Frustration grew to anger and much like my Facebook Deletion a few weeks ago, if I was going to talk about openness I have to live it. Part of my switch from Mac to Linux again full-time was that I grew tiresome of the walled garden. I preach the EFF/FSF talking points and support companies that support the community…except for my phone…

So here it goes, a switch to a more free device. In all honesty I would rather do the N900 route, but there is free and hackable; and free and usable. The N900 is far from usable and much like every N-series MID before it, Nokia has screwed over the community by not supporting the device for more than a year. The device near and dear to my heart is a Palm Pre, but the lack of new devices and questionable future turned me off. WebOS is a beauty and if in a year (I go through phones like toilet paper) there is a new device I will surely pick it up. For now though, its time for a switch to Android. Froyo SDK has really impressed me and while there are VERY rough edges I am willing to bleed for the cause.

Oh and switching might just include a flip to Sprint…Evo 4g…yummy…

Android

Everywhere I look in the work place I see two phones on everyone’s belt or desk. There sits the company issued blackberry next to the iPhone or Android device. In an era of financial concerns I cannot help but wonder what the outside world thinks about us. Based on BillShrink.com we can guestimate the total to be around 4000 dollars which is 6 times more than the average Haitian makes in a year.

In addition, on a more personal level why would a logical engineer spend an additional 100-150 dollars a month on a device who’s general capabilities are replicated with a company supplied and funded phone?

I wish I could make the above statements with a “giggle” because I rose above the geek lust and stick with a Blackberry…if only that were the case.

A few weeks ago I was stuck broken down on my Ducati in the middle of the ghetto. I brought my blackberry instead of iPhone over a somewhat cynical fear that I would crash and my nice personal phone would serve as a slip and slide. After being on the side of the road for 3 hours with nothing more than a blackberry for entertainment and safety usage I have this following list to say:

• Why does it take 10 minutes to restart a Blackberry? What on earth could take THAT long to restart and allow for input?
• Opera Mini improves the situation, but the surfing situation on a Blackberry is embarrassing. Simple Google searches and news reading is painfully slow. For a split second I saw a newspaper dispenser and dug for change
• Why does it lock-up when I am typing a message? Don’t give me the bull about multitasking and running too many things. Google Talk, eMail, and Browser-based Twitter are not enough to LOCK a machine up.
• Camera, music, and streaming pandora is worthless. If you ever think you will use it for anything more than email you are poor soul who has never touched an iPhone or Android

So why are there two phones on people’s hips and desk? The only conclusion I can come to is one is a pager and the other a small computer. Given the option to pay for their own device and service many would jump on the opportunity. The truth is that the Blackberry is a dying paradigm. Seamless email is nothing the cheapest “media smartphone” can perform with ease. Passwords, security, remote wipe, etc. All these things can be done with Google Android or iPhone. RIM has momentum and entrenchment in that their BIS/BES installs are extensively deployed at the highest level of govt. The problem is that momentum implies either an acceleration or slowdown. We can all agree that the momentum for RIM is the slow-down, we are watching the ball slow down.

RIM take a look @ Solaris and review your position in the market. People would rather spend their hard earned dollars than rely on your sad excuse for a modern smart-phone. To the businesses of the world paying for BB and watching your highest executives carry iPhone; time to wake-up. You are giving your workers rubber hammers because they are safer and expecting them to build you strong houses. Give them the tools they want…

The amount of banter on the topic is extensive, but there really are good reasons to leave Facebook. When I started dabbling in Social Networking back on the BBS days there was always a desire and reason for anonymity. It could have been for the illegal activities going on or for the fact people just didn’t want to over expose themselves. It was around the time AOL picked up some steam that sharing really became trendy. There were extensive pushes to kick AOL off the grid for the amount of anonymous data leaked from their pipes, but that was not enough to place controls on the system. As I joined sites like Friendster, Jaiku, etc. there were always controls in place for the amount of information I could share and what people could share about me. That layer of control allowed me to keep tabs on my personal identity and persona. I left MySpace and Hi5 since everyone told me “Facebook is way more secure,” but at the time I was unable to join due to no college affiliation. That changed and I joined…

My biggest gripe about Facebook isn’t that Big Brother will learn everything about me. I am a Defense Contractor and prior military, Big Brother knows more about me than I know. My gripe is that Facebook has no legal mandate to control my data. If I post that my dogs name is Tim, I was born on Mars, and my mom used to be Misses Fraglerock – you have in essence enough information to reset passwords on most major websites. I would share that information under the guise that Google would not crawl the info or some outside source. The issue with Facebook is even if I set the control to ONLY allow for you, my bestest friend to see it, as soon as you visit a website or take a stupid quiz my information is accessible to other folks. My circle of trust (COT) is now broken.

