TechGuize

Winners and Losers of Free Wi-Fi

2008-10-14T18:20:00.001-04:00

By Rick Aristotle Munarriz
October 14, 2008

Free nationwide Wi-Fi is one step closer to reality, now that FCC tests show that a chunk of available spectrum can support a countrywide network without interfering with rival spectrumholders.

Don't ditch your access provider just yet. This is, again, just one step in what will likely be a very long and winding road toward skinflint broadband.

The auction itself is still at least several months away. The eventual winning bidder will also have plenty of time to roll out the free product. The government is requiring that at least 50% of the nation be covered within four years, and 95% of the country within 10 years.

And lest you get all excited by thoughts of all-you-can-surf wireless, know that this isn't a charitable initiative. At least one likely bidder -- startup M2Z -- is looking at an ad-supported model, with paying subscribers receiving faster access. In other words, the free product is unlikely to satisfy cyberspace speedsters. The FCC will also make sure that free access is filtered; file-swappers and fans of X-rated sites will likely have to look elsewhere.

Still, canvassing the country with free connectivity will be a game-changer, full of opportunities and challenges alike. Let's look at both sides of the story.

The losers
The telcos and cable companies providing Web access may get hurt the most, especially among their entry-level pricing plans. If cheap, slow connectivity is what those consumers want, a free ad-supported model will hit the hot spot.

Most access providers are gargantuan companies with diversified product lines, but some are pure ISPs like Earthlink (Nasdaq: ELNK), and to a lesser extent, United Online (Nasdaq: UNTD). United Online has actually been moving away from its dependency on its Juno and NetZero dial-up offerings, acquiring properties like MyPoint, Classmates.com, and most recently FTD. Earthlink has not.

Wireless carriers should also feel the sting. Pitching subsidized handsets with expensive data plans won't be an easy sell if the public turns to Web chat alternatives.

Premium entertainment providers may get pinched, too. Sirius XM Radio (Nasdaq: SIRI) could face an uphill battle against free, universally accessible Internet radio. Local network affiliates, and even the cable giants, will suffer if couch potatoes begin to stream on their own terms.

In short, if you provide a premium service that has a reasonable Web-delivered alternative, free Wi-Fi is not your friend.

Another unlikely loser is Microsoft (Nasdaq: MSFT). Free users are likely to turn to cheaper Linux-flavored operating systems, bypassing premium productivity software like Microsoft Office in favor of free Web-stores apps like Google Docs. Cloud computing is coming anyway, but free nationwide Wi-Fi will make it even more pervasive.

The winners
Free Wi-Fi's aim is to provide deeper market penetration. That will naturally benefit e-commerce and online advertising companies, but investors need to be realistic. Folks who flock to free connectivity won't be voracious shoppers at Amazon.com (Nasdaq: AMZN) or desirable leads for sponsors on Google (Nasdaq: GOOG).

Still, free Wi-Fi should be a "net" positive for both companies. If you're shopping at the mall and you can hit Amazon for a little comparison-shopping -- many people do so already, but more will follow in a free Wi-Fi future -- Amazon will be treated to incremental sales.

Google will also be a winner, especially if the top bidder turns to this online ad king to monetize its landing page.

Another wave of profit may come from display advertising, an area where Yahoo! (Nasdaq: YHOO) excels. Yahoo! knows that it can't compete with Google on the paid-search side, but it knows how to milk the most out of less lucrative brand-enlightening display ads.

The scorecard
Dump the losers? Back up the truck on the winners? Not so fast. We may still be several years away from a reality of free countrywide Wi-Fi. That's a lot of time for the companies that now look like losers to arm themselves with the right tools to stay relevant.

Sirius XM Radio already has a Web-streaming product; an ad-supported freebie could help it compete with free Internet radio and serve as a gateway drug for the premium product. Phone and broadcasting titans have too much at stake to go down quietly, so expect them to map out ways to thrive in a changing environment.

The road is long, but it's never too early to study the map.

Avoiding the 5 Most Common Mistakes in Using Blogs with Students

2008-10-01T13:12:00.001-04:00

By Ruth Reynard

I've used blogs in my classes for five years with university graduate students. I've found them to be extremely helpful in certain circumstances but only when there is clarity for students in their use. Students who object to the inclusion of blogs in a course are usually objecting to what they perceive will be just one more task on top of a myriad of others or simply some busy work that will not benefit their learning. Older students can also reject the notion of "publication" that is inherent with blogging. Each of these objections can be addressed by an effective and innovative instructor by careful planning and skillful management. There are, however, several common mistakes that should be avoided when using blogs in instruction. I have made all of these mistakes and have learned how to address each one proactively.

1. Ineffective Contextualization
As with any instructional tool or learning support, without a clear context within which the tool is to be used, students will not understand the benefit to their learning and will, ultimately, reject the use of the tool. In order to effectively contextualize the use of an instructional tool, instructors must think carefully exactly where the tool will be used in the flow of the course, how often the tool will or might be used, and how necessary the tool is to the learning process. In the case of blogging, the most effective use of this tool is in the area of self reflection or thought processing. As such, there must be concepts for students to think through, various resources and content segments to process, or ideas to construct. To simply ask students to blog without this level of planning will lead to frustration for the students. In other words, there must be a certain amount of content preparation already covered or made accessible for students before blogging will really support the learning process. While a blog can also provide social placement of students or academic placement of students within a group, blogs are fundamentally individual in their purpose and essence. That is, while comments can be added or ideas posted following a blog entry, these sit outside the initial posting--blogs are not wikis or online discussion forums, therefore, if individual self-reflection is the central benefit to the learning process, instructors must plan carefully as to when in the course self-reflection will enhance the learning process for each student. Please note: there are additional benefits that instructors can glean from blogs in terms of helping access student voice and understanding student progress in their idea or concept construction, but the instructional use of the blog tool is mostly about the individual benefit to students first in deciding when and how to use blogs in instruction.

2. Unclear Learning Outcomes
Following on from designing the placing of blog use based on the instructional flow, is the notion of designing blog use based on learning outcomes.

Learning outcomes are much more than course objectives. Learning outcomes begin with course objectives; however, include student learning needs and objectives, and future application of the learning. Therefore, understanding of the global nature of the learning outcomes of a course in crucial to good planning and use of learning resources and tools. Choosing the blog tool in a course would mean that the transferable skills of critical thinking, thought processing and knowledge construction would be well supported and recorded. If the instructor is unclear as to what the learning outcomes of the course are and is focused only on course objectives, the potential of the blog tool may not be maximized. The following are several ways in which the use of blogs in instruction can develop new higher level thinking skills:

Analysis: A blog can help students process their thoughts and ideas for analysis. There is no better way to begin to see the importance of analysis as when there is a goal of articulating your thoughts for explanation to others. That is, if two ideas are presented together in support of one concept, self-reflective students must learn to a) distinguish the ideas, b) understand the differences between and similarities between, c) understand where the connection points are if any, d) decide, based on analysis, which one (if any) they will include and build upon in their own learning process. This is a highly constructive process and the skills needed must be intentionally encouraged and can be visibly recorded in a blog.

Synthesis: As part of the analysis, it is important that students can synthesis the original ideas and the new ideas they will articulate. The synthesis of ideas is crucial to the process of working ideas and incorporating new ideas into their own thinking.

New ideas: Grasping new ideas through analysis and synthesis means that students can move ahead with their thinking and move closer towards transformation in learning and application. Information is not what makes a new idea. Information must be processed and applied before new ideas will emerge for students. Too many instructors remain at the information-exchange stage with students and do not move them towards new ideas. A blog can help develop these thinking skills as well as capture the new ideas well for others to view and absorb.

Application: Without application, new ideas are not "owned" by students in their learning. That is, new ideas can only become meaningful and relevant for students when then are directly applied in real life contexts of practice and use. This stage can also be well captured in a blog and, in fact, the entire thinking process of each student can be captured and made accessible for instructors and other students to explore.

Note: Each of these stages of thought development must be intentionally supported by instructors through comments and feedback and expectations communicated to each student. Additionally, grades should reflect the entire process of learning, not simply the end product, if students are to understand the value to their own learning.

3. Misuse of the environment
As I mentioned before, blogs are not wikis and they are not online discussion forums. The essential difference between a blog and other online tools is that it is intended to be an individual publication: a one-way monologue or self-post to which others may comment but do not contribute. The original post remains as the person who posted it wanted it to be. This is important to realize in the instructional setting. If a discussion is desired, then blogging would not be the tool of choice. In the same way, if journaling is the intended goal, then an online discussion forum would not be the tool of choice. It is important to realize, as an instructor, that if you desire a journal-type setting, then your comments should be supportive and constructive and not intrusive otherwise the student(s) will cease to post. Blogs can have a discussional nature if there are many subscribers and participants. That is, you can "hear" from every student on one topic or another by creating a blog ring to which they can subscribe. The self-posting, however, remains the same. That is, unlike a wiki, where changes can be made to posts and documents, in a blog, the initial post always stands and is simply responded to and not altered in any way. When using blogs to encourage students to articulate their thoughts students can become empowered and feel that they are developing their own voice in the learning process. Instructors can also "glimpse" students' thought processes and become much more aware of their learning journey.

4. Illusive grading practices
Grading of blogs should have clear rubrics so that students do not become confused as to how their work is being evaluated. As blog posts are essentially a series of statements, I have suggested elsewhere that, depending on the learning outcomes of your course, specific statement types to recognize in your assessment rubric might be:

* Reflection statements (self positioning within the course concepts);
* Commentary statements (effective use of the course content in discussion and analysis);
* New idea statements (synthesis of ideas to a higher level); and
* Application statements (direct use of the new ideas in a real life setting).

As already mentioned, blogging can move students forward in their thinking, help them process to a higher level of understanding, and apply the learning to a practical context. If the grading is not clear and the tool is simply made available to students, not only will students become discouraged, they will likely not participate. As I have seen on numerous occasions, it is when students continue regular use of the blog throughout a course that their learning is truly supported and their thinking truly challenged. It is, therefore, important to keep students focused with regular reminders and to keep expectations clear and grading transparent. Timelines for completion should also be set so that students know how much time they have to use the blog tool.

5. Inadequate time allocation
The notion of adequate time is not discussed often enough in the use of technology in learning. Just as students are different in their processing time within any learning context, so adequate time should be given for every student to complete work using online tools such as the blog. Instructors should be reasonable and if possible, leaving the blog tool open until the end of the course. This will help students maximize the benefits of the tool and will also provide more time for students who need it. As online tools provide a more immediate learning context for students, they also usually encourage more participation from students. This participation in turn provides more text or other response types from students and ultimately more for instructors to read through or view and grade. Therefore, instructors should plan ahead and plan well for the increased work that will likely take place when their students are using online tools.

Students should be fully aware of what the expectations are and how the tool is being used in their learning process. Once students understand this, they are more likely to participate and to a greater degree of critical awareness. While there are many mistakes that can be made in using any new tool in instruction, instructors should have a question and answer mindset in their use. It is important to find out what problems or challenges exist and to find solutions quickly. Instructors who use online tools must be innovative in their approach, creative in their course design, and flexible in their methods in order to ensure successful learning experiences for their students. While there is no one-way to use any instructional resource well, it is important to integrate the use of any tool or learning resources intro the overall course design intentionally and totally supporting the learning outcomes for the students.

Ruth Reynard is the director of faculty for Career Education Corp. She can be reached at rreynard@careered.com.

Cite this Site
Ruth Reynard, "Avoiding the 5 Most Common Mistakes in Using Blogs with Students," Campus Technology, 10/1/2008, http://www.campustechnology.com/article.aspx?aid=68089

Stanford Testing iPhone Application Suite

2008-10-01T13:11:00.001-04:00

By Dian Schaffhauser
A suite of five software applications developed by students at Stanford University to run on Apple's iPhone is now being tested on campus. Two are for students, to manage course registration and bills. The other three will allow users to access Stanford's searchable campus map, get team scores and schedules, and check listings in the university's online directory, StanfordWho.

The university contracted with Terriblyclever Design, a startup company in San Francisco co-founded by Stanford student Kayvon Beykpour, to develop the suite of applications under the university's iApps Project. Beykpour is a junior majoring in computer science, and five of his company's six full-time employees also are undergraduates at Stanford.

During a pilot phase that launched recently, a select group of students who work in residential computing will test a beta version of the iPhone applications.

"We have talented students with good ideas about how they want to access administrative systems and services," said registrar Thomas Black, whose office is overseeing the project. "We want to harness their genius. We want to be able to say, 'You can come to Stanford, where students develop the applications that students use.'"

"We really were passionate about being more engaged in these systems," Beykpour said. "I am a student, and I use all these services, and I can't tell you how exciting it is to spend your time working in a capacity that you love working in--but also such that your final product affects your community."

Project leaders said the idea of letting students access key online systems and resources at Stanford via the iPhone began last May, when administrators in the registrar's office had a vision of introducing mobile applications that would enhance student life. The administrators then got in touch with Beykpour, and his company proceeded to develop the applications over the summer.

The university is offering a computer science course this fall titled, "iPhone Application Programming." The class currently has more than 80 students registered.

"We're offering this class because we think it provides students with a good way to exercise the foundations of computer science on an exciting new platform," said Mehran Sahami, an associate professor of computer science overseeing the course.

Acknowledging that security is a top priority, Tim Flood, director of student affairs information systems, said the same principles and practices currently governing the use of laptops and desktop computers at Stanford also will apply to mobile devices using the new applications. The applications will be compatible for anyone with an iPod touch as well.

Earlier in September Apple launched iPhone Developer University Program, for institutions looking to introduce curriculum for developing iPhone or iPod touch applications.

Dian Schaffhauser is a writer who covers technology and business. Send your higher education technology news to her at dian@dischaffhauser.com.

Cite this Site
Dian Schaffhauser, "Stanford Testing iPhone Application Suite," Campus Technology, 10/1/2008, http://www.campustechnology.com/article.aspx?aid=68044

Seton Hall Monitors Recruitment Dollars with Coremetrics

2008-10-01T13:10:00.001-04:00

By Dian Schaffhauser
Seton Hall University is using Coremetrics to better track its investment in recruitment efforts. The Web-based service, which is primarily used by retailers, captures behavioral data to provide the university with insights on how to allocate marketing dollars across campaigns and channels.

"Our recruitment cycle is a long one, often taking as much as 18 to 36 months from the initial inquiry to enrollment in classes," said Robert Brosnan, director of Web and digital communications. "During the application process, we interact with prospective students through a variety of online and offline channels. Coremetrics gives us one place to go to get all the data we need and to look at our marketing efforts from a holistic perspective. We've learned some surprising things that would have been impossible to discover without the ability to attribute conversion to multiple channels. Our analysis showed, for example, that natural search plays a more significant role than expected deep into the recruitment cycle. As a result of this insight, we have made changes to our online application process and are rethinking our paid and natural search strategies."

The marketing data is used to measure the impact of both online and offline influences, including print advertising, direct mail and college recruitment fairs, for the school, which has 10,000 students.

Dian Schaffhauser is a writer who covers technology and business. Send your higher education technology news to her at dian@dischaffhauser.com.

Cite this Site
Dian Schaffhauser, "Seton Hall Monitors Recruitment Dollars with Coremetrics," Campus Technology, 9/30/2008, http://www.campustechnology.com/article.aspx?aid=68038

More Universities Sign with Hothand Wireless To Deliver Mobile Marketing

2008-10-01T13:08:00.000-04:00

By Dian Schaffhauser
Hothand Wireless, which delivers "recreation" information to mobile devices, said it has added 10 university partners to its service, among them Georgia Institute of Technology, Ohio State University, and Stanford.

The company offers a mobile Web application with opt-in text messaging that lets students and others access information such as sports scores, standings, schedules, facility availability, contests, polls, and advertising on Web-enabled phones and other wireless devices. The network is sponsored by merchants that want to reach the university community, and in some cases, the company said, a portion of sponsorship funds or merchant fees are allocated to the school.

The service is available to all students and staff members in partner schools. Registration is required to access the service.

The company launched its University Mobile Network with a pilot program at the University of California Los Angeles which was sponsored by Best Buy Mobile. UCLA students also took advantage of special deals from Subway delivered to their phones.

Dian Schaffhauser is a writer who covers technology and business. Send your higher education technology news to her at dian@dischaffhauser.com.

Cite this Site
Dian Schaffhauser, "More Universities Sign with Hothand Wireless To Deliver Mobile Marketing," Campus Technology, 10/1/2008, http://www.campustechnology.com/article.aspx?aid=68034

XP SP3 Glitch a 'Gotcha' For IE7 & 8

2008-05-09T10:33:00.000-04:00

By Stuart J. Johnston
May 7, 2008

Microsoft finally released Windows XP Service Pack 3 (SP3) to the general public, earlier this week, after a minor glitch or two the week before. It is an update that many XP users have been waiting impatiently for, for months.

Despite the fact that it's now available, however, the company still has a caveat for some users. If you have Internet Explorer 7 or 8 already installed, you may want to uninstall it before installing SP3. Then, if you wish, you can reinstall IE afterwards.

Why? As the 1990s buzz phrase goes: it's complicated.

At least that's the message in a posting made on Microsoft's (NASDAQ: MSFT) IE team blog this week.

It revolves around the fact that SP SP2 shipped with IE6. However, XP SP3 ships with a slightly different version of IE6. It also concerns the order in which the service pack and IE7 or IE8 are installed.

"If you choose to install XP SP3, Internet Explorer 7 will remain on your system after the install is complete. Your preferences will be retained. However, you will no longer be able to uninstall IE7," Jane Maliouta, deployment program manager for IE8, said in her blog post. The same goes for IE8, which is currently in beta test.

That's because the uninstallation process saves the wrong set of IE6 files on your hard disk, which would cause big problems later – so you're locked out of simply reverting to IE6.

The best way to handle the problem, Maliouta said, is to first, uninstall IE7, install XP SP3, and then reinstall IE7.

For the more adventurous who may have installed the beta test release of IE8, the warning counts double. Microsoft has set its download sites to not offer SP3 to users who already have IE8 installed – for good reason. If you install SP3 on top of IE8, as with IE7, you will no longer be able to uninstall the beta software.

"Since people are more likely to uninstall beta software, we strongly recommend uninstalling IE8 Beta 1 prior to upgrading to Windows XP SP3 to eliminate any deployment issues and install IE8 Beta 1 after XPSP3 is on your machine," Maliouta added.

Two analysts said they don't view the situation as a significant problem, but one said that it makes the update process more complex than it should be..

"I suppose there could be some applications that are affected, but I don't see it having any impact on most users," Michael Cherry, lead analyst for operating systems at researcher Directions on Microsoft, told InternetNews.com.

Roger Kay, president of analysis firm Endpoint Technologies, was of a similar mind.

"It sounds like a glitch [Microsoft] needs to fix, but it doesn't sound like a big deal," he said. "Still, a user shouldn't have to go through a lot of work to get it fixed," Kay added.

The company had planned to release XP SP3 last week, but that fell through after Microsoft found a clash between the service pack and Microsoft's Dynamics Retail Management System (RMS).

Microsoft announced on Monday it had put a filter in place so that XP SP3 is not offered to users with RMS installed. Then it released the service pack as planned. The company is working to come up with a solution for RMS users.

What can you do with a second Ethernet port?

2008-05-08T09:52:00.000-04:00

By: Nathan Willis

Purchase a new PC or motherboard soon, and the chances are good that it will come with two built-in network interfaces -- either two Ethernet jacks or one Ethernet and one Wi-Fi. Tossing in a second adapter is an inexpensive way for the manufacturer to add another bullet point to the product description -- but what exactly are you supposed to do with it? If you are running Linux, you have several alternatives.

Plugging another Ethernet cable into the second jack and hoping for the best will accomplish nothing; you have to configure Linux's networking subsystem to recognize both adapters, and you must tell the OS how to use them to send and receive traffic. You can do the latter step in several different ways, which is where all the fun comes in.

The big distinction between your options lies in the effect each has on the other devices on your network (computers, routers, and other appliances) -- intelligently routing network traffic between them, linking them together transparently, and so on. In some cases, the simplest end result is not the easiest to set up, so it pays to read through all of the alternatives before you decide which to tackle.
Bonding

From your network's perspective, the simplest option is channel bonding or "port trunking" -- combining both of the computer's interfaces into a single interface that looks like nothing out of the ordinary to your applications.

A combined logical interface can provide load balancing and fault tolerance. The OS can alternate which interface it uses to send traffic, or it can gracefully fail over between them in the event of a problem. You can even use it to balance your traffic between multiple wide area network (WAN) connections, such as DSL and cable, or dialup and your next door neighbor's unsecured Wi-Fi.

To bond two Ethernet interfaces, you must have the bonding module compiled for your kernel (which on a modern distro is almost a certainty), and the ifenslave package (which is a standard utility, although you might need to install it from from your distro's RPM or APT repository).

On a typical two-port motherboard, the Ethernet adapters are named eth0 and eth1, so we will use that for our example commands. With ifenslave installed, take both Ethernet adapters offline by running sudo ifdown eth0 and sudo ifdown eth1. Load the bonding module into the Linux kernel with modprobe. There are two important options to pass to the module: mode and miimon. Mode establishes the type of bond (round-robin, failover, and so on), and miimon establishes how often (in milliseconds) the links will be checked for failure. sudo modprobe bonding mode=0 miimon=100 will set up a round-robin configuration in which network packets alternate between the Ethernet adapters as they are sent out. The miimon value of 100 is a standard place to begin; you can adjust if it you really want to tweak your network.

To create an actual bond (which for convenience we'll call bond0), run sudo ifconfig bond0 192.168.1.100 up to assign an IP address to the bond, then run ifenslave bond0 eth0 followed by ifenslave bond0 eth1 to tie the physical Ethernet interfaces into it.

Round-robin mode is good for general purpose load balancing between the adapters, and if one of them fails, the link will stay active via the other. The other six mode options provide features for different setups. Mode 1, active backup, uses just one adapter until it fails, then switches to the other. Mode 2, balance XOR, tries to balance traffic by splitting up outgoing packets between the adapters, using the same one for each specific destination when possible. Mode 3, broadcast, sends out all traffic on every interface. Mode 4, dynamic link aggregation, uses a complex algorithm to aggregate adapters by speed and other settings. Mode 5, adaptive transmit load balancing, redistributes outgoing traffic on the fly based on current conditions. Mode 6, adaptive load balancing, does the same thing, but attempts to redistribute incoming traffic as well by sending out ARP updates.

The latter, complex modes are probably unnecessary for home use. If you have a lot of network traffic you are looking to manage, consult the bonding driver documentation. For most folks, bonding's fault tolerance and failover is a bigger gain than any increased link speed. For example, bonding two WAN links gives you load balancing and fault tolerance between them, but it does not double your upstream throughput, since each connection (such as a Web page HTTP request) has to take one or the other route.
Bridging

The bonding solution is unique in that both network adapters act like a single adapter for the use of the same machine. The other solutions use the two adapters in a manner that provides a new or different service to the rest of your network.

Bridging, for example, links the two network adapters so that Ethernet frames flow freely between them, just as if they were connected on a simple hub. All of the traffic heard on one interface is passed through to the other.

You can set up a bridge so that the computer itself does not participate in the network at all, essentially transforming the computer into an overpriced Ethernet repeater. But more likely you will want to access the Internet as well as bridge traffic between the ports. That isn't complicated, either.

Bridging requires the bridge-utils package, a standard component of every modern Linux distribution that provides the command-line utility brctl.

To create a bridge between your network adapters, begin by taking both adapters offline with the ifdown command. In our example eth0/eth1 setup, run sudo ifdown eth0 and sudo ifdown eth1 from the command line.

Next, create the bridge with sudo brctl addbr bridge0. The addbr command creates a new "virtual" network adapter named bridge0. You then connect your real network adapters to the bridge with addif: sudo brctl addif bridge0 eth0 adds the first adapter, and sudo brctl addif bridge0 eth1 adds the second.

Once configured, you activate the bridge0 virtual adapter just as you would a normal, physical Ethernet card. You can assign it a static IP address with a command like sudo ifconfig bridge0 192.168.1.100 netmask 255.255.255.0, or tell it to retrieve its configuration via DHCP with sudo dhclient bridge0.

You can then attach as many computers, hub, switches, and other devices as you want through the machine's Ethernet port, and they will all be able to see and communicate with each other. On the downside, if you have a lot of traffic, your computer will spend some extra energy passing all of those Ethernet frames back and forth across the two adapters.
Firewalling and gateway-ing

As long as you have excess traffic zipping through your computer, the OS might as well look at it and do something useful, such as filter it based on destination address, or cache repeatedly requested Web pages. And indeed, you can place your dual-port computer between your upstream cable or DSL connection and the rest of your local network, to serve as a simple Internet-connection-sharing gateway, or as a firewall that exerts control over the packets passing between the network interfaces.

First, you will need to bring both network adapters up and assign each a different IP address -- and, importantly, IP addresses that are on different subnets. For example, sudo ifconfig eth0 192.168.1.100 netmask 255.255.255.0 and sudo ifconfig eth1 192.168.2.100 netmask 255.255.255.0. Note that eth0's address is within the 192.168.1.x range, while eth1's is within 192.168.2.x. Maintain this separation when you add other devices to your network and you will keep things running smoothly.

Forwarding the packets between the Internet on one adapter and your LAN on the other is the purview of iptables, a tool for configuring the Linux kernel's IP filtering subsystem. The command sudo iptables -A FORWARD --in-interface eth1 --out-interface eth0 --source 192.168.2.0/255.255.255.0 -m state --state NEW -j ACCEPT allows computers on the LAN interface eth1 to start new connections, and forwards them to the outside world via the eth0 interface. Following that with sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT keeps subsequent packets from those connections flowing smoothly as well.

Next, sudo iptables -A POSTROUTING -t nat -j MASQUERADE activates Network Address Translation (NAT), secretly rewriting the IP addresses of traffic from the LAN so that when it goes out to the Internet, it appears to originate from the Linux box performing the routing. This is a necessary evil for most home Internet connections, both because it allows you to use the private 192.168.x.x IP address block, and because many ISPs frown upon traffic coming from multiple computers.

Finally, run sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward to activate the kernel's packet forwarding.

This setup will pass traffic from your LAN to your Internet connection, but it does not configure the network settings on the LAN computers themselves. Each of them needs an IP address, gateway and network information, and some working DNS server addresses. If your dual-adapter Linux box is serving as a NAT gateway, you could easily have it provide that information to the clients as well, using DHCP. Your distro probably comes with the dhcpd package. Configuring dhcpd is beyond the scope of the subject here, but check your distro's documentation for Internet connection sharing and you will likely find the instructions you need.

Once you are comfortable using iptables to set up basic NAT and packet forwarding, you can dig a little deeper and learn how to use your box as a first-rate firewall by writing rules that filter traffic based on source and destination address, port, and protocol.
Isolating

Finally, you can always configure your secondary network adapter to work in complete isolation from the rest of your LAN.

Sure, there is little gain to such a setup for general-purpose computers, but it is a popular choice for certain Ethernet-connected devices that only need to send data to one destination. Homebrew digital video recorder builders use the technique to connect the HDHomerun HDTV receiver directly to a MythTV back end, thereby isolating the bandwidth-hogging MPEG streams from the LAN. The same traffic separation idea might also come in handy for other single-purpose devices, such as a dedicated network-attached storage (NAS) box, a networked security camera, or your Ethernet-connected houseplant.

For most devices, isolating your second adapter entails setting up the computer to act as a DHCP server as in the gateway example above, but without worrying about NAT rules routing between the secondary client and the rest of the network.
Caveat emptoring

So which technique is right for you? My advice is to think about what network trouble you most need to prepare for. If your dual-adapter box is a server with heavy traffic to handle, or you need to balance your traffic across two WAN connections, bonding is for you. On the other hand, if you just bought an HDHomeRun to add to your MythTV back end, think about attaching it directly to the spare interface.

Bridging and gatewaying are most similar, in that they use the dual-adapter box to connect multiple other devices into a single network. If that is what you need to do, consider that bridging works at the Ethernet link level, well below IP and TCP in the protocol stack. At the Ethernet level, the only sort of traffic shaping you can do is that based on the hardware MAC address of the computer. You have significantly more control when you run a full-fledged NAT gateway.

But whichever option you choose, remember that messing around with your network configuration can get you disconnected in a hurry if you make a mistake. For that reason, all of the above examples use commands that change the "live" system, but don't alter the configuration files Linux reads in at startup. If you make a mistake, a reboot should bring you back to a known working state.

If you decide you want to make your changes permanent, your best bet is to consult your distro's documentation. Distros vary slightly in where and how they store network configuration scripts (Red Hat uses /etc/sysconfig/network-scripts/, for example, while Ubuntu uses /etc/network/).

One you start digging into the details, you'll find even more possibilities for utilizing that second network adapter under Linux. But you should now be armed with a general idea of how to make both adapters talk to your network at the same time -- and you can do your part to eliminate network adapter wastefulness.

OfflineIMAP makes messages and attachments available locally

2008-05-08T09:50:00.000-04:00

May 06, 2008 (9:00:00 AM) - 2 days, 5 hours ago

By: Ben Martin

OfflineIMAP allows you to read your email while you are not connected to the Internet. This is great when you are traveling and really need an attachment from a message but cannot connect to the Internet.

You can use OfflineIMAP to sync all your email during the night so that it is all instantly available when you wake up. This is a security trade-off -- you gain speed and availability for your email at the expense of having to properly protect the local copy of all the email that is created on your laptop.

OfflineIMAP is designed to contact your IMAP servers and create a local copy of your email in maildir format. You then point your mail client at the local maildir tree and use your mail client as normal. OfflineIMAP can then sync any changes, such as which messages you have read and deleted, back to the server. OfflineIMAP performs a bidirectional sync, so new messages from the server are downloaded to your local maildir while any changes you have made locally are sent to the IMAP server.

If your email client does not support maildir format, you can use OfflineIMAP to sync email between two IMAP servers and ultimately accomplish the same thing. This scenario is a little more complex, as you need to install an IMAP server on your laptop, tell your email client to connect to the IMAP server on localhost, then use OfflineIMAP to keep the IMAP server on your laptop in sync with your main IMAP server. An alternative is to use OfflineIMAP to sync to a maildir repository as normal and tell your local IMAP server to use that maildir as its email source. This thread contains information on setting up courier-imap locally to serve up your mail.

OfflineIMAP packages are available for openSUSE, Ubuntu Gutsy, and from the Fedora 7 and 8 repositories. If no packages exist for your distribution, the documentation provides good information on installation from source. I used OfflineIMAP 5.99.2 from the Fedora 8 repository. Version 5.99.2 does not support the Gmail account type. Version offlineimap-5.99.7 from the Fedora rawhide repository does support Gmail but has another bug relating to directory creation which causes synchronization to fail. For these reasons I would recommend using the IMAP account type and manually configuring it for Gmail until package repositories contain later versions of OfflineIMAP.

The primary configuration file for OfflineIMAP is $HOME/.offlineimaprc, and you can find a commented template configuration file online. The configuration file defines one or more accounts. For each account you must set the local and remote repository. A repository is configured in its own section and contains the type for storing email locally, or IMAP to connect to a mail server. When connecting to an IMAP server you can specify the hostname, username, and password, and whether OfflineIMAP should use SSL to connect to the IMAP server.

Configuration and setup is shown below. First I create the configuration file using the sample that comes with the offlineimap package. The accounts directive is set to contain a single Gmail account. This account has both a local and remote repository so that OfflineIMAP knows where to store email locally and what server to contact. The local repository is a maildir in my home directory. The remote repository uses the type IMAP instead of Gmail because of the version issues discussed above. I have selected an appropriate email address as the remoteuser so spambots will make themselves known. The nametrans directive lets you change the name of folders in the local repository. In this case I call re.sub twice to first change occurrences of INBOX, [Gmail], or [Google Mail] into root. One directory will be missed by this initial mapping, which is then accounted for by moving the Sent folder inside the root folder. This translation is useful because Evolution expects your inbox to be directly in the root folder of your IMAP account. If you change where the local copy of INBOX is stored, Evolution can more naturally interact with the local mail repository. You can also set up more elaborate folder name translations depending on your needs.

$ cp /.../offlineimap.conf ~/.offlineimaprc $ vi ~/.offlineimaprc accounts = my-gmail [Account my-gmail] localrepository = GMailLocalMaildirRepository remoterepository = GMailServerRepository [Repository GMailLocalMaildirRepository] type = Maildir localfolders = ~/.offlineimap-maildir-my-gmail sep = . restoreatime = no [Repository GMailServerRepository] type = IMAP remoteuser = i-am-a-spam-bot-log-me@gmail.com remotehost = imap.gmail.com ssl = yes remotepassfile = ~/.offlineimap-pass-my-gmail realdelete = no nametrans = lambda foldername: re.sub('^Sent$', 'root/Sent', re.sub('^(\[G.*ail\]|INBOX)', 'root', foldername)) ... $ mkdir -p ~/.offlineimap-maildir-my-gmail

With this configuration in place, just run offlineimap. It will check its metadata and notice that you haven't performed any previous sync and download everything from your IMAP server.

You should then have a complete copy of your email in maildir format on your local machine. See the client notes for information on configuring your email client to directly use the email from this maildir. When you want to send your changes back to the main IMAP server and check for new email, just run offlineimap again. Alternatively, you can use the autorefresh directive in ~/.offlineimaprc to tell offlineimap to continue to sync your accounts every n minutes.

Normally, you should run OfflineIMAP without any command-line options to bidirectionally synchronize your configured email accounts, but OfflineIMAP accepts some options that might be handy for casual use. The -a option accepts a comma-separated list of accounts that you wish to synchronize. This can be great if you are expecting a message but have some accounts defined that are slower to sync than others. The -u option lets you choose one of many interfaces to OfflineIMAP. The default is the Curses.Blinkenlights interface, which you might find to be too distracting. TTY.TTYUI displays a simpler and less distracting progress report. You can also change the interface that will be used by default by altering the ui directive in ~/.offlineimaprc. The -c option allows you to specify an alternate location to ~/.offlineimaprc for the configuration file.

Having the contents of your IMAP account available offline means you don't have to seek out an Internet connection just to get an attachment or wonder if a particular message has been cached locally by your email client. If you are working with moderate-sized attachments, the ability to schedule your laptop to grab your email an hour before you wake up can save precious time when you are traveling.

As the SCO rolls

2008-05-08T09:15:00.000-04:00

By: Steven J. Vaughan-Nichols

Reality, as good writers know, is sometimes stranger than fiction. SCO's recent performance in the U.S. District Court in Utah is a perfect example. With years to prepare, SCO executives made some remarkable statements in their attempt to show that SCO, not Novell, owns Unix's copyright.

While this case is not about SCO's claims that IBM and other companies placed Unix IP (intellectual property) into Linux, Novell's attorneys decided that they would address this issue as well. One presumes that, since this may be their one and only chance to attack SCO's Linux claims in a courtroom -- what with SCO facing bankruptcy -- they decided to address this FUD once and for all.

Before getting to that, though, Novell hammered on Christopher Sontag, one time head of SCOSource, the division of SCO devoted to selling Unix's IP. Sontag, while dodging around what code SCO was actually selling -- UnixWare code or the whole Unix tree leading to UnixWare -- was finally cornered into admitting that SCO had received $16,680,000 from Microsoft and $9,143,450.63 from Sun and did not report these deals or income to Novell as it was required to do under the terms of the Novell/SCO APA (Asset Purchase Agreement).

