Recommended reading: AST‘s “Modern Operating Systems” (for somewhat outdated implementation details: “Operating Systems Design and Implementation“) and the papers about the L4 microkernel.