As a security professional we must place our money where our mouths are. If we are going to preach two factor authentication and default-deny, then we must live it. Facebook violates a default-deny policy by constantly changing TOS and releasing my information. They refuse to validate and control my data from myself and friends despite any setting I select…as such…auf weidersahn

Further Reading:

http://consumerist.com/2010/05/top-10-reasons-to-quit-facebook.html

http://www.technologygear.net/top-10-reasons-for-why-you-should-join-facebook.html

http://sickfacebook.com/top-10-reasons-why-facebook-sucks/

http://gizmodo.com/5530178/top-ten-reasons-you-should-quit-facebook

• Intel you suck…suck hard…your own Moblin distro can’t suspend because you feel that “embedded platforms shutdown and restart” Guess what sparky, they don’t always. Fix your damn IEGD driver
• Dell and Ubuntu screw you both for creating some custom driver to send out on Dell 12 laptops. The driver I install now was extracted from your blob. Hate Theo from OpenBSD as much as you want, but no blobs
• Windows drivers for this card suck pretty bad too. There is a video demo of the GMA500 Poulsbo playing Quake 3 off a MID. The driver in Windows XP-7 cannot play flash without massive frame drops. Totally unacceptable with the 10.1 Flash Beta to still have such trouble

The distro I landed with was Ubuntu 9.10. It pains me because it will never recieve the GNOME 2.30 install, but with PPA I am good with most everything else. I will use this as my hold over until Intel gets off their butts and produces quality code. I used to tell people that the Intel series of cards were the best in UNIX world for out of the box drivers. Yes+but=NO Don’t sour your good name Intel

Link to Support Matrix Spreadsheet if you browser does not support iframe

Links:

• Arch Linux Forum Post for PKGBUILD
• Compile IEGD on any Linux Kernel
• Why you are screwed with the Poulsbo
• Ubuntu Howto for Poulsbo Install
• Makefile hack to get around later kernels not compiling due to drm_agpgart on line 527

• Install Windows 7 to active Verizon Gobi Modem and Firmware
• Install GMA 500 Graphics driver
  • wget http://dl.dropbox.com/u/1338581/Gma500/scripts/poulsbo.sh && sh ./poulsbo.sh
  • add mem=2000 /etc/default/grub
  • update-grub
  • After reboot dpkg-reconfigure psb-kernel-source
• Edit /etc/apt/sources.list to include universe and multiverse
• sudo apt-get dist-upgrade
• reboot
• Update system to include SSD optimizations
• Install sony-laptop-zseries module
  • http://www.logic.at/people/preining/software/
  • sudo -i
  • mkdir -p /usr/share/sony-laptop
  • Extract np5 into directory
  • ln -sf ../share/sony-laptop/sony-laptop-zseries-0.9np5 /usr/src/sony-laptop-zseries-0.9np5
  • dkms add -m sony-laptop-zseries -v 0.9np5
  • /etc/init.d/dkms_autoinstaller start
  • vi /etc/modules
• Turn on WWAN hardware
  • mkdir /lib/firmware/gobi
  • Copy files from:
    • C:\Program Files\Qualcomm\Images\Sony\1\AMSS.mbn
    • C:\Program Files\Qualcomm\Images\Sony\1\Apps.mbn
    • C:\Program Files\Qualcomm\Images\Sony\1\UQCN.mbn
    • to /lib/firmware/gobi
  • Download qcserial and extract to /usr/src/
    • http://westhoffswelt.de/data/blog/vaiox_gobi2000/qcserial_with_gobi2000_support.tar.gz
    • cd /usr/src/qcserial
    • make
    • make install
    • echo “qcserial” >>/etc/modules
  • Download gobi loader for Linux and extract to /usr/src
    • http://westhoffswelt.de/data/blog/vaiox_gobi2000/gobi_loader_with_gobi2000_support.tar.gz
    • make
    • make install
• Enable Suspend
  • Install PSB fix in /etc/pm/sleep.d/99_psb_fix
  • Touch /etc/pm/sleep.d/98smart-kernel-video
  • Install USB Wakeup fix for QCSerial Gobi issue in /usr/lib/pm-utils/sleep.d/00usbsleep
• Enable console framebuffer
  • Edit /etc/default/grub
  • set gfxmode=1024×768
    • You can do the full 1600×768, but on the console I prefer larger fonts
  • Edit /etc/grub.d/00_header
    • • if loadfont `make_system_path_relative_to_its_root ${GRUB_FONT_PATH}` ; then
      • set gfxmode=${GRUB_GFXMODE}
      • set gfxpayload=keep
    • IT HAS TO GO UNDER “set gfxmode…”
• Enable scroll trackpoint
  • sudo vi /etc/hal/fdi/policy/mouse-wheel.fdi
• Install RFkill Applet to disable radios
  • http://www.logic.at/people/preining/software/rfkill-applet-0.6.tar.gz
  • Execute with the following installer: rfkill install.sh
  • Reboot and add to panel
• Internal Mic Fix
  • sudo apt-get install linux-backports-modules-alsa-2.6.31-20-generic
  • sudo add-apt-repository ppa:ricotz/unstable
  • sudo apt-get update && sudo apt-get dist-upgrade
  • Edit /etc/modprobe.d/alsa-base.conf
  • Add at the bottom of the file
    • options snd-hda-intel model=toshiba-s06 power_save=10 power_save_controller=N
  • On Sound Preferences change Profile to Analog Stereo Duplex
  • Turn speaker volume up HIGH