On the second day of the hearing, April 30th, Sontag admitted that he did not "know if there's any code that is unique to UnixWare that is in Linux." He also admitted that he did not know of any analysis that showed there was any "legacy SVRX [Unix] software' in UnixWare." For someone who was in charge of SCO's Unix IP, who arranged to license it to Sun and Microsoft, and whose company was suing IBM for using Unix code in Linux, Sontag seemed remarkably ill-informed about exactly what it was that he was selling.

Sontag was followed on the witness stand by SCO CEO Darl McBride. With McBride on the stand, as can be seen in the trial's transcript, things became somewhat surreal. McBride, only minutes after Sontag said he didn't know if there was Unix or UnixWare code in Linux, said, "We have evidence System V is in Linux." McBride's most memorable moment came though when he claimed, after years of never being able to demonstrate any direct copying of Unix material into Linux that "Linux is a copy of UNIX, there is no difference [between them]."

In regards to SCO's May 2003 letter to companies that were using Linux and "Therefore, legal liability that may arise from the Linux development process may also rest with the end user," McBride claimed that "I don't see anything in here that says you have to take a license from us."

From there, McBride went on to say that simply because SCO had stated in this letter that "We intend to aggressively protect and enforce our rights" and added that the company had already sued IBM, that SCO didn't mean to imply that "we're going to go out and sue everybody else." At the time, most observers agreed that SCO certainly sounded like they were threatening to sue Linux end-users.

McBride then managed to entangle himself in how SCO accounted for the revenue it had received from Microsoft and Sun. The implication, which McBride vigorously denied, was that SCO had misled the stock-buying public in SEC documents in 2003 and 2004.

In what may prove to be a problem for Sun in the future, McBride also said that while SCO felt Sun had the right to open-source Unix in OpenSolaris, its most recent Sun contract was really about Sun "looking for ways to take their Solaris operating system and make it more compliant with the Intel chip set, which is what SCO has a deep history of doing."

Greg Jones, Novell's VP of Technology Law, was then sworn in. Jones testified that SCO's 2003 agreement with Sun "allows Sun, then, to release Solaris as open source under an open source licensing model, which they have done in a project called OpenSolaris. So it poses a direct competitive challenge to Linux and, certainly, to Novell, given that Linux is an important part of Novell's business. We are a Linux distributor."

Jones went on to say that if Novell had been aware of SCO making this deal with Sun, it would not have allowed it because, "It simply would not have been in Novell's commercial interests. In the fall of 2002, Novell had acquired Ximian, a Linux desktop company. We were exploring ways to get into the Linux market so enabling a competitor to Linux simply would not have been in Novell's interests. In the manner in which they entered this agreement, when they did it, they kept all the money. I assume that would have been their proposal but, fundamentally, it simply would have been contrary to Novell's business interests to enable something like this."

On the third day of the case SCO stuck to its guns, but added little more to their arguments.

On the case's final day, Novell simply stated that, when all was said and done, the APA made it clear that Novell, and not SCO, had the rights to Unix's IP. Therefore, SCO had no right to make these deals, and certainly no rights whatsoever to keep the funds from such deal.

In Novell's closing arguments, Novell also hit again on the SCO/Sun deal. Novell pointed out that "There's no question they (SCO) allowed Sun to open-source Solaris," and that while SCO executives would have you believe that giving Sun the right to open-source Solaris had no market value, SCO's engineers believed that open-sourcing Solaris had great value.

So, as the case moves on, SCO still seems unable to make any headway on its claims that the APA gave it the right to sell Unix's IP. Novell attorney's also made a point of demonstrating that SCO still has only naked claims, without any evidence, that there's any Unix code inside Linux. The Judge is expected to rule on the case in the near future.

Finally, Sun may yet have to contend with Novell's IP interests in OpenSolaris. Novell clearly doesn't believe Sun had the rights to open-source the System V code within OpenSolaris under its CDDL (Common Development and Distribution License).

Apple in rumored talks to license vibration feedback for iPhone

2008-04-28T10:23:00.001-04:00

By Aidan Malley
Published: 02:45 PM EST

Apple has reportedly begun talks with Immersion to integrate haptic feedback into future touchscreen devices, addressing a complaint leveled against the iPhone by fans of physical buttons and keyboards.

An Apple worker has allegedly leaked to Palluxo that Immersion executives met twice with their Apple peers this week to discuss integrating Immersion's vibration response technology into the cellphone.

The meetings are said to parallel a more publicized deepening of relations between the two companies through indirect means: Immersion this week hired Clent Richardson, a former Worldwide Solutions Marketing VP at Apple between 1997 and 2001.

What exactly would be implemented is unclear. However, Immersion's most recent efforts have focused on using haptics to simulate physical button presses in an increasing number of touchscreen phones, including Sprint's soon-to-be iPhone rival, the Samsung Instinct.

The technique most frequently involves sending short, concentrated pulses through all or specific locations of a phone as the user taps buttons in software. In effect, haptics not only restore some of the feel absent in touchscreens, but also give users a way of confirming that the phone has recognized a command through more than just visual output.

A frequently-cited complaint regarding the iPhone is its lack of tactile feedback for converts from BlackBerries and other smartphones, many of whom expect the relative certainty of physical responses while navigating the interface or typing.

Neither Apple nor Immersion has commented on the rumored discussions, which are still early and so aren't expected to result in a finished product for some time.

Remote control function said hidden in iPhone beta firmware

2008-04-28T09:21:00.000-04:00

By Aidan Malley
Published: 02:20 PM EST

Code in Apple's latest iPhone 2.0 beta firmware allegedly contains references to a utility that will let an iPhone or iPod touch play media from nearby iTunes sources

Pointing only to an unnamed person as the source for its leak, TUAW claims that multiple string entries in the cellphone's beta code refer to selecting from different media categories and include mentions of dialog boxes that let users choose their particular source.

The information suggests that the additions are the groundwork for an Apple TV-like feature, purportedly named iControl, that would let users play any iTunes content over a local network with features similarly to the dedicated media hub already on store shelves.

It's unclear as to whether the feature is strictly intended for streaming local content to the iPhone itself or can actively steer other devices, imitating a more advanced home theater remote such as Logitech's Harmony.

However, the listings as they appear would indicate a direct connection to a 2.5-year-old patent filing submitted by Apple in late 2005.

In the filing, the iPhone maker says it has invented a method that would let a portable media player view the contents of a local media server, such as a computer, and send instructions telling the media server to change tracks while it outputs content to a separate media receiver, whether physically attached to the computer (such as speakers) or remote (such as an Airport Express-like connection).

The aim is to let users steer media playback in a networked media system with existing hardware rather than dedicated controllers, Apple engineers state in the earlier patent.

Regardless of its actual purpose of iControl, there are no clues as to when, if at all, the software will be released for the company's handheld devices.

Europe's not finished with Microsoft

2008-04-28T09:10:00.000-04:00

Microsoft's troubles in Europe are far from over, as Neelie Kroes, The EU competition commissioner, has warned. We review the past and future options for Microsoft and the European Commission.

Posted Richard Hillesley at 2:34PM, 24th April 2008

The 80s were the dog-eat-dog days of business. Top of the pile was Microsoft, the biggest and baddest of them all, led by Bill Gates, who invented the computer, the universe and everything.

Gates looked a bit like the nerd on the cover of Mad Magazine, made it to the cover of Time magazine, and was rich and successful beyond anybody's wildest dreams.

The view of Gates and Microsoft from inside the computer industry was more circumspect. PC software looked amateurish and nobody took it too seriously until the cultures began to collide in the business world during the middle of the decade. The affordable desktop computer, which sprang out of an unholy alliance between IBM, Intel and Microsoft, changed the face of computing in the home and in the work place, and for the most part was beneficial to the user, if only because it was cheap and accessible.

Microsoft always took more credit for this revolution than it probably deserved, but had a way of coming out on top, which owed everything to its early dominance of the operating system market for the IBM PC and its clones. From this dominance grew its prominence on the desktop, and the gradual eclipse of its competitors. The question that was always being asked of Microsoft was how much did the company owe its success to the quality of its software, and how much to the ruthlessness of its marketing?

From the beginning Microsoft had a special relationship with the original equipment manufacturers (OEMS), and made this relationship tell. Each innovation on the desktop, each new tool and the company that made it, either fell by the wayside or was assimilated into the Microsoft hive.

In the hive

Compaq had its arm twisted to stop it bundling Apple's Quicktime on the desktop. Internet Explorer, and later, the Windows Media Player, were bundled into the operating system, and given away free, sucking revenues and market share from Netscape, Real Networks and Apple. The squashing of Netscape and the subsequent death of the browser market led to Microsoft's conviction for monopolistic behaviour before the US antitrust courts.

Microsoft added platform-dependent "features" to Java to render Java's multi-platform features redundant, and when that ended up in court, developed the .NET platform, a very successful and popular alternative that reproduced many of the major features of Java with the notable exception of its multi-platform capabilities.

Kerberos, the encryption standard developed by MIT, was extended by Microsoft with the apparent objective of inhibiting interoperability in the workgroup server space and, in the words of Jeremy Allison of Samba: "these changes were treated as trade secrets, patented if possible, and only released under restrictive non-disclosure agreements, if released at all."

During the US anti-trust trials, Steven McGeady, a vice president of Intel, testified against Microsoft, Intel's most important trading partner, asserting that Microsoft intended to "embrace, extend and extinguish" competition by substituting open standards with proprietary protocols, and claimed that Intel had been warned to cease development of its Native Signal Processing audio and video technology, which promised to vastly improve user experience of the desktop - or else Microsoft would bypass Intel and develop Windows exclusively for AMD and National Semiconductor chips. "It was clear to us that if this chip did not run Windows it would be useless in the marketplace," McGeady testified. "The threat was both credible and terrifying."

Microsoft has always had an ambivalent relationship with the concept of interoperability and with the standards that make interoperability possible, tending to view the protocols and data formats it uses as "de facto" standards and "trade secrets" which it is free to "extend" with no obligation to share. This may not always be deliberate behaviour. Where there is a monopoly standards become incidental, an option rather an obligation. This tendency has been at the root of Microsoft's problems in the US and European courts. Microsoft is not being penalised for success, but for shutting the door on competition, and resisting any requests to modify its behaviour.

Into Europe

Microsoft's troubles in Europe began as early as 1993, when Novell complained that "onerous licensing conditions" imposed on OEMs by Microsoft was pushing NetWare out of the workgroup market.

In this market Novell had been the innovator, but Microsoft had muscled a napping, but still relevant, Novell out of the picture. Thus began a long history of litigation which culminated in the 17 September 2007 decision of the European Court of First Instance, which upheld the European Commission's decision to fine Microsoft and uphold the principle of interoperability.

The September judgement came at the end of a ten year case initiated by Real Networks, supported by Sun Microsystems, Novell and others, all arguing that innovative products were being pushed out of the market on the back of Microsoft's monopoly. Over the years each of these litigants withdrew from the case after doing deals with Microsoft worth billions of dollars, leaving the Free Software Foundation Europe (FSFE), the Samba Team, and their allies to fight the case to the finish.

As Jeremy Allison of the Samba Team told Groklaw: "the copyright in Samba is spread across many, many individuals, all of whom contributed under the GNU GPL 'v2 or later', now 'v3 or later' licenses. You can't buy that. There's nothing to sell. There's no point of agreement for which to say 'here are the rights to Samba, we'll go away'. We're in the, some would say unique, some would say unenviable position, of not being able to sell out. We can't be bought."

Much has been made of the Commission's insistence that Microsoft offer a version of Windows without Windows Media Player bundled, and the record fines imposed upon Microsoft. Improbably, some press coverage suggested that the European decision was a blow against innovation and competition. But the fines mean little more than a few pence on the price of Windows to a company as rich as Microsoft. The fines are a penance for Microsoft's prevarications and refusal to comply with the European courts.

The most important part of the judgement was the Commission's insistence that Microsoft be forced to publish the protocols used by Windows clients and servers under "reasonable" and "non-discriminatory" terms.

For this decision to have any meaning it was incumbent upon Microsoft to publish the protocols in their entirety, and to reflect the actual behaviour of Microsoft servers and clients in the real world - without evasion, inconsistencies, broken standards, obfuscations, fees or hidden patents - to comply with the commonly understood meaning of open standards and protocols as they have been implemented by other participants in the computing industry.

Microsoft has complied, with reservations, releasing protocols and data formats free for "non-commercial" use, (which immediately discriminates against competition), and making promises of future interoperability with its products. Unfortunately the promises have come with limitations, and the limitations target free and open source software.

As Thomas Vinje of ECIS, noted: "For years now, Microsoft has either failed to implement or has actively corrupted a range of truly open standards adopted and implemented by the rest of the industry. Unless and until that behaviour stops, today's words mean nothing."

Bursting the bubble

It is worth noting that once Netscape was trounced and Microsoft assumed the monopoly position in the browser market there was a five year gap of no innovation or competition between the release of IE6 and IE7. The subsequent release of IE7 was almost certainly prompted by the rapid rise of the open source browser, Firefox, and was notable for its failure to comply with W3C standards. Domminance of a market by a proprietary monopoly does not encourage innovation.

Throughout the European Commission's proceedings Microsoft claimed that the protocols were proprietary to Microsoft, and talked of protocols that were enclosed in a "blue bubble". Georg Greve, president of the FSFE explained: "The blue bubble was a theory that Microsoft invented in order to justify that it had kept parts of the protocol secret. They said that there's a difference between the internal protocols and the external protocols, if you want to describe them like that. They said that certain protocols that are so secret that they are in this blue bubble, because they had visualized this with a blue bubble, that this could never be shared without actually sharing source code, without sharing how the program exactly works. These protocols were so special that somehow, magically, you had to have the same source code to actually make that work. That was the blue bubble theory. So they said things like, 'HTML is outside the blue bubble, but the things you want us to disclose, that is inside the blue bubble.'"

In the wake of the decision, the US Assistant Attorney General for Antitrust, Thomas Barnett, made the highly contentious claim that the outcome, "rather than helping consumers, may have the unfortunate consequence of harming consumers by chilling innovation and discouraging competition," which drew a clear response from the EU competition commissioner, Neelie Kroes, that it was "totally unacceptable that a representative of the US administration criticised an independent court of law outside its jurisdiction."

In contrast, the American Antitrust Institute noted "the oddity of Barnett's statement" as both Europe and the US had found that Microsoft was "a monopolist which had acted to harm competition, and both insisted on interoperability in framing a remedy," and noted that "the EC has appropriately targeted strategies that would have the effect of deterring investment in innovations that might lead to a reduction of the monopolist's power and new benefits for consumers."

Talk is cheap

As the kerfuffle surrounding MS-OOXML demonstrates, the publication of protocols and data formats is not enough. To become truly universal, proprietary interest must be relinquished, and interoperability frameworks opened up to discussion, contribution and maintenance by third-parties through a neutral party (usually a standards body), and this is something that the European commissioners are beginning to understand.

As the MS-OOMXl kerfuffle has also demonstrated, such processes are highly political, and like the political process, can be influenced and misled.

But for the moment, Microsoft's tribulations in Europe are far from over. The Commission is investigating a complaint from Opera Software demanding that Internet Explorer comply with W3C standards, and one from the industry body, ECIS (European Committee for Interoperable Systems), in which Microsoft is alleged to have "illegally refused to disclose interoperability information across a broad range of products, including information related to its Office suite, a number of its server products, and also in relation to the so called .NET Framework.

The Commission's examination will therefore focus on all these areas, including the question whether Microsoft's new file format Office Open XML, as implemented in Office, is sufficiently interoperable with competitors' products."

In a press conference to announce Microsoft's latest fine, the EU competition commissioner, Neelie Kroes, emphasised that "a press release does not necessarily equal a change in a business practice. And if change is needed... then the change will need to be in the market, not in the rhetoric."

She also said: "There are lessons that I hope Microsoft and any other company contemplating similar illegal action, will learn.

. Talk, as you know, is cheap; flouting the rules is expensive.

. We don't want talk and promises, we want compliance.

. If you flout the rules you will be caught, and it will cost you dear."

Proprietary protocols are anathema to network computing and a deliberate hindrance to innovation and competition in computing environments. Few of the players, or users, maintain the illusion that a Microsoft-only world is either desirable or attractive - and the accusations of ballot stuffing, bribery, and undue political influence that surrounded the acceptance of OOXML as a standard by the ISO has only served to emphasise this reality.

Apple's ultra-thin MacBook Air also slim on profits?

2008-04-24T09:35:00.000-04:00

By Slash Lane
Published: 10:00 AM EST

In its determination to deliver the world's thinnest notebook, Apple admitted to sacrificing some speed and versatility, but a new analysis suggests that it may have given up some early profits as well.

Though the Cupertino-based Mac maker largely beat estimates for its second fiscal quarter on Wednesday, one sore spot appeared to be gross margin, which came in at about 100 to 200 basis points below most analysts' expectations at 32.9 percent.

An ensuing conference call was thus dominated by matter, as Wall Street folk routinely pelted management with questions on the perceived shortcoming as they sought a better understanding for their models going forward.

While management largely attributed the near 2 percent margin decline from the prior quarter to February's iPod shuffle price cut and a routine falloff in sales of Mac OS X Leopard and iWork, Piper Jaffray analyst Gene Munster offered his own explanation.

"We believe the margin outlook may be viewed negatively by investors, who likely wanted to see more of Apple's significant revenue upside trickle down to earnings," he wrote in a note to clients early Thursday morning. "The bottom line, we believe the margin was negativity impacted by a higher mix of Mac Book Air, which we now believe carries a lower margin."

On the bright side, Apple has likely built the potential for margin expansion into its MacBook Air design as adoption swells and component prices fall. What's more, Apple management appeared upbeat in stating that the Air has thus far shown little to no cannibalization effect on the company's other notebook offerings and thus could be considered largely responsible for helping push Mac unit growth to its highest rate in nearly two decades.

"The key takeaway from Apple's March quarter is that the Mac units grew at the highest year-over-year rates (units 51 percent and revenue 54 percent) in 17 years," Munster added in his note to clients. "Macs are the most meaningful category with the most potential and they are performing the best."

Looking ahead, the Piper Jaffray analyst said he's modeling conservatively for Mac growth rates to decline to 12 percent year-over-year for the remainder of calendar year 2008, which leaves "ample room for positive estimate revisions over the next 8 months."

"Mac growth is accelerating despite multiple quarters of strong growth, iPod sales are stabilizing with higher average-selling-prices due to the touch, and the iPhone will be significant in the second half of the year with the release of new hardware and software," he wrote.

Bacula: backups that don't suck

2008-04-24T09:34:00.000-04:00

By Robert D. Currier on April 23, 2008 (9:00:00 AM)

Good systems administrators know that implementing a robust backup procedure is one of their most important duties. Unfortunately, it's also one of the most complex and least fun. When the phone rings and there's a panic-stricken user on the other end who has just lost a crucial document, you need to be confident that you can promptly recover his missing files. Failure to do so can bring about a speedy end to a promising career in systems administration. So what's a budding sysadmin to do? Download the latest release of Bacula and watch those backup woes disappear into the dark of night.

Led by head developer Kern Sibbald, the Bacula team has built an open source backup solution that is fast, reliable, and exceptionally configurable. Bacula is not a monolithic application, but rather a collection of programs that together provide a robust backup, recovery, and verification toolset suitable for five or 500 systems.
Getting started

For this review we tested Bacula on a single CentOS 4 server using the file system as our backup medium. In our production environment we use Bacula to manage more than 500GB of backups from multiple clients using a tape robot. However, the lengthy process of configuring the tape robot and multiple clients makes this a daunting task for the first-time user. We recommend you stick with a single host for your test drive if you've not worked with Bacula before.

Bacula is available as a package using the standard package management tools yum or apt-get, but we prefer to install the application from source. When you're just getting started with Bacula, building from source gives you a better feel for how the application operates.

After downloading and uncompressing the project's source code you'll need to run the configure script. Bacula's configure script is well written and produces meaningful debug output but requires a large number of command-line settings. To simplify the configuration process the development team has included a suggested list of options that handle most environments. Start with these settings and modify them where appropriate. Case in point: the choice of database. Bacula is a database-driven application and requires MySQL, SQLite, or PostgreSQL. Make sure you have one of these databases installed prior to configuring Bacula. Once you've run the configure script, you can build Bacula using the normal make; make install process.

Next, you must create the Bacula database and tables and set appropriate access permissions. Located in Bacula's bin directory, the script create_bacula_database will create Bacula's database after determining what database you are using. After a successful termination of this script, executing make_bacula_tables will create and populate the database tables. Finally, grant_bacula_privileges will establish the necessary access controls. A word of warning: grant_bacula_privileges creates an unrestricted access policy for the user bacula. You should modify this policy to suit your needs. At a minimum you should consider setting passwords for the MySQL users root and bacula.

After successfully building and installing Bacula, the next step is setting up the config files. That can take some time, but once you've gotten them working you won't have to touch them again except when you add a new client or fileset.

To understand the configuration files, you need to understand how Bacula operates. Bacula comprises four main modules: the director, the storage daemon, the file daemon, and the console. The director is the "boss" of Bacula, providing job scheduling, backup media descriptions, and access control. In a typical Bacula deployment there is only one director.

The storage daemon handles all communications with the defined backup architecture: disks, single tape drives, tape robots, and optical drives. As with the director, there is usually only one storage daemon running per Bacula installation, but the storage daemon may have many backup devices defined.

The file daemon is installed on each client machine and provides the communications link between the storage daemon and the client. It needs access to all files that will be backed up on that client.

The console handles communications between the administrator and Bacula. The adminstrator can start or stop jobs, estimate backup sizes, and review messages from Bacula. Consoles are available that use wxWidgets, GNOME, and Web browsers, but we prefer the TTY version of bconsole.

The bacula-dir.conf file, which controls the director, contains detailed information on the clients to be backed up, job definitions, filesets, and job schedules. One of the outstanding features of Bacula is how close the configuration files as supplied come to being ready to rumble. While a large installation with many clients will require significant editing to the configuration files, our test of Bacula required us to only to give Bacula a list of files to back up.

Bacula typically installs to a subdirectory named bacula in the home directory of the user that is deploying the software. The configuration files are located in the bin subdirectory of /home/user/bacula. Switch to this directory and edit bacula-dir.conf. Search for the section of text beginning with "# By default this is defined to point to the Bacula build directory to give a reasonable FileSet to backup to disk storage during initial testing." Directly below these lines should be: File = /home/username/bacula/bacula-2.2.8. This is the FileSet definition, which controls what files and directories are to be backed up. You may change this definition to a directory of your choice or leave it as is during testing.
Your first backup

By default Bacula uses the filesystem as its backup media. To keep things simple we won't attempt to configure Bacula to use a tape drive -- we'll stick with the preconfigured definitions.

Change directories to Bacula's bin folder. Execute the bacula script with start as an argument: ./bacula start. You should see the following three lines:
# Starting the Bacula Storage daemon.
# Starting the Bacula File daemon.
# Starting the Bacula Director daemon.

If Bacula successfully started, that's great -- you're ready to run your first backup. If not, carefully read the error messages and double-check the bacula-dir.conf file. Make sure you've pointed Bacula to the directory you wish to be backed up and that the directory exists and is readable.

The final step in taking Bacula for a test drive is using the console to initiate the job. From the Bacula bin directory execute the bconsole script. Bconsole should return an asterisk prompt. At the prompt enter run. Bconsole will display a list of defined jobs for you to pick from. Since we're only backing up one machine (our test box) you should only have one job resource to choose from. Select the job and press Enter. Bacula will prompt you with a short list of settings, including client name, backup type (full, differential, or incremental) and the storage device. If all the settings look correct, enter yes to kick off the backup.

After a short wait, Bacula should return a "backup completed successfully" message with details including the file(s) backed up, the amount of space the backup consumed, compression ratios, and so on. Congratulations -- you've just run your first Bacula backup.
Only the beginning

Of course at this point we've barely scratched the surface of Bacula's many features -- the user manual is 665 pages long. New users should read the excellent tutorial before embarking on a multi-client Bacula installation.

Despite its apparent complexity, Bacula is straightforward to install and configure, comes with excellent documentation, and works right out of the box. If you have been considering moving from basic tar or rdump backup processes to a more substantial package, you can't go wrong by choosing Bacula. It definitely doesn't suck.

Notebook Company Tech Support Comparison

2008-04-23T08:24:00.000-04:00

by Kevin O'Brien

Computer problems can be one of the most frustrating situations any person can go through, especially if it is your primary computer for school or work. Downtime can cause missed assignments, projects, or worse if you manage all your finances through a computer and can't pay a bill on time. We decided to call up Dell, Toshiba, Lenovo, HP, Gateway, and Apple to who see was the easiest to deal with, and how long the average call was.

For our calls, we scored each company in multiple areas, including menu navigation, how long until you left the menu system, time to service rep, and total call length. The basic question asked to each company was, "Is there a way to manually eject a CD stuck inside my optical drive". The expected answer was using a paperclip in the manual eject hole, but as you might expect, not all companies came to that answer right away. In one case we were offered a brand new drive at first, and in another we ended up being cut off after 35 minutes on hold.

Dell Support Call

For our Dell support call, we used the Home and Home Office contact number listed on the site. This was 1-800-624-9896, which listed 24/7 availability. This number was fairly easy to find using Google, and a bit of navigating on the Dell site.

The first interaction the user gets is a voice activated menu system which was not very difficult to navigate. It took me about 30 seconds to get through the system, and 10 seconds later I was speaking to a service rep. The service representative was very friendly, and as soon as I mentioned my problem he prompted me to find a paper clip and insert it into the small hole on the side of the CD tray. After thanking him for his help, the total time on the phone was 3 minutes and 21 seconds.

Toshiba Support Call

For the Toshiba support call, we used the computers support line, listed as 1-800-457-7777. The website does not display if this is a 24/7 support line on the main "Contact Toshiba" webpage, but it worked for our Saturday afternoon call.

The support line was very easy to navigate, using all phone prompts to navigate the menus. Total time to navigate the menus and be routed to a support representative was 60 seconds. The representative was very helpful, and immediately knew about the pinhole on the side of the CD tray. Total time of the call was 3 minutes and 40 seconds.

HP Support Call

For our HP support call, I used the standard support line, which offered 24/7 availability. The number listed was 1-800-474-6836. Finding this number was very simple, using both Google and a little site navigation.

The HP support line was all voice navigated and the most frustrating to navigate. You are prompted for the type of product, as well as the product model name. In the case of our dv6500t test notebook, it was quite challenging to get the system to understand what I was saying. The voice prompt misunderstood me three times when I said "DV...." and routed me directly to the TV technical support center. On the 4th try, speaking very carefully, I finally got it to recognize what I was saying. After 4 minutes, I had finally made it to a human.

The technical service representative was frustrating to talk with, and would not assist me without a valid serial number. With some poking and prodding, he put me on hold to talk with his manager to find out if he was allowed to tell me how to manually eject a CD without a verified serial number. After 4 minutes of being placed on hold, he came back and thought that a paper clip used on the tray release hole would do the trick. The total time on the phone was 12 minutes and 30 seconds.

Lenovo Support Call

For our Lenovo support call, we used the United States 24/7 support line. The listed number was 1-800-426-7378, with about 200 additional numbers depending on what country you were located. Finding this list was quite simple using the help of Google and minor site navigation.

One quirk that cropped up with the Lenovo support line was when I first attempted to use my Skype VOIP line from my home. When the support number was dialed, the phone just rang and rang with no pickup from the other end. When I switched to my cell phone to make the call, the line picked up on the first ring.

The Lenovo phone system used a combination of voice and phone prompts to navigate the system. It took about 60 seconds to get routed to a human on the system. The representative required all of my computer and personal contact information before he would start, which added a bit of time to the service call.

After 4 minutes, I started to explain the problem, and received a very odd answer. He explained the drive did not have a manual release to eject a stuck CD, but they would be more than willing to send out a new drive for my notebook. While a new drive would be nice, what about my precious CD that was stuck? After additional hinting towards a possible fix, he finally suggested that a bent paperclip might work using the manual tray release hole. The total time on the phone was 7 minutes and 20 seconds.

Apple Support Call

The Apple technical support line was very easy to find, and it was listed as 1-800-275-2273. The Support page did not shot that the line was 24/7, but it worked just great on the weekend when I called.

Let me preface this support call by saying that I did not expect a quick answer for my standard stuck CD question. The MacBook Pro does not have a quick release on the CD tray, and it requires service to fix. I was hoping for a quick answer stating that fact, and hopefully some recommendation on the closest Apple Store.

The phone system used both voice and phone prompts to navigate to the correct area, and quickly routed me to a human in about 60 seconds. The service rep was very friendly, and was quick to help me once I gave him my information. When I explained the problem of the stuck CD, he asked questions about the noises the system was making, and if dragging the disc to the trash bin would eject the CD.

When I explained that the CD never fully clicked into position, he put me on hold to further research the problem. I was expecting a quick return, and explanation that it would require service, but I never heard from the guy again. I was on hold for 35 minutes and at the 39 minute total time mark, was disconnected from the call and routed back to the original Apple technical service menu. If I was real customer I would have gone crazy at that time.

Since the service was so bad the first time, I gave it another shot the next day during normal business hours. Getting through the phone prompts were just as easy as before and this time around the lady whom I spoke with seemed to be more eager to help me out. We went through some of the same troubleshooting steps such as pressing the eject button, restarting the computer, and so on. In the end she decided to send me to an Apple store for further help, and went as far as scheduling an appointment at my local genius bar. Total time was 6 minutes.

Gateway Support Call

Gateway technical support is set up differently from other manufacturers; they have different contact numbers depending on if the system was purchased directly from Gateway or instead, a retail store. The number I called was the retail support line, which was 1-408-273-0808.

The Gateway support line leads you through multiple voice prompts that require you to explain your intentions as well as share your model number. During this call the system did require multiple corrections, but unlike the HP line, never transferred me to a different support area. In all it took about 2 minutes to get through the voice prompts and finally speak with an agent. The support agent was very friendly and, even though I did not have my serial number handy, helped me along with my support request. Without referencing any support material he knew about the manual release off the top of his head, and quickly solved my problem. With a friendly reminder about locating my serial number in the future, I was done with the call in 4 minutes and 33 seconds.

Conclusion

Besides realizing that I have way too much free time on the weekends, I found that simple things can make the technical support experience either wonderful or frustrating. The interactive voice prompts were hands down the worst part of most calls. With HP, I was rerouted to the wrong area multiple times because the computer kept thinking my "DV6500t" model number meant I was saying "TV", which then cut me off and routed me to the wrong system. In others you had to pronounce the category you wanted multiple times before it would understand you. Having a simple "press 1 for computers ..." made the interaction much easier.

Overall, Dell and Toshiba were the best for ease of access and quick resolution. They had the easiest phone menu systems to navigate, fastest times to talk with an agent, and the shortest overall call length. Gateway ranked 3rd, with the phone prompts being the only negative aspect of the phone call. Lenovo was also very good, but a new optical drive isn't always the best answer when you are trying to get work done now. Apple ranked in the middle with Lenovo when you averaged the poor call experience with the excellent call the next day. HP came in last with the frustrating phone system that was nearly impossible to navigate. While your experience could vary greatly depending on the individual service representative, we hope this gives you an idea of how each company handles support and what to expect from each of them.

PayPal may block Safari users

2008-04-21T14:15:00.001-04:00

By Aidan Malley
Published: 06:20 PM EST

As part of a multi-tiered approach to guarding against online fraud on its site, PayPal says it will block the use of any web browser that doesn't provided added validation measures, potentially restricting the current version of Safari from the e-commerce site.

The money transfer service's Chief Information Security Officer, Michael Barrett, makes the new policy clear in a white paper (PDF) posted this week, which highlights the browser as a key means of putting an end to phishing (false website) scams alongside such steps as blocking fraudulent e-mail messages and criminal charges.

When addressing web access, Barrett argues that any user visiting a financial site such as PayPal should know not only that their browser will block fake sites meant to steal information, but also that the browser can properly indicate a legitimate site. Without either precaution, visitors may not only be victims of scams but may lose all trust in an otherwise safe business. This doubly harmful outcome is likened to a car crash without protection.

"In our view, letting users view the PayPal site on one of these browsers is equal to a car manufacturer allowing drivers to buy one of their vehicles without seatbelts," the expert says.

To that end, PayPal is said to be implementing steps that will first provide warnings against, and eventually block, any browser that doesn't meet these criteria.

Most modern web browsers, including Firefox and newer versions of Microsoft's Internet Explorer, are able to support at least basic blocking of phishing sites. The newest, such as Internet Explorer 7 or the upcoming Firefox 3, also support a new feature known as an Extended Validation Secure Socket Layer (EV SSL) certificate. The measure of authenticity turns the address bar green and identifies the company running the site, letting the user know any secure transactions are genuine.

Safari, however, lacks either of these features and so could fall prey to the blocks and warning messages. Barrett doesn't mention the browser by name but notes that any "very old and vulnerable" software would ultimately be blacklisted from the future update to PayPal's service, placing Safari in the same category of dangerous clients as Microsoft's ten-year-old Internet Explorer 4.

Apple's approach to browser security has so far been tentative. The Mac maker has briefly incorporated Google's database of fraudulent sites into a beta builds of Mac OS X Leopard this past fall, only to pull the feature in later test versions. Release builds of the stand-alone browser for both Macs and Windows PCs have also gone without the anti-phishing warnings, but notably leave code traces inside the software that raise the possiblity of improvements through a later update.

Apple hasn't responded to the white paper but is likely to face pressure as PayPal and similar institutions ask for an all-encompassing approach to fighting scams that involves EV SSL and other software techniques. Internet Explorer 7's debut has already had a demonstrated effect on customers, who are more likely to finish signing up for PayPal knowing that the web browser has authenticated the registration page.

"We couldn’t eradicate this problem on our own – to make a dent in phishing, it would take collaboration with the Internet industry, law enforcement, and government around the world," Barrett explains.

Open source testing tools target varied tasks

2008-04-21T13:45:00.000-04:00

April 18, 2008 (4:00:00 PM)
By: Mayank Sharma

Testing is an important function of the software development process, no matter how big or small the development project. But not every company or developer has access to professional testing tools, which can run into hundreds and even thousands of dollars. The good news is that they don't need them, thanks to the tons of freely available open source software testing tools.

In simple terms there are two major approaches to testing software -- the manual way (a summer intern with a checklist) or through an automated program. With automated testing programs, you can spend a lot of money procuring these tools or distracting yourself from the task at hand by rolling out your customized automated testing software.

Instead, you could head over to sites like Open Source Testing (OST), QAForums, Open Testware, and others that catalog various testing tools and look for something that works for you.

"The largest category of open source testing tools," says Mark Aberdour, who manages OST, "is functional testing tools. This can cover a range of practices from capture-replay to data-driven tests, from Web application testing to Java application testing, and lots more in between." Aberdour, who before his current software development role spent 10 years on the other side of the fence in software testing and test management, says that the list of open source testing tools also includes many performance testing tools and test management/defect tracking tools, as well as a good number of security testing tools.

"If you include unit testing tools, then there are large numbers of tools for the more popular languages, particularly where test-driven development (TDD) is more popular," he says. There are several tools for testing Web and Java applications, but "as is the way in open source," Aberdour says, "if there's an itch, someone will scratch it, so there are tools available for all manner of obscure needs." OST lists testing tools for languages such as PHP, Perl, Ruby, Flash/ActionScript, JavaScript, Python, Tcl, XML, and so on. "The list is probably bigger than I've brought together on OST, and TDD practitioners should head over to testdriven.com, which has more focus on that area."

