Linux Solutions

Sun Microsystems has given 1,300 of its employees the chop yesterday. This is the first in what will be a slew of forced redundancies that will reduce the company’s manpower by around a fifth.

The company said that it has cut workers from multiple levels within the company including senior management positions.

They did not actually reveal any names of those now seeking alternative employment, but rumours abound that the departed include individuals that work on some of the company’s biggest open source projects; OpenJDK, desktop Java, and the Java 2 Standard Edition (JavaSE) interface.

Other individuals that work in marketing and on social media have also been removed from their positions. They were working to build a community around OpenSolaris – the open source version of Sun’s Unix operating system.

The news will be disappointing to those who will be enjoying daytime television for the next while, but those that survived this wave of cuts will be breathing a sigh of relief for the time being. However, they better start saving everything they can because with more cuts coming they could easily be next. In November Sun made the announcement that 6,000 of its 33,400 strong workforce would be going, and that’s on top of the 1,700 or so cuts announced in May.

Sun said in a statement yesterday that the number of people made redundant “when combined with the other cost cutting measures and organizational changes being implemented, will put the company on track for improved financial performance.”

Sun aren’t the only big fish trying to swim in an increasingly small pond these days - Microsoft have been forced to lay-off 5000 staff from its 95,000 strong workforce in response to the economic crisis that’s swallowing up companies left, right and centre.

Chief Executive Officer at Microsoft, Steve Ballmer, said regarding the issue, “We’re certainly in the midst of a once-in-a-lifetime set of economic conditions. The perspective I would bring is not one of recession. Rather, the economy is resetting to lower level of business and consumer spending based largely on the reduced leverage in economy.”

A few days ago I spoke on the Conficker/Downadup (C/D) worm that’s working its way around the world, infecting a huge number of Windows-based computers, and a recent story has revealed that if a Linux user who has the Wine software – a program that allows Linux users to download Windows programs – that they could be infected too.

The Superworm that has reportedly been attacking a patched vulnerability in Microsoft Windows, with a reported 6.5 million new infections in the past 4 days alone, bringing the total to an estimated 9 million machines infected.

There are a number of factors contributing to the worm’s growth. The Windows vulnerability allows for self replicating attacks in 2000, XP and Server 2003 version of the software, and the virus has been designed to exploit flash and network drives allowing it to spread across a local network at worrying pace even if just one computer is affected.

A large factor that has allowed the worm to grow is because of stubborn data managers and administrators of Windows-based systems who failed to listen to the warnings and download a security update. Microsoft released a patch to combat the worm over three months ago, but nearly one in three machines have not downloaded it, according to security company Qualys.

The C/D worm uses the autoplay function to load up files from removable devices using a simple autorun.inf file which can fool users into installing malicious code on their machines. This means that even Windows Beta 7 users could have been affected by the slithery culprit.

While autoplay can be turned off and autorun.inf files removed, the users can be easily deceived by the pop-up that appear once the removable device is plugged in. Once the worm is loaded on to a system it uses a complex algorithm based on public websites such as Google to contact their “home” servers and disables Windows Update automatically.

The clever part is that the algorithm changes every day, pointing to different domain names every day (up to 250) and are calculated using a public key – not unlike those used in security encryptions.

It would appear that no-one is safe as even a hospital in Sheffield, England has reported that more than 800 of its 7000 computers have been compromised by the worm – system administrators decided to turn off Windows security updates.

Red Hat has announced the arrival of the fourth version of its Enterprise Linux Distro, RHEL 5.3, which adds support for new hardware, a number of virtualisation changes and some other interesting additions. RHEL 5.3 has added over 150 new enhancements, a number of which appeared in Fedora (essentially a development release for RHEL). Some may argue that Fedora stands alone, but it’s clear that Red Hat use Fedora as the foundation for RHEL.

The most notable enhancement in RHEL 5.3 is the support for Intel’s “Nehalem” Core i7 processors – the desktop processors that launched last November and are implemented in a 45 nanometer process, have new micro-architecture and an Opteron-like interconnect called QuickPath – that will be delivered in Servers sometime in March, if all goes to plan.