Ubuntu Linux 9.10 SSD Optimizations

Disable Access Time Attributes
Edit your /etc/fstab. Modify the root partitions settings. Add noatime and nodiratime to defaults.

/dev/sda2 / ext4 noatime,nodiratime,errors=remount-ro 0       1

Optimizing the Kernel
Add the following to the /etc/sysctl.conf

vm.swappiness=0
vm.vfs_cache_pressure=50

Optimizing the Scheduler
Edit /etc/default/grub and add noop to end of mem=2000MB

GRUB_CMDLINE_LINUX_DEFAULT=”quiet splash mem=2000MB elevator=noop”

Run sudo update-grub afterward

RFKill Install.sh – the program doesn’t include an install program. Here is a small script

#!/bin/bash

sudo cp rfkill-applet.py /usr/bin/rfkill-applet
sudo chmod a+x /usr/bin/rfkill-applet
sudo cp rfkill-applet.server /usr/lib/bonobo/servers/
sudo chmod a+x /usr/lib/bonobo/servers/rfkill-applet.server
sudo cp rfkill-applet.png /usr/share/pixmaps
sudo cp rfkill-applet-hardoff.png /usr/share/pixmaps
sudo cp rfkill-applet.config /etc/

/etc/hal/fdi/policy/mouse-wheel.fdi

<?xml version=”1.0″ encoding=”UTF-8″?>

<match key=”info.product” string=”PS/2 Generic Mouse”>
<merge key=”input.x11_options.EmulateWheel” type=”string”>true</merge>
<merge key=”input.x11_options.EmulateWheelButton” type=”string”>2</merge>
<merge key=”input.x11_options.YAxisMapping” type=”string”>4 5</merge>
<merge key=”input.x11_options.Emulate3Buttons” type=”string”>true</merge>
<merge key=”input.x11_options.EmulateWheelTimeout” type=”string”>200</merge>
</match>

/usr/lib/pm-utils/sleep.d/00usbsleep

# disable wakeup events when suspending from USB
echo disabled > /sys/bus/usb/devices/usb1/power/wakeup
echo disabled > /sys/bus/usb/devices/usb2/power/wakeup
echo disabled > /sys/bus/usb/devices/usb3/power/wakeup
echo disabled > /sys/bus/usb/devices/usb4/power/wakeup

