- luv-main - example.com

Fwd: [free-software-melb] Draft Fedora plan to cope with Secure Boot on x86 hardware
by Bianca Gibson 07 Jun '12

07 Jun '12

Hi everyone, Update on secure boot from the Melbourne Free Software mailing list. ---------- Forwarded message ---------- From: Chris Samuel <chris(a)csamuel.org> Date: 31 May 2012 16:43 Subject: [free-software-melb] Draft Fedora plan to cope with Secure Boot on x86 hardware To: Melbourne Free Software Interest Group < free-software-melb(a)lists.softwarefreedom.com.au> Hi all, Matthew Garrett has just posted a draft plan on how Fedora 18 plans to cope with Windows 8 certified x86 hardware that has Secure Boot enabled in EFI. http://mjg59.dreamwidth.org/12368.html Basically it involves signing up with Microsoft, paying a $99 one-off fee and then getting them to sign a boot shim that will boot Grub2 that has been signed by a Fedora key. Then it has to be signed code all the way down to user space, so no loading out-of-tree drivers, filesystems or other modules, either FLOSS or proprietary (and certainly not a custom kernels) whilst Secure Boot is enabled. For those who've not come across what this means, he has a nice summary: # Secure boot is built on the idea that all code that can touch the # hardware directly is trusted, and any untrusted code must go through # the trusted code. This can be circumvented if users can execute # arbitrary code in the kernel. So, we'll be moving to requiring # signed kernel modules and locking down certain aspects of kernel # functionality. The most obvious example is that it won't be possible # to access PCI regions directly from userspace, which means all # graphics cards will need kernel drivers. Userspace modesetting will # be a thing of the past. Again, disabling secure boot will disable # these restrictions. # # Signed modules are obviously troubling from a user perspective. # We'll be signing all the drivers that we ship, but what about out # of tree drivers? We don't have a good answer for that yet. As # before, we don't want any kind of solution that works for us # but doesn't work for other distributions. Fedora-only or # Ubuntu-only drivers are the last thing anyone wants, and this # really needs to be handled in a cross-distribution way. Interestingly he also shows that you can use Secure Boot to ensure that your system will only be able to boot Fedora (etc) and never boot a proprietary OS: # A system in custom mode should allow you to delete all existing keys # and replace them with your own. After that it's just a matter of # re-signing the Fedora bootloader (like I said, we'll be providing # tools and documentation for that) and you'll have a computer that # will boot Fedora but which will refuse to boot any Microsoft code. # It may be a little more awkward for desktops because you may have # to handle the Microsoft-signed UEFI drivers on your graphics and # network cards, but this is also solvable. I'm looking at ways to # implement a tool to allow you to automatically whitelist the # installed drivers. Barring firmware backdoors, it's possible to # configure secure boot such that your computer will only run software # you trust. Freedom means being allowed to run the software you want # to run, but it also means being able to choose the software you # don't want to run. Interesting times! cheers, Chris -- Chris Samuel : http://www.csamuel.org/ : Melbourne, VIC This email may come with a PGP signature as a file. Do not panic. For more info see: http://en.wikipedia.org/wiki/OpenPGP _______________________________________________ Free-software-melb mailing list Free-software-melb(a)lists.softwarefreedom.com.au http://lists.softwarefreedom.com.au/mailman/listinfo/free-software-melb

5 5

DVD Eject issue
by Colin Fee 07 Jun '12

07 Jun '12

Don't know if this is OS related but I'll ask anyway. In my media server at home, running Ubuntu 10.04 LTE server edition, I'm having trouble ejecting/opening the DVD tray when the machine is operating under the OS's control. When at the BIOS menu or halted at the grub menu you can open and close the tray to your hearts content via the drive's eject button. Once booted into the OS it becomes almost impossible to do when the drive is empty. I've taken to keeping an old CD in the drive as a work around as when the tray is occupied it will eject without issue, from the button or via the eject command. I have tried two other drives of similar model and they behave in the same way and all three drives operate as expected when placed into a Windows box. Of course what I don't have to hand as write this (not being in the same place as the server) is the exact model and firmware details other than to say they are Lite-on DVD-RW drives. In all other respects they operate normally. -- Colin Fee tfeccles(a)gmail.com

4 4

poll
by Russell Coker 06 Jun '12

06 Jun '12

According to the current poll 53% of 77 people who responded will give a talk at a LUV meeting this year. That would be 41 people which would be an average of more than 6 per month! Should we make the meetings longer to accommodate 3 or 4 talks? -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