So how do they compare with the expensive proprietary tools? "In some cases, very well," says Aberdour. He points out WebLOAD and OpenSTA as examples that hold up well in the performance testing market -- no surprise there, since they were both originally commercial tools. Underlining his point, Aberdour says, "You have tools like Wireshark, which is huge in the security market, and Bugzilla and Mantis in the defect tracking sector. In functional testing there are a number of really great tools (Selenium, Abbot, Jameleon, jWebUnit, Marathon, Sahi, soapui, and Watin/Watir to name a few) with strong feature sets."

According to Aberdour, in addition to the tool itself, the advantage of the commercial tools is often their integration with an automated software quality (ASQ) suite, and of course an established company behind them, which will feature in a lot of people's selection criteria. Here again things are looking good for open source testing tools. Aberdour points out the RTH test case tool which integrates with Watir, HttpUnit, JUnit, MaxQ and the commercial WinRunner. Even bug trackers like Mantis and Bugzilla integrate with functional testing tools and test case tracking tools.

When it comes to reliability and accuracy, Aberdour says the classic open source arguments apply. The popular tools are tested and used by a high number of people, and many of the tools have evolved large and sustainable communities with many people feeding back on quality-related issues. "For many of these tools, innovation is high and release processes rapid. Yet it is not a free-for-all -- the code base may be open, but write access to the repository is closely guarded, and developers have to earn the right to commit."

According to Aberdour, the main issue for people using the tools is not whether their need is served, since in most cases you will find a tool to do the job, but whether the tool is mature enough to invest in. "Test automation is a major undertaking that has high costs in terms of upskilling your test team and creating test scripts, etc., and people need to know that the tool is a good investment, whether or not there is a license fee to pay. People will be asking if the tool is going to be around in five years' time, what levels of support are available, how good is the feature innovation, bug fixing, release schedules, and so on." Aberdour thinks there is a big gap in selection and evaluation support and paid technical support services, which is what he wants to focus on next with OST.

Of course there are strong and sustainable communities around the more popular tools that provide excellent support, but Aberdour says the market isn't at the point yet where there is a lot of commercial support available. Yet there are some examples of support companies evolving around open source products, and a lot of the product teams will hire themselves out. "In a commercial sense this market is still quite young, but it will mature, and when the product integration, community maturity, and commercial support are right, it has the potential to be highly disruptive. Gartner reckons the ASQ market is worth $2 billion a year, and while Hewlett-Packard and Mercury absolutely dominate, there are hundreds of smaller proprietary vendors at real risk from open source disruption. Things are certainly moving in the right direction."

Open source testing tools offer great performance and are a bargain compared to proprietary testing tools. The lack of a formal and consistent support structure might work against some tools being used to test mission-critical apps. But if you are an open source developer or with a software development company pondering over your testing budget, spend some time checking out the testing tools Web sites and forum boards. You might save yourself some serious bucks.

Howto setup Database Server With postgresql and pgadmin3

2008-04-21T13:37:00.003-04:00

Posted by admin on April 14th, 2008

PostgreSQL is a powerful, open source relational database system. It has more than 15 years of active development and a proven architecture that has earned it a strong reputation for reliability, data integrity, and correctness. It runs on all major operating systems, including Linux, UNIX (AIX, BSD, HP-UX, SGI IRIX, Mac OS X, Solaris, Tru64), and Windows. It is fully ACID compliant, has full support for foreign keys, joins, views, triggers, and stored procedures (in multiple languages). It includes most SQL92 and SQL99 data types, including INTEGER, NUMERIC, BOOLEAN, CHAR, VARCHAR, DATE, INTERVAL, and TIMESTAMP. It also supports storage of binary large objects, including pictures, sounds, or video. It has native programming interfaces for C/C++, Java, .Net, Perl, Python, Ruby, Tcl, ODBC, among others.

pgAdmin III is the most popular and feature rich Open Source administration and development platform for PostgreSQL, the most advanced Open Source database in the world. The application may be used on Linux, FreeBSD, OpenSUSE, Solaris, Mac OSX and Windows platforms to manage PostgreSQL 7.3 and above running on any platform, as well as commercial and derived versions of PostgreSQL such as EnterpriseDB, Mammoth PostgreSQL, Bizgres and Greenplum database.

pgAdmin III is designed to answer the needs of all users, from writing simple SQL queries to developing complex databases. The graphical interface supports all PostgreSQL features and makes administration easy. The application also includes a syntax highlighting SQL editor, a server-side code editor, an SQL/batch/shell job scheduling agent, support for the Slony-I replication engine and much more. Server connection may be made using TCP/IP or Unix Domain Sockets (on *nix platforms), and may be SSL encrypted for security. No additional drivers are required to communicate with the database server.

Install Postgresql and pgadmin3 in Ubuntu

PostgreSQL 8.2 version will be installed in Ubuntu 7.10 (Gutsy Gibbon)

sudo apt-get install postgresql-8.2 postgresql-client-8.2 postgresql-contrib-8.2

sudo apt-get install pgadmin3

This will install the database server/client, some extra utility scripts and the pgAdmin GUI application for working with the database.

Configuring postgresql in Ubuntu

Now we need to reset the password for the ‘postgres’ admin account for the server

sudo su postgres -c psql template1
template1=# ALTER USER postgres WITH PASSWORD ‘password’;
template1=# \q

That alters the password for within the database, now we need to do the same for the unix user ‘postgres’:

sudo passwd -d postgres

sudo su postgres -c passwd

Now enter the same password that you used previously.

from here on in we can use both pgAdmin and command-line access (as the postgres user) to run the database server. But before you jump into pgAdmin we should set-up the PostgreSQL admin pack that enables better logging and monitoring within pgAdmin. Run the following at the command-line

we need to open up the server so that we can access and use it remotely - unless you only want to access the database on the local machine. To do this, first, we need to edit the postgresql.conf file:

sudo gedit /etc/postgresql/8.2/main/postgresql.conf

Now, to edit a couple of lines in the ‘Connections and Authentication’ section

Change the line

#listen_addresses = ‘localhost’

to

listen_addresses = ‘*’

and also change the line

#password_encryption = on

to

password_encryption = on

Then save the file and close gedit.

Now for the final step, we must define who can access the server. This is all done using the pg_hba.conf file.

sudo gedit /etc/postgresql/8.2/main/pg_hba.conf

Comment out, or delete the current contents of the file, then add this text to the bottom of the file

DO NOT DISABLE!
# If you change this first entry you will need to make sure that the
# database
# super user can access the database using some other method.
# Noninteractive
# access to all databases is required during automatic maintenance
# (autovacuum, daily cronjob, replication, and similar tasks).
#
# Database administrative login by UNIX sockets
local all postgres ident sameuser
# TYPE DATABASE USER CIDR-ADDRESS METHOD

# “local” is for Unix domain socket connections only
local all all md5
# IPv4 local connections:
host all all 127.0.0.1/32 md5
# IPv6 local connections:
host all all ::1/128 md5

# Connections for all PCs on the subnet
#
# TYPE DATABASE USER IP-ADDRESS IP-MASK METHOD
host all all [ip address] [subnet mask] md5

and in the last line, add in your subnet mask (i.e. 255.255.255.0) and the IP address of the machine that you would like to access your server (i.e. 138.250.192.115). However, if you would like to enable access to a range of IP addresses, just substitute the last number for a zero and all machines within that range will be allowed access (i.e. 138.250.192.0 would allow all machines with an IP address 138.250.192.x to use the database server).

That’s it, now all you have to do is restart the server

sudo /etc/init.d/postgresql-8.2 restart

That’s it you can start using postgresql in Ubuntu

Create a Database from command line

You can also use pgadmin3 for all postgresql related

To create a database with a user that have full rights on the database, use the following command

sudo -u postgres createuser -D -A -P mynewuser

sudo -u postgres createdb -O mynewuser mydatabase

Rethinking Gobuntu

2008-04-21T13:35:00.000-04:00

Sun, 2008-04-20 20:22 — Magic Banana

In a few days, both the gNewSense and Gobuntu project will release a new version of their distributions. Based on Ubuntu Hardy Heron, they will aim at satisfying the most exigent users in terms of freedom. This apparent duplication of work may not perpetuate. Indeed, some developers behind Gobuntu (including Mark Shuttleworth himself) think of "channelling the energy from Gobuntu into gNewSense".

I was visiting the archives of the gobuntu-devel mailing list when I found this message from Mark Shuttleworth. Questioning the future of the Gobuntu project, he posted this message six days ago:

"Perhaps we really are on the wrong track, that the only way to meet the
needs of the gNewSense folks is to have completely different source
packages to Ubuntu. If that is the case, then I think it would be better
to channel the energy from Gobuntu into gNewSense.

I had hoped to see more participation and collaboration around Gobuntu
because of the benefits of keeping up with the standard Ubuntu (regular
releases, security updates etc). However, it seems that the audience for
a platform like this is willing to accept infrequent releases and less
maintenance in return for a platform which can be modified more
radically. That's OK, it's just a bit unexpected - I thought we could
get the best of both worlds, with six-monthly releases of something that
excluded *binary package* that were controversial in the eyes of the
FSF, but retained access to everything else in Ubuntu.

I don't mind having been wrong in that expectation, I can see the
arguments in favour of less collaboration in the case where it is more
important to be different than to have infrastructure in common, and
from what I've seen on this list, the desire to be different (have
different source packages as well as binary packages) is stronger than
the desire to collaborate (share infrastructure, release cycles etc).

I'm not sure that the current level of activity in Gobuntu warrants the
division of attention it creates, either for folks who are dedicated to
Ubuntu primarily, or to folks who are interested in gNewSense. I would
like us to have a good relationship with the gNewSense folks, because I
do think that their values and views are important and I would like
Ubuntu to be a useful starting point for them. But perhaps Gobuntu isn't
the best way to achieve that.

So, I would like to hear from the gNewSense guys how they would like to
be involved in Ubuntu, to help ensure that Ubuntu is a useful starting
point for their important work. If Gobuntu is not the best way to
achieve that, then I think we should stop working on it and encourage
folks who want that to focus their efforts on gNewSense, while at the
same time figuring out how Ubuntu can be more useful for gNewSense.

Mark"

First of all, let us notice how Mark Shuttleworth cares about the users' will of freedom. Although he can be considered as the spiritual father of Gobuntu, he somehow encourages the Gobuntu's developers to move to gNewSense if the purpose of the Gobuntu project would be better achieved through gNewSense. He even thinks of helping gNewSense by making Ubuntu "more useful" for it. Such a philanthropy is remarkable.

Thus, Ubuntu's leader suggests that the users would benefit from having one single Ubuntu derivative strictly following the Free Software Foundation views on a truly Free Operating System. This GNU/Linux distribution would be gNewSense because it maintains independent repositories, whereas Gobuntu shares them with Ubuntu. Let us recall the advantages of this independence:

* The ability to modify a package containing some proprietary blobs (e.g., the Linux kernel) or presenting other troubles (e.g., Firefox, which, somehow, encourages the installation of proprietary extensions) instead of removing it.
* No affiliation with any repository of proprietary softwares (enabling the Restricted or the Multiverse repository in Gobuntu is a matter of one click in Synaptic).
* Beyond the repository themselves, working on Ubuntu's package system means using Launchpad, a Web application distributed under a proprietary license.

In addition, gNewSense is endorsed by the Free Software Foundation. Kurt von Finck, one of the main developer behind Gobuntu, focuses on this while confirming the bridge-building with gNewSense. Here is what he wrote a few hours before Mark Shuttleworth's message:

"Gobuntu is 100% free software. The CD image provided to you
contains nothing but free code. But with Gobuntu you are free to add (or
subtract) what you see fit, and the Ubuntu repositories make it
trivially easy to do so. Thus, while Gobuntu is free software as defined
by the FSF, RMS will not recommend it personally.

Now, all that having been said, please be aware that Paul O'Malley from
the gNewsense project and myself have plans to discuss these very issues
at the Ubuntu Developer's Summit in May. Questions vis-a-vis Gobuntu and
gNewsense are arising frequently, and need to be answered definitively
so we can all get back to work and stop playing politics.

Before anyone takes my remarks here as some sort of "official" statement
(which they most assuredly are not) I would ask that you refrain, and
instead wait for the fruits of the UDS conversations between Mark, Paul,
FSF staff, and yours truly.

We'll get the discussion times on the UDS agenda, and everyone is
welcome to participate when the time comes.

Flame on.

--

./k

Kurt von Finck

Senior Ubuntu System Support Analyst
Canonical, Ltd."

All in all, the discussion on the gobuntu-devel mailing list is very similar to the one I had a few months ago. For the targeted public, it seems that the gNewSense advantages in terms of ideological pureness rise above the more pragmatical concerns Mark Shuttleworth and all Gobuntu's developers thought to be essential.

Furthermore, from the next release of Ubuntu, the need for the Gobuntu project becomes less pressing. Indeed, on the gobuntu-devel mailing list (definitely an interesting source of information!), I discovered this other message:

"Current Ubuntu CD images now have a "Free software only" checkbox on the
"Boot options" menu (select language and then press F6 twice). This
should make things easier for people who happen to have an Ubuntu CD to
hand and want to install a system without anything from the restricted
component.

As of last week, this actually works when installing from the desktop CD
too. While there are some packages from restricted in the live
filesystem, when you select this boot option they will be removed from
the target system after the bulk file copy has taken place. It turns out
that this wasn't as hard to do as I'd thought - a mere 13 lines of code!

Cheers,

--

Colin Watson"

Although no official position has been decided yet, Gobuntu Hardy Heron may be the ultimate version of this project. Some of its developers may move to gNewSense while some other may continue to help in tracking proprietary blobs in Ubuntu's repositories. GNewSense would eventually gain more developers and some help from the Ubuntu project. Gobuntu would, somehow, be integrated to Ubuntu through a boot option. In the end, the winner would neither be gNewSense, nor Gobuntu. It would be the user.

Add faceted search to Thunderbird with Seek

2008-04-21T13:33:00.000-04:00

By Dmitri Popov on April 21, 2008 (9:00:00 AM)

Do you struggle to keep tabs on your Thunderbird inbox? The SIMILE Seek extension might be the answer to your problems. The extension adds faceted browsing to Thunderbird, which allows you to search and manage your email messages in a radically different way than you are used to.

To better understand how faceted browsing works, take a look at sites like the venerable Open Directory Project. The site allows you to narrow your search by filtering the data by the criteria, or facets, you choose. For example, you may start with a broad category called Computer, then narrow it to Open Source, then Software, and so on. Each time you choose a category, you effectively add a facet to your search, and thus make it more precise.

The Seek extension can help you to search your email in a similar manner. Once installed, Seek adds a panel to Thunderbird's interface with several default facets. Each facet displays search results for the criteria it represents. For example, the Tag facet shows all the tagged emails grouped by their tags. The Recency facet displays all emails received today, the day before, within a week, and so on.

Each facet not only provides a quick overview of the messages that match the facet's criteria, but also lets you filter the results. For example, you can view messages tagged as Important by clicking on the Important tag in the Tag facet. Another way to narrow search results is to use the "Type to filter" field in some of the facets. Start entering a search criteria in the field, and the facet narrows the search results as you type. You can, of course, refine the search results by combining several facets. For example, you can quickly find messages sent directly to you (the To CC/me facet) by a particular person (the From facet) the day before (The Recency facet). You can see the number of messages matching the chosen facets in the Results pane, which contains a few other useful features. Using the search field, you can combine more traditional text search with faceted browsing. And if you tick the Include whole threads check box, Seek groups the messages into threads, giving you a better overview of your correspondence.

You can easily rearrange facets in the Seek panel by using drag and drop. You can also remove some of the default facets and add more facets by choosing them from the list of available facets. So, if you don't use tags, you can replace the Tag facet with something else; for example, the Priority facet.

Seek also boasts an impressive visualization feature, which is based on another nifty tool from the SIMILE project called Timeline. Select Visualize from the drop-down list in the Results pane, and Seek maps the email messages on a visual timeline. At least this is how it's supposed to work in theory. In practice, however, I couldn't make this feature work. Every time I tried it, the extension threw an error message complaining about an unresponsive script.

Another of Seek's weak points is that the extension performs indexing every time you select a folder. It's not a big problem if the folder contains a couple of hundred messages, but it can become an issue if you have thousands. For example, on my machine, it took Seek 1 minute and 12 seconds to index a folder containing 10,338 emails. While this is pretty fast, it's still quite a nuisance if you switch often between different folders. To work around this problem you can enable Seek only when needed, and then deactivate it when you are done searching, by pressing the Disengage link.

Despite these drawbacks, Seek is by far the most impressive and innovative extension for Thunderbird out there. If you want to beef up your email client with powerful search capabilities, Seek is worth a try.

Every Monday we highlight a different extension, plugin, or add-on. Write an article of less than 1,000 words telling us about one that you use and how it makes your work easier, along with tips for getting the most out of it. If we publish it, we'll pay you $100. (Send us a query first to be sure we haven't already published a story on your chosen topic recently or have one in hand.)

Baker College wins National Collegiate Cyber Defense Competition

2008-04-21T13:29:00.001-04:00

By Joe Barr on April 21, 2008 (4:00:00 PM)

Baker College of Flint, Mich., defeated defending champion Texas A&M University and four other regional winners from across the country to capture the third annual National Collegiate Cyber Defense Competition, which concluded in San Antonio, Texas, over the weekend. Texas A&M finished a close second, and the University of Louisville took third. Also competing for the championship were the Community College of Baltimore County, Mount San Antonio College of Los Angeles County, and the Rochester Institute of Technology.

Hosted by the Center for Infrastructure Assurance and Security (CIAS) at the University of Texas at San Antonio (UTSA), the event pits six regional winners, each given a similar small enterprise network to protect, against a team made up of experienced security professionals dubbed the Red Team, a.k.a. Team Hilarious.

Teams are scored on how well they protect their identical networks, made up a Cisco router and five servers: Windows 2003 running Internet Information Services, Windows 2000 running DNS, Solaris X86 running Apache and OpenSSL, Gentoo running MySQL and NFS, and BSD running Sendmail. Team workstations can run Vista, Windows, Fedora, or BSD, as the team prefers. Teams are required to provide SMTP, POP3, HTTP, HTTPS,and DNS services throughout the competition, and outages on any of those services result in deductions from their score. At specified times, the teams are also asked to bring up FTP, SSH, RDP, and VNC services, in accordance with the 2008 competition rules.

In addition to the attackers (the Red Team) and the defenders (the Blue Teams), there is also a White Team. The White Team acts as the overall network operations center, observers, and as communications center. All requests for information, assistance, and problem reporting by the competing teams go through the White Team; teams are not allowed direct communication with the outside world except for publicly available information and software available on the Internet. The White Team also delivers in-competition requests for new services and scores the teams' performance.

The entire event took place at the San Antonio Airport Hilton hotel, and each team (Red, White, and each competing Blue team) had its own private, closely guarded room. A White Team observer was present in each competing team's room for the entire competition.
Team Hilarious

Red Team captain Dave Cowen has a jovial face and a pirate's beard. When his laughter could be heard in the hall outside the Red Team room, collegians winced, because they knew that another server has just fallen prey to the Red Team's relentless attacks.

The other Red Team members (first names only) Luke, Ryan, Evan, Jacob, and Leon are all professionals in the security industry. On Friday, the first day of the competition, the Red Team had the adrenaline of the hunt, the chase, the pursuit of hapless quarry, in the air, as team members sat around the conference table, staring into the screens of their laptops, some using two laptops at once, and sharing information as they gleefully began probing the target networks for weaknesses and mapping IP addresses to specific configurations.

One of the first remarks heard after the competition began was, "Interesting, the Solaris exploit from last year still works." That was followed shortly by Dave Cowen announcing "OK, professionals, we need a local Solaris 5.10 exploit for privilege escalation."

In addition to a few members of the press, the Red Team room was also visited by various federal agents. A contingent from the Secret Service was present all weekend. Three black-suited gentlemen claiming to be from the FBI were present Friday. Defense Information Systems Agency agents were present as part of the competition infrastructure, and among their other duties, helped escort journalists from room to room during the event.

The mood in the Baltimore County Community College Blue Team room Friday afternoon was in stark contrast with the lightness and laughter heard in the Team Hilarious room. All seven team members were focused on the job at hand, which was to begin securing the network they found running at the start of the competition. Voices were muted, there was no idle chatter, and everyone was busy at whatever task they had been assigned.

Teams are allowed to modify the configurations as they see fit during the event, so long as they follow the rules and provide the required services. The configuration itself seems to have been a weak spot for defending the networks, and at the end of the competition on Sunday, Cowen said that you reach a point where the configuration is more important than the supply of exploits available to attackers. He made that remark not long after hacking a team's Web server so that it displayed their credit card database as its homepage during the last half hour of the competition.

A two-hour awards luncheon took place shortly after the end of competition Sunday morning. There were speeches by US Representative Ciro Rodriguez and Cornelius Tate, the brand-new Director of the DHS Cyber Security Division, prior to announcing the winners. This year's competition was the closest ever, with three teams in a virtual tie after the second day, and Baker edging defending champion Texas A&M by the slimmest of margins at the end. Whether they took home the gold or not, all the teams were made up of bright, skillful students, and given the presence of two community college teams in the final six, it's obvious that the size of the school is not as important as the skill of its students in the world of cyber defense.

Baltimore County Community College, the only team with a female competitor, and Mount San Antonio Community College in Los Angeles, proved that network security skills are not the exclusive domain of larger, better-known institutions. Their presence at this national competition is roughly the equivalent of a community college basketball team making it to the NCAA's Final Four, and both schools and students deserve kudos for going head to head against teams from much larger schools, especially since those schools may include two graduate students on their team.

Dr. Gregory White, director of the UTSA CIAS, one of the founders of the original competition when it was held on a regional basis rather than nationally, explained there is a large network and computer security population in San Antonio, primarily because the Air Intelligence Agency is located there. UTSA was a logical place to become an academic center for computer and network security. That led to it become the first Texas university to be designated as a "Center for Academic Excellence in Information Assurance Education" by both the DHS and the National Security Agency, and it currently offers bachelor and masters-level degrees in information security from several of its schools.

Sponsors for this year's event included the AT&T Foundation, DHS, Cisco Systems, Acronis, Northrop Grumman, Accenture, the Information Systems Security Association, Core Security, our sister site ThinkGeek, Code Magazine, and Pepsi. White said that more sponsors are needed for future competitions in order to do all the things CIAS wants to accomplish.

What's the right filesystem for your portable backup drive?

2008-04-16T16:08:00.001-04:00

By Nathan Willis on April 16, 2008 (7:00:00 PM)

So you just bought an external hard drive for backups. Now, with what filesystem should you format it? Ext2? FAT32? No matter which one you choose, there are trade-offs to consider.

You face the same choice whenever you buy a USB thumb drive, but for a backup drive, a lot more is at stake. Those backups have to be there and be reliable when disaster strikes. On the one hand, you need to preserve your data and your metadata, so not just any filesystem will do. But on the other, if you're not at your home base, you need to be able to access it from anywhere, so you can't be too obscure.

Back in February, my streak of never needing to restore from backup came to an end (though my no-hard-drive-failure streak is still running strong at 11 years). Filesystem corruption zapped some work from my laptop while I was on the road. It was not a sizable amount in the grand scheme of things, but inconvenient in that it happened while I was away from home base. Once I returned, I started shopping for a pocket-sized external hard drive to carry around to deal with such occasions in the future.
Evil number one: Old and FAT

If a drive comes formatted out-of-the-box, it likely uses FAT32 -- the old Microsoft classic guaranteed to be readable on any computer modern enough to have the right physical connector. You can use FAT32 for a backup drive and be safe in the knowledge that you can retrieve files from it on a Linux, Windows, or Mac OS X system. But FAT32 limits individual file sizes to 4GB, a restriction way too small for video editing and increasingly for DVD ISOs and virtual machine images. More importantly, FAT32 does not support Unix file permissions, adding hassle to restoring ownership and write permission to backup recovery.

NTFS overcomes those technical limitations, but its write support under Linux and OS X is, at best, a problematic hurdle. That makes it risky: a backup system that is a daily hassle to write to is a backup system that doesn't get used. Getting out of that habit is the last thing you want to do.
Evil number two: Nobody understands me

Ask for advice on formatting an external drive in a Linux forum, and the traditional answer is ext2. It is the standard native-to-Linux filesystem -- a reliable, no-nonsense choice for well over a decade, and thanks to its compatibility with successor ext3, unlikely to disappear from Linux in the foreseeable future.

All of which makes ext2 a good option as long as you live in a perfect world, in which no matter where you go there is a Linux computer handy. But if you occasionally find yourself in a room with one of the 90% of the world's PCs that run Windows, you will find it unable to read ext2 partitions.

There are two actively developed projects to bring ext2 support to Windows. The Ext2 Installable File System (IFS) implements system-level read/write access for Windows systems from NT 4.0 to Vista. It is regarded as generally stable, although it does not respect Unix file permissions, and cannot read Logical Volume Manager (LVM) volumes. It is freeware, but not open source.

Ext2fsd is GPL-licensed, and supports many of the same features as Ext2 IFS. It does not run on Windows NT or on Vista, though, and its developer cautions that it is not to be regarded as stable. It does not support LVM, but the latest development builds do support reading ext3 journals.

On Macs, the only option is ext2fsx, an open source project that appears to have gone dormant late in 2006. It was last verified to support OS X version 10.4. Recent rumblings among a new set of developers in the project's discussion forum indicate a growing interest in resuming development, so 10.5 users may not be left out in the cold for long.
Calculating which is the lesser

Not a particularly heartening choice, is it? Everything can read FAT32, but you'll lose your file permission settings and will have to take special measures to split up oversized files. Ext2 will be a breeze to use in Linux, but you will have to find another Linux system to read it.

You can address the latter point by always carrying around a bootable Linux CD or flash drive, or perhaps keeping a copy of the ext2 tools for Windows and Macs on portable storage as well. That is a workable solution, although it adds complexity and additional points of failure. Scratch or lose your portable Linux image and you are back to square one. Plus, the ext2 solutions for the proprietary OSes all require administrator privileges to install -- something you may not have access to in an emergency disaster recovery scenario.

But then again, how many files do you actually have that exceed 4GB in size? Are file ownership and permissions for data (i.e. not system) files really that difficult to restore, compared to the time required to reinstall the OS itself after a hard drive failure?

What I have done in the past is use ext2 for the bulky 3.5-inch backup disk attached to my desktop system at home, and FAT32 on the pocket-sized portable drive I take on the road. Neither approach is a perfect solution, but considering the different steps I'd likely have to take to recover from a failure in both circumstances, at least that approach simplifies a quick recovery in both.

But my choice certainly isn't the only reasonable way to look at it. What strategy do you use, and when disaster strikes, how has it fared?

A year later, sales of Linux on Dell computers continue to grow

2008-04-16T11:00:00.000-04:00

Sales figures not released, but program is thriving, Dell says

April 14, 2008 (Computerworld) As Dell Inc. approaches its one-year anniversary of selling laptop and desktop computers preloaded with Ubuntu Linux, the company is continuing to expand the fledgling program to new computer models and markets.

In interviews at Dell's Parmer campus north of Austin last week, four Dell representatives said sales of the Linux-loaded machines are encouraging.

Though they declined to give sales figures for the Linux-equipped machines, the Dell officials were adamant in saying that the program wouldn't be continuing or adding new models if the sales figures were not adequate.

"A [sales] number is not going to validate it as much as our actions to date," which include adding new models and configurations, said company spokeswoman Anne Camden.

Dell first offered Linux on its machines in 1999, when it installed Red Hat Linux on a selection of Dell servers, said Matt Domsch, the company's Linux technology strategist in the CTO's office. A short time later, Dell tried selling consumer-focused laptops with Red Hat Linux, but the effort was not sustained due to inadequate demand.

Dell has continued to sell enterprise servers with Linux since that 1999 debut, Domsch said. The recent Linux-on-Dell program for laptops and desktop machines, however, has been gaining momentum, he said. "If the program wasn't successful, we wouldn't be able to continue it," Domsch said.

The machines can be configured and ordered at the company's Dell and Linux Web page. In January, Dell announced another Linux-loaded laptop machine, with a host of high-performance features.

The Linux-on-Dell idea emerged in February 2007, after CEO Michael Dell debuted a new company-hosted blog called IdeaStorm, where customer could offer ideas and input on prospective new products and services. More than 100,000 people posted comments about wanting to see the company sell computers straight from the factory with Linux preloaded.

Ten weeks later, in May last year, Dell announced that it would begin selling Linux-loaded machines to consumers and businesses.

So far, Dell hasn't advertised Linux on its machines in consumer advertising campaigns; rather, it's relying on open-source enthusiasts seeking out the machines on the Dell site. Those people are often the same ones who suggested the combination in the first place.

"Those who care, know" that Dell is selling the machines, said Russ Ray, a Dell product marketing representative. "If you know Linux, you're going to know we sell Dell products with Linux on them."

Consumer-focused ads featuring Linux on Dell could appear at some point, Ray said, but it's not critical to the company. "I think that will occur when there's a reason for that to occur," he said. "We would like to get to a place where to some degree, it really doesn't matter" to consumers which operating system is on the machines.

For business users, there has been a growing interest in the Linux-on-Dell program, Ray said. "We have had many inquiries" regarding cost savings, infrastructure needs, desired applications and compatibility with existing Unix systems, he said. "It's the stuff that you would assume."

John Hull, manager of Dell's Linux engineering department in its Global Solutions Engineering division, said that two years ago, he would never have expected such a program to get started.

The Linux-on-Dell program has made Dell machines more desirable for users who are seeking alternative operating systems to Microsoft Corp.'s Windows, Hull said. "People might have looked at other brands previously but are now looking at Dell because of Linux," he added. "We started in the big markets, where they were asking the loudest, and we went from there."

The company has employees who monitor a wide variety of blogs, looking for discussions involving consumers who are seeking information on Linux, laptops and desktops, Camden said. The employees identify themselves and post replies pointing people to Dell and its Linux offerings. "They evangelize it on that kind of level," she said.

The iPhone SDK and free software: not a match

2008-04-15T19:39:00.000-04:00

By Nathan Willis on April 15, 2008 (7:00:00 PM)

Apple's recently released a software development kit (SDK) for the iPhone, but if you were hoping to port or develop original open source software with it, the news isn't good. Code signing and nondisclosure conditions make free software a no-go.

The SDK itself is a free download, with which you can write programs and run them on a software simulator. But in order to actually release software you've written, you must enroll in the iPhone Developer Program -- a step separate from downloading the SDK, and one that requires Apple's approval.

Since its release, many in the free software and open source community have debated whether the terms of the iPhone Developer Program are compatible with common licenses such as the GPL. In a search for a definitive answer, we asked the principal parties themselves. Apple did not reply to our inquiries, but Free Software Foundation (FSF) Licensing Compliance Officer Brett Smith was happy to discuss the licensing issues in depth.

First, let's look at the SDK and the developer program that accompanies it.

To download the SDK, you must first sign up for a free Apple ID -- an existing Apple Developer Connection, .Mac, or iTunes Store account will do -- and use it to register with Apple as an iPhone Developer. The SDK by itself won't let you create applications that run on actual iPhone devices, though. To do that, you must enroll in Apple's iPhone Developer Program, for a fee starting at $99.

For the time being, Apple is not accepting all applicants. Currently only US residents age 18 and up are eligible, and Apple is selecting a limited number of applicants. Who gets approved and speculation as to why are popular discussion topics on Apple-centric Web sites.

If your application is approved, a document called the Registered iPhone Developer Agreement lays out the terms and conditions under which you can create iPhone apps. It is those conditions that conflict with free software licenses like the GPL.
Problem: code signing

The iPhone Developer Program establishes Apple as the sole provider of iPhone applications. You can choose not to charge for an app you author, but the iTunes Store is the only channel through which it can be delivered to end users and installed. Apple signs the apps it approves with a cryptographic key. Unsigned apps won't run on the iPhone.

This condition conflicts with section 6 of the GPLv3, the so-called "anti-TiVoization" provision. In particular, it prohibits Apple from distributing a GPLv3-licensed iPhone application without supplying the signing keys necessary to make modified versions of the application run, too.

Thus, you as the developer could attempt to place your code under the GPLv3, but Apple could not distribute it -- and since only Apple-signed programs will run, no one else could distribute it either.

The FSF's Smith says the fact that the author of the program (i.e., you) and the distributor of the binary (i.e., Apple) are unrelated entities makes no difference. "If a program is meant to be installed on a particular User Product, GPLv3 imposes the same requirements about providing Installation Information whether the software is directly installed on the device or conveyed separately."

Because of the GPL's viral nature, any app that is derived from other GPLv3 code must be licensed in a way that preserves GPLv3's code signing requirement. But there are still projects that have chosen to retain earlier licenses, such as GPLv2, and prior versions of the GPL did not include the code signing requirement. Thus you could in theory place your work under GPLv2, as long as it was either entirely original or derived only from code licensed under GPLv2 and earlier. But the result still would not qualify as free software, since no one could alter your source code and run the modified result on their phone.

As Smith explains, "partially free" software is still non-free. "The Free Software Definition is not a checklist, where software that fulfills three of the criteria is somehow 'better' than software that only meets two. The Free Software Definition lists the bare minimum rights you need to make sure that the software works for you, instead of somebody else. If you've been deprived of any single one of those rights, whether by a license, a patent, code signing, or any other means, then you've lost your freedom. You no longer control the computer; it controls you. Getting some source is a small consolation prize for losing your own autonomy."

But the aforementioned situation is only an option if Apple would allow you to release the source....
Problem: nondisclosure

Unrelated to the code signing complication is another issue that restricts your choice of licenses. The Registered iPhone Developer Agreement is a contract between the developer (you) and Apple. If you violate any of the terms and conditions of the agreement, you lose your right to use the coding utilities in the SDK and all of its information and documentation.

Section 3 of the document is a nondisclosure agreement (NDA). It defines "all information disclosed by Apple to you that relates to Apple's products, designs, business plans, business opportunities, finances, research, development, know-how, personnel, or third-party confidential information" as "Confidential Information" -- excluding specific information that is available elsewhere. You must agree not to "disclose, publish, or disseminate" any of the aforementioned Confidential Information, and not to use it "in any way, including, without limitation, for your own or any third party's benefit without the prior written approval of an authorized representative of Apple in each instance."

Those broad restrictions may be standard issue for an NDA, but they constitute a binding agreement that trumps your usual right to place a license of your choosing on your source code. As Smith puts it, "If you agree to an NDA that prohibits you from sharing your program's source, then you cannot release that program under the GPL, or incorporate any GPL-covered code in it."

Publicly releasing source code that uses the iPhone APIs as documented in the SDK and Developer Program could easily fall under the definition of "disclosing," "publishing," or "disseminating" Confidential Information, as none of the iPhone APIs are documented elsewhere. A clearer word from Apple regarding what exactly constitutes "disclosing," "publishing," and "disseminating" would be helpful, but until the company makes such a clarification, the conservative interpretation is the safest.

You could ask Apple for permission to publish your source code, but in the absence of such permission, violating the agreement terminates your right to use the SDK and to publish your software, regardless of the license you choose.

Finally, the fact that currently only US residents age 18 and older can even sign up for the iPhone Developer Program disqualifies many free software developers right out of the gate. The US-only restriction will likely be lifted, just as the devices themselves have been rolled out country by country. But the Registered iPhone Developer Agreement is intended to serve as a binding contract, so the age restriction is certainly here to stay.