/etc/pm/sleep.d/99_psb_fix

#!/bin/sh

ACTION=$1

case “$ACTION” in
suspend|hibernate)
fgconsole >/tmp/xconsole.pm-sleep.tmp
;;
resume|thaw)
chvt 1
chvt `cat /tmp/xconsole.pm-sleep.tmp`
;;

esac

• Intel Atom Z supports VT instructions. Really neat to boot KVM up on a little netbook
• NetBooks are usually cheesy, this machine feels solid and well built. Sony does some nice engineering, but there in front of your face is a SD card and HG Duo…
• Battery life is OK, I am considering the extended the battery, but really don’t feel the need based on the 3 hours I get now
• Verizon built in is awesome! Riding the metro into work today I was on IRC (irc.freenode.net) loving life. On the way home I fired up a skype session with no issue

No good:

• GMA500 is a stupid and horrible video card. Intel I hope you punch yourself in the face. The card is crappy in Windows and Linux, but especially linux
• Linux support is pretty good, except for the GMA500. I dare say this, but I am in the process of dropping Windows 7 on the thing due to Intels lack of professionalism. In a day of Linux Netbooks and NetTops this is reprehensible to ship something like this.
• The right shift key is worthless
• SSD slower than industry approaches

Overall I rate the laptop highly. Well worth the purchase

sudo vi /etc/pam.d/gdm-autologin and add the italic lines below

#%PAM-1.0
auth    requisite       pam_nologin.so
auth    required        pam_env.so readenv=1
auth    required        pam_env.so readenv=1 envfile=/etc/default/locale
auth    required        pam_permit.so
auth    optional        pam_gnome_keyring.so
@include common-account
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
session required        pam_limits.so
session optional        pam_gnome_keyring.so auto_start
@include common-session
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
@include common-password

The first step was to get a current version of OpenVPN installed on the Ubuntu 9.10 server. I decided to go with the bridge setup rather than a routed so that I could play more easily with my VMware clusters at the house and the lab with my BeOS and OpenBSD boxes.

sudo apt-get install openvpn bridge-utils

Next I setup a bridged adapter to use on the Ubuntu 9.10 box that would give me transparent access. Open the /etc/network/interfaces file in vi

auto lo br0
iface lo inet loopback

iface br0 inet static
address 172.16.1.102
network 172.16.1.0
broadcast 172.16.1.255
netmask 255.255.255.0
gateway 172.16.1.1
bridge_ports eth0
bridge_fd 9
bridge_hello 2
bridge_maxage 12
bridge_stp off

iface eth0 inet manual
up ifconfig $IFACE 0.0.0.0 up
up ip link set $IFACE promisc on
down ip link set $IFACE promisc off
down ifconfig $IFACE down

Afterward you need to restart the network interfaces

sudo /etc/init.d/networking restart

Since I was using the desktop edition of Ubuntu rather than Server (this machine was a pseudo desktop for a little bit) I had to enable ip forwarding by editing /etc/sysctl.conf with vi and adding

net.ipv4.ip_forward=1

Next few steps are to setup the CA you need for certificate generation. Easy-rsa is pretty sweet for quick and dirty CA for these type of things. You can also use the openvpn tools to do static keys, but where is the fun in that?

sudo mkdir /etc/openvpn/easy-rsa/
sudo cp -R /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/
sudo vi /etc/openvpn/easy-rsa/vars

Change these lines at the bottom so that they reflect your new CA.

export KEY_COUNTRY=”US”
export KEY_PROVINCE=”VA”
export KEY_CITY=”Alexandria”
export KEY_ORG=”oneguynick”
export KEY_EMAIL=”nick@notlikelytopostinanopenwebsite.com”

Now to generate your root

cd /etc/openvpn/easy-rsa/ ## move to the easy-rsa directory
sudo chown -R root:admin . ## make this directory writable by the system administrators
sudo chmod g+w . ## make this directory writable by the system administrators
source ./vars ## execute your new vars file
./clean-all ## Setup the easy-rsa directory (Deletes all keys)
./build-dh ## takes a while consider backgrounding
./pkitool –initca ## creates ca cert and key
./pkitool –server server ## creates a server cert and key
cd keys
openvpn –genkey –secret ta.key ## Build a TLS key
sudo cp server.crt server.key ca.crt dh1024.pem ta.key ../../

These next two up/down scripts setup the bridge when the server starts. This is the magic in not having to perform the routing you used to be required to do in OpenVPN1

sudo vi /etc/openvpn/up.sh

This script should contain the following

#!/bin/sh
BR=$1
DEV=$2
MTU=$3
/sbin/ifconfig $DEV mtu $MTU promisc up
/usr/sbin/brctl addif $BR $DEV

Now, we’ll create a “down” script.

sudo vi /etc/openvpn/down.sh

It should contain the following.