1 0

net access
by Russell Coker 05 Jun '12

05 Jun '12

For a while I've been providing Wifi net access at LUV meetings. I'm going to start using a password, the ESSID is "etbe" and the password is "selinux1". Bandwidth limits will apply so if you need to do something big (10MB or more) then talk to me first. If you want to check your email and visit a site like news.com.au while waiting for the meeting to start then just do it. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

2 1

itspot
by stripes theotoky 03 Jun '12

03 Jun '12

Hi to all, ordered some stuff from itspot (specifically a bunch of corsair usb drives) more than 2 weeks ago. never been delivered, no response to e-mails. has anybody else had similar experience? can you suggest another online shop? cheers

4 4

Re: itspot
by Keith Lewis 01 Jun '12

01 Jun '12

Erik Christiansen <dvalin(a)internode.on.net> wrote: > ... Since then I've been more than happy with City Software, Lucky you. I have had an absolutely awful experience with them. I tried to purchase a $3K laptop... Paid up front by paypal. Stupid of me I suppose... They demanded my drivers licence and Visa card... After many months, and much heartbreak, I eventually got some sort of a refund... My opinion is that there are better, less expensive places... (I eventually bought the laptop I wanted from Mwave, no silly requirements, no delays. And lower cost. And a totally unexpected small discount - something called mwave dollars...) Keith

1 0

fgets() and DOS files
by Russell Coker 31 May '12

31 May '12

Is there a library routine like fgets() but which takes any of CR, NL, and CR+NL as an end of line? -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

6 12

stripping binaries
by Russell Coker 30 May '12

30 May '12

Linux has used demand-loading of executables and shared objects for ages. This means that if an executable or shared object has some pages that happen to never get called (IE for corner conditions that don't happen in the usual case) then they never get read from disk. The same applies for debugging data when the object isn't being debugged. Even if you have unused data on the same pages as executable data thus increasing the number of executable pages loaded into RAM it shouldn't be a big deal as RAM keeps getting bigger so that only a small portion of the multi-gigabytes of RAM in a low-end system is used for executable pages. Disks are getting bigger all the time. Nowadays it would be silly to consider purchasing a disk for a desktop system that's less than 2TB in size and laptops have had hundreds of GB for ages. Currently the biggest root filesystem on a system I run is 12G, that is 0.6% of the space on a desktop disk you might purchase (*) and less than 10% of the low end laptop disks that were on sale a couple of years ago. If I had to make that 24G for the root filesystem it wouldn't be a big deal. In terms of reducing binary size there has been some discussion about a port of Linux that uses 32bit instructions with 64bit data operations and registers on an AMD64 architecture. The idea is to save RAM and TLBs by not using 64/64 while still getting some performance benefits of a 64bit CPU. But there is little interest in this and it seems that Debian won't support it due to no- one caring. So the question is, why strip binaries? Back in the days when we ran servers with 100MB hard drives there was a real need to save space. When a 128Kb/64Kb ADSL link was considered fast there was a real need to reduce download time. But now that most of us have ADSL links that allow 100KB/s (800Kb/s) UPLOAD speeds and significantly faster download speeds. The thing about the debugging symbol table is that you never know when you will need it. Having it always there seems to have no cost that matters but it can provide significant benefits. So why ship a program or shared object that's stripped? (*) The system in question has a 160G disk I got from a junk pile. But as half the disk space is on my /junk filesystem and there is still unallocated space I think this supports my general point. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

9 23

Re: limit concurrent connections with squid
by Tim Connors 30 May '12

30 May '12

On Wed, 30 May 2012, Trent W. Buck wrote: > I suppose there are caveats: it would have to be pleasant, like > OpenWRT, not like a Thecus NAS; and I'd have a strong preference for a Funny you should say that. I ended up giving up on the godawful hacked up scripts (that recursively run chmod/chown immediately on any external drive plugged in, without asking the user) in my thecus n4200, and installed debian on it. I've been meaning to write a blog post on it, if nothing else other than to say "don't buy thecus unless you're prepared to put a lot of work in". -- Tim Connors

2 2

limit concurrent connections with squid
by James Harper 29 May '12

29 May '12

I have a Linksys SRW2048 switch and the UI fails under IE[789] because it uses too many concurrent connections for the switch to handle. I can use IETab in Firefox which works because it indirectly limits the number of concurrent HTTP requests, but that isn't always a solution. I have a squid proxy running on a linux router though, so I was hoping I could limit the number of concurrent connections. The docs tell me I can limit them by using a deny but that will result in the connection failing rather than simply being delayed until other connections are complete. Any suggestions? I'll use netfilter to drop new connection requests if I can't figure it out using squid. Thanks James

7 15