There are other restrictions on what iPhone applications are allowed to do, which some might consider barriers to free software. The limitations already discussed affect all apps, regardless of function.
Freedom!

Of course, the code signing and NDA hang-ups apply only to developers who sign up for the program. Reverse-engineer the iPhone and you can code to your heart's content. So long as you do not expose yourself to the official SDK, you can license your work however you want.

All of the third-party iPhone apps available up until now are the result of jailbreaking the devices, a pastime at least partly responsible for Apple's decision to create an iPhone SDK in the first place.

To its credit, the Apple development community seems to recognize the limitations of the iPhone SDK as they apply even to non-free software, and is writing about them.

As the iPhone SDK Era begins, it is interesting to look back at what the FSF had to say about the launch of the device itself. The FSF launched GPLv3 on the same day that Apple launched the iPhone, and used the event to address the restrictions placed on iPhone owners.

Executive Director Peter Brown described the device as "crippled, because a device that isn't under the control of its owner works against the interests of its owner." The document goes on to cite DRM locks and "TiVoization" as the principal problems.

In the months since those words were written, the TiVoization problem might have sounded abstract, but the details of the iPhone SDK make it crystal clear -- you cannot write free software for the iPhone, even if you want to.

Steve McIntyre elected Debian Project Leader 2008

2008-04-15T19:37:00.000-04:00

The winner of the Debian Project Leader (DPL) 2008 election is Steve McIntyre, His term as DPL will extend for one year starting on April 17th, 2008.

The details of the results shall soon be up at the election page as per the results announcement email. You can read all three DPL 2008 candidate platforms at the election page.

You can also see a graphical output of the process at this page. This year, over 49% of developers eligible to vote sent their votes to the Condorcet system.

Organizations without a common understanding of authority and leadership can not survive in the long term. And those with direct democratic forms of participation do not tend to scale well and are noted for their difficulty managing complexity and decision-making, leading to failure.

The Debian Project community designed and evolved a solid governance system since 1993, having established shared conceptions of formal authority, leadership and meritocracy, limited by defined democratic adaptative mechanisms.

Since its foundation in 1993, the Debian Project had four phases of its governance system and five conceptions of leadership and meritocracy.

Between 1997 and 1999, the community drafted a Constitution to formalize leadership roles, rights and responsibilities. It was ratified using itself, as a test case.

The governance system was validated in 2006, when a crucial conflict was resolved within the approved framework.

The Debian Project Leader 2008 election is another confirmation of the suitability of the framework to the Project objectives, defined by the Debian Social Contract, the Debian Constitution, ratified at Debian Policy, and one of the reasons why its developers are so committed.

The evolution of the Debian Project's system of governance was thoroughly studied by Siobhán O'Mahony, Assistant Professor at the University of California's Graduate School of Management, and Fabrizio Ferraro, General Management Professor at IESE. You can read more about it at this page , which includes a link to the complete scientific study with detailed research data and analysis.
About the Debian Project

Debian GNU / Linux is one of the free libre operating systems ( GNU/Linux, GNU/Hurd, GNU/NetBSD, GNU/kFreeBSD), running 18733+ officially maintained packages on 15 hardware platforms, from cell phones and network devices to mainframes and supercomputers, developed by more than two thousand volunteers from all over the world who collaborate via the internet on the Debian Project.

Debian's dedication to Free Libre Open Source Software, its constitutional non-profit nature, its open and meritocratic development model, organization and social governance make it a first among free libre operating system distributions.

The Debian project's key strengths are its volunteer base, its dedication to the Debian Social Contract and the Debian Constitution, and its commitment to provide the best operating systems attainable, following a strict quality policy, working with an established QA Team and helpful users reporting bugs, suggestions, exchanging ideas, and registering experiences.

You can help Debian Project without joining it and even not being a programmer, or being a development and or service partner company or institution at the Debian Partner Program, or simply making various donations to the Debian Project.

Debian Project news, press releases and press coverage can be found from the official Debian wiki page. PR contact at debian-publicity list.

File Synchronization with Unison

2008-04-15T19:31:00.000-04:00

April 14th, 2008 by Mike Diehl in * HOWTOs

Keeping the files on multiple machines synchronized seems to be a recurring problem for many computer users. Until I discovered Unison (http://www.cis.upenn.edu/~bcpierce/unison/) I never really had a completely satisfactory solution.

What we'd like to be able to do is efficiently keep two or more servers completely synchronized with each other no matter what gets changed on any of the servers. In the simplest case, we have a production server and a backup server that we need to keep in sync. We might have a cluster of servers used in a load balancing configuration. In the worst case, we might have a group of computers where changes are occurring on any or all of the devices. Consider the case where we have a computer at the office, a laptop, and a work computer at home. We want to be able to work from any computer at any time.

One solution is to simply use scp (http://www.openssh.com/) to copy the files from one computer to the other or others. This solution requires that we designate one computer to be the “master” and only changes that occur on the master computer are propagated to the other, slave, computers. Besides a lack of flexibility, this solution has one serious drawback; it copies every file from the master to each slave computer, every time the synchronization process is started. On a slow network link, or a large directory structure, this often proves untenable.

A slightly better solution is to use rsync. (http://samba.anu.edu.au/rsync/) The rsync program only transfers those files that are different. In fact, rsync only transfers those parts of a given file that are different. This mechanism is quite efficient, but still suffers from the master/slave architecture that scp suffers from.

There are solutions that depend upon kernel services such as the FAM (http://oss.sgi.com/projects/fam/faq.html) or clustered filesystems like Coda. (http://coda.cs.cmu.edu/doc/html/index.html) These solutions, of course, require a kernel recompilation, which seems like a lot of work to simply keep a couple servers synchronized.

So far, unison is the simplest and most effective solution I've found. Unison will correctly synchronize two servers even if changes occur on both servers. If a change occurs in the same file on both servers, this causes a conflict, and unison will display an error message. File content as well as permissions and ownership can be synchronized. Unison even allows you to keep Linux machines and Windows machines in sync. For those of you who have slow network links, it's nice to know that unison works like rsync in that it only transfers those parts of a file that have been changed, when possible.

Installing unison is trivial. The package management system in most Linux distributions can automatically install unison for you. Otherwise, simply download the source and compile it. You will need Ocaml installed, though.

Unison can be configured to use a native network protocol, or to use OpenSSH in order to transfer files. The native protocol isn't authenticated, nor encrypted, so it isn't nearly as secure as the ssh configuration. I recommend using the ssh configuration and that's the configuration my example will use. For automated synchronization, you will probably want to setup certificate-based authentication for ssh. There are many easy-to-follow instructions on the Internet that describe how to set this up, so I won't cover that here.

Once you have unison installed, and ssh configured, it's time to start synchronizing! But first, we should discuss, briefly, how unison works, especially the first time it is run against a particular file repository. The first time you use unison on a file repository, the program makes a note of modification timestamp, permissions, ownership and i-node number for each file in both repositories. Then, based on this information, it decides which files need to be updated. The program stores all of this information in the ~/.unison directory. The next time unison is run on the file repository, changes are trivial to detect. Intuitively, you might expect that unison is examining the file's contents to see if the file has changed, but that isn't what is happening. If a files modification timestamp and i-node number change, the file needs to be updated. This is a very fast calculation and scales well, even on very large files.

Here is a quick example from one of my computers:

unison /home/mdiehl/Development ssh://10.0.1.56///home/mdiehl/Development/ -owner -group -batch -terse

This should all be on one line. I do a lot of software development and in this example, I'm using unison to synchronize the development directory from my Internet accessible server to my workstation on my private network. Even though this example is fairly intuitive, it doesn't get much more complicated than this, so let's take a closer look.

The example synchronizes /home/mdiehl/Development on my server to the same directory on my workstation who's IP address is 10.0.1.56. The ssh protocol is used for the file comparison and transfer. Since this is a bi-directional process, it doesn't matter where the script runs as long as the two machines can reach each other over the network; it's just more convenient to run my scripts on the server, but I could just as easily run this script from my workstation if I change the IP address in the script.

The “-owner” and “-group” parameters tell unison to attempt to synchronize the user and group ownership. You need to make sure that the owners and groups exist on all of the machines you intend to synchronize. For example, if you are syncing a directory owned by the user “bob,” who's uid is 500, you need to be sure that “bob” exists on every server. Otherwise, you will find that unison will create an entire directory structure owned by uid 500. This is messy, but easily resolved.

Since I run this example command from cron, I use the “-batch” parameter, which tells unison to not ask the user any questions, and simply do what it can if there are any conflicts. Similarly, the “-terse” parameter keeps unison from filling up my cron log with a bunch of unnecessary output.

When I run the example, above, I am presented with a list of updates that are being made between the two computers. The final lines are the most important, though:

UNISON finished propagating changes at 01:05:15 on 13 Apr 2008 Synchronization complete (8 items transferred, 0 skipped, 0 failures)

As you can see, 8 files needed to be transferred in order to synchronize the two servers. Fortunately, there were not problems, and all 8 files were transferred, and my two machines are back in sync. If there were files with conflicting changes, then we would see that in the “skipped” tally. If there had been file permissions or network problems, those would have shown up as failures. Either way, we'd want to go back through the log to find out what happened.

In the several years that I've been using unison, I've only had a few problems with it. As mentioned earlier, the most common problem stems from having conflicting file changes. For example, if you make a change to a file on one server and then change the corresponding file on the other server and the files don't end up being identical, unison sees that as a conflicting change and flags it. The way I usually resolve this problem is by deciding which version I want to keep and using the “-prefer” option to tell unison which version it should... prefer... when there is a conflict. In the example above, if I wanted to have the local version overwrite the remote version, I would add:

-prefer /home/mdiehl/Development

To the end of the command line.

The very first problem I had with unison was when I tried to synchronize two directories that had several tens of thousands of files in them. Unison simply ran out of memory. If I had one complaint about unison, it would be that I have to break large file repositories into smaller pieces in order to use unison to synchronize them. It doesn't seem to me that it should take that much memory to do the book keeping, but I can't argue with the fact that the tool works and I've never lost a file with it.

The unison website indicates that unison is no longer under active development. This is unfortunate, but it shouldn't dissuade you from using and trusting the program. I've found it to be quite mature and is still actively being supported via the unison mailing list. I've had a few occasions to ask for help on the mailing list and I've found the list be extremely helpful.

Unison is a very effective means of synchronizing servers. It can be used in a “star” topology to keep multiple servers in sync. I can also be used in a “ring,” or any other topology you might need. The documentation is quite extensive and well written. I hope you find it as effective and easy to use as I have.

Mike Diehl is a Linux Administrator for Orion International at Sandia National Laboratories in Albuquerque, New Mexico. Mike lives with his wife and two small boys. Mike can be reached via email at: mdiehl@diehlnet.com

User Access Control in Drupal 6

2008-04-11T14:00:00.002-04:00

In this article by David Mercer, we will look at an entirely different aspect of running a Drupal website. Once we have added the functionality to the site, we now have to give some thoughts about how this functionality is to be accessed, or by whom. As the site grows, you will most likely feel the need to delegate certain responsibilities to various people. Alternatively, you might organize a team of people to work on specific aspects of the site. Whatever is required, at some stage you will have to make decisions about who can do what, and Drupal makes sure that it is possible to do precisely this.

Having Drupal simplify the implementation of your access control policies does not mean that the task is a trivial one. There is still much thought that needs to go on behind the scenes in order to create a sophisticated, and above all, effective policy for controlling access to the site. Because of this, we will spend a bit of time exploring the ramifications of the various choices available, instead of simply listing them. Taking a holistic approach to implementing an access control policy will ensure you don't end up with any nasty surprises down the line.

Specifically, this article will look at Planning an access policy, Roles, Users, and Access rules.

Before we continue, it is worth pointing out that at the moment of adding the basic functionality you are more than likely using the administrative user (user number 1) for all the site's development needs. That is absolutely fine, but once the major changes to the site are completed, you should begin using a normal administrative user that has only the permissions required to complete your day-to-day tasks. The next section will highlight the general philosophy behind user access, which should make the reason for this clear.
Planning an Access Policy

When you think about how your site should work, focus in on what will be required of yourself, other community members, or even anonymous users. For instance:

* Will there be a team of moderators working to ensure that the content of the site conforms to the dictates of good taste and avoids material that is tantamount to hate speech, and so on?
* Will there be subject experts who are allowed to create and maintain their own content?
* How much will anonymous visitors be allowed to become involved, or will they be forced to merely window shop without being able to contribute?

Some of you might feel that the site should grow organically with the community, and so you want to be extremely flexible in your approach. However, you can take it as given that Drupal's access policies are already flexible, given how easy it is to reconfigure, so it is good practice to start out with a sensible set of access rules, even if they are going to change over time. If you need to make modifications later, so be it, but at least there will be a coherent set of rules from the start.

The first and foremost rule of security that can be applied directly to our situation is

Grant a user permissions sufficient for completing the intended task, and no more!

Our entire approach is going to be governed by this rule. With a bit of thought you should be able to see why this is so important. The last thing anyone wants is for an anonymous user to be able to modify the personal blog of a respected industry expert. This means that each type of user should have carefully controlled permissions that effectively block their ability to act outside the scope of their remit.

One upshot of this is that it is better to create a larger number of specific roles, rather than create a generic role or two, and allow everyone to use those catch-all permissions.

A role constitutes a number of permissions that define what actions any members of that role can and can't perform.

We will explore roles in detail in the next section!

Drupal gives us fine-grained control over what users can accomplish, and you should make good use of this facility. It may help to think of your access control using the following figure (this does not necessarily represent the actual roles on your site—it's just an example):

The shaded region represents the total number of permissions available for the site. Contained within this set are the various roles that exist either by default, like the Anonymous users role, or those you create in order to cater for the different types of users the site will require—in this case, the Blog Writer users and Forum Moderator users roles.

From the previous diagram you can see that the Anonymous users role has the smallest set of permissions because they have the smallest area of the total diagram. This set of permissions is totally encapsulated by the Forum Moderator users and Blog Writer users—meaning that forum moderators and blog writers can do everything an anonymous user does, and a whole lot more.

Remember, it is not compulsory that forum moderators encapsulate all the permissions of the anonymous users. You can assign any permissions to any role—it's just that in this context it makes sense that a forum moderator should be able to do everything an anonymous user can and more.

Of course, the blog writers have a slightly different remit. While they share some privileges in common with the forum administrators, they also have a few of their own. Your permissions as the primary or administrative user encompass the entire set, because there should be nothing that you cannot control.

It is up to you to decide which roles are best for the site, but before attempting this it is important to ask: What are roles and how are they used in the first place? To answer this question, let's take a look at the practical side of things in more detail.
Roles

It may seem a bit odd that we are not beginning a practical look at access control with a discussion on users. After all, it is all about what users can and cannot do! The problem with immediately talking about users is that the focus of a single user is too narrow, and we can learn far more about controlling access by taking a more broad view using roles. Once we have learned everything there is to know about roles, actually working with users becomes a trivial matter.

As mentioned, a user role in Drupal defines a set of rules that must be obeyed by all the users in that role. It may be helpful to think of a role as a character in a play. In a play, an actor must always be true to their character (in the same way a user must be faithful to their role in Drupal)—in other words, there is a defined way to behave and the character never deviates (no matter which actor portrays the character).

Creating a role in Drupal is very easy. Click the User management link under Administer and select the Roles tab to bring up the following:

As you can see, we have two roles already defined by default—the anonymous user and the authenticated user. It is not possible to change these, and so the Operations column is permanently set to locked. To begin with, the anonymous user (this is any user who is browsing the site without logging in) has very few permissions set, and you would more than likely want to keep it this way, despite the fact it is possible to give them any and all permissions.

Similarly, the authenticated user, by default, has only a few more permissions than the anonymous user, and it is also sensible to keep these to a minimum. We will see in a little while how to go about deciding who should have which permissions.

In order to add a new role, type in a name for the role and click Add role, and you're done. But what name do you want to add? That's the key question! If you are unsure about what name to use, then it is most likely you haven't defined the purpose of the role properly. To see how this is done, let's assume we require a forum moderator who will be a normal user in every way, except for the ability to work directly on the forums (to take some of the burden of responsibility off the administrator's hands) to create new topics, and to edit the content if necessary.

To get the ball rolling, type in forum moderator and click Add role—actually, you might even want to be more specific and use something like conservation forum moderator if there will be teams of forum moderators—you get the general idea.

Now the roles page should display the new role with the option to edit it, shown in the Operations column. Click edit role in order to change the name of the role or delete it completely. Alternatively, click edit permissions to deal with the permissions for this specific role (we discuss permissions in a moment so let's leave this for now).

Our work is just beginning, because now we need to grant or deny the various permissions that the forum moderator role will need in order to successfully fulfill its purpose. New roles are not given any permission at all to begin with—this makes sense, because the last thing we want is to create a role only to find that it has the same permissions as the administrative user.

Chances are you will need to add several roles depending on the needs of the site, so add at least a blogger user that can edit their own blog—we will need a few different types to play with later on.

Let's move on and take a look at how to flesh out this new role by setting permissions.

This article has been extracted from: Building Powerful and Robust Websites with Drupal 6
Building Powerful and Robust Websites with Drupal 6 Build your own professional blog, forum, portal or community website with Drupal 6

* Set up, configure, and deploy Drupal 6
* Design and implement your website's look and feel
* Easily add exciting and powerful features
* Promote, manage, and maintain your live website

For more information, please visit:
www.PacktPub.com/drupal-6-create-powerful-websites/book
Permissions

In order to work with permissions, click the Permissions link under User management and you should be presented with a screen much like the following (notice the new forum moderator role on the right-hand side of the page):

As you can see, this page lists all of the available permissions down the left-hand column and allows you to enable or disable that permission by checking or un-checking boxes in the relevant column. It is easy enough to see that one traverses the list, selecting those permissions required for each role. What is not so easy is actually determining what should and shouldn't be enabled in the first place.

Notice too that the permissions given in the list on the left-hand side pertain to specific modules. This means that if we change the site's setup by adding or removing modules, then we will also have to change the permissions on this page.

Most times a module is added, you will need to ensure that the permissions are set as required for that module, because by default no permissions are granted.

What else can we learn from the permissions page shown in the previous screenshot? Well, what does each permission precisely mean? There are quite a few verbs that allow for completely different actions. The following lists the more common, generic ones, although you might find one or two others crop up every now and then to cater for a specific module:

* administer: gives the user the ability to affect the function of a module. For example, granting administer rights to the locale module means that the user can add or remove languages, manage strings, and even export .po files. This permission should only ever be given to trusted users, and never to anonymous users.
* access: gives the user the ability to make use of a module without being able to affect it in any way. For example, granting access rights to the comment module allows a user to view comments without being able to delete, edit, or reply to them.
* create: gives the user the ability to create content of some sort. For example, granting rights to create stories allows users to do so, but does not also give them the ability to edit those stories.
* edit any/own: gives the user the ability to work with either anyone's content or specifically the content they have created—depending on whether edit any or edit own is selected. For example, granting edit own rights to the blog module means that the user can modify their own blogs at will.
* delete any/own: applies to content related modules such as Node and empowers users to remove either anyone's content or confine them to removing only content posted by themselves. For example, setting delete own blog entry allows users to take back any blog postings they may regret having published.

There are also other module-specific permissions available, and it is recommended that you play around and understand any new permission(s) you set.

Previously, assigning the edit own permission automatically provided the delete own permission. For added security, delete own permissions for individual core content types have been removed from all roles and should be assigned separately.

How do we go about setting up the required permissions for the forum moderator user? If we look down the list of permissions shown on the Permission page, we see the following forum-related options (at the moment, the forum moderator permissions are those in the outermost column):

Enabling these three options, and then testing out what new powers are made available, should quickly demonstrate that this is not quite what we want.

If you are wondering how to actually test this out, you need to create a new user and then assign them to the forum moderator role. The following section on Users explains how to create new users and administer them properly. Jump ahead quickly and check that out so that you have a new user to work with if you are unsure how it is done.

The following point might make your life a bit easier:

Use two browsers to test out your site. The demo site's development machine has IE and Firefox. Keep one browser for the administrator and the other for anonymous or other users in order to test out changes. This will save you from having to log in and log out whenever testing new permissions.

When testing out the new permissions one way or another, you will find that the forum moderator can access and work with all of the forums—assuming you have created any.

However, notice that there are node module permissions available, which is quite interesting because most content in Drupal is actually a node. How will this affect the forum moderator? Disable the forum module permissions for the forum moderator user and then enable all the node options for the authenticated user before saving and logging out.

Log back in as the forum administrator and it will be clear that despite having revoked the forum based options for this user, it is possible to post to or edit anything in the forum quite easily by selecting the Create content link in the main menu. Is this what you expected?

It should be precisely what you expect because the forum moderator is an authenticated user, so they have acquired the permissions that came from the authenticated user. In addition, the forum posts are all nodes, and any authenticated user can add and edit nodes, so even though the forum moderator is not explicitly allowed to work with forums, through generic node permissions we get the same result:

Defined roles are given the authenticated user permissions.

Actually, the result is not entirely the same because the forum moderator can now also configure all the different types of content on the site, as well as edit any type of content including other people's blogs. This is most certainly undesirable, so log back in as the primary user and remove the node permissions (except the first one) from the authenticated user role. With that done, you can now spend some time building a fairly powerful and comprehensive role-based access control plan.

As an addendum, you might find that despite having a goodly amount of control over who does what, there are some things that are not easily done without help from elsewhere.
Users

A single user account can be given as many or as few permissions as you like via the use of roles. Drupal users are not really anything unless they already have a role that defines the manner in which they can operate within the Drupal framework. Hence, we discussed roles first.

Users can be created in two ways. The most common way is by registering on the site—if you haven't already, go ahead and register a new user on your site by clicking the Create new account link on the homepage just to test things out. Remember to supply a valid email address otherwise you won't be able to sign in properly. This will create an authenticated user, with any and all permissions that have been assigned to the authenticated user role.

The second way is to use the administrative user to create a new user. In order to do so, log on as the administrative user and click on Users in User management under Administer. Select the Add user tab and follow the instructions on that page. For example, I created a new forum moderator user by ensuring that the relevant role was checked:

You will need to supply Drupal with usernames, email addresses, and passwords. Once there are a couple of users to play around with, it's time to begin working with them.

Administering Users

The site's administrator is given complete access to the other users' account information. By clicking on the edit link shown to the right of each user account (under the Operations column heading) in the Users page under User management, it is possible to make any changes you require to a given user.

Before we do though, it's worth noting that the administration page itself is fairly powerful in terms of being able to administer individual users or groups of users with relative ease:

The upper box, Show only users where, allows you to specify several filter conditions to cut down the result set and make it more manageable. This will become more and more important as the site accumulates more and more users. Once the various filter options have been implemented, the Update options allow you to apply whatever changes are needed to the list of users selected (by checking the relevant checkbox next to their name).

Having both broad, sweeping powers as well as fine-grained control over users is one of the most valuable facilities provided by Drupal, and you will no doubt become very familiar with this page in due course.

Click on the edit link next to the forum moderator user and take a look at the Roles section. Notice that it is now possible to stipulate which roles this user belongs to. At present there are only two new roles to be assigned (yours might vary depending on which roles have been created on your setup):

Whenever a user is added to another role, they obtain the combined permissions of these roles. With this in mind, you should go about delegating roles in the following fashion:

1. Define the most basic user of the site by setting the anonymous user permissions.
2. Set permissions for a basic authenticated user (i.e. any Tom, Dick or Harry that registers on your site).
3. Create special roles by only adding the specific additional permissions that are required by that role, and no more. Don't re-assign permissions that the authenticated user already has.
4. Create new users by combining whatever roles are required for their duties or needs.

If you follow the steps above, you will be sure to always give the correct permissions to each role by avoiding redundancy and only applying permissions incrementally by role. Basically, you are building up a user's permissions from the most basic to the most complex without having to assign every single permission each time. It should be commonsense (although not a technical obligation) that a forum moderator would have all the permissions of an anonymous and authenticated user, plus a few more. Looking back to the first diagram in the section Planning an Access Policy you can see that, in this case, we would:

1. Define the anonymous user and authenticated user role permissions—an authenticated user should have all the permissions of an anonymous user, plus whatever else is needed by a basic site user.
2. Create new roles with only the additional permissions needed for both the forum moderator and blog user respectively—other than those given to the authenticated user.
3. Assign blog writers to the blog user role (they are automatically given the permissions granted to an authenticated user), and do the same for forum moderators and their role.

Other than using that strategy for assigning roles to users, the rest, as they say, is history. Play around with any new roles you create to ensure they behave as you expect and then move on.
User Settings

This section looks at how the site treats users, rather than discussing what users can and cannot do. However, you will find that some of the information in this section is important for the look and feel of the site.

Click on User settings under the User management. The following set of options is provided, beginning with user registration settings, as follows:

User Access Control in Drupal 6

In this article by David Mercer, we will look at an entirely different aspect of running a Drupal website. Once we have added the functionality to the site, we now have to give some thoughts about how this functionality is to be accessed, or by whom. As the site grows, you will most likely feel the need to delegate certain responsibilities to various people. Alternatively, you might organize a team of people to work on specific aspects of the site. Whatever is required, at some stage you will have to make decisions about who can do what, and Drupal makes sure that it is possible to do precisely this.

Having Drupal simplify the implementation of your access control policies does not mean that the task is a trivial one. There is still much thought that needs to go on behind the scenes in order to create a sophisticated, and above all, effective policy for controlling access to the site. Because of this, we will spend a bit of time exploring the ramifications of the various choices available, instead of simply listing them. Taking a holistic approach to implementing an access control policy will ensure you don't end up with any nasty surprises down the line.

Specifically, this article will look at Planning an access policy, Roles, Users, and Access rules.

Before we continue, it is worth pointing out that at the moment of adding the basic functionality you are more than likely using the administrative user (user number 1) for all the site's development needs. That is absolutely fine, but once the major changes to the site are completed, you should begin using a normal administrative user that has only the permissions required to complete your day-to-day tasks. The next section will highlight the general philosophy behind user access, which should make the reason for this clear.
Planning an Access Policy

When you think about how your site should work, focus in on what will be required of yourself, other community members, or even anonymous users. For instance:

* Will there be a team of moderators working to ensure that the content of the site conforms to the dictates of good taste and avoids material that is tantamount to hate speech, and so on?
* Will there be subject experts who are allowed to create and maintain their own content?
* How much will anonymous visitors be allowed to become involved, or will they be forced to merely window shop without being able to contribute?

Some of you might feel that the site should grow organically with the community, and so you want to be extremely flexible in your approach. However, you can take it as given that Drupal's access policies are already flexible, given how easy it is to reconfigure, so it is good practice to start out with a sensible set of access rules, even if they are going to change over time. If you need to make modifications later, so be it, but at least there will be a coherent set of rules from the start.

The first and foremost rule of security that can be applied directly to our situation is

Grant a user permissions sufficient for completing the intended task, and no more!

Our entire approach is going to be governed by this rule. With a bit of thought you should be able to see why this is so important. The last thing anyone wants is for an anonymous user to be able to modify the personal blog of a respected industry expert. This means that each type of user should have carefully controlled permissions that effectively block their ability to act outside the scope of their remit.

One upshot of this is that it is better to create a larger number of specific roles, rather than create a generic role or two, and allow everyone to use those catch-all permissions.

A role constitutes a number of permissions that define what actions any members of that role can and can't perform.

We will explore roles in detail in the next section!

Drupal gives us fine-grained control over what users can accomplish, and you should make good use of this facility. It may help to think of your access control using the following figure (this does not necessarily represent the actual roles on your site—it's just an example):

The shaded region represents the total number of permissions available for the site. Contained within this set are the various roles that exist either by default, like the Anonymous users role, or those you create in order to cater for the different types of users the site will require—in this case, the Blog Writer users and Forum Moderator users roles.

From the previous diagram you can see that the Anonymous users role has the smallest set of permissions because they have the smallest area of the total diagram. This set of permissions is totally encapsulated by the Forum Moderator users and Blog Writer users—meaning that forum moderators and blog writers can do everything an anonymous user does, and a whole lot more.

Remember, it is not compulsory that forum moderators encapsulate all the permissions of the anonymous users. You can assign any permissions to any role—it's just that in this context it makes sense that a forum moderator should be able to do everything an anonymous user can and more.

Of course, the blog writers have a slightly different remit. While they share some privileges in common with the forum administrators, they also have a few of their own. Your permissions as the primary or administrative user encompass the entire set, because there should be nothing that you cannot control.

It is up to you to decide which roles are best for the site, but before attempting this it is important to ask: What are roles and how are they used in the first place? To answer this question, let's take a look at the practical side of things in more detail.
Roles

It may seem a bit odd that we are not beginning a practical look at access control with a discussion on users. After all, it is all about what users can and cannot do! The problem with immediately talking about users is that the focus of a single user is too narrow, and we can learn far more about controlling access by taking a more broad view using roles. Once we have learned everything there is to know about roles, actually working with users becomes a trivial matter.

As mentioned, a user role in Drupal defines a set of rules that must be obeyed by all the users in that role. It may be helpful to think of a role as a character in a play. In a play, an actor must always be true to their character (in the same way a user must be faithful to their role in Drupal)—in other words, there is a defined way to behave and the character never deviates (no matter which actor portrays the character).

Creating a role in Drupal is very easy. Click the User management link under Administer and select the Roles tab to bring up the following:

As you can see, we have two roles already defined by default—the anonymous user and the authenticated user. It is not possible to change these, and so the Operations column is permanently set to locked. To begin with, the anonymous user (this is any user who is browsing the site without logging in) has very few permissions set, and you would more than likely want to keep it this way, despite the fact it is possible to give them any and all permissions.

Similarly, the authenticated user, by default, has only a few more permissions than the anonymous user, and it is also sensible to keep these to a minimum. We will see in a little while how to go about deciding who should have which permissions.

In order to add a new role, type in a name for the role and click Add role, and you're done. But what name do you want to add? That's the key question! If you are unsure about what name to use, then it is most likely you haven't defined the purpose of the role properly. To see how this is done, let's assume we require a forum moderator who will be a normal user in every way, except for the ability to work directly on the forums (to take some of the burden of responsibility off the administrator's hands) to create new topics, and to edit the content if necessary.

To get the ball rolling, type in forum moderator and click Add role—actually, you might even want to be more specific and use something like conservation forum moderator if there will be teams of forum moderators—you get the general idea.

Now the roles page should display the new role with the option to edit it, shown in the Operations column. Click edit role in order to change the name of the role or delete it completely. Alternatively, click edit permissions to deal with the permissions for this specific role (we discuss permissions in a moment so let's leave this for now).

Our work is just beginning, because now we need to grant or deny the various permissions that the forum moderator role will need in order to successfully fulfill its purpose. New roles are not given any permission at all to begin with—this makes sense, because the last thing we want is to create a role only to find that it has the same permissions as the administrative user.

Chances are you will need to add several roles depending on the needs of the site, so add at least a blogger user that can edit their own blog—we will need a few different types to play with later on.

Let's move on and take a look at how to flesh out this new role by setting permissions.

This article has been extracted from: Building Powerful and Robust Websites with Drupal 6
Building Powerful and Robust Websites with Drupal 6 Build your own professional blog, forum, portal or community website with Drupal 6

* Set up, configure, and deploy Drupal 6
* Design and implement your website's look and feel
* Easily add exciting and powerful features
* Promote, manage, and maintain your live website

For more information, please visit:
www.PacktPub.com/drupal-6-create-powerful-websites/book
Permissions

In order to work with permissions, click the Permissions link under User management and you should be presented with a screen much like the following (notice the new forum moderator role on the right-hand side of the page):

As you can see, this page lists all of the available permissions down the left-hand column and allows you to enable or disable that permission by checking or un-checking boxes in the relevant column. It is easy enough to see that one traverses the list, selecting those permissions required for each role. What is not so easy is actually determining what should and shouldn't be enabled in the first place.

Notice too that the permissions given in the list on the left-hand side pertain to specific modules. This means that if we change the site's setup by adding or removing modules, then we will also have to change the permissions on this page.

Most times a module is added, you will need to ensure that the permissions are set as required for that module, because by default no permissions are granted.

What else can we learn from the permissions page shown in the previous screenshot? Well, what does each permission precisely mean? There are quite a few verbs that allow for completely different actions. The following lists the more common, generic ones, although you might find one or two others crop up every now and then to cater for a specific module:

* administer: gives the user the ability to affect the function of a module. For example, granting administer rights to the locale module means that the user can add or remove languages, manage strings, and even export .po files. This permission should only ever be given to trusted users, and never to anonymous users.
* access: gives the user the ability to make use of a module without being able to affect it in any way. For example, granting access rights to the comment module allows a user to view comments without being able to delete, edit, or reply to them.
* create: gives the user the ability to create content of some sort. For example, granting rights to create stories allows users to do so, but does not also give them the ability to edit those stories.
* edit any/own: gives the user the ability to work with either anyone's content or specifically the content they have created—depending on whether edit any or edit own is selected. For example, granting edit own rights to the blog module means that the user can modify their own blogs at will.
* delete any/own: applies to content related modules such as Node and empowers users to remove either anyone's content or confine them to removing only content posted by themselves. For example, setting delete own blog entry allows users to take back any blog postings they may regret having published.

There are also other module-specific permissions available, and it is recommended that you play around and understand any new permission(s) you set.

Previously, assigning the edit own permission automatically provided the delete own permission. For added security, delete own permissions for individual core content types have been removed from all roles and should be assigned separately.

How do we go about setting up the required permissions for the forum moderator user? If we look down the list of permissions shown on the Permission page, we see the following forum-related options (at the moment, the forum moderator permissions are those in the outermost column):

Enabling these three options, and then testing out what new powers are made available, should quickly demonstrate that this is not quite what we want.

If you are wondering how to actually test this out, you need to create a new user and then assign them to the forum moderator role. The following section on Users explains how to create new users and administer them properly. Jump ahead quickly and check that out so that you have a new user to work with if you are unsure how it is done.

The following point might make your life a bit easier:

Use two browsers to test out your site. The demo site's development machine has IE and Firefox. Keep one browser for the administrator and the other for anonymous or other users in order to test out changes. This will save you from having to log in and log out whenever testing new permissions.

When testing out the new permissions one way or another, you will find that the forum moderator can access and work with all of the forums—assuming you have created any.

However, notice that there are node module permissions available, which is quite interesting because most content in Drupal is actually a node. How will this affect the forum moderator? Disable the forum module permissions for the forum moderator user and then enable all the node options for the authenticated user before saving and logging out.

Log back in as the forum administrator and it will be clear that despite having revoked the forum based options for this user, it is possible to post to or edit anything in the forum quite easily by selecting the Create content link in the main menu. Is this what you expected?

It should be precisely what you expect because the forum moderator is an authenticated user, so they have acquired the permissions that came from the authenticated user. In addition, the forum posts are all nodes, and any authenticated user can add and edit nodes, so even though the forum moderator is not explicitly allowed to work with forums, through generic node permissions we get the same result:

Defined roles are given the authenticated user permissions.

Actually, the result is not entirely the same because the forum moderator can now also configure all the different types of content on the site, as well as edit any type of content including other people's blogs. This is most certainly undesirable, so log back in as the primary user and remove the node permissions (except the first one) from the authenticated user role. With that done, you can now spend some time building a fairly powerful and comprehensive role-based access control plan.