#!/bin/sh
BR=$1
DEV=$2
/usr/sbin/brctl delif $BR $DEV
/sbin/ifconfig $DEV down

Now, make both scripts executable.

sudo chmod +x /etc/openvpn/up.sh /etc/openvpn/down.sh

Below is my example /etc/openvpn/server.conf Customize as you see fit

mode server
tls-server

local 172.16.1.102
port 443 ## i am running on 443 rather than the default for firewall bypassing
proto udp

#bridging directive
dev tap0
up “/etc/openvpn/up.sh br0″
down “/etc/openvpn/down.sh br0″

persist-key
persist-tun

#certs
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-auth ta.key 0

#cipher and compression
cipher BF-CBC # Blowfish (default)
comp-lzo

#DHCP
ifconfig-pool-persist ipp.txt
server-bridge 172.16.1.102 255.255.255.0 172.16.1.50 172.16.1.60
push “dhcp-option DNS 172.16.1.1″
push “dhcp-option DOMAIN geekyschmidt.com”
max-clients 10

#log and security
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3

Afterward restart the OpenVPN Server

sudo /etc/init.d/openvpn restart

Now it is time to generate your client certs that you will need to copy to each device. I use n900 as the name here, but you can replace with whatever you wish. I try to keep names and machines close for my poor memory

cd /etc/openvpn/easy-rsa/
source ./vars
./pkitool n900

You will be left with a few files in your /etc/openvpn/easy-rsa/keys directory you need to copy to the device. In my case I copied them to the MyDocs/openvpn area of my N900 to be sure the applet could see them. Most linux machines store them in /etc/openvpn. The list of files to copy is below. Keep in mind that mine are named n900 due to the above pkitool n900 command.

1. ca.crt
2. ta.key
3. n900.key
4. n900.crt

Once those are on the machine you need to generate a config file. Here is mine from the n900.

### Client configuration file for OpenVPN

# Specify that this is a client
client

# Bridge device setting
dev tap

# Host name and port for the server (default port is 1194)
# note: replace with the correct values your server set up
remote notlikelytopostinanopenwebsite.com 443

# Client does not need to bind to a specific local port
nobind

# Keep trying to resolve the host name of OpenVPN server.
## The windows GUI seems to dislike the following rule.
##You may need to comment it out.
resolv-retry infinite

# Preserve state across restarts
persist-key
persist-tun

# SSL/TLS parameters – files created previously
ca ca.crt
cert n900.crt
key n900.key

# Since we specified the tls-auth for server, we need it for the client
# note: 0 = server, 1 = client
tls-auth ta.key 1

# Specify same cipher as server
cipher BF-CBC

# Use compression
comp-lzo

# Log verbosity (to help if there are problems)
verb 3

On the n900 you will need to install from extras-testing the openvpn packages

sudo gainroot
apt-get install openvpn openvpn-applet

Thats it! Click in your status bar with the n900 and import the config file stored in MyDocs/openvpn from earlier. It will import the keys into the correct locations and allow you to test the connection.

playback_mime_types=video/mp4-generic, video/quicktime, video/mp4, video/mpeg4, video/3gp, video/3gpp2, application/sdp, audio/3gpp, audio/3ga, audio/3gpp2, audio/amr, audio/x-amr, audio/mpa, audio/mp3, audio/x-mp3, audio/x-mpg, audio/mpeg, audio/mpeg3, audio/mpg3, audio/mpg, audio/mp4, audio/m4a, audio/aac, audio/x-aac, audio/mp4a-latm, audio/wav
playlist_formats=audio/x-scpls, audio/mpegurl, audio/x-mpegurl
audio_folders=.sounds/, .videos/, Music/
video_folders=.videos/, Video/
icon_names=phone-nokia-n900
folder_depth=2
coverartfilename=cover.jpg
coverartfiletype=jpeg
coverartsize=200

is_audio_player