RHEL 5.3 doesn’t just run on those chips, it also connects to the chip’s power management features, allowing it to save energy, and has been tweaked to take advantage of their simultaneous multi-threading. The Xeon variants of Nehalem for servers will scale up to eight cores, with two visual threads in each core. In a four socket system this will mean that an operating system and its applications will habe 64 threads.

REHL 5.3 also includes OpenJD, which is an open implementation of Jave SE6 development kit and runtime for Java. Red Hat say that the OpenJDK support combined with its JBoss Enterprise Application Platform yields the first enterprise-grade, fully open source Java stack.

The new Distro includes support for Global File System 2, and also includes support for data encryption for block devices using the Linux Unified Key Setup feature. RHEL 5.3 also includes am iSCSI boot firmware table that allows the operating system to be booted from disk arrays linked to servers over an iSCSI link.

REHL releases generally have a number of technology previews, and the new version is not any different. The ext4 file system has been included which is a bridege to the ReiserFS and ext3 file systems and a bridge to BTRFS – a future Linux system.

Other previews include eCryptfs, which is a stacked cryptographic file system that mounts on top of file systems such as ext3, and stateless Linux. The release also includes a tech preview of the GNU GCC 4.3 compiler set.

If you are already a customer with a support contract you’ll get the update for free.

Jaunty Jackalope, the third alpha of Ubuntu’s 9.04 distro, has been released. The Alpha includes the Linux 2.3.28-3.4 kernel and comes pre-loaded with support for using the Ext4 file system – however the Ext4 is widely expected to remain as the default file system for Jaunty.

Ubuntu’s founder Mark Shuttleworth spoke about a number of improved notifications on the desktop in quite some detail last year. The company as added a simple menu into the latest alpha version that sets preferences for notifications.

Ubuntu have said that the final version of Jaunty Jackalope will hit shelves, so-to-speak, on April 22nd.

The distro includes the use of X.org’s latest 1.6 server, which means there is no more support for proprietory nVidia drivers, which means users will have to wait fot an update from the chip maker or choose a suitable open source driver instead.

“In the short term, this will again cause increased instability for some users while the video drivers catch up,” said the Jaunty Jackalope press release.

Ubuntu has also warned those who use Intel i845 or i865 video chipset’s for the next while until they fix a glitch that is known to prevent the nouvea X driver from loading.

The company has also disabled the DontZap option so as to stop users from accidentally initiating the Ctrl-Alt-Backspace combination. Developers are currently working on a GUI Configurable option that they hope will be ready for the April 22nd release.

Mr Shuttleworth said that he wants the best experience for his users: “Experiments are also not something we should do lightly. The Ubuntu desktop is something I take very personally; I feel personally responsible for the productivity and happiness of every Ubuntu user, so when we bring new ideas and code to the desktop I believe we should do everything we can to make sure of success first time round. We should not inflict bad ideas on our users just because we’re curious or arrogant or stubborn or proud. Despite being occasionally curious, arrogant, stubborn and proud…”

In related news, Ubuntu has also released a bug fix for a problem that crept out of the shadows back in October 2007. Many users complained that the Distro forces drives to spin up and down at an unnatural rate due to power management features that were a little too aggressive.

When the problem first arose Ubuntu said it was a firmware/BIOS problem and nothing to do with the OS. The update is now available for versions 9.04, 8.10 and 8.04 (LTS).

Remember the film Tremors? You know that’s the one where these big worms slithered around eating people – well this is like that…expect its your PC that’s getting eaten this time.

Downadup, or Conficker as it’s also known, is a Superworm that has reportedly been attacking a patched vulnerability in Microsoft Windows, with a reported 6.5 million new infections in the past 4 days alone, bringing the total to an estimated 9 million machines infected.

The numbers are but an estimate, and security researchers say the numbers could be inflated by security company F-Secure, as it’s near impossible to ascertain the exact amount of infections.

“This thing has gotten way out of hand,” said Paul Ferguson, a security researcher for anti-virus provider Trend Micro who has spent the past several weeks tracking the worm’s progress. “It seems pretty spectacular to me that there could be that much growth.”

There are a number of factors contributing to the worm’s growth. The Windows vulnerability allows for self replicating attacks in 2000, XP and Server 2003 version of the software, and the virus has been designed to exploit flash and network drives allowing it to spread across a local network at worrying pace even if just one computer is affected.