As an addendum, you might find that despite having a goodly amount of control over who does what, there are some things that are not easily done without help from elsewhere.
Users

A single user account can be given as many or as few permissions as you like via the use of roles. Drupal users are not really anything unless they already have a role that defines the manner in which they can operate within the Drupal framework. Hence, we discussed roles first.

Users can be created in two ways. The most common way is by registering on the site—if you haven't already, go ahead and register a new user on your site by clicking the Create new account link on the homepage just to test things out. Remember to supply a valid email address otherwise you won't be able to sign in properly. This will create an authenticated user, with any and all permissions that have been assigned to the authenticated user role.

The second way is to use the administrative user to create a new user. In order to do so, log on as the administrative user and click on Users in User management under Administer. Select the Add user tab and follow the instructions on that page. For example, I created a new forum moderator user by ensuring that the relevant role was checked:

You will need to supply Drupal with usernames, email addresses, and passwords. Once there are a couple of users to play around with, it's time to begin working with them.

This article has been extracted from: Building Powerful and Robust Websites with Drupal 6
Building Powerful and Robust Websites with Drupal 6 Build your own professional blog, forum, portal or community website with Drupal 6

* Set up, configure, and deploy Drupal 6
* Design and implement your website's look and feel
* Easily add exciting and powerful features
* Promote, manage, and maintain your live website

For more information, please visit:
www.PacktPub.com/drupal-6-create-powerful-websites/book
Administering Users

The site's administrator is given complete access to the other users' account information. By clicking on the edit link shown to the right of each user account (under the Operations column heading) in the Users page under User management, it is possible to make any changes you require to a given user.

Before we do though, it's worth noting that the administration page itself is fairly powerful in terms of being able to administer individual users or groups of users with relative ease:

The upper box, Show only users where, allows you to specify several filter conditions to cut down the result set and make it more manageable. This will become more and more important as the site accumulates more and more users. Once the various filter options have been implemented, the Update options allow you to apply whatever changes are needed to the list of users selected (by checking the relevant checkbox next to their name).

Having both broad, sweeping powers as well as fine-grained control over users is one of the most valuable facilities provided by Drupal, and you will no doubt become very familiar with this page in due course.

Click on the edit link next to the forum moderator user and take a look at the Roles section. Notice that it is now possible to stipulate which roles this user belongs to. At present there are only two new roles to be assigned (yours might vary depending on which roles have been created on your setup):

Whenever a user is added to another role, they obtain the combined permissions of these roles. With this in mind, you should go about delegating roles in the following fashion:

1. Define the most basic user of the site by setting the anonymous user permissions.
2. Set permissions for a basic authenticated user (i.e. any Tom, Dick or Harry that registers on your site).
3. Create special roles by only adding the specific additional permissions that are required by that role, and no more. Don't re-assign permissions that the authenticated user already has.
4. Create new users by combining whatever roles are required for their duties or needs.

If you follow the steps above, you will be sure to always give the correct permissions to each role by avoiding redundancy and only applying permissions incrementally by role. Basically, you are building up a user's permissions from the most basic to the most complex without having to assign every single permission each time. It should be commonsense (although not a technical obligation) that a forum moderator would have all the permissions of an anonymous and authenticated user, plus a few more. Looking back to the first diagram in the section Planning an Access Policy you can see that, in this case, we would:

1. Define the anonymous user and authenticated user role permissions—an authenticated user should have all the permissions of an anonymous user, plus whatever else is needed by a basic site user.
2. Create new roles with only the additional permissions needed for both the forum moderator and blog user respectively—other than those given to the authenticated user.
3. Assign blog writers to the blog user role (they are automatically given the permissions granted to an authenticated user), and do the same for forum moderators and their role.

Other than using that strategy for assigning roles to users, the rest, as they say, is history. Play around with any new roles you create to ensure they behave as you expect and then move on.
User Settings

This section looks at how the site treats users, rather than discussing what users can and cannot do. However, you will find that some of the information in this section is important for the look and feel of the site.

Click on User settings under the User management. The following set of options is provided, beginning with user registration settings, as follows:

You might want to consider which of the first three options to select quite carefully, depending on how you envisage the site functioning. For example, allowing everyone to read and post comments to the forums, or do whatever, without needing to register first may be ideal. If this is the case, then it is likely that the only people who would need to register are going to be performing some sort of administrative duties, in which case you would probably want to select the first option, or at least the third option.

If you do go for the third option, then check the user list regularly in order to unblock new users as soon as possible. Note that Drupal can be configured to email the site administrator automatically whenever there is a new user registration application.

Additionally, if you enter a message into the User registration guidelines text area then this will appear during the registration process, as shown in the following screenshot:

I specifically added this note in here because it is fairly well known that new users often log in with the one-time password generated by Drupal, but then fail to add their own password before logging off. When they return, they are then locked out because the one-time password has expired and there is no new one set.

The next section on this page deals with the process of user email customization for the various different type of emails that Drupal sends out. There is an interesting facet to this in that Drupal makes certain variables available for use within the static text that is entered. Let's take a look at how to modify a line or so in order to get the feel for how it works.

By way of example, we will change the Welcome, no approval text from:

Account details for !username at !site

to a slightly sprightlier:

Congratulations !username, you have registered with the !site on !date!

Nothing too complicated here! The keywords preceded by the ! sign are simply placeholders for other values that are inserted into the email, according to how they are set at that particular time. This gives you the ability to personalize correspondence. In this case, the subject of the welcome email for a user registered as David M is now displayed as follows:

The !username, !site, and !date placeholders have been correctly changed to reflect the contents of the variables for that particular setup. There are settings available for several standard emails such as password recovery and welcome (awaiting admin approval). The defaults are fairly sensible and easy to change should you need to. Remember the placeholders that are available for each piece of text are mentioned below the section heading, so play around with them until you are comfortable with their usage:

The final two sections deal with Signatures and Pictures. If you wish to enable Picture support for users, then select Enabled from the list, provide a default picture (if you want one), and click Save configuration (the other settings are fairly self explanatory and sensible, and you can come back at any stage to change them if they are not suitable).

Drupal will set up a pictures folder to hold all of the pictures within the files folder in your Drupal installation. Once everything is done, users will have a new section added to the edit tab of their my account page, like the following figure:

When the picture has been successfully uploaded, it will appear on the my account page, and with the user's blog and forum posts on the site. If the image does not appear and you end up seeing a link, something like the following:

...then you will need to ensure that you set the correct upload module permissions on the Permissions page, as follows:

Remember that since the forum administrator user automatically receives all the permissions of the authenticated user, it is not necessary to enable the view uploaded files permission for the forum administrator as this would be redundant and would make the purpose of your user less clear.

It is possible to control where the user pictures are displayed by selecting the Configure tab of the Themes page under Site building and checking the relevant picture related checkboxes, as shown in the following figure:

Allowing users to incorporate pictures into a site is a good way for people to be able to personalize their contributions, and also gives everyone something visual to associate posts with. This is a great way to foster a community, as it helps give different users an identity of sorts.

Changing the picture is easy! Simply modify it in the Picture section of the user's edit page, as shown in the following screenshot:

That is pretty much the end of the line for configuring users. There are still a few more things we need to discuss with regards to security before we can move on though.
Access Rules

So far it should seem like Drupal has things more or less covered when it comes to ensuring that it is possible to control who does what on the site. This is certainly the case, but there are a few more situations that we have not yet discussed, and may well end up affecting the site at some stage. For example, what happens if there is a company that repeatedly spams your forums with advertisements and marketing information? Or, what happens if only people from a certain company should have access to your site?

Problems of this nature can really be a thorn in the side. Access problems can even end up driving community members away—unless you have the ability to set access rules.

There are some techniques that can be used to set access rules via the Access rules link under User management. To implement any access rules you will need to select the Add rule option, which brings up the following page:

From this you can see that I am in the process of making a rule that denies access based on an email address—more specifically, really@nastyspammer.com. Before we continue on this line, it is important to note that there are both Allow and Deny options available, and these will act based on a supplied Username, E-mail, or Host address given in the Rule type section. The final option, Mask, allows you to specify the actual name of the user or host to which the rule will apply.

In the above case, the email address really@nastyspammer.com will have a deny rule created after Add rule has been clicked.

Go ahead and create a rule like this one, and notice that the rule now appears under the list tab. Now that there is a deny rule in place, how do we go about using it? The answer is that it is already being used. If someone tries to register with the email address supplied in the rule, they will be denied access. As it stands, this is probably not very helpful, because it is unlikely you will know ahead of time what specific email addresses to block.

In order to cater for the times when you aren't entirely sure of the specific address, there are two wildcard characters provided that can serve as generic strings or characters. Imagine you wanted to ban someone who runs a small spamming business. Simply blocking their current email address is not really sufficient, because they can easily create another address and use that one to register. If you know that the addresses come from one location, such as:

@irritating_spammer.com

...you could use the % character to match whatever characters are present before the @ sign, effectively stopping anyone from that email server from registering, like so:

%@irritating_spammer.com

If you have a Hotmail account, or something similar, try blocking any address that ends with @hotmail.com and then attempt to register an account on the site. Drupal will dutifully display the following message:

A new problem rears its ugly head when it so happens that you don't want to allow Hotmail addresses on the site, with the exception of a close personal friend who is traveling around the world and can only access Hotmail addresses. In this case, you need to set an Allow rule as well. If, for example, the email address of the person is good_friend@hotmail.com, then you could set the Allow rule by selecting the appropriate options to cater for this on the add rule page.

The rules would then look something like the following:

What this does is ban all Hotmail addresses from the site. However, because an allow rule takes precedence over a deny rule, the one and only Hotmail address specified in the single allow rule shown in the screenshot will work fine. Now when your good friend attempts to register, everything will go swimmingly well.

After adding plenty of rules, things can sometimes become slightly confusing and it is simply not feasible to continue attempting to register new names all the time, to ensure that they work according to plan. In this case, use the Check rules tab on the right-hand side of the Access rules page. This allows names of users, email addresses, and hosts to be entered in order to check whether they have access or not. Simply compare these results with your expectations to determine if everything is working as planned.

One final thing to bear in mind is that if you deny access using the host criteria, then this will be enforced throughout the site and not just on the registration pages. For the case of the spammer, you would probably want to deny access to the site in general; so you would select the host option with something like this for the Mask:

%irritating_spammer%

This would then match to any host with irritating_spammer in it. For example:

www.really_irritating_spammer.com
www.mildly_irritating_spammer.com
www.extremelyirritating_spammer.org
www.unbelievably_irritating_spammer.comms.org.co.sz

...and so on.

It is important to realize that this only applies to the host criteria:

If an undesirable user has already registered with an email address that is subsequently blocked, then no action will be taken against them.

Remember to check that all the added rules have the desired effect on the site's access policy. It would be a shame to make a rule that prevented potentially valuable community members from accessing content, causing them to go elsewhere.

I would be remiss if I didn't mention, before finishing off, that there are a number of other user access/authentication-related modules available on the Drupal website. It is probably worthwhile to check these out at http://drupal.org/project/Modules/category/74 in case there is something that is particularly suited to your needs.
Summary

This article provided a good grounding in the basics of controlling access to your site's content. Drupal comes with a large number of facilities and options to ensure proper maintenance of the site by retaining overall control with the administrative user, as well as delegating important jobs to trusted users via the use of roles.

We looked at how to go about planning an access policy. This is not only an important requirement, in terms of making sure the site runs smoothly, but also helps to solidify how the site will eventually work by forcing you to consider many eventualities. A tour of the fundamental aspects of access control in Drupal saw us discussing roles, permissions, and users, and learning how to plan and implement an access policy based on the requirements of the site.

Access rules were then introduced as a further way of controlling who gets into the site, with a discussion on how to use the wildcard characters effectively. Planning, and above all, testing, will help ensure that everything works as intended.

With that, we are done with access control, although you are strongly urged to spend some time playing around with the various options until you are comfortable with being able to make changes and understanding their effects.

About the Author

David Mercer was born in August 1976 in Harare, Zimbabwe. Having always had a strong interest in science, David came into regular contact with computers at university where he graduated cum laude with majors in applied math and math (although he minored in computer science).

As a programmer and professional writer who has been writing both code and books for about nine years, he has worked on a number of well known titles, in various capacities, on a wide variety of topics. His books have sold tens of thousands of copies and have been translated into over 6 different languages to date.

David finds that the challenges arising from the dichotomous relationship between the science (and art) of software programming and the art (and science) of writing is what keeps his interest in producing books piqued. He will no doubt continue to write professionally in the future.

David balances his time between programming, reviewing, writing, and contributing to interesting web-based projects such as RankTracer and LinkDoozer. When he isn't working (which isn't that often) he enjoys playing guitar (generally on stage and unrehearsed) and getting involved in outdoor activities ranging from touch rugby and golf to water skiing and snowboarding. Visit RankTracer or find him on LinkDoozer where he is generally lurking.

HP ships USB sticks with malware

2008-04-10T10:16:00.000-04:00

Posted on ZDNet News: Apr 9, 2008 5:02:00 PM
Hewlett-Packard has released a batch of USB keys for numerous Proliant server models which contain malware that could allow an attacker to take over an infected system.

The worms contained on the 256KB and 1GB USB drives have been identified as W32.Fakerecy and W32.SillyFDC. The worms spread by copying themselves to removable or mapped drives and affect systems running Windows 98, Windows 95, Windows XP, Windows Me, Windows NT and Windows 2000, according to AusCERT.

HP's Software Security Response Team issued a warning to AusCERT this week after discovering the worms on the USB drives and has also provided a list of affected servers to the security response organization.

To find out whether a drive is infected, HP recommends inserting it into a system with up-to-date antivirus software. Systems with up-to-date antivirus should be protected from the threat, according to HP.

John Bambenek, a researcher at the security organization Sans Internet Storm Center, has said that because the infected USBs only affect Proliant servers, a targeted attack cannot be ruled out.

However, the threat risk from the worms is considered to be low. "This is probably not going to escalate into a widepread epidemic," Nishad Herath, senior research scientist at McAfee Avert Labs, told ZDNet.com.au. "But I would most definitely urge users to perform a virus scan of any media--including any new blank drives--you receive from vendors prior to installing/using them as slip-ups like this have been known to happen in the past."

HP claims the worm-infected USBs will have only affected a small number of customers.

"HP takes all quality issues very seriously. Because the keys involved are used to install optional floppy-disk drives, this only affects the USB Floppy Drive Key kit which is a very low volume option and impacts a very small percentage of our ProLiant customer base. We've determined root cause and are fully confident that we have resolved this event. To date, no customers have reported this issue," a spokesperson for HP told ZDNet.com.au.

HP has provided an advisory page for customers with affected USB keys.

To find out whether a drive is infected, HP recommends inserting it into a system with up-to-date antivirus software. Systems with up-to-date antivirus should be protected from the threat, according to HP.

John Bambenek, a researcher at the security organization Sans Internet Storm Center, has said that because the infected USBs only affect Proliant servers, a targeted attack cannot be ruled out.

Liam Tung of ZDNet Australia reported from Sydney.

Time Machine via AirPort Disk Is Unsupported, Apple Says

2008-04-08T14:14:00.000-04:00

by Glenn Fleishman

Apple confirmed for me last week that a feature for using hard drives attached via USB to an AirPort Extreme Base Station is an unsupported feature. The company declined to provide further information. This feature was available in the betas of Mac OS X 10.5 Leopard, as has been widely reported, but was removed from the public Leopard feature list and from the shipping version of the operating system. Apple had been working on providing me a definitive statement since my review of Time Capsule for Macworld was published on 21-Mar-08.

What a "lack of support" means is that if you attempt to use an 802.11n AirPort Extreme Base Station for Time Machine backup, you won't get any help from Apple's technical support, something that readers have already told me. I've been receiving reports that USB-attached drives work erratically with an AirPort Extreme. TidBITS editor Joe Kissell and I have been discussing the strange array of scenarios in which you find an Apple Filing Protocol (AFP) volume that's shared by the AirPort Extreme server not appearing automatically for Time Machine. (See "MacVoices Podcast Covers Time Capsule Ins and Outs," 2008-04-03, for links to the podcasts. I also talked about Time Capsule and this problem in a podcast on 26-Mar-08 with Jason Snell, editorial director for Macworld.)

This option to choose an AirPort Extreme-connected drive first appeared with the release of several related firmware, driver, and operating system updates on 19-Mar-08 (see "AirPort Update Extends Time Capsule, Adds AirDisk Support," 2008-03-19). I speculated at the time that this addition was an error on Apple's part, perhaps due to a debugging feature left turned on that wasn't properly turned off before the updates shipped. This was buttressed in part by the way in which Time Capsule drives - whether an internal drive or ones connected externally via USB - appear via Bonjour in a list of selectable volumes when setting up Time Machine, but AirPort Extreme disks do not.

For more background on this situation, see the original response I had in "Time Capsule and Its Associated Rage Factor, 2008-01-17" and details on Time Capsule's USB drive support in "Time Capsule Ships with Support for USB Drive Backups," 2008-02-29.

Somewhere along the line, Apple changed the name of this concept of sharing drives from USB over the network from "AirDisks" to "AirPort Disks."

Apple says Final Cut Server shipping after lengthy delay

2008-04-08T09:52:00.001-04:00

By AppleInsider Staff
Published: 08:00 AM EST

Apple on Tuesday announced that Final Cut Server, its new software solution for media asset management and workflow automation announced last year, is finally shipping to customers.

Introduced last April at the 2007 National Association of Broadcasters conference, Final Cut Server is a scaleable server application that automatically catalogs large collections of assets, allowing searching across multiple disks and SAN volumes, as well as viewing, annotation and approval of content from anywhere using a PC or Mac.

"Whether producing a 30-second spot, the nightly news or a major motion picture, Final Cut Studio is the choice of editors around the world," said Rob Schoeben, Apple's vice president of Applications Product Marketing. "With the introduction of Final Cut Server, collaboration just got a whole lot easier for millions of editors, producers and clients who work with Final Cut Studio."

Final Cut Server automatically catalogs media and generates thumbnails, poster frames and low-resolution clip proxies for quick browsing in user specified formats. A cross-platform client enables a PC or Mac to use Final Cut Server's broad search capabilities, which extend from simple keywords to complex combinations of IPTC, XMP and XML metadata. Final Cut Server also configures a range of highly specific access controls that define user permissions on an asset or project basis.

Apple says the application can scale to support workgroups of different sizes, ranging from a two-person post house to a multi-national news organization and can automate as much, or as little, of the production pipeline as needed. A configurable event-based response model tracks job status, monitors media changes, and automates review and approval notifications and complex sequences of tasks-all through a series of simple menu selections.

Tightly integrated with Final Cut Studio for a seamless extension of the workflow, Final Cut Server includes Compressor 3, Apple's industrial strength digital encoding and compression tool, which delivers pristine format conversions for publishing to DVD, broadcast television, the Internet, Apple TV, iPod, iPhone and other mobile phones.

Final Cut Server is available immediately through the Apple Store, Apple's retail stores and Apple Authorized Resellers for a suggested retail price of $999 for one server and 10 concurrent client licenses, and $1,999 for one server and unlimited client licenses. Full system requirements and more information on Final Cut Server can be found here

Apple notebook lines to see major design changes, sources say

2008-04-08T09:50:00.001-04:00

By Kasper Jade
Published: 12:35 PM EST

Apple Inc.'s existing MacBook and MacBook Pro notebooks will be the last of their breed, as both product families are destined for major design changes upon their next refresh, AppleInsider has learned.

Of the two, the 13-inch consumer MacBooks will undergo the most significant metamorphosis, shedding their plastic enclosures for ones constructed from more eco-friendly materials such as aircraft-grade aluminum and stainless steel, people familiar with the matter say.

The move, which makes good on a promise by company chief executive Steve Jobs to push towards a "greener Apple," will also mark an end to Macs that come clad in the now tawdry looking white enclosures that began with front face of original iMac nearly a decade ago.

Similarly, the MacBook Pro is also bound for aesthetic revisions, which like their upcoming MacBook counterparts are described by those familiar with the products as borrowing several design cues from the August 2007 aluminum iMacs and all-new MacBook Air. The end result, those same people say, will be a more uniform Mac product matrix in terms of design and material usage, and a MacBook offering that will far outclass its rivals.

Though precise details are admittedly limited given the ongoing revision process, it's presumed this will include instances of matte black on portions of the casings, oversized trackpads, and the adoption of the MacBook Air's keyboard by the MacBook.

While the footprint of the 13-, 15-, and 17-inch systems will remain largely unchanged, Apple will reportedly be free to perform some trimming around the edges, similar to -- but nowhere near the same magnitude -- as what was accomplished with the MacBook Air, and to a lesser extent, the rear of the aluminum iMacs.

Compelling the Cupertino-based firm to introduce radical revisions across its notebook lines at this juncture are two primary factors. The first is the company's industrial design cycle, which typically spans 18-24 months.

Neither the MacBook nor MacBook Pro have undergone an aesthetic or structural revision since adopting Intel chips back in the first half of 2006, meaning both will sport outdated outfits by Apple's design standards come mid-year.

The design of the MacBook Pro is particularly dated, having been introduced in January of that year with a form factor largely reminiscent of the late PowerBook G4, only 20 percent slimmer. MacBooks, arguably the fresher of the two lines, saw the most significant overhaul of all Intel-bound Macs systems just a few months later with their robust, magnetic-latching enclosures. (AppleInsider provided coverage and details of both design revisions (MacBook Pro: 1, 2; MacBook: 1, 2, 3, 4, 5) in the months leading up to their respective introductions.)

Also paving the way for redesigned enclosures at this time are logic-board changes on the part of Intel that offer Apple the opportunity to re-asses and slightly modify the notebooks' internals. Both the MacBook and MacBook Pro are to receive "Montevina"-based processors from the chipmaker's upcoming Centrino 2 platform, which require a new "Socket B" logic-board. The second-gen mobile Penryn chips will boast a 1066MHz front-side bus and clock between 2.26GHz and 2.8GHz.

Intel's roadmap calls for Montevina to splash down this June, around the same time Apple will host its annual developers conference in San Francisco. However, it's unclear at this time whether the Mac maker will use that forum to showcase its new notebook designs, or reserve their unveiling for a different stage at a slightly later date.

Although Apple has been amongst the first PC manufacturers to adopt Intel's latest mobile technologies over the past two years, there's often a window period of several weeks (or months) between the chipmaker's formal announcements and the arrival of supporting Mac systems. Therefore, it's believed volume shipments of Montevina-based Mac notebooks won't take place until sometime during the third calendar quarter of the year, which spans July through Sept.

Nevertheless, Apple has been on a tear as of late when it comes to notebook sales momentum, and the new models are only expected to accelerate that growth. According to the most recent data from research firm NPD, sales of Mac notebook systems in the US retail sector rose 64 percent year-over-year for the month of February, compared to an average 20 percent increase for the rest of the industry.

While awaiting new MacBooks and MacBook Pros in the third quarter, Apple enthusiasts will have a pair of other major product launches to anticipate. First and foremost will be a complete refresh of the company's desktop computer families, which will include iMac and Mac mini systems built around current generation Core 2 Duo mobile processors based on Intel's Penryn architecture.

Also expected within the next 60 days is an eagerly anticipated update to the company's iPhone handset that will operate on third-generation wireless networks, which promise speed increases of up to 10X for Internet-related functions.

DCR Workshop: Color Management, Part I

2008-04-08T08:51:00.003-04:00

Submitted by David Rasnake on Thursday, April 03, 2008

Anyone who's done much image post-processing knows it's true: what you see on your screen doesn't always tell you much about how something's going to look in print. If you've ever fine-tuned a photo in Photoshop only to be disappointed when the printed results didn't even come close to the power and punch of the shot on your screen, the importance of having your monitor's output match your printer's is probably evident. While full-time pros recognize the need to be able to accurately control color from one end of their workflow (the camera) to the other (the print) and through all the stops in between (the computer), this idea has only recently come into its own with hobbyist photographers, fueled to some degree by the availability of lower cost color management tools.

If you've been scared off of color management in the past by the mystique that surrounds it, fear not: with the current crop of hardware and software color management tools, especially, calibrating and profiling your workflow is not only manageable but even downright easy, even for profiling newbies. In this first installment of a two-part DCR Workshop series, we'll move through calibrating and profiling your display – the process of standardizing your monitor's output that forms the foundation of making what you see on screen what you get when you print your images: why is it important, how does it work, and what do you need to make it happen? In an overview that's part tutorial, part product review, we'll also demo the display profiling process using a particular color management tool – in this case, Datacolor's Spyder3 Elite system.

WHY CALIBRATE AND PROFILE?

Admittedly, for casual photographers carefully controlled color may not be the most photographically effective use of time and money. For basic calibration solutions, if you're working on a Macintosh try the built-in calibration utility in OS X's display controller; on a PC, Adobe Gamma performs a similar function, though you have to have Photoshop installed to use it (and don't forget to disable/remove it if you move up to a third-party calibration/profiling system). For many users, these basic correctives may well be enough to get your display close enough to what you're getting from your preferred photo output method – whether it's your home printer or a photo lab.

What happens, though, when "close enough" isn't close enough? Getting the perfect look on your screen after hours of editing only to spend countless more hours trying to get a print that aligns with what you're seeing is one of the most frustrating aspects of digital photography. Often, the differences that we're talking about at this level are subtle (they certainly were in our testing), but if they aren't usually the difference between a bad print and a good one, they can easily constitute the minutia that separates good prints from great ones. Given the wide variance we experienced in comparing color on one monitor to the next, it's probably safe to say that a fair number of DSLR users have spent more time and money on camera-side equipment upgrades that will make a less apparent impact on the final printed image than a calibrated display and profiled print workflow.

While advanced display calibration isn't a "magic bullet" for color and tonal range issues – there's output device profiling to consider, for starters, and even the best calibration systems can't fully account for hardware and image handling differences – it's an important first step in making what you're seeing when you edit photos a reproducible situation across a range of devices. With display calibration and profiling, what you're ultimately doing is bringing what you're seeing on a specific monitor – in terms of color, brightness, and contrast – into line with a widely accepted standard for image reproduction, and in this sense, calibration is an investment in peace of mind. With a calibrated and profiled display, you have some assurance that what you see on-screen is, up to a pretty tightly defined standard, what you should expect to get in print, taking a lot of the guesswork about how something will print up out of the image workflow.

I'll repeat that for novice shooters looking to get decent, consistent snapshot prints, a color management system like the one described in the sections that follow may well be overkill. But if you're running up against colors that just won't cooperate from one side of your workflow to the other, keep reading...

CALIBRATION AND PROFILING: NUTS AND BOLTS

Once you're sold on the idea of display calibration and profiling, it's time to get down to the actual process of calibrating a display. Anyone who has attempted to understand calibration and profiling before is probably aware that this is where things get technical (and, in many cases, more than a little obtuse), and those of us without advanced degrees in physics start getting scared. In calibrating and profiling a display, however, there are only a few basic concepts at work, and before we jump into the calibration process itself, a little demystification is in order.

Calibration and Profiling: What's the Difference?

First, a quick note on the fundamental terms themselves, as the words "calibration" and "profiling" are not interchangeable. At its most basic, "calibration" has to do with setting a monitor's brightness and contrast to accepted standards. A "profile" stores the information needed to bring the display into calibration, along with information used to correct how the monitor displays color. To use the technical terms, calibration (the first step) focuses primarily on adjusting gamma, white point, and luminance, while profiling (which happens after the display is calibrated) stores this calibration information and also adjusts the monitor's gamut. If these terms mean nothing to you, don't worry: we'll move through them step by step.

Understanding Gamma

Correcting a display's "gamma" is probably the most talked about, and least understood, part of the calibration process. In order to ensure that what you see is what you get, it's also potentially the most important. In essence, "gamma" refers to the contrast curve of your monitor; it doesn't effect the maximum values (pure white and pure black), but rather, changes the way the tones between these two extremes relate to each other. If you've ever played with the contrast of an image, you can probably visualize this basic concept:

Normal Contrast

Increased Contrast

As I increase the contrast on this image (I've used a black and white to make the tonal changes easier to see), the very lightest and very darkest areas of the image are still just as they were before. What has changed, however, are the gray values in the middle of the range, with the darker grays "moving" closer to pure black, and the lighter grays "moving" closer to pure white. To oversimplify somewhat, your display's gamma refers to how much of this kind of mid-tone shifting contrast it applies to what's being displayed.

LUTs and Profiles

The final displayed gamma is the result of both the monitor's contrast tendencies and information supplied to the display by the graphics card through a system known as the look-up table, or LUT. Now that you know this acronym, you can probably let it pass immediately from your mind – unless you have an older graphics card or you get into much more advanced profiling, the user and the LUT have no direct interaction, and each need only trust that the other exists and is doing its job and leave it at that. In the interest of full disclosure, though, the final word on this topic is that in calibrating a monitor, you are essentially supplying data through the means of a utility or piece of software to the LUT, which compensates for the display's contrast tendencies to arrive at the chosen contrast level – the chosen gamma.

Along with color rendering information, this calibration data forms the "profile" that the computer uses to bring the display into conformity with the standards you select. More on this a little later on.

Gamma and White Point, Mathematically

Where an actual display is concerned, gamma isn't just a general concept but a specific, expressed number value – normally between 1.0 and about 2.5 (though it can theoretically be higher). These numbers come from the mathematical representation of a particular contrast curve – if you've ever used the "Curves" function in Photoshop or similar programs to manipulate image contrast, this idea will be familiar. (For tech heads who insist on knowing more, gamma, or γ, is the exponent in an equation f(x)=xγ relating display intensity, x, and luminance, f(x). In terms of actually calibrating a monitor, this specific piece of knowledge is completely superfluous as well.)

Obviously, then, a purely linear curve (one that applies, for purposes of the contrast analogy, no contrast adjustment to the display) has a value of 1.0, with values greater than 1.0 increasing the amount of contrast, in effect. With many calibration utilities, you can calibrate your gamma to whatever value you'd like, but these days a gamma of 2.2 is the accepted standard for most uses. Thus, if you're using one of these color calibration utility that allows you to set gamma – whether a third-party system, an Adobe or Apple utility, or your graphics card's control panel – use 2.2 as a starting point.

Similarly, monitor calibration must also take the device's displayed "white point" into account. Anyone who's familiar with digicam white balance can probably foresee where this related concept is heading: white point is, for all intents and purposes, the color temperature of the image. While the choice of white point (which is, like white balance, defined as a temperature value in degrees Kelvin) for your display is somewhat arbitrary, the accepted standard is 6500K – essentially, the color temperature of mid-day daylight.

Why Does it Matter?

So why these standards for gamma and white point, and why do they matter? Basically, the human eye doesn't see the world in a linear way, and a contrast curve with a gamma of 2.2 provides a nice match for the way our eyes see: calibrating a monitor to a gamma of 2.2 helps make the display's color space better align with the way we see the world. It's all more complicated than that in truth, and there are other accepted gamma standards for different uses, but if you're a Windows user, especially, with a typical monitor working in the sRGB color space – the default setting for most cameras, if they have a setting at all – 2.2 is the most commonly accepted choice.

Likewise, calibrating the white point on your monitor to 6500K gives you, in most basic terms, a picture of what your printed images should look like under daylight-colored lighting (though as we'll see, calibration utilities sometimes recommend a different white point to account for ambient light conditions in your work environment).

Ultimately, a corrected gamma and white point, along with appropriately set brightness (which establishes the pure white and pure black points in which the contrast curve operates), form the basis of monitor calibration, allowing you to distinguish subtle changes in shading.

Gamma

With a calibrated monitor, you should be able to view a series of stepped "gray percentage" blocks like the ones above and make out the distinctions between each segment. If you can't, your display isn't showing you everything that's potentially going on within your images.

Gamut and Profiling

As noted, the calibration data used to set your monitor's displayed gamma to 2.2 and white point to 6500K is a large part of the profile that your chosen calibration software or utility adds to your machine. The profile (technically known as an "ICC profile") is nothing more than a file that stores data used by your graphics card to adjust your display output to conform to the standards used in the calibration process. In short, the profile is used by your graphics card to tell the display what to do to achieve correct gamma and white point. It's also crucial to the other piece of the profiling equation: gamut.

Not to be confused with gamma, "gamut" refers to the range of colors your monitor is capable of displaying. In addition to correcting gamma and white point to specified standards, a color management system also analyzes the monitor's output gamut and compares the colors it displays with known values. If your monitor oversaturates certain greens, for instance, a profile can zero in on these specific color values and apply a corrective via your graphics card.

Building a color profile is where visual calibration becomes too subjective to be of much use. While you can usually get gamma calibrated to an acceptable standard, for dealing with your display's color reproduction issues, a third-party system using a colorimeter is really almost a must.

CHOOSING AND USING COLOR MANAGEMENT TOOLS

Thankfully, understanding the intricacies of what color management tools are doing is much more difficult than actually using one. When it comes to consumer-level hardware and software packages for calibrating and profiling your display, it's really a two-horse race. For this tutorial and test, we went with Datacolor's Spyder3 Elite system, though the somewhat more dominant X-Rite (to use another analogy, the Canon to Datacolor's Nikon) has several interesting tools out there with similar functionality.

For casual users, the Spyder3 Elite system (at around $270) comes off as a bit pricey, though advanced photographers will appreciate the more open features set it provides over previous and current step-down Spyder models. Given the level of customizability and the decent amount of power it offers, it's a relative bargain compared to a commercial spectro system. Still, for users looking to wade into the monitor calibration pool rather than dive in head-first, both X-Rite and Datacolor offer more basic monitor calibration and profiling systems in the $150 range.

The walk-through that follows, then, deals specifically with the Spyder3 Elite system, though the process is much the same whatever hardware and software package you choose.

The Tools for the Job

Whatever company you go with and whichever system you choose, if you're shopping in the consumer and entry-pro level markets that the devices mentioned previously cover, what you're buying is essentially a two-part apparatus. The primary (really the only) piece of hardware needed is a colorimeter – a small USB device used to measure and evaluate the output of your display and communicate this information back to the computer.

The latest, greatest technology for consumer colorimeters is a built-in ambient light measurement system (that little "eye" on the front of the device), though the business end of the colorimeter is the sensor found on the flipside.

In Datacolor's lineup, at least, it's the software package – the second part of our two-part system – that defines the setup (all of the consumer-level Spyder systems use the same colorimeter). As noted, we gave the Spyder3 Elite system a run, though Datacolor's Spyder3Pro software does much of the same thing without a few of the custom functions and bells and whistles.

Installing the Software

The entire process of installing Datacolor's software, connecting the Spyder, answering some questions, and letting the device build a profile took less than ten minutes, start to finish. If you're feeling impatient, a quick video walk-through shows how it's done:

To get things rolling, we dropped the Spyder3 Elite CD into the drive (in the case of the photos and video, on my workhorse Dell business notebook) and clicked "Install" from the pop-up menu.

On a PC, the Spyder3 utility loads a standard installer screen and goes to work. Everything was finished in less than three minutes, and with no restart required I plugged my colorimeter in via its USB connection was ready to calibrate. (Just for the sake of comparison, we also tried out the installation on four other machines – desktops and notebooks – including an iBook G4, with similar results and no installation glitches all around; if anything, the interface is a little cleaner, and the software runs a little smoother in a Macintosh environment.)

Launching the Spyder3 Elite utility for the first time, the system immediately detects an unprofiled display and automatically loads the "New Monitor" window.

Select the checkbox for "Calibrate this display," click "Next," and you're off and running.

Screen Settings and Options

At this point, the user is called on to provide some information about the display being calibrated/profiled, and to make some baseline hardware adjustments to get the monitor ready for the software's process. The Spyder's first question should be obvious: what kind of display are we dealing with?

In reading down the list of options, you'll note that the Spyder3 Elite system even allows calibration and profiling of projectors, ensuring color control for slideshows and presentations. While most casual users will likely be indifferent to this feature, for pros and other serious shooters looking to show off their work in a larger setting, it's a neat addition to the package. As interested as I was to see how the process for a projector might actually work – this is where the tripod socket on the bottom of the Spyder's stand apparently comes in handy – I selected "Laptop" as my display type (note that it's separate from "LCD," for reasons that will become obvious momentarily).

The next order of business involves specifying the level of hardware-side control your particular display provides.

Depending on the display type selected, the list of options is tailored to cover the common range of adjustments (a second screen covers the RGB and Kelvin sliders found on many newer LCD displays, for instance). In this case, my tester laptop has only backlight adjustment.

Once you've selected the hardware-side adjustments that can be made, the software walks you through what to do with them. In my case, the backlight control was used to visually set the white luminance, based on a quick visual analysis of a series of stepped gray blocks like the ones mentioned earlier.

For displays with more controls, Spyder3 Elite may prompt you to restore some to their default settings, or to use others to optimize your display output. Whatever the specifics, however, the software's instructions are, in most cases, reasonably clear and easy to follow, even for users unfamiliar with the technical aspects of calibration.

At this point, Spyder3 Elite goes ahead and fills in the rest of the details based on its baseline configuration.

Notice that, as expected, the Spyder3 Elite calibrates to a white point of 6500K and a gamma of 2.2 by default. For more advanced users needing to customize their calibration, however, adjustments to all of these values are just a click away under the "Expert Console."

As we'll see shortly, the Spyder3 system also sometimes suggests modifications to these default settings based on hardware limitations or ambient light conditions as measured during its analysis.

Ambient Light Analysis

With most user variables supplied, the process is now largely back in the Spyder3 Elite's automated hands. Though not all calibration tools are so equipped, our test setup is able to make adjustments based on ambient light measurements, and thus before analyzing the display itself, the Spyder prompts the user to setup the colorimeter to take an ambient light measurement.

As before, with a visual guide on the screen showing you exactly what to do, taking the measurement isn't difficult at all: set the colorimeter in its stand and near the computer, click "Next," and the device handles the rest.

In my specific case, the ambient light levels during testing were "Very Low" according to the Spyder (an ideal situation, given that too much ambient light can alter how a screen appears to the eye). For this kind of lighting, the Spyder software suggests that a 5000K white point and a lower white luminance level than the default setting might be appropriate.

Because I regularly use my notebook under extremely high ambient light, I'll opt to keep my settings (which are optimized for bright ambient conditions), but in general, if your software and hardware support ambient light analysis and you tend to use your computer under consistent lighting conditions, it's best to accept the suggested settings. Also, whether or not your calibration tools measure ambient light, it's recommended that you do what you can to reduce overly bright external light sources for the reasons stated above. In the case of the Spyder3 Elite, the system will warn you repeatedly if your ambient light levels are too high.

Building a Profile

For the final phase of the calibration and profiling process, the colorimeter must actually come into contact with your display's surface in order to measure the monitor's output and make appropriate adjustments. In our case, the Spyder3 software shows exactly where to position the device.

Attaching the colorimeter to the screen is usually done either via a suction cup (better on CRTs than LCDs) or by hanging the colorimeter with its cable draped over the back of the display (many colorimeters have a sliding counterweight on the cable lead to facilitate this).

Theoretically, you could just as easily hold the device in place, though the process does take several minutes and the colorimeter needs to stay reasonably still during this time.

With the colorimeter in place, click "Continue" and the software begins, placing a series of solid color fields in front of the colorimeter for the device to "read" and evaluate. Roughly four minutes later, our machine wrapped up and prompted me to give the new profile a name.

With a profile created, Spyder3 Elite shows users the before-and-after results of calibration and profiling right in the utility interface. Several test images of different types (saturated, black and white, low-key, high-key, etc.) can be called up on the screen; click "Switch" and the profile is alternately turned on and off, allowing users to see before-and-after images in real time and evaluate the difference for themselves.

A display profile has now been built, and the utility can be closed out. That's really all there is to it.

EVALUATION AND RESULTS

With a display profile built, you're ready to get to work, and in most cases your involvement with the calibration tool will be limited until you need to calibrate again (Datacolor allows you to set a pop-up recalibration reminder and recommends that you recalibrate your display once a month or thereabouts, as display output tends to shift over time). The software automatically stores the profile such that the computer loads it on startup without being prompted.

Glitches and Bugs

At least that's the ideal setup, and in most cases it seemed to work alright for us. This is where making sure that all other calibration/profiling utilities are removed or disabled becomes critical, though: we had one test machine in our group of five (a PC laptop with multiple displays connected) that didn't want to automatically load its profiles on startup, though I'm not entirely convinced that this issue didn't relate to a phantom version of Adobe Gamma that we kept uninstalling but never seemed to actually go away. Chalk it up to a unique system problem, since it was isolated to one machine of five.

It should also be noted that the software was a little screwy on PCs, in particular, with multiple displays, only detecting the display that the software window was launched onto on the first load. To find the second display, I had to calibrate the first monitor, close the software, and relaunch it on the other display. Strange, but apparently true, as the process proved to be the same on two different machines with this setup. In a similar vein, be aware that a notebook that uses multiple displays only part of the time (as in a docking arrangement, where you use the notebook plus an external display at your desk, but also use the notebook stand-alone at home or on the road) can occasionally give Spyder3 Elite fits, causing it to clear the profile for the notebook display.

The Visual Results

In testing the system on several machines, the results, while not always dramatic, were often revealing. For instance, as I had long suspected based on comparisons with my other machines, the laptop shown in the walk-through tends to push a broad swath of the highlight range, making areas of an image look blown out that, in truth, contain plenty of tonal information. Similarly, the laptop's default profile tends a bit cool, though I honestly hadn't even noticed until I side-by-sided the new version with its original profile.

If you work under bright ambient light (most overhead fluorescents in office environments fall into this category), you may find that calibrated color on your screen looks a bit dull at first, with whites that look closer to gray to unaccustomed eyes. The Spyder3's ambient light measurement function strongly disliked the light in our office, and wasn't able to sufficiently adjust the white luminance to compensate. Similarly, it's widely known that the apparent contrast and brightness of LCDs, and especially laptop displays, shifts dramatically based on viewing angle. Again, ambient light and working conditions can be as important to accurate color reproduction as the display setup itself, and doing what you can to create a consistent work environment for photo editing will make the output results more consistent.

The Spyder's Studio Match function does a decent job of bringing multiple displays to parity, though differences in hardware often make exact matches difficult to achieve – the more different the hardware (trying to match a new LCD and an aging CRT, for instance), the less you should expect the displays to match exactly. In some extreme cases, you'll have to decide what match points are most important to you and calibrate with this in mind; thankfully, the Spyder's Expert Console is generally up to the task of making these kinds of one-off adjustments, and all but the most exacting users will do just fine in trusting the system to make the match as it thinks best. Even without running Studio Match, we found the Spyder's profiles to yield extremely similar results across a range of hardware – producing a slightly warm profile compared to other systems I've used, but showing few variations in color/hue and no apparent discrepancies in tonal range across systems.

Long story short, the calibration and profile tool does exactly what it claims to do, providing consistent color, contrast, and brightness (and, in turn, consistent image appearance) from one computer to another.

CONCLUSIONS

Even in limiting the discussion (for now) to display calibration alone, this overview is really just the tip of the iceberg. There are simply too many hardware- and software-specific differences in implementing consistent color management to even begin to touch on in a single review and tutorial. We'll talk a bit more about device-specific ICC profiling in Part II of this series, but if there are specific questions about calibration and profiling as it relates to a certain setup or piece of software, or about controlling workspace in programs like Photoshop to make the most of a profiled display, we're glad to continue the discussion in the forums.

Larger than this, however, I hope that this walk-through gets at the idea that while the concepts may be complex, using color management tools to calibrate and profile your display really isn't hard and shouldn't be intimidating. With a growing number of options on the market and prices for these systems coming down into very reasonable territory, if you've been struggling to get your images under control, it's never been easier or cheaper to manage color in your workflow.

Stay tuned for Color Management, Part II, in which we'll bring things full-circle by profiling our printer output and do some analysis to see how much of a difference it ultimately makes.

WSJ's Mossberg says 3G iPhone due in 60 days

2008-04-07T12:15:00.003-04:00

By Aidan Malley
Published: 04:50 PM EST

Speaking at a Beet.tv executive summit, well-known Wall Street Journal writer Walt Mossberg has stirred the pot by stating that an iPhone with 3G access will be available within 60 days.

The journalist makes his off-hand but apparently certain statement while discussing the relatively poor state of Internet access in the US, whose cellular and landline connections are often outrun by foreign providers.

Mossberg doesn't cite any sources in his talk with executives, in which he also comments that the Apple TV is limited by the speed of American Internet access.

However, the technology critic is also known for gaining privileged access to information and products from Apple. Mossberg received his review iPhone on June 11th last year -- more than two weeks before the touchscreen cellphone was available to the general public and ahead of most other journalists.

The comments echo the increasingly repeated June timetable for a launch of an iPhone with faster wireless access. In recent days, multiple analysts have predicted that Apple will unveil its 3G iPhone no later than June, with Piper Jaffray claiming that the ongoing iPhone shortage is a sign of inventory control measures meant to phase out older models.

T-Mobile Germany has further sparked interest by subsidizing the price of 8GB iPhones in a promotional campaign that ends June 30th.

Mossberg's statement can be seen in the video below at the 6 minute, 53 second mark.

Successive Mac OS X 10.5.3 builds continue from Apple

2008-04-07T12:14:00.001-04:00

By Katie Marsal
Published: 10:00 AM EST

Mac maker Apple Inc. continued this week with a somewhat unusual practice of providing outside developers with successive builds of its next operating system update, Mac OS X 10.5.3, fairly early in the testing cycle.

The company has historically followed a pattern in which it would alternate between releasing external and internal builds, where successive external seeds -- those to outside developers -- would only occur in the days leading up to the software's intended release.

Development of Mac OS X 10.5.3 has not been following that course. Instead, Apple has externally seeded three successive builds of the OS update to its vast developer community, beginning with build 9D10 late last month and continuing on through build 9D12 on Thursday.

According to people familiar with 9D12, the build tacks on 17 additional fixes and code corrections to a list now over 110 deep. Particular emphasis appears to have been placed on Spaces, they say, where new tweaks target the feature's preference pane, hot keys activation, and general functionality.

In addition, Apple is also said to have patched holes in Kerberos authentication, the .Mac preference pane, AirPort, and Network Setup Assistant.

In a set of developer notes reported to have accompanied the latest build, Apple made no changes to the system components in which it seeks developer feedback. That list still spans 25 items long and includes core components such as AirPort, Automator, Audio, Graphics, iCal, Mail,. Rosetta, Spaces, Spotlight, and Time Machine.

Though Mac OS X 10.5.3 is presumed for a release sometime in the next 7 weeks, the rapid and successive seedings suggest the update could hit sooner than later.

RBC on shortage; Apple vs. Big Apple; T-Mobile's 99 Euro iPhones

2008-04-07T10:46:00.002-04:00

By Aidan Malley
Published: 06:25 PM EST

An RBC analyst says that demand, not future models, are dictating the sudden iPhone shortage. Meanwhile, Apple assures buyers that more are on the way, the company is fighting New York City over an apple logo, and T-Mobile Germany is the first to subsidize the iPhone's price with different plans.

RBC: iPhone shortfall result of huge demand

Claims that Apple's sudden lack of iPhones is sign of an imminent upgrade to 3G are unrealistic, Royal Bank analyst Mike Abramsky said on Thursday in a note to investors.

Instead, Apple is more likely to have simply underestimated demand. Investigations suggest that the iPhone maker dropped its build rate by as much as 50 percent in the first quarter of 2008, assuming that demand would drop sharply after the holiday; that sales rate remained steady, Abramsky says. He also notes that Apple has had a recurring difficulty in estimating iPhone demand, including sales of unlocked devices.

An early 3G iPhone launch ignores a number of factors, the RBC researcher notes, including the need to receive government approval and the timing of the version 2.0 firmware update in June, which presents a more likely opportunity.

Still, Abramsky adds, the problem is one Apple is glad to have. The company "probably feels like the dog that caught the car," he says.

Apple responds to iPhone shortage concerns

Until now the only party remaining silent on the subject of its iPhone shortage, Apple on Thursday chimed in on the subject in response to a New York Times inquiry. Spokesman Steve Dowling responded briefly by noting that a steady supply of shipments is still enroute.

"We are working to replenish iPhone supplies as quickly as we can," he says in a prepared statement.

Dowling declined to provide an explanation for the shortage.

Apple disputes New York City campaign logo

Although it runs three flagship retail stores in New York City, Apple is taking the local government to task for attempting to trademark a logo resembling its namesake fruit.

While the city's emblem -- meant for the GreeNYC environmental campaign -- bears little direct similarity to Apple's partly-eaten version, the appearance is close enough that Apple has filed its formal opposition to the registration of the trademark.

The use of the logo by New York would "seriously injure" Apple's reputation by causing confusion and diluting the brand, Apple claims.

The protest will require that an independent survey take place to determine whether claims of confusion are well-founded.

T-Mobile Germany to subsidize iPhone price during promo

Apple has historically resisted subsidizing the iPhone's price with subscriptions since its debut, but that should change as of next week, according to reports.

Starting April 7th, T-Mobile Germany is expected to run a promotional campaign that will discount the price of an 8GB iPhone by increasing amounts depending on the customer's subscription plan. A customer of the 89-Euro Complete XL plan, which offers 1,000 minutes per month, will pay just 99 Euros for the phone itself.

Having obtained a full chart for the campaign, German site iFun has also learned that less costly Complete L and M lans will offer the phone for 149 and 199 Euros. A fourth plan, the Complete S plan, will offer just 50 minutes of calling and caps data to 500MB but will still offer the phone for 249 Euros, or 150 Euros less than its normal asking price.

Notably, the sale is due to end on June 30th, shortly after Apple expects to ship its version 2.0 firmware upgrade.

Apple out-muscles Wal-mart to become No. 1 US music retailer

2008-04-07T10:43:00.001-04:00

By Katie Marsal
Published: 03:45 PM EST

Apple confirmed Thursday that the iTunes Store has surpassed Wal-Mart to become the number one music retailer in the US, based on the latest data from the NPD Group. [Updated with info from Apple press release.]

“We launched iTunes less than five years ago, and it has now become the number one music retailer in the world,” said Eddy Cue, Apple’s vice president of iTunes said in a statement. “We are thrilled, and would like to thank all of our customers for helping us reach this incredible milestone.”

NPD ranks music retailers based on data from its MusicWatch survey that captures consumer reported past week unit purchases and counts one CD representing 12 tracks, excluding wireless transactions. The iTunes Store became the largest music retailer in the US based on the amount of music sold during January and February 2008.

The announcement confirms an earlier report from ArsTechnica which revealed that the iTunes operator garnered a 19 percent share of all US-based retail music sales in January, good enough to push it past industry leader Wal-Mart, which captured a 15 percent share for the same period.

Apple's surge to the No. 1 spot comes just one month after the company reported passing Best Buy to become the No. 2 US music retailer.

What's of particular interest from Ars's earlier report is that it includes an NPD chart of the top 10 music retailers from January with their associated share of the market. NPD declined to release those specific share percentages back in February when Apple definitively claimed the No. 2 spot.

US music retailer rankings for one week in January | Source: ArsTechnica

Not only does the chart reveal Amazon to be a distant fourth in the rankings behind Apple, Wal-mart, and Best Buy with its 6 percent share, it more importantly shows the approximate level of separation between the top players.

Adobe: 64-bit Mac Creative Suite apps won't happen till v5.0

2008-04-07T10:40:00.000-04:00

By Slash Lane
Published: 01:25 PM EST

Adobe's plans to deliver 64-bit Photoshop support as part of the upcoming release of its Creative Suite 4.0 software bundle for Windows PCs, but Mac users will have to wait till version 5.0 to see the same treatment.

This has nothing to do with software maker's commitment to the Mac platform and is instead an unfortunate side affect of Apple's decision to scrap plans for a 64-bit version of its Carbon API set mid-course, said John Nack, Senior Product Manager for Photoshop applications.

Apple has long offered its developers two primary sets of programming interfaces (APIs) for writing Mac OS X applications: "Cocoa," which supports 64-bit development, and the legacy "Carbon" set, which only supports 32-bit. However, with a significant number of existing applications relying on Carbon, Apple at its 2006 developers conference said it had begun work to enable a 64-bit version of the API set.

As such, Adobe's original plan for its Creative Suite applications on the Mac was to add Intel support through the existing Carbon API set with the release of v3.0 and then deliver 64-bit support in v4.0 via the 64-bit Carbon API set, according to Nack.

"At the WWDC show last June, however, Adobe & other developers learned that Apple had decided to stop their Carbon 64 efforts. This means that 64-bit Mac apps need to be written to use Cocoa (as Lightroom is) instead of Carbon," he explained. "This means that we'll need to rewrite large parts of Photoshop and its plug-ins (potentially affecting over a million lines of code) to move it from Carbon to Cocoa."

Nack said Adobe immediately began adjusting its product development plans after learning of the change, but added that no one at the company "has ever ported an application the size of Photoshop from Carbon to Cocoa." Therefore, pushing for 64-bit support by v4.0 was just not feasible.

"It's a drag that the Mac x64 revision will take longer to deliver. We will get there, but not in CS4," he assured Mac users. "Our goal is to ship a 64-bit Mac version with Photoshop CS5, but we’ll be better able to assess that goal as we get farther along in the development process."

In a blog posting, Nack also took a stab at dispelling some myths about the benefits of 64-bit applications, specifically the notion that they instantly perform at twice the speed of 32-bit apps.

In its own tests, Adobe found the average 64-but app to run about 8 to 12 percent faster than a 32-bit one. But the primary advantage of 64-bit applications is their ability to address very large amounts of memory in excess of 4GB.

"This is great for pro photographers with large collections of high-res images," said Neff, who added that opening a 3.75 gigapixel image on a 4-core machine with 32GB RAM is about 10x faster in the 64-bit version of Photoshop currently under development than it is on the existing version.

Intel touts anti-theft tech for laptops

2008-04-07T10:37:00.000-04:00

By Tony Smith in Shanghai
2nd April 2008 11:11 GMT

IDF Intel today announced an initiative it hopes will make it much less desirable for criminals to steal laptops. The aim is to build the ability to lock down a machine's storage - and possible even the processor itself - if it's pinched.

Intel Anti-Theft Technology (ATT) isn't yet ready for incorporation into new machines, but with research showing that even consumers now rate data protection second only to performance among the list of desirable attributes new laptops should possess, the chip giant clearly thinks it's time to get moving on this issue.

Because it's early days for the technology, precise details are slim - Intel's Mobility Group chief, Dadi Perlmutter, today could only give a very broad overview of ATT. However, the initiative will seek to put in place hardware within the system to disable laptops booted without authorisation and to prevent access to stored information.

Hard disks with on-board data encryption already exist, but Intel clearly hopes to encourage more storage vendors to do so, and to add the technology to solid-state drives too.

That secures data but it doesn't discourage theft - encrypted drives can be replaced - so the ability to tie actual system operation into the OS login process or a password entered earlier in the start-up sequence could deter criminals in the first place by making the hardware itself valueless if stolen.

Perlmutter hinted Intel is also looking into incorporating tracking technology into ATT, though that takes the add-on beyond the hardware and into the service provider domain.

Not that Intel is devising ATT on its own. System suppliers Fujitsu Siemens and Lenovo, Bios maker Phoenix and malware basher McAfee are also working on the project, the chip giant said.

The results of their work are expected in Q4, though whether that's in shipping laptops or as a technology computer makers will subsequently be able to adopt remains to be seen. The timing suggests the latter: it's just ahead of the time we'd expect Intel to refresh its Centrino platform following the debut of Centrino 2 - aka 'Montevina' - in May this year.

Step by Step: Using Samba to join a Windows Domain

2008-04-07T10:33:00.001-04:00

by Judith Myerson
04/01/2008

In this article, I give you the steps you need to use Samba to join to a Windows domain. The primary domain controller (PDC) will serve as the password server for the domain. If Samba and winbind services are running, turn them off. I will show you how turn them on after you join to the Windows domain. You should save your files at any point in your "work-in-progress" and restore your originals if you intend to reboot. You should make note of your hard devices listed in your fstab file. Before you start you should ping the server from your intended Linux workstation.

Step 1. Join the Samba Server

You must join the Samba server before you join the Linux client and then test the Linux password. If the Samba server already has been joined, go to Step 3.

To join the server to the domain, you must have name resolution to your password server and an administrative account so you can join your Linux workstation to the domain. To do this, you first create the domain account to change a user's SMB password and then test winbind and local system accounts and groups.

To create the password, run as a root user. Type:

smbpasswd
[ - j MYDOMAIN] [ - r PDC ] [-U user-name]

Here is how each option in the password works.

Option 1: -j MYDOMAIN

-j MYDOMAIN lets you add a Samba server into a Windows Domain. When invoked with -U, that username (and optional password) are used to contact the PDC to create a machine account, and to set a password on it.

Option 2: -r PDC

PDC is the full name of your PDC server in the format of DomainMaster.MYWORK.com. You can specify what machine you wish to use to change your password or another user's password. If you do not specify, smbpasswd defaults to the local host.

Option 3: -U user_name

user_name is the domain username who has been assigned administrative privileges. On that machine, you can specify the username whose password will be changed.

If the password test is successful, you can then test winbind to allow Windows domain users and groups to appear and operate as Linux users and groups on a Linux machine. Winbind uses a UNIX implementation of Microsoft RPC calls, Pluggable Authentication Modules (PAMs), and the name service switch (NSS).

To get users, type:

# wbinfo - u

To get groups, type:

# wbinfo - g

To test connections, type:

# wbinfo - t

When the results are successfully returned you should see MYDOMAIN=user.
Step 2. Test Linux Password

Test the Linux system password assuming you already have changed the nsswitch.conf file to include winbind options. If you did not include those options in the nsswitch file, go to step 3 and then repeat step 2. Upon a successful test, the system should see domain resources along with the local Linux machine accounts.

To get a list of Linux users, type:

# getent passwd

To get a list of Linux groups, type:

# getent group

Step 3. Edit nsswitch Configuration File

First, backup your nsswtich.conf file in case something goes wrong, like this:

# cp nsswtich.conf
nsswitch.bak

After you open nsswtich.conf, add winbind to the end of the passwd: and group: lines at the beginning of the line, like this:

passwd: compat winbind

group: compat winbind

If winbind does not work properly, go to step 4 and then repeat step 3. Otherwise, when you are done with the nsswitch.conf file, run idconfig to activate the changes, like this:

#/sbin/idconfig

Step 4. Edit the winbind Section in the Samba Configuration File

If you discover that the winbind section is missing from the smb.conf file, add it. If you find it, make a few changes to look like this:

#winbind options

winbind operator = +

winbind uid = 15000-25000

winbind gid = 15000-25000

winbind cache time = 15

winbind enum users = yes

windbind enum groups = yes

template homedir = /home/winnt/%D/%U

template shell = /bin/shell

What this section says is that you can separate domain and username with "+" or even "\" and use uids and gids from 15000 to 25000 for domain users and groups respectively. You can allow enumeration of winbind users and groups and give users a real shell for those who have telnet access.
Step 5. Create a Domain Home Root Directory

In step 5 I have included template homedir = /home/%D/%U in the configuration file. This means you must check if a domain home directory exists. If it does not exist, you must create the %D (domain) directory. The %U (user) will be created automatically when the user logs on.

Here is an example:

# cd /home
# mkdir MyWork
# chmod 777 MyWork

So now when a user logs in MyWork+DAVE the Samba script will put the user in /home/MyWork/ and will automatically create DAVE's home directory.
Step 6. Update Linux System Password

You need to allow passwords to change from Windows to update Linux System Password, like this:

unix password sync = Yes

passwd program = /usr/bin/passwd %u

passwd chat =*Type_new_password*
%n\n

*Retype_new_password* %n\n

*Password_updated_successfully*

After this, you may make further password updates using PAM's password change control flag for Samba. You must enable the control flag so you can use PAM for password changes when requested by an SMB client instead of the program listed in the passwd program. Chat parameter is:

Pam password change =yes

Step 7. Check the Global Section in the Samba Configuration File

At this point we are not quite done with the smb.conf file. Let's take a closer look at the global section in the configuration file particularly where you may need to make the changes.

[global]

workgroup = MYWORK

os level = 2

time server = Yes

unix extensions = Yes

encrypt passwords = Yes

map to guest = Bad User

printing = CUPS

printcap name = CUPS

password server = DomainMaster.MYWORK.com

socket options = SO_KEEPALIVE IPTOS_LOW DELAY
TCP_NO DELAY

wins support = No

veto files = /*.eml/*.nwd/ched32.dll/*.{*}/

security = domain

netbios name = my-Linux

The os level option is largely auto-configured in the Samba-3 release series and it is seldom necessary to manually override the default setting. When the map to guest option is set to Bad User, the system rejects user logins with an invalid password. The printing parameter controls how printer status information is interpreted on your system. CUPS is one of the printing styles. To use the CUPS printing interface set printcap name = cups.

The socket options configuration options are set on a per-connection basis and can be reset by Samba on the sockets in the smb.conf file to increase throughput. An explanation of each option follows.

TCP_NODELAY, a default value, tells the server to send as many packets as necessary, so you will have no or low delay. This will give you up to a 30 percent speedup.

IPTOS_LOWDELAY trades off throughput for lower delay. This applies to routers and other systems, not the server. Set IPTOS_LOWDELAY whenever you set TCP_NODELAY. You will get an increase in speed up to around 20%.

SO_KEEPALIVE initiates a periodic check every four hours to see if the client is still there. It eventually arranges to close dead connections, returning unused memory to the operating system.

The wins support option controls if the nmbd process in Samba will act as a WINS server. You should not set this to yes unless you have a multi-subnetted network and you wish a particular nmbd to be your WINS server. Note that you should NEVER set this to yes on more than one machine in your network.

Use the veto files option if you want to prevent users from seeing certain files and directories completely. Each entry in the list must be separated by a '/', which allows spaces to be included in the entry. '*' and '?' can be used to specify multiple files or directories. One feature of this option is that if a directory you are trying to delete contains only the veto files, the deletion will fail unless you also set the delete veto files option to yes.
Step 8. Edit PAM Files

Backup the PAM files, before you start editing three files, stored in the etc directory You should be logged on as root when you backup the login, xdm, samba files, like this:

# cp login login.bak

# cp xdm xdm.bak

# cp samba samba.bak

Edit the login file to add pam_winbind.so and pam_mkhomedir.so. PAM starts reading the file from the top and goes down to the next line only if the credentials supplied are good to pass the current line.

#%PAM-1.0
auth required pam_securetty.so
auth required pam_env.so
auth sufficient pam_unix2.so nullok
auth sufficient pam_winbind.so use_first_pass
auth required pam_deny.so
auth required pam_nologin.so
account sufficient pam_winbind.so
account required pam_unix2.so
password required pam_pwcheck.so nullok
password required pam_unix2.so nullok use_first_pass use_authtok
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
session sufficient pam_unix2.so none # debug or trace
session sufficient pam_limits.so

When you edit the xdm file, add the pam_winbind.so parameters.

#%PAM-1.0
auth sufficient pam_winbind.so
auth sufficient pam_unix2.so use_first_pass nullok #set_secrpc
account sufficient pam_winbind.so
account required pam_unix2.so
password required pam_unix2.so #strict=false
session required pam_unix2.so debug # trace or none
session required pam_devperm.so
session required pam_resmgr.so

When you edit the Samba file, make sure it looks like the:

#%PAM-1.0
auth required pam_unix.so
account required pam_unix.so

Step 9. Test PAM Settings

You need to perform two tests: console login and X-windows login.

Console login test: In performing a console login test, you first press Ctrl+ALT+F1 to start a new console session as a back door for testing your PAM setting. At the login prompt test your login using the local root account. After you have verified that you can log in using the machines local account you can test a console login of a domain account. The username is specified as DOMAIN+USER.

X-windows login test: You do this test after you successfully logged in using both the local root account and a domain account. This is what you have to do:

* Log in as root from the same console session.
* Change back to your Windows session, using Ctrl+ALT+ F1.
* Log out of the X-window session and return to the login window.
* Test the login using a local machine account, then log out after login is complete.
* Test domain login using username specified as DOMAIN+USER

Step 10. Check the Results

The results should show in your login dialog all the account names that exist on the domain. This is fine for a small user base. If you have a large user base and do not wish to display all the user names you can disable this option in the login manager under system administration. Go to the users tab and change the show user to "none."

Once you are satisfied with the results, you can change ownership of files and folders by specifying the user (e.g., DOMAIN + USER), like this:

# chown DOMAIN+USER filename

Step 11. Check Samba and winbind Services

Skip this step if you already modified or set up your Samba and winbind services. Otherwise, do the following:

From the console cd over to the etc/rc.d directory where you can view, change or modify your systems services. You need to setup these services to ensure they start every time when you boot up.

Use the chkconfig script to see if smb and winbind services are on. These services should be on for runlevels 3 and 5. Type:

# chkconfig --list smb

If the results show the services are not set to on for runlevels 3 and 5 turn them on using the chkconfig, like this:

# chkconfig smb on

# chkconfig winbind on

Next we disable the nscd service which interferes with the proper functioning of winbind, like this:

#chkconfig nscd off

Now turn off the nscd service, like this:

#./nscd stop

We are now ready to start smb and winbind, if it is running already restart them:

#./smb start
#./winbind start

Judith Myerson is a systems architect and engineer. Her areas of interest include enterprise-wide systems, database technologies, network & system administration, security, operating systems, programming, desktop environments, software engineering, web development, and project management. You can contact her at jmyerson@c2040.com

N.Y. Lawmakers Near Vote on 'Amazon Tax'

2008-04-07T10:09:00.002-04:00

Hotly debated provision could rewrite the rules of e-commerce.

April 4, 2008
By Kenneth Corbin

As New York lawmakers hash out the state's budget, one contentious issue may have a dramatic impact beyond the Empire State: A provision requiring many online retailers to collect sales tax on state residents' purchases.

The provision, now facing a coming vote as part of state legislators' 11th-hour efforts to pass a state budget, could require e-tailers to collect taxes even if they have no employees or offices within the state.

If signed into law with the budget, the so-called "Amazon tax" would apply to merchants offering commissions in exchange for customer referrals, a practice known among Internet retailers as an affiliate program.

Many online retailers, such as Amazon, Barnes & Noble and Buy.com, have programs that allow individuals or organizations to include a link to the e-commerce site on their own Web page. The affiliate receives a commission for sales generated through the referral.

The bill's supporters, including trade associations such as the Retail Council of New York State, countered it simply shifts the onus of collecting the tax onto businesses.

To date, consumers have been responsible for reporting their own purchases from out-of-state companies on their state income tax returns and paying a use tax on those items.

Additionally, requiring Web businesses to collect sales taxes would level the playing field between bricks-and-mortar businesses and their online counterparts, according to Ted Potrikus, the Retail Council's executive vice president and director of government relations.

"Collecting the sales tax on purchases made over the Internet is not a new tax," Potrikus told InternetNews.com. "This is pretty much all I've talked about with the state legislators since February."

He added that many bricks-and-mortar retailers also maintain e-commerce businesses -- so they're already required to navigate the intricacies of local tax codes when shipping items to any online shopper living in a state where they have a store.

"If [offline retailers] can figure out how to charge, collect and remit the right kind of sales tax in every jurisdiction in the country, I think the Internet companies can do the same," he said.

The move comes as states are finding that the honor system of consumers' reporting and paying use taxes is falling short. For one reason, many people do not know that they are required to report out-of-state purchases. Supporters of such bills also maintain it's impractical for states to enforce collection on an individual level.

In the budget he submitted, then-Gov. Eliot Spitzer estimated that requiring businesses to collect Internet sales taxes would boost the state's revenue by $47 million in 2008-09, and $73 million in 2009-10.

As the bill now stands, any e-commerce company that derives more than $10,000 of revenue from New York-based affiliate referrals will be required to collect sales taxes on all purchases shipped to New York addresses. Businesses will have to register as tax vendors by June 1.

Spitzer had introduced the idea in November in a memo from the state tax commission, but rescinded it the same day as media outlets began reporting the controversial new policy. Spitzer said it was not the right time to increase taxes on New Yorkers.

"This is a gray area"

Even if passed into law as part of the state's budget, observers say any New York online tax provision will rest on uncertain legal footing -- and is likely to be challenged in state or federal court.

The 1992 U.S. Supreme Court ruling in Quill v. North Dakota held that only businesses with a physical presence in a state are required to collect sales taxes on purchases shipped there. Typically, companies have been deemed to have physical presence if they maintain a store, office or distribution center in the state, or if any employees are based there, such as a sales representative.

Amazon does not have any employees in New York, but the budgetary provision asserts that its affiliates are enough to constitute physical presence.

The budget, as submitted originally by Spitzer, singles out e-tailers who "enter into agreements with organizations under which the organization receives a commission if it includes a link on its Web site that connects the users to the Internet retailer's Web site."

According to the provision, those organizations are representatives of the company, and it asserts that "the extent of these local solicitation activities is easier to ascertain for the sellers than it is for the [state]."

But observers said the matter is far from cut and dried.

"It's sort of this new definition of what a representative could be. It's going into an area that hasn't been touched on yet," said Hugh Goodwin Jr., a state and local tax attorney and partner with international law firm DLA Piper. "This seems to me to be really pushing it. This is a gray area."

Goodwin said that the definition of physical presence varies among states, and that New York has historically taken an aggressive stance on the issue.

Viewed in that light, the legal defense of the provision would be that it is not a new law, but rather a clarification of an old one. Affiliate programs of the kind employed by Amazon did not exist in 1992, when the Supreme Court ruled on Quill.

The crux of any legal challenge would be the definition of terms, where opponents of the provision would claim that affiliates should not be considered on a par with company employees, while New York would argue that it is within the boundaries of Quill.

The Quill case established the rule of physical presence, which New York claims it is updating to apply to a new economic model. Another Supreme Court ruling from three decades earlier could also be used to marshal a defense of the new tax provision.

In its 1960 ruling in Scripto v. Carson, the Supreme Court determined that independent contractors working in Florida on behalf of the Georgia-based Scripto pen company established a "nexus" in the state, and thus it was responsible for collecting sales taxes on purchases made by Florida residents.

The similarities between Scripto's contractors and participants in an affiliate program such as Amazon's -- neither being full-time employees -- may boost New York's case in the event of a legal challenge. New York could, perhaps convincingly, claim that in taking commission for customer referrals, online affiliates act in the same capacity as Scripto's contractors.

The revenue crush and tax maze

States are pushed to measures such as New York's tax law clarification from the need to turn red ink black.

"A lot of states are trying to get revenue from out-of-state companies," said Joe Henchman, tax counsel at the Tax Foundation, a Washington, D.C.-based nonpartisan research and educational organization.

But Henchman warns against what he calls "exporting the tax burden to out-of-state companies."