A large factor that has allowed the worm to grow is because of stubborn data managers and administrators of Windows-based systems who failed to listen to the warnings and download a security update. Microsoft released a patch to combat the worm over three months ago, but nearly one in three machines have not downloaded it, according to security company Qualys.

If the 9 million infected machines sounds exaggerated, it probably is. According to Paul Royal, the chief scientist with Damballa, just 500,000 unique IP addresses have been linked with the Downadup master server - a far cry from the 9 million suggested by F-Secure.

So how did F-Secure come to that staggering figure? They say they infiltrated the Downadup’s control channel and analysed the log of machines that connected. Whilst looking around they discovered a counter that they believe shows the number of infected systems. They created a script to add all those numbers together (what happened to the good old fashioned calculator) and worked put that 8.97 million machines were infected.

The bizarre thing about this worm is its intentions. Researchers have determined that it has not committed fraudulent activity on a large scale. So far it has set up a domain that forces users to install fake anti-virus software at a cost, but once security experts shut down that domain, the worm has, pardon the pun, remained underground.

The worm uses a random domain name generator embedded in the software that causes machines to jump to a different domain every day, but security boffins have been registering predicted domain names ahead of the worm. They say they haven’t noticed any spam, banking detail or password fraud as of yet.

“Given that there are new domain names generated everyday, the botmasters have an infinite number of chances to actually claim control of the botnet and direct it to do whatever they want whenever they want,” said Royal. “Based on what we saw in the past, it seems likely they may try and push rogue anti-virus software on people’s systems in the future, but of course, there’s nothing that precludes them from doing something completely different.”

Although this story has nothing to do with Linux, I thought it was rather interesting all the same…

The Ministry of Defence said yesterday that they have suffered from a virus outbreak in their computer systems, causing a small number of the defence network’s systems to crash, leaving Royal Navy warships administration networks vulnerable.

The computer systems that have been affected are the NavyStar systems, which are based on a server cabinet and cable-networked PC’s on each warship. The systems are used primarily to keep supply records and act as an email server. NavyStar connects to large networks via shore-based connection when vessels are sitting in their docks, and use satellite communication while out on the open sea.

The company supplying the systems is Fujitsu, who supplied the systems in early 2000. NavyStar is to be used as part of the Defence Information Infrastructure that is currently being rolled out across the MoD.

The NavyStar hardware varies from ship to ship, as it depends when the systems were installed and at what point the vessel had its last dockyard maintenance. Each system is built with sturdiness and is battle ready – with the PC’s having hard cases and shock mounting. Each system is made to follow strict emissions guidelines to avoid complications with other systems.

In the last two weeks multiple MoD systems have been infected by viruses, including aircraft carrier the Ark Royal. The biggest damage to the men and women on the ships is the loss of email communication – the main way of keeping in touch with family and friends.

This statement was released by the MoD:

“Since 6 Jan 09 the performance of the MOD IT systems in a number of areas was affected by a virus. Immediate action was taken to isolate the problem to stop the virus from spreading. This meant that some people were without regular IT access (i.e. email, internet). There have been no infections detected on any networks with sensitive information.

“A solution to prevent re-infection has been tested and implemented. The majority of systems are working normally. This is an ongoing process which we are working urgently on so for those people who are still off line normal business will resume as quickly as possible.”

The MoD has says that none of its command or operational systems have been affected, but they do run on similar hardware so you can bet their security experts are working overtime to ensure they don’t have any further problems.

The MoD has also refused to comment on the details of the virus, and how it got into the systems but reassured its staff that “no classified or personal data has been or will be at risk of compromise” due to “pre-existing security measures”.

Newspaper reporters from the Sunday Times claimed that the results of a Harvard University study showed that two web searches – namely those on Google – used as much carbon dioxide as boiling a kettle. The generally well informed paper opened the story with:

“Performing two Google searches from a desktop computer can generate about the same amount of carbon dioxide as boiling a kettle for a cup of tea, according to new research.”

What they failed to mention is that the physicist who did the study, Alex Wissner-Gross, never actually mentioned Google in his study. Online technology website TechNewsWorld spoke to Wissner-Gross:

“For some reason, in their story on the study, the Times had an ax to grind with Google…Our work has nothing to do with Google. Our focus was exclusively on the Web overall, and we found that it takes on average about 20 milligrams of CO2 per second to visit a Web site.”

Wissner-Gross also rubbished the newspapers claims that the searches caused as much carbon dioxide as a kettle: “I have no idea where they got those statistics,” he said.

Google have set loose the PR machine to ensure they don’t get damaged by the news. Company spokesman, Jamie Yood said that the co-founders Larry Page and Sergey Brin are “really dedicated” to pursuing greener technologies.

Yood Acknowledges that the company is using energy and from a business perspective it, “makes sense to get this energy cost as low as possible”.

“They recognize that if we’re going to use energy, let’s try to figure out how to do this as minimally as possible”, he added.

The company does make an effort. Electric cars and bikes for employees are used on and around the company’s Californian headquarters, and they use recycled materials throughout their buildings. Yood adds that they have the most energy efficient data centres.

Google is none too please about the kettle allegations, claiming that a search uses the same amount of energy as the human body uses in around ten seconds. Google have requested a copy of the study from Wissner-Gross, who plans to send them one.

Yood says that the Times reporters interviewed a data centre manager, but never made use of the information he gave them, preferring a more sensationalist story over fact.

The technology Google’s search functions use allows any user to retrieve almost any information they require – so long as there is a web page on the subject. The energy required will differ depending on the depth of a search. For example if someone were to search for “Angelina Jolie” there will be millions of instantly available pages as its likely to be on multiple servers at the edge of the network, but if someone were to ask for something obscure like “Ben Afflecks career” then the search would use a deeper part of the network, causing higher energy usage.

Wissner-Gross has had the press hounding him since his study results were published by the Sunday Times. The paper correctly quoted Wissner-Gross as saying, “A Google search has a definite environmental impact” and “Google operates huge data centers around the world that consume a great deal of power.”

Defending what he said, Wisner-Gross said believes that people would not disagree with that statement. “Everything online has a definite environmental impact. I think everybody can agree on that, including Google”, he said

TechNewsWorld asked him why he reckons the Times focused on his study, and in particular Google.

“The short answer is, it’s a really easy way to sell papers. Google is a very successful company and it’s a very easy way to get readership by making grandiose claims about them,” he concluded

A number of Sun MySQL workers have been told they cannot enter the border of Australia because the Oz government fears that they want to steal local business.

The employees were due to attend a Linux conference in Hobart, Tasmania but have been denied short stay business visas.

Kaj Arno, vice president of the “database community” at Sun, appeared to be completely un-shocked as he blogged about the news, claiming that borders are one of the biggest hindrances to open source development.

“Open Source is global in nature. You can develop a database in, say, Finland or Sweden, and become known in, say, Ukraine or the United States. This would imply that Open Source knows no borders,” Arno mused. “In practice, borders hamper Open Source work a lot.”

He went on to describe how Russian and Ukranian based MySQLers have struggles to obtain visas for meetings in America and the European Union. And as a Finnish-born bloke he has also suffered the “hassle” of getting into Russia, and was once stopped from entering India – but he never thought Australia would shut the door on him.

He mentions that the country’s decision to barr the workers will “adversely affect” MySQL’s presence at the linux.conf.au at the end of January.

In other barely related, but interesting nonetheless news, Red Hat and Novell – the Linux distributors – have had a bit of a reshuffle in their respective board rooms.

As the try to battle the bite of the worlds economic meltdown Red Hat has brought in Greg Symon as vice president and general manager of its North American sales division – the biggest slice of the company’s cake.

Symon, who spent 22 years at Intel, will report directly to Red Hat’s president of global sales, services and marketing, Alex Pinchev.

Symon takes over the role from Ed Bovajian who worked at the company until June last year. He moved to EnterpriseDB as its president and CEO.

Novell have made a change too, promoting Javier Colado to president of EMEA operations. Novell have replaced Volker Smid, who has gone on to “pursue other interests”.

Colado has been at Novell since 2006 and has been an executive at McAfee and Lucent Technologies. Colado’s responsibilities for managing Novell’s channel partner relationships will be given to Jhon Dragoon, Chief Marketing Officer for Novell.