He argues that the current U.S. tax system, with about 7,400 different state and local sales taxing jurisdictions, is in desperate need of reform. In an age of global trade and point-and-click shopping, Henchman believes that a system of taxation based on geographical boundaries is a "square peg in a round hole."

Henchman won't be alone in lamenting the implications. In 2000, revenue officials from a number of U.S. states banded together in an effort to address bewildering discrepancies in which goods are taxed in different jurisdictions, and the rates at which they're taxed.

The resulting Streamlined Sales Tax Project, which aims to put pressure on Congress to simplify the tax code, now counts 17 states as full members of its governing board and five as associate members. New York is not a member.

Like Streamlined, Amazon similarly argued in favor of simplifying tax rules while making its case to New York legislators. The company claimed that it did not object to collecting taxes in principle, but that the complexity of existing laws -- once applied to Internet shopping -- would entail unreasonable expense.

In addition to Washington state, where it is based, Amazon collects sales taxes on purchases shipped to North Dakota, where it has a call center. It does the same for shipments to Kansas and Kentucky, where it maintains distribution centers.

Bills based on recommendations from Streamlined have repeatedly stalled in Congress, and Potrikus of the Retail Council said Amazon's show of support for the project was somewhat disingenuous.

"The national solution is so bogged down in different warring, bureaucratic factions," he said. "It's easy to take something that you know isn't going to work and hold it up as a solution. Streamlined has become more of a dodge at this point than a solution."

Henchman, who opposes the New York provision, doesn't see Streamlined as a solution, either. He criticized the project for linking jurisdictions to nine-digit ZIP codes, which he said reinforces artificial and obsolete economic boundaries and fails to whittle down the number of tax codes to a level that merchants can be expected to navigate.

Absent the type of sweeping reform that Henchman envisions, or even the success of the comparatively moderate Streamlined project, states will be closely watching New York's moves -- to see whether lawmakers give the provision the thumbs-up, and if so, how it fares in an anticipated legal challenge.

Assuming the interpretation is not overturned, and if revenue rises as the governor's budget predicts, other states can be expected to take a more aggressive approach toward e-commerce taxation.

"If New York adopts this, then other states are going to do it, too," Henchman said.

Microsoft & Linux: At What Point Is It Cheaper to Just Buy Novell?

2008-04-07T10:07:00.000-04:00

From a technology perspective Novell has two things to offer Microsoft - SUSE and Identity Management

By: David Harrison
Apr. 4, 2008 05:15 AM

Microsoft no longer sees itself as simply a Windows company. One recent indication of this is their determination to buy the LAMP-centric (Linux/Apache/MySQL/PHP) Yahoo! Instead of migrating all the tried and tested Yahoo! services over to a Windows server infrastructure, wouldn't it be simpler to establish Microsoft Linux through the acquisition of Novell? From a technology perspective Novell has two things to offer Microsoft - SUSE and Identity Management.

The U.S. Supreme Court has cleared the way for Novell to continue their Wordperfect anti-trust suit against Microsoft. Novell's argument is that anti-competitive operating system issues caused their once mighty Wordperfect suite to come tumbling down. This turn of fortune cost Novell to the tune of $1 billion. The lawsuit Novell has filed against Microsoft is for damages potentially in the order of $3 billion.

Whilst everyone agrees Microsoft is no saint the fact of the matter is Novell and Wordperfect got beaten by aggressive pricing and marketing rather than significant operating system level anti-competitive action. Microsoft gained market share by aggressively dropping the price of Office to the point that it was less than half that of its competitors. Rather than following suit and matching dollar for dollar these moves Novell blindly followed their original pricing structures inherited from when they purchased Wordperfect.

Novell's past business blunders aside, given Microsoft's recent showing in the courts you would have to say its an even money bet that some financial compensation arises from this case. Whether it is in the order of $3 billion is unlikely but even a quarter of that amount is still a hefty sum. Does there come a time when Microsoft executives look at Novell and decide it is cheaper to buy them outright than cough up massive legal fees and reparations?

A few years ago the idea of Microsoft buying Novell would be dismissed on anti-competitive grounds, but these days Microsoft faces stiff competition from the likes of Red Hat, IBM, Sun, Oracle and of course Google. Even in recent years the two companies have hardly been competing against each other. The controversial agreement struck a few years ago between the two has seen them in coopetition rather than competition without so much as a mumble from regulatory bodies.

Given Novell's current financial position if a $3 billion payout were on the cards it is not a huge leap to suggest that Microsoft simply buy them out rather than buy their forgiveness. Whilst it would take more than $3 billion to buy the company it would not take much more (relatively speaking) considering Novell has a current market cap of $2.1 billion. Also from a shareholder's perspective an acquisition is much better than a payout as their investment is preserved and built upon instead of going to lawyers and the opposition.

From a technology perspective Novell has two things to offer Microsoft - SUSE and Identity Management. Microsoft currently resell SUSE and have a comparatively weak Identity Management business so both assets could be put to good use. Netware, Novell's other technology is at end of life but this customer base is currently having to weigh up a tricky migration to SUSE or Windows Server. As a consequence owning both end points of this decision would not be such a bad thing from a sales point of view.

Perhaps the biggest hurdle to get over is the general idea that Microsoft cannot sell Linux because it invented Windows. Given the recent announcements at Mix'08 in cloud computing and advertising it would seem that Microsoft no longer sees itself as simply a Windows company. Arguably another indication of this is their determination to buy the LAMP-centric (Linux/Apache/MySQL/PHP) Yahoo!. Instead of migrating all the tried and tested Yahoo services over to a Windows server infrastructure, wouldn't it be simpler to establish Microsoft Linux through the acquisition of Novell?

Google cops to puppeting Great American Wireless Auction

2008-04-07T10:06:00.000-04:00

Verizon slates 4G for 2010
By Cade Metz in San Francisco
Published Friday 4th April 2008 19:48 GMT

Google has admitted it toyed with Verizon during The Great American Wireless Auction.

Today, the US Federal Communications Commission lifted the gag order it placed on companies that vied for the coveted 700-MHz band, a prime portion of the US airwaves, and the world's largest search engine couldn't help but tell the world what an important role it played in the auction's outcome, ensuring that at least part of the band will provide open access to any device and any application.

"As you probably know by now, Google didn't pick up any spectrum licenses in the auction," two Google lawyers wrote on The Official Google Rhetoric Blog. "Nonetheless, partly as a result of our bidding, consumers soon should have new freedom to get the most out of their mobile phones and other wireless devices."

Back in August, the FCC said it would attach an open access requirement to the 700-MHz "C Block" - but only if bidding exceeded a $4.6bn reserve price. In the end, it was Google that placed the magic bid, and the Mountain View outfit admits that delivering open access was its "top priority."

"Based on the way that the bidding played out, our participation in the auction helped ensure that the C Block met the reserve price. In fact, in ten of the bidding rounds we actually raised our own bid - even though no one was bidding against us - to ensure aggressive bidding on the C Block. In turn, that helped increase the revenues raised for the U.S. Treasury, while making sure that the openness conditions would be applied to the ultimate licensee."

Yes, Google was prepared to actually win the C Block. But it never expected this would happen. "We were also prepared to gain the nationwide C Block licenses at a price somewhat higher than the reserve price; in fact, for many days during the early course of the auction, we were the high bidder. But it was clear, then and now, that Verizon Wireless ultimately was motivated to bid higher (and had far more financial incentive to gain the licenses)."

In other words, Google's main objective was to stick Verizon with an open access requirement. And that's exactly what happened. After Google took bidding over the reserve price, Verizon placed the bids that won the C Block.

In the fall, Verizon brought legal action against the FCC, hoping to destroy the commission's open access requirement. But this didn't work out. And now, the mega-telco has no choice but to open the C Block to any application and any device - at least in theory.

Verizon has announced that its entire network will be open by the end of the year. But at this week's CTIA wireless trade show in Las Vegas, Verizon CEO Lowell McAdam badmouthed government regulation of the wireless industry - just before FCC chair Kevin Martin announced he would not enforce open-access beyond the 700-MHz C Block.

The other big 700-MHz winner was the other big American telco: AT&T. Today, both AT&T and Verizon announced they would use their newly-won spectrum to roll out 4G networks based on the fledgling LTE (Long Term Evolution) standard.

According to Adrian Scrase of 3GPP, the organization that oversees LTE, the standard will be ratified by the end of this year. "We want to complete LTE by December 2008, and then go to market with a mature product," he told us. And Verizon is saying that its LTE network will launch as early as 2010.

“The spectrum we purchased in this auction, combined with our existing portfolio, provides new flexibility as we execute our high-growth business model,” read a canned statement from McAdam.

“We also believe that the combination of the national, contiguous, same-frequency C-block footprint and our transition to LTE will make Verizon the preferred partner for developers of a new wave of consumer electronics and applications using this next generation technology."

Meanwhile, AT&T says that its LTE network may not be ready until 2012. But it's still struggling to complete a 3G network. As Jesus Phone owners know all too well. ®

Five principles for successful mass collaboration, part 3

2008-04-02T20:30:00.000-04:00

By Charles Leadbeater on April 02, 2008 (9:00:00 PM)

Linux has succeeded as a product only because the community that supports it has organised itself systematically to create, share, test, reject, and develop ideas in a way that flouts conventional wisdom. Successful We-Think projects are based on five key principles that were all present in Linux. Earlier I introduced three principles; here are the final two.

This article is excerpted from the newly published book We-Think: The Power of Mass Creativity.
Collaborate

A mass of contributions does not amount to anything unless together they create something ordered and complex. An encyclopaedia is not a mass of random individual contributions; it is a structured account of knowledge. People playing a game or building a community need to agree rules to govern themselves, or chaos ensues. How do We-Think communities govern themselves without an obvious hierarchy being in charge, enforcing the law? This challenge is not technical but political. We-Think works only when it has responsible self-governance, and that is a particularly difficult thing to achieve in highly diverse communities.

People often think in different ways because they have very different values; what matters to them differs. Someone who sees the world through art and images will acquire skills -- drawing and painting -- that make it easier for them to work. Someone who sees the world in terms of numbers and money is more likely to become an accountant, to use a calculator rather than a paintbrush. A large toolbox that includes both calculators and paintbrushes, both artists and accountants, is good for innovation.

The trouble is that people with fundamentally different values often find it difficult to agree on what they should do and why. Diverse ways of thinking are essential for innovation; diverse values, based on differences about what matters to us, often lead to squabbles. This is why diverse communities often find it more difficult agree on how to provide public goods, such as healthcare, welfare benefits and social housing. Diverse groups can become very unproductive when their differences overwhelm them, provoking conflicts over resources or goals. Elinor Ostrom found that shared fisheries, forests and irrigation systems required effective self-governance and local monitoring by participants to make sure no one was over-using resources. When local self-governance fails, the commons collapses and innovation becomes impossible.

We-Think succeeds by creating self-governing communities who make the most of their diverse knowledge without being overwhelmed by their differences. That is possible only if these communities are joined around a simple animating goal, if they develop legitimate ways to review and sort ideas and if they have the right kind of leadership. What they are not, ever, is egalitarian self-governing democracies.

As an example, consider the open source community that produces Ubuntu, a user-friendly version of Linux. Mark Shuttleworth, Ubuntu's founder, is like a benevolent dictator and reserves some decisions for himself, such as the design of the Ubuntu Web site. The heart of the community, the technical board, meets online to set technical standards and to define what should be included in the different versions of the program. The board's decision-making is transparent and open: anyone can propose additions to policies through the Ubuntu wiki; the board's agenda is made available as a wiki every two weeks; and anyone can attend the online meetings as an observer. The decisions are taken, however, by Shuttleworth and four other board members, whom he appoints -- albeit subject to a vote among the community's lead programmers. Meanwhile a separate Ubuntu community council supervises the social structure, creating new projects and appointing leaders for teams that support different releases and features of the program, such as those for laptop users. Then there are the LoCo teams around the world who promote the use of Ubuntu in their country. Someone can become an Ubuntu member (an Ubuntero) by coding software, documenting changes, contributing artwork or acting as an advocate for Ubuntu. In mid-2007 the community had 283 core members. Those with most power and responsibility -- dubbed Masters of the Universe -- are the core developers and they have their own council to determine who should be allowed into their guild.

The lesson of Ubuntu -- which is still far from a proven success -- is that effective governance of creative communities is like a lattice-work. Decision-making is very open: anyone can see what is decided and how; anyone can make suggestions about what should be done. But the way decisions are made is rarely democratic. Ubuntu the product may be open source; the community that sustains it is far from open-ended. These are not like the Utopian communes of the 1960s -- which is why they might be more successful than cooperatives of the past.
Create

We-Think enables a mass social creativity which thrives when many players, with differing points of view and skills, the capacity to think independently and tools to contribute, are brought together in a common cause. If the players are distributed they must have a way to share, combine and cohere around a common goal. However, for much of the time contributors may work independently and in parallel, often reworking elements of a core central product -- whether that's an epic poem in Ancient Greece, a piece of genetic code, a latter-day software program or an encyclopaedia. The product grows through accretion and a reciprocal process of observation, criticism, support and imitation. Most people take part because they get an intrinsic pleasure from the activity and seek recognition from their peers for the work they have done. These communities must have places -- forums, Web sites, festivals, gazettes, magazines -- where people can publish and share ideas. Social creativity is not a free-for-all; it is highly structured. Although the lines between expert and amateur, audience and performer, user and producer may be blurred, those with more standing in the community, based on the history and quality of their contribution, form something like a tightly networked craft aristocracy. Social creativity collapses without effective self-governance: decisions have to be made about what should be included in the source code, published on the site, pushed to the top of the news list. Participants who do not abide by the community's rules have to be excluded somehow. They must respect the judgments of their peers.

The raw material of these collaborations is creative talent, which is highly variable. People are good at different things and in different ways. It is difficult to tell from the outside, for example by time-and-motion studies, who is the more effective creative worker. It is impossible to write a detailed job description for a creative position specifying what new ideas need to be created by whom and by when. Open source communities resolve the difficulties of managing creative work by decentralising decision-making down to small groups who decide what to work on, depending on what needs to be done and the nature of their skills. It is very difficult for someone to pull the wool over the eyes of their peers; they will soon be found out. When it works, peer review excels at sharing ideas and maintaining quality at low cost.
Conclusions

We-Think will not work where there is no core around which a community can form; where experimentation is costly and time-consuming, and so feedback slow; where decision-making becomes cumbersome or opaque, beset by complex rules; where the project fails to attract a large and diverse enough community. It will not take off if tools to add content are difficult to use; if contributors cannot connect to one another; if communities cannot govern themselves effectively and so either fracture or ossify. For many important activities, We-Think will make no sense at all: performing medical operations, cooking meals, running nuclear reactors, railways or steel mills. It is not well suited to tasks where only professional expertise will do. In late 2006 I had a minor operation and was very glad to find that the surgeon was not assisted by a group of pro-am butchers, bakers and candlestick-makers who were taking their lead from the Wikipedia entry on the procedure they were about to perform. (Pro-ams are people who undertake activities as amateurs but to professional standards.)

We-Think works only under certain conditions. Usually, a small group creates a kernel which invites further contributions. Its project must be regarded as exciting, intriguing and challenging by enough people with the time, means and motivation to contribute. Tools should be distributed, experimentation cheap and feedback fast, enabling a constant process of trialling, testing and refinement. The product should benefit from extensive peer review, to correct errors and ratify good ideas. Tasks should be broken down into modules around which small, close-knit teams can form, allowing a range of experiments to run in parallel. There should be clear rules for fitting the modules together and separating good ideas from bad. Ownership of the project must have a public component, otherwise the sharing of ideas will not make sense.

It is not all or nothing but a matter of degree: from No We-Think at one end of the spectrum, where traditional, closed and hierarchical models of organisation still make sense, to Full We-Think at the other end, with the likes of Linux and Wikipedia. In the middle, there will be lots of opportunities to blend some of these ingredients in different ways.

Blogging is a prime example: it allows a mass of people to contribute their views, but only rarely do they find a core to build around. Mostly, bloggers communicate into the ether. They have no desire to build something with others, merely to leave their mark on their little patch of digital space. Blogging is high on participation, low on collaboration. Flickr, the photo-sharing site, and YouTube, the video site, fit in this Low We-Think category: they allow a mass of participants to connect with an audience and with one another. Yet there is relatively little collaborative creativity. When YouTube becomes a platform for people to collaborate in making films together it may acquire some of the features of We-Think.

Social networking is Medium We-Think. Sites such as MySpace, CyWorld and Bebo have not yet encouraged much deliberate collaborative creativity, although some participants have begun to use them for example to support political candidates or to rally around causes they care about. Collaborative filtering and the book reviews and ratings on Amazon, and social tagging tools like Technorati and del.i.cious, through which people help one another find interesting material on the web, fit into this category.

Only when all our five conditions come together at scale to provide a deliberate, conscious form of social creativity in which many people contribute and collaborate does Full We-Think emerge. OhmyNews, the South Korean citizen-journalist news service, fits in here, as do mass computer games like World of Warcraft and scientific collaborations like the project to unravel the worm's genome. Full We-Think is the deliberate and organised combination of contributions from a mass of distributed and independent participants.

It would be silly to suggest that We-Think can work in every situation and that it is always the best organisational recipe. The challenge is to engage in more We-Think when it is appropriate, which is when we are collectively trying to solve a complex problem, or to create something that no individual could produce and where creative thinking is critical to develop ideas. We-Think will not touch all organisations but some will be transformed, and many will find some aspects of what they do changed, possibly quite fundamentally, by this new organisational recipe.

Hunting for wireless networking solutions

2008-04-02T20:29:00.000-04:00

By Bruce Byfield on April 02, 2008 (4:00:00 PM)

While most basic hardware support for GNU/Linux is improving constantly, wireless support remains dismal. Few manufacturers make an effort to support the operating system, or to publicize what support they have. Moreover, the components of wireless devices change so fast that one version of a device may offer support while a second version doesn't -- even though both versions share the same model number. And if, in addition to functionality, you also want a device with free drivers and no reliance on proprietary firmware, your choices are even more limited. Fortunately, no matter what your preferences, online resources exist to help you find the card that's right for you or get your existing wireless network adapter to work with Linux.

Before you start looking for alternatives, you should be aware of what you are up against. In particular, you should know that some modern laptops, including most recent Lenovo Thinkpads, check for the original mini-PCI wireless card, and will not boot if it is changed or removed.

You can get around this limitation by editing the CMOS or modifying the BIOS. But the consequences if you make a mistake there can include an unusable computer, so these solutions are not for the inexperienced or faint of heart. Most people are probably better off looking for a wireless PCMCIA, ExpressCard, or CardBus adapter, or one on a USB dongle, which can be added without any consequence. The loss of an external port may be a small price compared to the dangers of changing the mini-PCI card.

Once you have decided what form your wireless support will take, identify your device either from the documentation that ships with it or by running the lspci command. Then look it up in Ubuntu's detailed wireless documentation, which includes a list of mini-PCI and PCMCIA adapters, and another one of USB devices. These lists will tell you whether your card is supported by one of three non-free solutions -- Ndiswrapper, the Broadcom Firmware-Cutter, or the MadWifi drivers -- or supported by a driver that is installed automatically with Ubuntu. While your distribution may not include the same defaults, if Ubuntu supports a driver you need, at least in theory you should be able to get your wireless device working on your distribution as well. No matter what your solution, other pages in Ubuntu's documentation should provide most, if not all, the information you need to enable wireless.

The one drawback to the Ubuntu lists is that the information about ExpressCard and Cardbus adapters tends to be limited. To find more current information, go to the information about ExpressCard and Cardbus on the TuxMobil site. However, be aware that these lists include more than just wireless cards.
Non-free solutions

Given the current state of wireless support, the odds are overwhelming that the device that comes with your computer will only work with a non-free solution. If you decide to focus on functionality and try to live with what you have, you should be able to enable it by using Ndiswrapper or, if you have a Broadcom card, the Broadcom Firmware Cutter. Both Ndiswrapper and the Firmware Cutter are hacks that wrap a layer of code around the Windows driver for your card so that you can use it under GNU/Linux. Either method involves identifying the card and following a relatively simple set of steps, but both can give mixed results. More importantly, if you are committed to free software, then the use of a Windows driver will make these solutions unacceptable to you.

Another non-free alternative is the Madwifi drivers for the Atheros chipset, which can be found in many distributions. Like Ndiswrapper and the Firmware Cutter, the Madwifi drivers are free software in themselves, but dependent on non-free software. Madwifi developers are working on a free version of the binary-only Hardware Abstraction Layer that the software depends on. Until that effort reaches maturity, however, in many cases Madwifi will not be acceptable to those who prefer free software.
Finding free alternatives

In fact, many free drivers for GNU/Linux are dependent on non-free firmware, which makes them unacceptable for completely free distributions such as gNewSense or for individuals who want a free operating system.

According to the Free Software Foundation's hardware pages, the only devices that are completely free are those that use the Ralink RT2500/RT2400 chipset or the Realtek RTL8180 chipset with the driver compiled from source. The trouble is, not all devices that use these chipsets work with GNU/Linux, if user experiences described on the Internet can be trusted. Nor do all distributions include drivers for those that do, which is why the wireless page also includes a link to the rt2x00 Project that develops them. To further complicate matters, the chipset is almost never mentioned in the specifications for wireless devices.

The simplest approach is to use one of the devices that the Free Software Foundation has tested, such as the Asus WL-107G PCMCIA card and the Linksys WUSB54G USB 2.0 dongle. However, if you want more alternatives, look at the lists of manufacturers and devices maintained at Rapla.net, which are conveniently divided into device types.

Some items on the list are marked with an asterisk, and whether they use the chipset depends on the version of the device, so you should be careful to buy only the version specified (if one is). Items unmarked by an asterisk should be usable regardless of version, although, just to be safe, you might want to avoid recent models to avoid undocumented changes.

Having come so far, you should also take the time to search on the manufacturer and model of the devices you are interested in and see what experience others have had with them. For instance, in searching for a USB dongle, I decided against the Buffalo WLI-U2-KG54-AI and Gigabyte GN-WBKG because of reported problems I found discussed on the Internet. Instead, I identified the OvisLink Evo-W54USB and Sweex LC100060 as adapters that other users had enabled successfully.

Once you have done this research, your final obstacle is to buy the device of your choice. If my experience is typical, you will have to order your adapter rather than run down to your local retailer. You should also go shopping armed with several alternatives, since your first choice might not be available. You will probably have more luck ordering from an independent store than a member of a chain. Frequently, chain stores will order only limited inventory or deal only with certain suppliers, and may refuse to order any of your choices.
Making a choice

Is tracking down a free wireless adapter worth the effort? That depends on your priorities. If you only want your computer to work, then probably you should be content using Ndiswrapper, the Firmware-Cutter, or the Madwifi drivers -- at least for a while. As the forums for major distributions attest, these utilities can be tempermental. They not only have to be reapplied with every major version change in your kernel, but, sometimes, with minor version changes as well. At times, a revised kernel may stop them working altogether, at least temporarily.

For such reasons, choosing a free solution may be less quixotic than you might first imagine. The non-free solutions to GNU/Linux's lack of consistent wireless support are ingenious hacks, but, if a free solution takes more research in the short run, in the long term, your idealism may result in more trouble-free computing and be the wiser choice.
Bruce Byfield is a computer journalist who writes regularly for Linux.com and IT Manager's Journal.

Tracking Open Source in Mobile Handset Market

2008-04-02T20:18:00.002-04:00

New research suggests it has a few hurdles to overcome.

April 1, 2008
By Judy Mottl

The iPhone isn't the only spoon stirring the mobile handset pot these days. For more than a few reasons, open source mobile operating systems based on the Linux kernel may have a significant impact on future product development.

That's because of the kernel's attractive features, such as expanding support for security and with multiple chipset makers, according to a new report from Strategy Analytics' Handset Component Technologies Service.

Stuart Robinson, director of research at the firm, said the consensus in the report is that interest in Linux is at an all-time high and that it will emerge as a worthy competitor to market leaders Symbian and Windows Mobile in the handset arena

The report, entitled "Mobile Linux: Google and Motorola Hold the Short-Term Keys to Success," said Linux-based systems could spur more innovation than the iPhone. However, it added, there are serious hurdles to eliminate before open source becomes the driving force in mobile handsets as opposed to another driver.

Linux-based mobile handset systems first appeared in 2003; it was natural for different flavors of the open source operating system to proliferate. Now, Linux-based systems account for 20 of the 30 or more mobile handsets OSs in use, the firm said. But that flavor proliferation has become a detriment, according to Strategy Analytics analyst Sravan Kundojjala.

"Recent moves suggest consolidation is in the cards," Kundojjala told InternetNews.com in an e-mail. After all, quantity doesn't always mean quality. Although more than 25 million Linux-based phones have shipped worldwide, open source systems account for about 15 percent market share, far behind market leader Symbian, which holds over 50 percent share, and Windows Mobile which hovers at about 18 percent.

Yet the numbers may change a bit, said Kundojjala, pointing to recent moves by the Motorola backed LiMo Foundation, as well as other industry groups working to reduce fragmentation and push for standardized offerings.

"Considering the interest Mobile Linux is generating, the number of projects in the pipeline (Google's Android, LiMO) and the waning interest in Symbian's monopoly, all these things should definitely fuel mobile Linux market share in the coming years," said the analyst, adding that he believes market leader Nokia will jump on the Linux bandwagon at some point.

The fragmentation, he added, means each vendor and operator use unique specific APIs (define), not to mention the intellectual property and legal issues that grow with different open source technologies and related licenses.

"On the surface it looks like the Linux kernel is free but mobile Linux vendors spend significant amount of time to optimize it, and have to add several proprietary patches to it," he explained.

A more commercial, and unified approach by vendors and organizations could go a long way to creating a "verticalization of the software stack" for reducing fragmentation.

"People have been waiting for someone to take accountability for Linux as other proprietary companies have for their own systems. Google's Open Handset Alliance, Motorola and LiMO both have been making very good progress," he said.

Less fragmentation will lead to much better device management capabilities, which the analyst said is the keystone to gaining good market traction.

"Companies like Research in Motion and Microsoft got good traction in the enterprise mobile market because of excellent management capabilities, PIM (Personal Information Management) synchronization, Exchange server support," said Kundojjala.

"Linux is a very popular choice in corporate back-end infrastructures and Linux on Mobile phones can have good integration capabilities in theory. But, it depends on the company's decision to support or not business applications to run on Linux based devices," adding the analyst.

"We believe enterprise support for Mobile Linux should improve as Mobile Linux-based smartphone shipments are expected to surge and operators give better support."

Is open source a regulated utility?

2008-04-02T20:16:00.002-04:00

Posted by Matt Asay

Todd Barr of Fiveruns (formerly of Red Hat) has a thought-provoking post comparing the software industry to the energy industry. Specifically, he calls out open source as akin to regulated energy companies, while proprietary software vendors are more like unregulated energy companies. The interesting part is what happens when you combine the two:

I think the future looks similar to the energy industry: large technology companies will have a mix of regulated and unregulated businesses, that maximizes the advantages of both. For standard, widely-used technologies, open source "regulation" makes sense because it lowers development costs and provides a standards-based, predictable subscription base of business.

For niche and high-end software, companies will still expect a substantial return on their development cost, and therefore will protect that IP and sell it at a premium until competition makes that impossible.

IBM provides an example. IBM is particularly adept at foisting "regulation" onto its competitors by fostering open-source projects like Linux and the Apache web server. It uses open source as a "regulated" gateway to its higher-margin, proprietary businesses.

As more and more open-source companies get gobbled up by proprietary software companies, it's likely that we'll see this regulated/unegulated interplay for years to come. The question will be whether the industry will continue to trend toward open source. I think it will. We have decades to determine if I'm right or wrong.

Extensions for OpenOffice.org Impress

2008-04-02T20:09:00.001-04:00

April 2nd, 2008 by Bruce Byfield

Extensions for OpenOffice.org Impress

Extensions have long been written for OpenOffice.org Writer. However, the fact that attention is finally being paid to other applications seems a sign that OpenOffice.org is finally starting to develop an active extension-writing community.

A case in point is the recent availability of extensions for Impress, OpenOffice.org's slide show program. Extensions for Impress are still outnumbered four or five to one by those for Writer, but at least they are now being written. Just as importantly, they are filling important gaps in functionality, and encouraging uses for slide shows other than the standard presentation in work or education.

All these extensions are installed in the normal way -- that is, you download their files, and then use Tools - > Extension Manager from within OpenOffice.org to activate them. If you are installing them just for the current account, then select My Extensions before navigating to an extension's file to install it.

eVoice

Written in Java, eVoice helps to close the functionality gap between Impress and MS PowerPoint by allowing you to add a sound clip to each slide. You will also need a microphone plugged into your sound card and set up in your operating system.

The extension adds an eVoice item to the top level of menus. To add an extension, select Insert from the eVoice menu. You are presented with a dialog with Record, Stop, Play, and Pause buttons across the top to do the recording, and OK and Cancel buttons on the bottom to save the recording or discard it.

Finished recordings take the form of a gray object at the bottom right of the slide while you are working, and is invisible when you actually run the slide show. As with any OpenOffice.org object, you can re-position the object by clicking it and dragging it when the border with the green handles appears around it -- a bit of functionality that will inevitably come in handy when you designing your slide layouts. You can have only one sound clip per slide, and attempting to add a second will delete the first.

eVoice's home page suggests that it is designed for adding narration to a slide show, and probably that is what most people will use it for. However, you can also use a two-way jack to record sound clips directly from a sound system or MP3 player.

In fact, with some experimentation and selection, as well as quick slide transitions, you can even create the illusion of continuous sound playing through the slide show. However, the effort to achieve this effect can be considerable, so you probably shouldn't consider it unless the presentation you are working on is important enough to justify the time it takes.

Sun Presentation Minimizer

Like PPT minimizer, which it is obviously based on, Sun Presentation Minimizer is designed to reduce the size of a slide show. Admittedly, in these days of 8 gigabyte flashdrives, there is less need for this functionality than even a few years ago, but this extension is still useful if you want to coax maximum speed out of your slide show or else make it available as a download for others on a web site.

Sun Presentation Manager adds an item to the Tool menu that opens a wizard that guides you step by step through reducing the size of your slide show. In general, it works by taking out unnecessary items, such as unused master files or hidden files and the cropped areas of photos, and reducing the resolution of graphics -- since presentations are typically shown online, you don't need more than a 96 dpi resolution unless you are planning on printing your slides.

The extension also offers to use static versions of what OpenOffice.org refers to as OLE objects. Since GNU/Linux does not use OLE objects, this term is somewhat misleading, but what it refers to is other files embedded in your current one.

You can select which of these file-reducing measures to implement, or, if you are unsure how to proceed, choose one of the three pre-set options from the first slide. On the last slide, you can also save your own current options as a pre-set.

How much space you save depends on the contents of your slide show and the options you choose. However, you can generally reduce the size of a presentation to 15-75% of the original size. The final screen in the wizard shows you how much space you are saving, and by default saves the reduced file under a different name so that you can preserve the original.

When I tested it, Sun Presentation Minimizer was unable to deliver as promised with so-called OLE Objects. It also needed some help to make clear to less experienced users exactly what was going on. However, these points aside, the extension is still worth investigating.

PhotoAlbum

A photo album is one of the secondary uses of a slide show, especially in education. The home page for PhotoAlbum promises to produce a slide show in four clicks, and I am happy to say that the extension not only keeps this promise, but is simple to use throughout.

To use PhotoAlbum, place the images you plan to display in a separate directory and start a new Impress file. Then go to -> Add-Ons -> Create Photo Album. The menu item opens your file manager, so that you can select the images' directory, and the extension creates an album for you with one image per slide, and filling the entire slide. Images appear in numeric then alphabetical order.

The album defaults to random slide transitions and is set to loop constantly. However, if these settings aren't to your liking, you can easily change them after you create the album. As you probably know (or can easily find out), slide transitions are set from Slide Show -> Slide Transitions, and the loopback from Slide Show -> Slide Show Settings -> Type.

As well as the purpose stated in its name, PhotoAlbum can also be useful in reducing the tedium of inserting images in the slides of an ordinary presentation. If you number all your images in the order in which they appear, or name them alphabetically, you can easily add all your images at once. Of course, you will probably want to adjust the slide layouts and the size and position of the images, but PhotoAlbum will cut out the tedium of adding images one at a time, if you can only get yourself minimally organized.

Conclusion

These are not the only extensions available for Impress. For one thing, many general extensions, such as CropOOo also work in Impress.

For another, I am always interested in alternative uses for slide shows (on the grounds that the conventional presentation is too static and common to be effective any more), I hoped to be able to mention OpenCards, which creates a series of flash cards. a technique that is popular in teaching languages. Unfortunately, OpenCards crashed on all my available systems, no matter which version of Java was installed, so I am unable to to describe its workings.

However, the three extensions mentioned here are good examples of some of the work being done now. All of them are useful enough that, with any luck, they will be included by default in an OpenOffice.org install.

HP Expands Midrange Hardware, Software Offerings

2008-04-01T17:09:00.000-04:00

New servers and prepackaged configurations of CRM and Linux software aim to help make IT a profit driver for smaller shops.

By Andy Patrizio

HP continues efforts to woo the midsized business market, today introducing new hardware and software offerings designed to appeal to those customers' specific needs.

Among today's releases are a new rackmount server, a new blade for HP's existing chassis, Linux support offerings and tie-ins for Seibel CRM, Oracle 10g database and secure remote access via Citrix.

The feature set reads like those associated with enterprise-level offerings. But Urs Renggli, director of HP's TSG small and mid-market business at HP, said enterprise concerns are migrating down to smaller businesses.

"Midsized businesses are competing now not just with each other but also enterprises that figured out IT should be a profit center," he told InternetNews.com. "As a result of that, CRM has really bubbled up as a major investment area. I think we're going to see customers putting money into it in the coming months and years."

Just as large enterprises did a few years earlier, smaller firms now realize that IT could be not just an operations support system, but also a profit driver and a competitive tool, he said.

However, these companies don't want a watered-down, diluted enterprise solution. On the other hand, they don't have time for a six-month procurement process the way a Fortune 500 company might -- and they don't have the staff for a lengthy rollout.

"It's slowly moving down to the mid-market, but we approached it in a different way," Renggli said. "We're not selling the products we sell to enterprises. All of the products are designed for the mid-market. We're giving guidance to channel partners and ISVs, providing them with sales tools and technical tools, enabling him to sell this business solution to their target market."

Chief among the new mid-market products introduced today is HP's ProLiant BL260c G5 server blade and ProLiant DL120 G5 rackmount server. The G5 blade fits into the c7000 and c3000 chassis, but HP said the unit is 20 percent cheaper and 64 percent more power-efficient than other blades.

The G5 runs a single processor Xeon, holds up to 24GB of memory and supports both RAID and HP's StorageWorks storage connectivity and redundant networking. The DL120 is a 1u server running a single dual-core and quad-core Celeron, Core 2 or Pentium processors, supports DDR2 memory and comes with Serial Attached SCSI (SAS) Host Bus Adapters (HBAs) and Smart Array Controllers.

Pricing for the HP ProLiant BL260c will start at $1,199 while the ProLiant DL120 system will start at US $699.

HP today also introduced HP Insight Control Environment for Linux (ICE-Linux), designed to help midsized businesses better manage their server and cluster environments by monitoring system and high-performance cluster health. The solution is built on HP's Systems Insight Manager (SIM) infrastructure.

The company also debut another Linux offering -- HP Linux Oracle Quick Reference Solutions, pre-sized configurations of HP and Oracle database components for Linux-based HP ProLiant servers. The configurations are designed for systems of 75 to 400 users. Pricing starts at $289.

To broaden its CRM portfolio, HP is adding five Oracle 10g databases as an option for customers, along with Oracle Siebel CRM Professional Edition configurations, all validated by Oracle.

The offering complements HP's existing Microsoft Dynamics CRM offerings.

The company today also announced HP Secure Remote Access, which helps midsized businesses provide secure connections to desktop PCs, thin clients, business notebooks, tablet PCs, iPAQ handhelds and smartphones. This is done through Citrix Access Essentials, which is bundled with Windows Server 2003 and Microsoft Small Business Server 2003 R2.

Finally, HP said it would begin offering AMD's oft-delayed Quad-Core Opteron across all server products that currently carry dual-core Opterons.

Anil Miglani, senior vice president of research firm AMI Partners, said HP's offerings are aiming to address growing needs among midsized businesses.

"For a number of years, midsized firms were making IT purchases on an ad hoc kind of basis," Miglani said. "The focus on business was not there. What they are finding now is what enterprises learned, they want to bring in the IT and integrate them with their business processes and integrate them with their offerings."

"In that respect, I think HP's offerings are moving in the right direction because most of these are infrastructure-related offerings, and businesses can use them to integrate with their business processes with tangible results," he said. "So in that sense, HP's offerings today are a step in the right direction."

Five principles for successful mass collaboration, part 2

2008-04-01T17:07:00.002-04:00

By Charles Leadbeater on April 01, 2008 (10:00:00 PM)

Linux has succeeded as a product only because the community that supports it has organised itself systematically to create, share, test, reject, and develop ideas in a way that flouts conventional wisdom. Successful We-Think projects are based on five key principles that were all present in Linux. Yesterday I talked about Core and Contribute. Today, it's Connect.

This article is excerpted from the newly published book We-Think: The Power of Mass Creativity.

At the St. Louis World's Fair in 1904, an ice cream stand ran out of cups. The owner of the waffle stand next door started rolling his waffles to form cones. There was nothing new in either ingredient, but the combination of ice cream and the waffle created something entirely new. The more combinations a community can create, the more innovation there will be. Cities are creative when they make these combinations possible. The same is true of We-Think.

Diversity counts for little unless the different ideas that are floating around can be brought together to cross-pollinate. A community that is diverse but Balkanised will not be creative. People with different ideas must find a way to connect and communicate with one another. When they do, and in the right way, the results can be explosive. James Watson and Francis Crick unravelled the double-helix structure of DNA because they found a way to combine their very different outlooks. Crick's training spanned physics, biology and chemistry. Watson had trained as a zoologist but had become fascinated by DNA after studying viruses. They combined their ideas through constant, intense conversation of a kind of which their rivals were incapable. Watson and Crick's collaboration was a case of one plus one equals 12.

The larger the group and the more diverse perspectives are involved, the greater the benefits from combining them. Take five people, each with a different skill. That gives 10 possible pairings of skills. Add a sixth person with a different skill. That creates not 12 pairs but another five possible pairings 1 -- 115 in all. A group with 20 different tools at its disposal has 190 possible pairs of tools and more than 1,000 combinations of three tools. A group with 13 tools has almost as many tools -- 87 per cent -- as a group with 15 tools. Not much of a gap. But if a task requires combining four tools it is a different story. The group with 15 tools has 1,365 possible combinations of four tools. The group with 13 tools has 715, or about 52 per cent. Groups with larger sets of diverse tools and skills are at an advantage if they can combine effectively to take on complex tasks.

Markets are not the best way for people with diverse skills to connect and combine. A market might provide a way for someone with a problem to find someone else who might have a solution: if you have a leaking tap, you look for a plumber. That is the model of Innocentive, the scientific problem-solving community that was spun off from the drugs company Eli Lilly. Companies can post their scientific problems on Innocentive's Web site to see if they can be solved by one of the more than 100,000 scientists signed up to the market. But markets of this kind have inherent limitations: they work for specific problems that need exactly the right individual to solve them. They do not provide the basis for sustained creativity and innovation to explore difficult complex puzzles. That is a kind of problem-solving that comes only from intense collaboration. In the worm project, the researchers started by meeting in the coffee room at Brenner's laboratory. In We-Think, crowds need meeting-places, neutral spaces for creative conversation, moderated to allow the free flow of ideas. This is why, at their heart, these projects have open discussion forums and wikis, bulletin boards and community councils, or simple journals like Lean's Engine Reporter and the Worm Breeder's Gazette, so that people can come together in a way that allows one plus one to equal twelve many times over.

In We-Think projects, the task of combining ideas is made easier because the products usually fit together like Lego bricks: they are made from many interconnecting modules. Modularity is not new; it has been a feature of computer development since at least as long ago as the 1960s, when IBM was developing its System/360 computer. Fred Brooks, the person responsible, wanted everyone involved to be kept abreast of what everyone else was doing. Daily notes of changes to the program were shared with everyone. Quite soon people were starting work each day by sifting through a two-inch wad of notes on these changes. The costs of communication and coordination spiralled out of control. Miscommunication and misunderstandings grew. Adding people to the project did not solve the problem: more work got done, but more misunderstandings were created and with them more bugs. When the wad was five feet thick, Brooks decided to break the S/360 into discrete modules that could be worked on separately. A core team set some design rules specifying what modules were needed and how they should click together. This meant that module-makers could concentrate on their patch while the core team looked after the architecture of the system as a whole. New and better modules could be fitted into the system without its having to be redesigned from scratch.

Modularity really pays dividends when it is combined with open ways of working -- when it enables a mass of experiments to proceed in parallel, with different teams working on the same modules, each proposing different solutions. This combination is how open source gets the Holy Grail: a mass of decentralised innovation that all fits together. Just as Lego bricks come in a dizzying array of colours, shapes and even sizes but all have the same system of connectors, We-Think projects have rules for making connections that usually come from the core team. This is what allows a mass of independent but interconnected innovation. Mass computer games, collaborative blogs, open source programmes and the human genome project all share this feature: they click together masses of modules.

However, a Lego brick structure is not enough to make We-Think work. Groups also need to make decisions. Diverse contributors can combine their ideas only if they can agree how to collaborate. Any commons will fall into disrepair if it is not effectively self-regulated. That is far easier said than done.

Dell plans to slash 8,800 jobs, cut $3 billion in costs

2008-04-01T17:06:00.001-04:00

Apr 1st 2008 3:49PM by Nilay Patel

Dell reported an $11.6B profit last year, but the company apparently isn't satisfied -- it just announced a plan to shave off $3B in costs over the next three years. As you'd expect, it's going to take a little more than off-brand soda and thrift store uniforms to achieve the sqeeze: 6,500 jobs are due to be eliminated (on top of 3,200 already cut) and a desktop manufacturing plant in Austin is scheduled to close as well. The big chunk, however, is going to come putting the squeeze on design, manufacturing, and logistics, as well as cutting component and material costs across all Dell product lines. That's the part that has us a little worried, actually -- we're fans of new Dells like the XPS M1330, here's hoping this doesn't mean a return to beige boxes.

Sony BMG busted for software piracy in France

2008-04-01T17:05:00.001-04:00

Apr 1st 2008 3:22PM by Nilay Patel

Ouch, that payback, it can be a bitch -- Sony BMG, distributors of rootkit-installing CDs and litigious foe of P2P users worldwide, has just been busted in France for using pirated software on its servers. And it gets even worse: Windows admin tool developer PointDev says a Sony BMG was caught when an IT staffer actually called up for support and gave a pirated license number to the phone tech. That's some pretty shady behavior for a company that's rammed anti-piracy measures down its own customers' throats -- too bad it's probably not going to feel the hit of the €300,000 ($475,000) lawsuit nearly as hard as the college students it routinely sues for $5,000.

No Signs of Recession in The Chip Business

2008-04-01T17:03:00.000-04:00

Sales are up modestly, with strength in certain markets. DRAM is most definitely not one of them.

By Andy Patrizio

Semiconductor sales are slowing, but they are still growing according to two separate surveys released on Monday. Gartner found sales rose 3.8 percent in 2007 to $273.9 billion, while the Semiconductor Industry Association (SIA) reported a 1.5 percent increase in February over the prior year.

The growth is coming in specific areas for different companies, Gartner noted. For example, Intel's 10.7 percent growth to $33.8 billion, to lead the market, was led by strong sales in mobile processors, which has been the fastest growing market for computing for some time now.

Toshiba rose from number six to number 3 in revenue which increased 20.8 percent in 2007 to $11.8 billion thanks to sales of integrated circuits for Sony's PlayStation3 console, NAND flash and CMOS image sensors for mobile phones.

Gartner said that in the current economy, chip customers would do well to track customer usage and find out where the sales are going, since some markets will be stronger than others. "Periods of uncertainty, like the current one, often create ideal situations to strengthen product and application portfolios without paying inflated prices," said Richard Gordon, managing vice president at Gartner in a statement.

The market feeling the most pain would have to be the DRAM market, which saw a decline of $2.4 billion in revenue year over year, or 7.1 percent, due to the huge oversupply even with the increasing demand for more memory. One company defying that is Hynix Semiconductor, which saw 2007 revenues grow 19.1 percent.

Hynix did this by aggressively adding capacity, but in doing so, the market was plagued with oversupply throughout 2007 and consequently steep decline in average selling price. As such, Gartner said "Hynix must take most of the blame for the market's unprofitability in the second half of 2007."

Meanwhile, this past February saw a modest gain in chip sales of 1.5 percent over February 2007 to $20.44 billion, according to the Semiconductor Industry Association (SIA). Sales declined by 4.9 percent from January, but that's typical of normal seasonal patterns in the industry at this time of year.

The SIA noted that even though demand for DRAM rose 40 percent year-over-year in February, prices still declined by 43 percent, which goes completely counter to the basic rule that prices increase along with demand. What that means is supply is outstripping demand, which is growing at a phenomenal rate, and it has done so for some time now.

John Greenagel, a spokesman for the SIA, declined to point fingers like Gartner but did say there is too much supply. "Unit shipments are up dramatically year-over-year. When the units are up, that means they are going into end products somewhere. That means there is a market for end products, but that means there is such a supply problem that the industry has no pricing power," he told InternetNews.com.

"There's a lot of people in the DRAM business cranking out an awful lot of products," he added. "When a customer can get all the product they need from any number of suppliers, it's going to be a buyer's market. It's a great deal for consumers right now."

Despite all the talk of trouble in the U.S. economy, thus far it hasn't manifested in the electronics market. Greenagel said he's waiting to see the next report from the Consumer Electronics Association which would show whether there's been a decline in gadget purchases, but so far he said there are no signs of decline in product sales.

ISO doesn't get it, says Microsoft; starts new international IT standards body

2008-04-01T17:02:00.000-04:00

By Mayank Sharma on April 01, 2008 (7:08:01 PM)

GREEDMOND, WA -- Bruised, battered, fined, and ridiculed over its fight for OOXML acceptance, Microsoft has decided it's had enough. The company is so angry with ISO that it has decided to form its own standard-setting organization.

"As the world's leading software company, we weren't very happy with the treatment meted out to us by ISO," complains company spokesperson Ican Leek. "ISO is too slow, explicit, and factual. We have several projects in the pipeline that are stalled because ISO likes to give people time to think. This is unacceptable."

Microsoft has now taken it upon itself to show how things are done -- by forming a new standards body. It expects its new body, called League of Extraordinary Standards (LES), to revolutionize computing. "It's the equivalent of Web 2.0 of the standards world, the missing link. With LES we'll do more. We'll connect users and suppliers like never before," says Leek

The company has already started selecting members for the organization. Calling the existing ISO system of selecting national members "corrupt," Microsoft claims its membership guidelines are "fairer to corporate and national users alike." So far Azerbaijan, Belarus, Bosnia and Herzegovina, Congo, Jamaica, and Tunisia have all signed up to be part of LES. "This group represents a healthy cross-section of the computing world," Leek maintains. "This is obviously a more inclusive body than the ISO, which is full of representatives from old-fashioned colonial powers like Norway, Switzerland, Canada, and Sri Lanka."

At a preliminary meeting held earlier this week, members of the new body met at Microsoft headquarters to hammer out a plan of action for the coming months. One of the items discussed was an update to ODF, which runs the risk of losing its status of being a standard when ISO is replaced by LES. But Leek believes ODF can be made compatible with OOXML despite the fact that the ODF developers "didn't leave enough room for innovation."

The new format, tentatively called ODF-PRO, is a "100% free, patented version of the old format that'll be free to use in any operating system as long as its Windows Vista or something more expensive." Calling backwards-compatibility a thing of the past, Leek says the new body is more concerned with interoperability between member countries. "Not all of them begin their week on Sundays," he says, "or use the standard European alphabet we prefer here at Microsoft headquarters. But that's okay. We'll teach them how to get along in the modern IT world, even if we have to give all the representatives free Zune music players and a few thousand shares of Microsoft stock to motivate them."

How to Get Fired

2008-04-01T13:47:00.001-04:00

From Dawn Rosenberg McKay

Part 1: Advice You Can Live Without

As About.com's Career Planning Guide I have the opportunity to visit many of my fellow career advice sites on the Web. Through my extensive virtual travels I have found that articles about succeeding on the job abound. But, what if you wanted to know how to get fired? Could you find an article that would tell you how to perform so poorly on the job that your employer, with a swish of his or her hand, would summarily dismiss you? I looked around and found nothing that fit the bill. So I decided to write such an article myself.

P.S. If you came here looking for advice on how to stay employed, just do the opposite of everything I tell you here.

* Arrive late for work
Being on time is for wimps. Drag yourself out of bed whenever you feel like it. Stop to run an errand on your way to the office.
* Don't forget the coffee
No not for your boss -- for yourself! You're already late so why not stop for a cup of coffee on the way to work? Don't forget to get a muffin or a roll too (crumbs on your tie look really good).
* Eat at your desk
I mean your coffee and roll, not your lunch silly. Why would you want to work through lunch anyway? And take your time — you're in no hurry to start working.
* Take a long lunch
An hour for lunch? Are they nuts? That can't possibly be enough time to get together with an old friend and run a few more errands.
* Have a drink
What's lunch without a couple of beers? It'll relax you. So what if you smell like a brewery?
* Make personal phone calls
If you can't make your phone calls from the office, when else will you find the time? Don't make those calls short and sweet -- chat away.
* Speaking of chatting...
Let's not forget about the good old Net. You can go into a chat room any time of day, so why waste your precious personal time.
* Send lots of email
Use those eight hours at work to take care of all that personal email. Oh and don't forget to use your work email address.
* Download, download, download...
Your connection is much faster at work than on your home pc. And besides, there are some things you wouldn't want your significant other to see.
* Make the customers/clients really mad
There are several ways to do this. If you deal with customers in person, ignore them while you talk to your co-workers. Don't have answers to their questions. If most of your contact is by phone, keep yours busy so clients can't get through. If they bother to leave a message, don't return their phone calls.
* Don't ever go beyond your job description
Even when a project is down to the wire and your help is desperately needed, just remember: "It's not your job."
* Leave work early
Who made that five o'clock rule anyway? If you leave 15 minutes early think of how much you can get done before dinner.
* Party hardy
Nights are made for partying. Don't worry — you can sleep late tomorrow. After all, you do plan to get to work late, don't you?

Exploring Time Capsule: 10/100/1000 Ethernet vs. 802.11g/n Wireless Networking

2008-04-01T13:42:00.001-04:00

By Prince McLean
Published: 08:30 AM EST

Time Capsule, like most of Apple's earlier AirPort base stations, can handle both wired and wireless networked devices, but is optimized for serving wireless clients. This segment, the fourth of six exploring Time Capsule in depth, highlights the differences between wired and wireless networking on Time Capsule and the AirPort Extreme.

Time Capsule and the AirPort Extreme are designed primarily to serve wireless clients, providing a convenient and minimally invasive way to network systems in a home or small office to support centralized backups, file sharing, and media streaming. Wired Ethernet networking is nearly always going to be much faster, but also requires running wires through walls and tethering mobile devices to an Ethernet jack.

For the purposes Time Capsule is designed, including Time Machine backups and simple file and print sharing, the speed advantages of Ethernet are less of a factor compared to the needs of users who want a blazing, hard wired RAID array supplying high speed Network Attached Storage.

All of Apple's recent AirPort base stations have included an Ethernet switch, which allows user to directly plug in devices using an Ethernet cable; the base station bridges those wired clients to any devices attached wirelessly, so all can appear on the same AirPort created network.

However, while the AirPort base stations support full speed Ethernet switching, the shared disk file serving capacity of Time Capsule and AirPort Extreme is not tuned to saturate a big Ethernet pipe. That means the effective speed of the base stations' wired networking jacks are not competitive with a standalone NAS or dedicated file sharing computer. The numbers below (and chart on page 2) help outline that fact.

Real World Tests: Gigabit Ethernet vs 802.11n WiFi

Connected via Gigabit Ethernet to Time Capsule from a MacBook Pro, it took 1:38 to copy a gigabyte folder of mixed media to its internal drive. Including the few seconds it took for the sleeping Time Capsule drive to spin up, the operation took 1:45.

Wirelessly, it initially took a whopping 13:10 for the MacBook Pro to copy the same files to Time Capsule. In a parallel test, it took 8:18 to wirelessly copy the files to a drive connected via USB to an AirPort Extreme. The odd difference in speed was apparently related to the fact that in both tests, the MacBook Pro was wirelessly attached to the AirPort Extreme base station, which then wirelessly relayed the data to the Time Capsule, which was setup to "Extend a Wireless Network."

In that configuration, the MacBook Pro was skating across the wireless network twice to reach Time Capsule. With Time Capsule configured as the primary base station, the MacBook Pro took just 2:55 to copy the same files, a huge difference. Repeating the test again, it took 4:36 to perform the same action.

Repeating the gigabyte file copy test using a 5 GHz configuration took 8:17 and then 9:38 on the second try, suggesting that the 5 GHz setting itself isn't likely to make a huge improvement for typical users, and may instead just reduce their range and signal strength due to its worse signal penetration and radio power limitations. However, using wide channels, the same copy took just 2:11, indicating that in optimal conditions, 802.11n can easily compete with running wires in many applications.

The wild fluctuations in copy times over our wireless network links makes it harder to empirically compare wired to wireless times in a way that offers users with different configurations and different circumstances (such as the degree of outside interference, and the user's specific needs for wireless coverage area) a simple "rule of thumb" answer.

Below, we outline and present the results of various tests we performed to show you the range in performance you can expect to get wirelessly, compared to a wired network using Gigabit Ethernet, using Fast Ethernet (such as on previous 2007 models of the AirPort Extreme) and using 802.11g (on WiFi clients that do not support the full speed of 802.11n).

WiFi N vs Gigabit Ethernet and Multiple Users

In ideal conditions, 802.11n can perform at around three quarters the speed of Time Capsule's Gigabit Ethernet for a single user. However, if there are multiple users, each will eat into the limited, shared wireless bandwidth available. In a small office network, this favors setting up non-mobile machines to use Gigabit Ethernet rather than share the wireless network with mobile machines such as laptops. An Ethernet switch will allow each wired user to enjoy a fast, independent connection to the Time Capsule or shared AirPort Extreme drive, although at some point, concurrently connected users will eventually hit the limits of the drive and the data serving hardware itself.

For home users, an individual doing more than one thing, such as streaming AirTunes while running Time Machine, may similarly see a blip in their music playback performance every time Time Machine kicks in. Time Machine seems to momentarily overwhelm the wireless network when it first begins and again when it wraps up the backup session at the end, but counterintuitively, does not seem to excessively tax the network while it's actually backing up files in the middle of its session.

The design of Time Machine makes this issue easy to work around; if you're doing intensive network file operations or streaming media, simply turn Time Machine off to prevent any interruptions, and turn it back on again when its greedy use of the network no longer matters. Time Machine automatically accounts for lost time and catches up.

In our tests, configuring the network to use wide channels over the 5 GHz frequency made the network fast enough to accommodate both AirTunes and Time Machine at the same time without any hiccups. Attempting to dump the gigabyte of test files on the Time Capsule at the same time that both background operations where actively going on resulted in an estimate of 17 minutes from the Finder file copy, but didn't interrupt AirTunes playback. Time Machine took longer to perform its back up, but everything played along cooperatively, even as the reported signal strength fell down to around 216 Mbits/sec. The test files actually took 8:51 to copy during the AirTunes and Time Machine wireless smack down.

That indicates that for casual home and small office users, Time Capsule and the AirPort Extreme can support typical file sharing and Time Machine operations without any noticeable lag, if conditions are ideal, the configuration is optimized, and expectations are set realistically. For users with more demanding needs, a standalone NAS or dedicated file server connected to Time Capsule's Gigabit Ethernet switch might make more sense.

Real World Tests: Gigabit Ethernet vs Fast Ethernet vs Wireless

If you have a Fast Ethernet version of the AirPort Extreme base station, you might be worried that you need to upgrade to Time Capsule in order to gain the faster speed advantage of Gigabit Ethernet. There is a small speed advantage, but it isn't the factor of ten that the theoretical throughput numbers suggest. Copying the gigabyte of test files via Fast Ethernet (10/100 Mbit/sec) to the AirPort Extreme disk from the same MacBook Pro took 2:45.

That's just 50% longer than using Gigabit Ethernet to access the Time Capsule, which may also enjoy a slight advantage in being directly connected to its internal drive over SATA rather than via USB; in other words, the difference in Fast Ethernet and Gigabit Ethernet isn't that dramatic. It also explains why Apple left Gigabit Ethernet off the original revision of the AirPort Extreme base station; Gigabit Ethernet sounds good, but the base station hardware can't take full advantage of the much bigger pipe.

Copying the same gigabyte of files to a PowerMac G5 acting as an AFP file server, the operation took 1:45 via Fast Ethernet. Using Gigabit Ethernet, the same files copied in 0:38. That indicates that the Time Capsule and AirPort Extreme are not the most ideal file servers for high performance users who have little need for wireless connectivity.

If you have an extra machine sitting around, it would no doubt make a much faster wired file server, although both of the base stations are much more compact and energy efficient than a PC or Mac set up primarily to perform file sharing; the base stations are designed primarily to serve wireless clients. And of course, Time Machine currently does not support backing up to other file server shares outside of the AirPort Extreme and Time Capsule, although this should be remedied soon in updates to Mac OS X Leopard.

Repeating the same file copy test to Time Capsule over Gigabit Ethernet, it took 1:37, almost three times longer than coping the files to the PowerMac G5 over Gigabit Ethernet. Wirelessly, copying files to the PowerMac G5 file server took 2:51; wirelessly copying directly to Time Capsule using the same network setup took 2:49. That means the standalone server was slower over wireless than Time Capsule, but considerably faster when using Gigabit Ethernet. Incidentally, in each of these tests, Time Capsule served as the wireless and Ethernet router between the MacBook Pro and the PowerMac G5 (which did not have its own wireless card).

While a standalone server can easily offer a significant edge in performance as a Gigabit Ethernet (or even a Fast Ethernet) file server, Time Capsule and AirPort Extreme are both equally as fast compared to a dedicated standalone server when serving the purpose they were designed for: wireless backups and effortless file sharing in a simple and efficient compact form factor. For users with needs for the performance of a wired network, there are more appropriate server solutions to choose from, from designating a machine as a file sharing host or setting up a dedicated server.

The chart below shows copy times in minutes:seconds, seconds, and megabytes per second, and graphs the performance on the right. We performed many of the tests twice to show the variance we saw in wireless performance even in back to back tests with no obvious variables changing. The results indicate that when used as a wireless device, Time Capsule is nearly as fast as when accessed by a wired client.

Again, note that these time reflect the performance of Time Capsule with little background competition from other clients. As multiple devices or background activities consume its wireless bandwidth, the performance of wireless networking will rapidly fall in comparison to wired clients, so while stringing cables can be unnecessary in an AirPort home, a small office using Time Capsule might want to diversify their network with an Ethernet backbone to support non-mobile clients.

Real World Tests: WiFi 802.11n vs WiFi 802.11g

Unlike the wireless networking tests, copying files over Ethernet resulted in far more consistent test results; there was no significant divergence between test times as there was when testing wireless connections. The variable results related to wireless networking times also suggests why reviewers reported a wide difference in the usefulness of wireless disk sharing on the MacBook Air.

With a poorly configured network, even 802.11n can be unusable slow, and in our tests, even older 802.11g devices could beat it in copy times. Set to optimize data throughput, base stations using a wide 40 MHz channel of the 5 GHz band should greatly improve the experience of users tied to WiFi, particularly Air users.

What about older clients that can't wring the wide channel performance from 5 GHz 802.11n networks? Using a PowerBook G4 with 802.11g, it took 7:21 minutes to copy the test files to Time Capsule, and that was through a secondary 802.11g router connected to the Time Capsule via Fast Ethernet.

That's no match for the 2 to 3 minute average of 802.11n in ideal settings using wide channels, but is actually better than the default configuration times experienced with 802.11n out of the box in b/g compatibility mode. The sweet spot of wireless networking is clearly targeted on 802.11n, but earlier devices can make reasonable use of Time Capsule and Airport Extreme shared drives.

The main advantage of upgrading to 802.11n for users with mixed wireless equipment is signal range; 802.11n devices use MIMO antenna technology to dramatically expand the coverage area of a base station. Even in situations where 802.11n isn't demonstrably faster than 802.11g, its wider range of coverage means the signal will not only be accessible to a greater area, but its speed will also hold up better on the peripheral edges of service.

Once you upgrade enough of your wireless devices to move to 802.11n exclusively (or create a hybrid base station network as described earlier with dedicated 802.11n service), you can take advantage of the other 802.11n trick: wide channels in the 5 GHz band that supply a major boost in network speed. Don't tell your neighbors or they'll flock into the 5 GHz band behind you and turn it into the same overpopulated wasteland that currently plagues many 2.5 GHz WiFi users in urban areas. Also note that in mixed mode, 802.11n networks momentarily slow down to g or even b speeds when older devices are actively transmitting data on the network.

The next segment will look at how the wired and wireless networking of Time Capsule and AirPort Extreme compares against performing Time Machine backups to a directly connected USB drive.

Apple hit with another "millions of colors" lawsuit

2008-04-01T13:41:00.000-04:00

By Slash Lane
Published: 03:00 PM EST

Just days after settling a lawsuit in which it was charged with misrepresenting the quality of its notebook screens, Apple Inc. has been hit with a second class-action suit rife with similar allegations over one of its iMac displays.

According to the new suit, filed in a San Jose court Monday by Kabateck Brown Kellner, LLP, Apple is deceiving consumers by concealing that its new 20-inch iMac monitors are inferior to the previous generation’s and those of the new 24-inch iMac.

Specifically, the firm takes issue with a marketing claim from the Mac maker that both the 20-inch and 24-inch iMac are capable of displaying “millions of colors at all resolutions." While this claim holds true for the current 24-inch model and previous generation 20-inch model -- both of which display 16,777,216 colors on 8-bit, in-plane switching (IPS) screens -- the new 20-inch iMac display is said to be capable of 98 percent fewer colors (262,144).

"Apple is duping its customers into thinking they’re buying 'new and improved' when in fact they’re getting stuck with 'new and inferior,'" Brian Kabateck, Managing Partner of KBK, said in a statement. "Beneath Apple’s 'good guy' image is a corporation that takes advantage of its customers. Our goal is to help those customers who were deceived and make sure Apple tells the truth in the future."

While Apple describes the display of both the 24-inch and 20-inch iMacs as though they were interchangeable, KBK asserts that the monitors in each of the desktop systems are of radically different technology.

The new 20-inch iMac features a 6-bit twisted nematic film (TN) LCD screen, which the firm claims is the "least expensive of its type," sporting a narrower viewing angle than the display of the 24-inch model, less color depth, less color accuracy and greater susceptibility to washout.

Apple on its website says: "No matter what you like to do on your computer — watch movies, edit photos, play games, even just view a screen saver — it’s going to look stunning on an iMac."

However, KBK argues that the inferior technology in the 20-inch iMac is "particularly ill-suited [for] editing photographs" due to its limited color potential and the distorting effect of its color simulation processes.

"Apple is squeezing more profits for itself by using cheap screens and its customers are unwittingly paying the price," Kabateck said.

Apple last week agreed to a settlement in a similar class-action lawsuit brought on by two professional photographers, which charged that the company's Intel-based notebooks were only suited to display the "illusion of millions of colors through the use of a software technique referred to as 'dithering,' which causes nearby pixels on the display to use slightly varying shades of colors that trick the human eye into perceiving the desired color even though it is not truly that color."

The terms of that settlement were not made public.

Exploring Time Capsule: WiFi 802.11n and the 5GHz band

2008-04-01T13:27:00.002-04:00

By Prince McLean
Published: 08:00 AM EST

Earlier versions of the WiFi specification all used the 2.4GHz radio spectrum. The new 802.11n standard, supported in Time Capsule, the square AirPort Extreme, and recently shipping AirPort Express units, allows users to alternatively select the use of 5GHz channels. This segment, the third of six, compares the pros and cons of using this new section of frequencies, which can be both problematic and provide a major boost in speed.

Our real world testing of Time Capsule's WiFi performance suggested two findings. First, wireless networking performance can and will vary all over the map even without any obvious variables changing. This makes it difficult to accurately profile the speed of a wireless configuration. In comparison, file copy times over Ethernet or direct connections such as USB were easy to verify in additional follow-up tests. Actual results for wireless throughput will vary dramatically in relation to obvious sources of radio interference in addition to other sporadic factors that are harder to identify.

Second, users with multiple base stations should ideally connect the computers that will be making heavy use of file sharing to the base station actually hosting the shared drive. This requires some network planning, as client computers will attempt to connect to the base station supplying the strongest signal of all the base stations that are on the same network. In other words, locate the Time Capsule or AirPort Extreme hosting the share drive closest to the systems that will be using it the most, and use any additional base stations to extend the network signal elsewhere.

Next, evaluate the wireless network signal strength within AirPort Utility (below) to make sure there are no obvious sources of signal interference. This could include radio emitting devices such as cordless phones and microwave ovens, unnecessary Bluetooth devices that could be turned off, and any metal barriers that might obstruct the signal. Neighboring WiFi networks may also likely impede ideal connectivity, so if possible, experiment with different WiFi channel settings to situate your wireless network outside of the signal range used by other nearby networks.

802.11n WiFi and The 5 GHz Band

As noted earlier, with WiFi 802.11n on the AirPort Extreme and Time Capsule, you can set up your network to use a different set of frequencies all together by selecting "802.11n only (5GHz)" as the radio mode in Wireless settings (below). This isolates your network from interference from other 802.11b/g WiFi networks as well as any 2.5 GHz cordless phones, but of course prevents older 802.11b/g clients from connecting to your network, including most Macs earlier than 2007 and other WiFi b/g devices such as the iPhone or iPod Touch.

If you have both old and new wireless devices, you can cable (via Ethernet, below) a new 802.11n base station hosting a 5 GHz network to an older 802.11b/g base station configured to operate in the "802.11b/g compatible" 2.4 GHz band. This enables faster devices to connect at full speed with minimal interference, while also allowing older devices to connect to the same network through the older base station and interoperate together with every other device on the same network. This setup also prevents 802.11b/g devices from temporarily slowing down a 802.11n network as they transmit, which happens when using mixed devices on a 802.11n base station configured as "b/g compatible."

Incidentally, there is also an 802.11a standard, which is essentially 802.11g running in the 5 GHz band. All of Apple's 802.11n base stations and wireless cards now backwardly support 802.11a/b/g, but Apple never directly supported the earlier 802.11a standard in its products prior to 802.11n because 802.11a was largely intended for office deployments, where the downsides to the 5 GHz band could be more easily worked around. Which brings us to the potential drawbacks--and advantages--of using 5 GHz.

The Pros and Cons of 5 GHz

As noted by Glenn Fleishman in the article Wi-Fi Networking News: 5 GHz or Bust, the 5 GHz band has much greater radio spectrum available; there are 12 non-overlapping channels, each with 20 MHz of bandwidth. The entire 2.4 GHz band is only 80 MHz wide, which only allows for three non-overlapping 20 MHz channels; while you can select any channel between 1 and 11 in the standard 2.4 GHz band, there is so much overlap between channels that only 1, 5, and 11 can really coexist in the same area without interference. When using 5 GHz, the base station selects the channel for you automatically.

However, 5 GHz is also a higher, shorter radio frequency, which means that at the same amount of radio transmission power, its radio waves propagate shorter distances than those of 2.4 GHz base stations. The 5 GHz band is also worse at penetrating solid objects such as wooden walls in a home (neither band can penetrate metal walls, such as lath and plaster walls using a metal mesh found in some older buildings). There are also power transmission restrictions that affect the use of the 5 GHz band. These factors combine to result in users likely seeing a significant drop in their signal range when using 5 GHz.

In our initial tests, switching to 5 GHz initially had no positive impact on wireless transmission speeds. In fact, it actually seemed to slow things down. However, Apple's 802.11n AirPort devices, including Time Capsule, support a wide channel mode when using 5 GHz that does make a big difference in network speed.

Use Wide Channels For a Big Boost

The greatest advantage to using 5 GHz is the ability to bond two channels together, which Apple calls "Use wide channels." (below) This allows the base station to grab twice as much radio bandwidth (40 MHz) and should be turned on by default when using the 5 GHz band. This will also boost the reported connection speed from 130 to 300 Mbit/sec, at the expense of possibly interfering with other nearby 5 GHz networks, giving up some signal range, and dropping compatibility with 802.11b/g devices.

However, once configured to use wide channels in the 5 GHz band (the setting hides behind the "Wireless Options..." button on the Wireless tab of AirPort Utility, below), our gigabyte of test files copied to the Time Capsule in 2:11, a dramatic improvement that put 802.11n in the running next to Time Capsule's Gigabit Ethernet performance (which took 1:38) and was well below the 3 to 8 minutes required by wireless configurations only using a single 20 MHz channel.

Of course, connecting the base station directly via an Ethernet cable makes the biggest difference in performance, but also negates the convenience of wireless networking. In any case, the fact that 802.11n wireless networking can approach the ballpark of base station Gigabit Ethernet speeds is pretty impressive. The dark side of the same coin is that the AirPort Extreme and Time Capsule have relatively poor Gigabit Ethernet performance (as noted in the next segment).

It also needs to be pointed out that WiFi performance will degrade rapidly as the user loses signal strength; the poor performance of the first tests were exaggerated by a drop in signal strength related to unknown environmental factors. During the first tests we ran, the AirPort software reported a signal strength that fell from 130 to 117 or below. With a 300 Mbit/sec, 40 MHz wide channel network, the loss in signal reception coverage might offset the faster data rate, or require more base stations to extend the same signal coverage.

If you're thinking that configuring wireless networking sounds a lot more like voodoo than engineering, you might be right. Experimentation to suit your own needs related to signal reception area versus data speed, and accounting for the type of barriers or sources of interference in your specific setup is essential to gain the best possible performance.

The next segment in this series will look at our actual test results comparing wireless performance between modern 802.11n devices, older computers that only support 802.11g, and systems directly connected over Ethernet. We'll also compare performance of 10/100 Fast Ethernet offered by last year's AirPort Extreme, and the Gigabit Ethernet performance of currently shipping Time Capsule and AirPort Extreme base stations, and compare how the base stations stack up against a dedicated file sharing server.