It’s easy to find a cheap security product on the internet these days. One look at the many websites that peddle free downloads and try now, buy later products and you’ll be presented with a myriad of options.

When it comes to your IT security, you should always choose the software that you believe will stop the biggest threat to your computer. When you’re on these download sites you should take your time to weigh up the benefits and pitfalls of each product carefully. Cost is generally the first thing people consider. Ultimately, you get what you pay for, but free open source products are getting better and better every few months.

Ideally you’d want an unlimited budget and you’d buy whatever you felt did everything required, and often open source software doesn’t quite cut the mustard. Evaluating every aspect of your selected product; what does it cover? Is technical support available? what about upgrades? Does the price increase after the first year? Is their really a big difference between the free version and the paid version?

Let’s look at disk encryption software. Can open source software provide a solid alternative to off the shelf products?

The first thing to consider is would you use any software that uses a proprietary encryption algorithm. At the core of any product with cryptographic services is a cryptographic module. This module generally does not have adequate testing and validation against established standards, so won’t provide the security level you require. With an open source alternative the cryptographic module will not be proprietary and is generally tightened up by a squad of security experts.

If the software is poorly designed the product will prove insecure, placing your valuable information at risk of theft or damage. The major advantage the many security experts cite is that with an open source security option, you are able to check the source code itself to ensure the encryption algorithms are implemented correctly.

This being said, just because you maybe prefer open source to ‘off the shelf’ products, you shouldn’t rest on your laurels. Even a good open source cryptographic module that has been badly implemented can lead to a serious vulnerability that could have dire consequences for your data.

You shouldn’t assume as well that it’s just the smaller open source developers that get in a mess. In May 2008, Debian has a major security failure in its GNU/Linux operating systems random number generator, making any OpenSSL keys generated during that past 20 months so predictable that they could be guessed in only a few hours.

The massive user generated encyclopedia Wikipedia will live on for another year thanks to $6.2 million in donations.

The record amount has surpassed the $6 million expectations of the non-profit organisation, the Wikipedia Foundation, after Wikipedia founder Jimmy Wales led the charge with a personal appeal in December.

There were concerns that the foundation would be closing the book, so to speak, on the encyclopedia, as the $6m goals seemed pretty far away even nearing the end of 2008, so Wales made the plea on the website instead of the usual web donation banner to save Wikipedia.

Nine days after launching the appeal, the Foundation had raised over $2 million from 50,000 donations, and by January 2nd over 125,000 individual donors had raised a further $4.5 million to reach the final sum. Wikipedia’s founder labelled the donations as the “most ambitious and successful campaign in the history of the Foundation.”

When the fiscal year ends on June 30th, 2009, analysts predict that Wikipedia will need around $5,974,000 to survive. The cash will be used to ensure the companies technical infrastructure remains able to cope with demand, that the can maintain their 23 members of staff, and that they can keep running the Wikipedia Academies and in-person workshops.

Wales released a clearly heart felt thank you message to those that donated: “Your continued support will also serve as a much-needed financial safety net if economic conditions continue to worsen globally…You have proven that Wikipedia matters to you, and that you support our mission: to bring free knowledge to the planet, free of charge and free of advertising. You’ve helped make and keep Wikipedia available for the whole world.

“I deeply appreciate your support.”

The Foundations website informs people of how exactly the money will be spent, and the financial report will automatically be sent to any one who donated to the Foundation.

Something that is very important for users is that the website remains ad-free. The open source nature of the website is appealing and Wikipedia is the fourth most visited website on the internet in terms of number of users, according to figures from ComScore.

It’s good to see that Wikipedia has won this battle, but sadly it has not won the war. With the world in financial ruin, money will be too tight to mention when the cash runs out. I for one hope that the website can remain, as it’s a great source of information, but with Jimmy Wales even have to get down and contact donors directly you have to say the future looks bleak.

Monetising a website that has no advertising will always be a problem. It’s down to ethics, but to be honest how many websites these days have advertisements that you ignore. I’ve seen so many these days that I don’t even notice ads. So maybe Wikipedia could have some advertising to solve there problems.